Curonian Group
Curonian Group
Curonian Group Pty Ltd (ACN 697 342 966, ABN 73 697 342 966), the provider of Vards AI.
Curonian Group Pty Ltd ("Curonian", "we", "us", "our") is a company registered in New South Wales, Australia. We make Vards AI, an AI workspace for accounting and advice firms, consultants and small teams. Vards AI is currently offered to businesses in Australia.
This policy explains how we collect, use, disclose and protect personal information when you:
Curonian is a small business: its annual turnover is under A$3 million and it has not chosen to opt in to the Privacy Act 1988 (Cth) under section 6EA. That means the Privacy Act generally does not apply to us, although some of its rules, such as those for tax file numbers, may still apply. Whether or not the Act applies, we have chosen to handle personal information in line with the Australian Privacy Principles (APPs), and this policy is written to meet APP 1. Section 13 adds what people in the European Economic Area and the United Kingdom need to know.
"Your firm" means the business that holds the Vards AI account you use. "Workspace content" means what your firm puts into or creates in Vards AI: conversations, documents and files, agent settings, client and contact records, email, calendars, projects, invoices, time records, call and meeting transcripts, knowledge-base documents and anything agents produce.
Where your workspace content is kept depends on how your firm runs Vards AI.
| How your firm runs Vards AI | Where workspace content is kept | Does Curonian hold it? |
|---|---|---|
| Desktop app (Windows) | In an encrypted database on your firm's own computer | No. It is not sent to us. |
| Your own server (a firm runs Vards AI on a server it controls) | On that server | No. It is not sent to us. |
| Hosted service at vardsai.curoniangroup.com, run by Curonian | In an encrypted database on servers we rent from Fly.io in Sydney, Australia | Yes. We hold it on your firm's behalf. |
Desktop app and your own server. We do not receive, store or have access to your workspace content. Curonian receives only what is listed in section 3 (for example, licence checks and any crash report your administrator chooses to send). When your firm uses an outside AI provider or another service, Vards AI sends the content that feature needs from your computer or server straight to that provider (section 4).
Hosted service. We store your firm's workspace content on servers we operate, in a database encrypted at rest. Access controls keep each firm's workspace separate from every other firm's. We use the content only to provide the hosted service to your firm: we do not use it to train AI models, sell it, or show it to other customers. When an agent uses an outside AI provider or another service, our servers send the content that feature needs to that provider on your firm's instruction (section 4). Your firm decides what goes into Vards AI and is responsible for the personal information it holds about its own clients and contacts; we process that information for your firm (section 13 explains the roles in GDPR terms).
No one at Curonian looks at hosted workspace content except: when your firm asks us to, for support; where needed to investigate a security problem or abuse of the service; or where the law requires it. We hold the encryption key for the hosted database, so this is a rule we keep, not something the technology alone prevents.
If you sign in with a Vards account, our account service holds your email address, name, a hash of your password (never the password itself), the business you belong to, your seat and role, your firm's licence status, Stripe customer and subscription identifiers, the installations registered to your firm, and a record of account events (for example, sign-ups, sign-ins, password resets and role changes). It never holds workspace content. The account service runs on Cloudflare. It uses IP addresses for a short time to limit abuse (for example, too many sign-in attempts).
Password-reset emails. When the hosted service, the desktop app or your own server has no mail service of its own, it sends password-reset emails through our account service. The account service receives only the recipient's email address, a one-time code (which expires after 30 minutes) and the firm's name for the greeting, and passes them to Resend (section 3.5) to send. It receives nothing from the workspace. An installation whose administrator has set Vards accounts to "Off" never uses it.
When the desktop app or your own server checks its licence, it sends our licence service (license.curoniangroup.com, run on Cloudflare) your licence key and nothing else. The licence key contains the email address it was issued to. When you start a trial, the app sends the email address you enter. Like any internet request, each check also reaches the service with your IP address. The licence service does not record the IP address itself; Cloudflare, which runs it, may keep request logs that include it for a short time. The licence service keeps a record of the key (email address, plan, seats, trial start and expiry) for up to 400 days for a paid licence and 15 days for a trial, and a trial record for each email address for 30 days.
The licence service never receives workspace content.
Payments are processed by Stripe. Stripe collects your card or other payment details directly; we never receive your full card number. We receive confirmation of payment, the card brand and last four digits, and billing address details.
We use Resend to send email such as trial and licence emails, receipts, renewal reminders, account verification and password-reset messages (including those described in section 3.2). Resend handles your email address, name and the message. Email you send to us, and our replies, are held in our mailboxes, which Microsoft (Microsoft 365) hosts for us.
If your firm uses the hosted service, we hold its workspace content as described in section 2, along with: each person's name, email address, role and hashed password; a record of when each person accepted our terms, including the IP address they accepted from; audit-log entries recording what people and agents did; and the service's operating logs, which do not contain conversation content. A sign-in cookie keeps you signed in (section 3.10).
Workspace content can include sensitive information about your firm's clients, such as financial records, tax file numbers and health information. We hold it only to provide the service to your firm and do not use it for any purpose of our own.
When something in Vards AI breaks, it records a crash report so the fault can be found and fixed. A crash report holds: the type of error; a short error message with names, email addresses, phone numbers, long numbers (such as tax and bank account numbers) and similar details removed as far as the software can recognise them; where in the code it happened; the screen it happened on; the last few screens and the software's own requests (method, address path and status only); and the release and edition. It never holds conversations, prompts, documents, files, client records, the contents of requests, or cookies. People, firms and installations appear only as one-way codes. These codes are pseudonyms, not anonymous: we cannot turn them back into a name, but a report is still treated as personal information.
Vards AI has a "Send anonymous usage analytics" switch, off by default. If it is turned on, the software would send a weekly summary: the app version, counts of a fixed list of features used (for example, that the knowledge base was opened or an export was made), and the number of agents and conversations. It holds no content and no names, email addresses or user identifiers. It is never sent while Local-Only Mode is on. Today nothing is sent even when the switch is on, because we run no service to receive it. We will update this policy before we start one.
The desktop app checks GitHub (GitHub Releases) for new versions and downloads them from there. GitHub receives the request and your IP address, as with any download. The app installs an update only when you agree.
Each firm chooses which AI providers and models its agents use, and connects them with its own account and API key. Curonian never supplies its own AI key: your firm always uses its own account with each provider. For each reply, Vards AI sends the chosen provider the conversation together with what the agent works from for that reply: its instructions and memories, the knowledge-base documents and project material attached to it, and whatever its tools read, such as client records, emails, files or accounting data. It never sends the whole database at once.
Providers Vards AI can connect to include Anthropic, OpenAI, Google (Gemini), xAI, Mistral, Groq, DeepSeek, Perplexity, Cohere, Alibaba (Qwen), Moonshot, Zhipu, OpenRouter, Cerebras, NVIDIA, Cloudflare Workers AI and Hugging Face; the full list is shown in the app when you connect a provider. These providers are based in, or process data in, the United States, Europe, China and other countries, depending on the provider and the plan your firm uses. Each provider handles the content under its own terms with your firm, including how long it keeps the content and whether it may use it to improve its models. Your firm should check those terms, and decide whether sending client information to that provider meets its own legal and professional obligations, before it connects the provider.
The optional Privacy Shield swaps names, numbers and similar details for placeholders on your firm's own computer or office server, before any external AI sees them, and puts the real details back in the answer. It replaces the details it recognises; it does not make content anonymous, and someone may still be identifiable from context, so people should check what it shows them before sending. The Privacy Shield runs only in the desktop app or on a firm's own office server. It does not run on Curonian's hosted service.
Depending on what your firm turns on, Vards AI also sends content to the services your firm connects with its own accounts, for example:
On the hosted service these calls are made from our servers; otherwise from your firm's computer or server. Your firm's sign-in tokens and passwords for these services are stored encrypted in its Vards AI database and used only to make these calls.
Whoever runs an installation can turn on Local-Only Mode. While it is on, web search and browsing, image and video generation, outside safety scanners, phone calls and transcription by outside speech services are refused, and usage statistics and crash reports are never sent. Email, the integrations your firm connects, and messages sent after a person approves them still work. It does not change where messages to agents go: the AI provider your firm chose still receives them, unless "Require local inference" is also on.
Before an agent sends an email or a text message, Vards AI asks a person to approve it, showing who it goes to and what it says. This applies even when a workspace has turned off other approval prompts, and it applies to scheduled tasks and workflows: they do not send an email or a text until a person approves it. Approvals are recorded in the audit log. (If you text Vardsy, the built-in assistant, from your own verified phone number, its reply comes straight back to that number.)
This section applies when someone at your firm connects a Google account to Vards AI.
gmail.modify and gmail.send permissions). Vards AI uses these to show your email in the Vards Inbox, including attachments; to let you archive, move, label, flag, mark read or unread, and move messages to the Bin, with each change appearing in Gmail; to create, rename and delete labels; to save drafts and delete drafts it saved; and to send the emails you write, and emails an agent prepares once a person has approved them (section 4.5), from your Gmail address. It moves mail to the Bin, where Gmail keeps it for 30 days; it never permanently deletes a message. It does not ask for, and does not change, your Gmail settings, filters or forwarding.calendar.readonly and calendar.events). These let Vards AI see your calendars and view and edit events on every calendar your Google account can reach, not only ones you pick. They do not let it create or delete calendars or change who a calendar is shared with. Vards AI uses them to list your calendars, show your events in the Vards AI calendar, check when you are free when someone books a time with you, and add, change or delete an event when you, or an agent you directed, asks it to.drive.file). With Vards AI's own Google connection, Vards AI can see only the files you choose with Google's file picker and the files Vards AI creates, so that it can bring a file into Vards AI or save a document to your Drive. If your firm sets up its own Google connection instead (using its own Google Cloud client), it may grant full Drive access; that is your firm's choice and configuration.Vards AI's own "Sign in with Google" for Gmail is not switched on yet, because Google has not finished verifying it. Until it is, Gmail connects with a Google app password, or through your firm's own Google connection (its own Google Cloud client). We will update this section when Sign in with Google for Gmail is switched on.
Vards AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
The Vards AI Chrome extension is optional. It lets you use Vards AI in your own Google Chrome. It does three things:
Where the data goes. The extension sends data only to the Vards AI you connected it to:
From there, page text and your questions are handled like any other conversation: they go to the AI provider your firm chose (section 4.1), or stay on your systems if your firm uses a local model. If you use the hosted service, the extension's data reaches Curonian's servers. The extension itself contacts no AI provider, analytics service or advertiser, and sends nothing to Curonian except through the hosted service.
What it stores in your browser. The pairing with your Vards AI, the Vards AI address, the personal connection code (API key) the side panel uses, a random identifier for this installation, and, for the current browser session only, the tabs you offered with "Ask here". Nothing is synced to other computers. It does not use your browsing history, cookies or downloads, and it does not download or run code from anywhere: everything it runs is in the package you installed.
What it collects, in Chrome Web Store terms:
It does not ask for your device's location.
Our commitments for extension data. The use of information received from the Vards AI extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use data from the extension only to provide its single purpose: letting you and your Vards AI agents work with web pages in your own Chrome. We do not sell it, use it for advertising, use or transfer it for any unrelated purpose, or use it to decide creditworthiness or for lending. No person at Curonian reads extension data that reaches the hosted service except: with your express agreement, for specific items; where needed for security, such as investigating abuse; or where the law requires it.
Stopping it. Press Stop in a tab's bar or in the extension's popup to stop an agent; disconnect the extension in Vards AI (Settings, In-app browser); or remove the extension from Chrome. Removing it stops it working and deletes what it stored in your browser. It does not delete anything already sent to your Vards AI, which follows your firm's settings and section 11.
We use the personal information we collect for our own purposes (section 3) to:
We use or disclose personal information for another purpose only if: you would reasonably expect it and the purpose is related to one of these (directly related, for sensitive information such as health information); you agree; or it is required or authorised by or under law, or another exception in the APPs applies.
Marketing email. We send marketing email only with your consent. Every marketing email identifies Curonian and has a working unsubscribe link, and we act on an unsubscribe within 5 working days.
We share personal information only with the providers we use to run our business, and only what each needs:
| Provider | What for | Where |
|---|---|---|
| Fly.io | Hosting the hosted service (servers, encrypted storage, daily backups) | Sydney, Australia (Fly.io is a United States company) |
| Cloudflare | Our website, DNS, licence service, Vards account service and crash collector | Cloudflare's global network |
| Stripe | Payments and subscriptions | United States and other countries where Stripe operates |
| Resend | Sending our emails | United States and other countries where Resend operates |
| Microsoft (Microsoft 365) | Our own mailboxes, including privacy@curoniangroup.com | Australia and other countries where Microsoft operates |
| GitHub | Publishing desktop app updates | United States |
| Google (Fonts and YouTube) | Fonts and demo videos on our website (section 3.10) | United States and other countries |
We may also share personal information with professional advisers (under confidentiality), and with regulators, courts or law enforcement where the law requires or authorises it. If Curonian's business is sold or merged, personal information may pass to the buyer, and we will require the buyer to handle it in line with this policy. Google user data is the exception: it passes to a buyer only with your explicit consent (section 5.4).
Providers your firm chooses (section 4) are different. Your firm chooses them, contracts with them and connects them with its own accounts. We do not choose them for your firm. On the hosted service our servers send them content on your firm's instruction.
We do not sell personal information, and we do not share it with advertisers.
Before we disclose personal information overseas to a provider we engage, we take reasonable steps to make sure it handles the information in line with the APPs, for example through its contract terms. Using Vards AI does not mean you consent to an overseas disclosure, and does not remove our responsibility for one we make.
No system is perfectly secure. If we become aware of a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as the Privacy Act's notifiable data breaches scheme requires where it applies to us, including for tax file number information; where it does not apply, we will follow the same steps as our own practice. Where the GDPR or UK GDPR applies to information we control (section 13), we will notify the relevant authority within 72 hours of becoming aware of a breach, unless it is unlikely to put anyone at risk, and we will tell the people affected without undue delay if it is likely to put them at high risk. If a breach affects a hosted firm's workspace content, we will tell that firm without undue delay, and aim to do so within 48 hours, so it can meet its own obligations (Terms of Service clause 12.4).
| Information | How long |
|---|---|
| Billing records (invoices and payments) | 7 years, the longest period Australian company and tax record-keeping laws require of us |
| Licence and trial records in the licence service | Up to 400 days (paid), 15 days (trial licence), 30 days (trial index by email) |
| Support correspondence | Up to 3 years after the matter is closed |
| Vards account | While your account is active and for 90 days after it closes, then deleted |
| Crash reports on an installation (including the hosted service) | 30 days; a summary of each fault (type, place in the code, counts and releases, no report details) while the fault is open, and for 90 days after it was last seen once resolved |
| Crash reports sent to us by desktop or own-server installations | 30 days; their fault summaries until the fault has not been reported for 180 days |
| Marketing contacts | Until you unsubscribe; then we keep only what we need to stop emailing you |
| Hosted workspace content | Until your firm deletes it or asks us to; it then stays in our daily backups for up to 5 days. When a hosted firm closes its account, we delete all its data 30 days later, and it leaves our backups 5 days after that. |
Inside Vards AI, your firm controls retention: by default the audit log is deleted after 365 days, and administrators can set conversations, messages, calls and meetings to be deleted automatically after a set period (Settings, Admin & Compliance, Compliance, Data retention policy).
Erasing a person. When a person is erased in Vards AI, it deletes their own data: their account, private conversations, notes, memories, credentials, connections and the record of their terms acceptance (including the IP address). Records they created for the firm, such as client records, invoices, documents and shared conversations, stay with the firm with that person's name removed. In the audit log, their identity and the entries' details are removed. Your firm can also export or erase a client's data.
Backups. The desktop app keeps its own backups on your computer (7 daily, plus a few made before updates, restores and by hand). Erased data can remain in those backups until they are replaced. If a desktop backup from before an erasure is restored, Vards AI erases the person again before anything else uses the restored data. On the hosted service, backups are kept for 5 days.
Hosted firms. Your firm can ask us for a full copy of its data, or to delete all of its data from the hosted service, at privacy@curoniangroup.com.
You can ask us for access to the personal information we hold about you, and ask us to correct it. We do not charge for a request or for a correction, and we will reply within 30 days. If we refuse, we will tell you why and how to complain.
You can stop marketing email at any time with the unsubscribe link, or by writing to us.
If your personal information is in a firm's Vards AI workspace (for example, you are a client of an accounting firm that uses Vards AI), that firm controls it. Please contact the firm. If you contact us about it, we will pass your request to the firm, or help it respond.
You can deal with us without giving your name where that is practical, for example for a general enquiry. We cannot supply a licence or account anonymously.
If the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to how we handle your personal information:
Vards AI and our website are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18 for our own purposes. A firm's workspace may still contain information about children (for example, a client's dependants), which the firm supplies and controls and which we process only for the firm on the hosted service.
Our licence service decides automatically whether a licence key is valid and whether an email address has already had a trial; it refuses a second trial for the same address. We do not consider that this significantly affects anyone's rights or interests, but you can ask us to review any such decision. Curonian does not otherwise use computer programs to make decisions about you. Firms use Vards AI's agents to help with their own work; each firm decides how it uses them and is responsible for telling its own clients about that.
To ask about privacy, use your rights or make a complaint, contact our privacy officer:
Privacy Officer, Curonian Group Pty Ltd
Email: privacy@curoniangroup.com
Post: 2/39 Dover Road, Rose Bay NSW 2029, Australia
We will acknowledge a complaint within 7 business days and give you our answer within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au, by phone on 1300 363 992, or by post at GPO Box 5288, Sydney NSW 2001. Whether the OAIC can deal with a complaint depends on whether the Privacy Act applies to the information concerned (section 1). People in the EEA or UK can also complain to their local data protection authority (section 13).
We will update this policy when what we do changes, before the change takes effect where we can. We will email active customers about significant changes and change the "Last updated" date at the top.