1. Who We Are & How to Contact Us

Curter, Inc. ("Curter," "we," "us," or "our") operates the Curter platform — an AI-powered software service that helps SBA lenders and banking professionals generate loan briefs and identify refinancing opportunities within their existing loan portfolios. The Service is available at curter.ai.

This Privacy Policy governs how Curter collects, uses, stores, discloses, and protects information in connection with the Service. It applies to all users of the Service, including individual loan officers, banking professionals, Team Leaders, and Subordinate Users operating under a Team Account.

For privacy-related questions or requests, contact us at:

• Privacy inquiries: [email protected]
• Security incidents: [email protected]
• Legal: [email protected]
• Website: curter.ai

This Privacy Policy is incorporated by reference into and forms part of Curter's User Agreement. Defined terms used in this Privacy Policy that are not separately defined herein have the meanings given to them in the User Agreement, available at curter.ai/terms.

2. The Two Categories of Information — A Critical Distinction

Everything that exists in the Curter platform falls into one of two categories. Understanding this distinction is fundamental to understanding how privacy works on our platform:

	Category 1 — Service Information	Category 2 — User Data & Submitted Content
Source	Retrieved by Curter from publicly available government, regulatory, and financial sources.	Input, uploaded, or transmitted by you or your Authorized Users.
Examples	SBA SOPs; federal interest rate benchmarks; eligibility criteria; regulatory guidance; industry underwriting standards; government-published financial data.	Borrower names & financials; loan portfolio data; client contact information; sales leads; deal terms; account credentials; payment information.
Privacy responsibility	Curter. We control what public sources we retrieve and how we present them.	Yours primarily. You choose what to input. You are responsible for having the right to submit it. Curter protects it as described in this Policy.

3. Information We Collect

3.1 Information You Provide to Us Directly

When you create an account, use the Service, or communicate with us, we collect:

• Account registration information: name, email address, job title, institution name, phone number, and account credentials (password stored in hashed form — never in plain text).
• Payment and billing information: credit card or payment account details, billing address, and transaction history. Payment card data is processed by a PCI-DSS compliant third-party payment processor. Curter does not store raw payment card numbers.
• Team Account information: the identities of Team Leaders and Subordinate Users, usage allocations, and team structure.
• User Data and Submitted Content: all data, documents, borrower information, loan portfolio data, financial records, client names, sales leads, prospect data, and any other information you choose to input into the Service. See Section 2 for the full definition and Section 5 for how we handle this information.
• Communications: emails, support tickets, feedback, and other communications you send to us.

3.2 Information We Collect Automatically

When you access and use the Service, we automatically collect certain technical and usage information:

• Log data: IP address, browser type and version, operating system, device identifiers, pages accessed, features used, timestamps of activity, and error logs. Log data is collected to operate, secure, and improve the Service.
• Usage analytics: aggregate and de-identified data about how users interact with the Service — which features are used, how often, and for how long. This data is used to improve product functionality and is not used to identify individual users for marketing purposes.
• Cookies and similar technologies: session cookies required for authentication and platform function; preference cookies to remember your settings. We do not use advertising or behavioral tracking cookies. See Section 11 (Cookies) for details.
• Device and connection information: device type, screen resolution, and connection type, used for rendering the Service correctly across devices.

3.3 Service Information — What We Retrieve from Public Sources

To generate Outputs, Curter's platform retrieves and synthesizes information from publicly available sources including SBA publications and SOPs, federal agency guidance and rulemaking, publicly available interest rate benchmarks and financial data, and industry-standard underwriting references. This is Service Information as defined in the User Agreement. Curter controls what public sources we access and how we present that information. Service Information does not constitute personal data about any individual and is not subject to this Privacy Policy's protections for User Data.

3.4 Information We Do Not Collect

Curter does not:

• Collect Social Security numbers, government-issued ID numbers, or biometric data about end users of the Service (i.e., about you as a user). Note: you may input borrower SSNs or ID numbers as part of User Data — this is covered in Section 5.
• Collect personal health information (HIPAA-regulated data) about users of the Service. If you submit HIPAA-regulated data to the Service without a separate BAA with Curter, you do so in violation of the User Agreement.
• Purchase or receive data about you from data brokers, marketing lists, or third-party analytics firms for advertising or profiling purposes.
• Use session replay tools, screen recording software, or keyloggers that capture your individual keystrokes or screen content.

4. How We Use Information

4.1 To Provide and Operate the Service

We use the information we collect primarily to provide the Service you have subscribed to. Specifically:

• Processing User Data you submit to generate Outputs — including loan briefs, refinancing opportunity analyses, and related documents.
• Authenticating your identity and maintaining your account.
• Processing payments and managing billing for your subscription or Team Account.
• Delivering in-platform notifications, usage alerts, and overage warnings as described in the User Agreement.
• Providing customer support and responding to your inquiries.
• Transmitting applicable User Data to third-party AI model providers as necessary to generate Outputs. See Section 6 for full disclosure on third-party AI provider data flows.

4.2 To Improve, Secure, and Maintain the Service

• Analyzing aggregate, de-identified usage data to understand how features are used and identify opportunities for improvement.
• Monitoring for security threats, unauthorized access attempts, abuse, and technical errors.
• Conducting internal audits of user compliance with the User Agreement.
• Debugging, testing, and maintaining platform infrastructure.

4.3 To Comply with Legal Obligations

• Responding to lawful requests, subpoenas, court orders, or other legal process from law enforcement or regulatory agencies.
• Fulfilling our obligations under GLBA, FCRA, applicable state privacy laws, and other Applicable Laws.
• Investigating and responding to potential violations of the User Agreement or applicable law.
• Preserving and producing records in connection with litigation or regulatory proceedings.

4.4 What We Do NOT Do with Your Information

Curter will NEVER: (1) sell User Data to any third party for any purpose; (2) use User Data for advertising or marketing to your clients, borrowers, or prospects; (3) share User Data with competitors of yours or with other Curter customers; (4) use your borrower data or loan portfolio data for any purpose beyond providing the Service to you; or (5) use Submitted Content to train AI models without your explicit written consent.

5. User Data — How We Handle What You Submit

5.1 Your Ownership; Our Limited License

You retain full ownership of all User Data you submit to the Service. By submitting User Data, you grant Curter a limited, non-exclusive, non-transferable license to process your User Data solely for the purpose of providing the Service to you. This license terminates when your account is closed or User Data is deleted in accordance with Section 5.4.

5.2 Your Responsibility for What You Submit

You are solely responsible for the content, accuracy, legality, and appropriateness of User Data you submit. Specifically, you represent and warrant that:

• You have all necessary rights, consents, authorizations, and legal authority to submit User Data to the Service, including any borrower personal information, client data, or third-party financial records;
• You have provided all required privacy notices to borrowers, clients, and customers whose information you submit, including any notices required under GLBA, FCRA, applicable state privacy laws, or your institution's privacy program;
• Your submission and processing of User Data complies with the Gramm-Leach-Bliley Act (GLBA), Fair Credit Reporting Act (FCRA), and all other Applicable Laws governing the handling of customer financial information;
• You have not submitted any data subject to HIPAA without first entering into a separate, signed Business Associate Agreement (BAA) with Curter. Curter is not a HIPAA Business Associate by virtue of this Privacy Policy or the User Agreement alone.

If you choose to submit sales leads, prospect data, client contact lists, pipeline information, or other competitively sensitive business development information, you do so entirely at your own risk. See Section 6.3 of the User Agreement for the full scope of Curter's disclaimers regarding such Submitted Content.

5.3 How We Protect User Data — Security Safeguards

Curter implements commercially reasonable administrative, technical, and physical safeguards designed to protect User Data against unauthorized access, disclosure, alteration, and loss. Our current security practices include:

• Encryption in transit: all data transmitted between your browser or application and Curter's servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: User Data stored on Curter's infrastructure is encrypted at rest using industry-standard encryption protocols.
• Access controls: access to User Data within Curter's systems is restricted on a need-to-know basis. Curter personnel do not access User Data for any purpose other than providing the Service, troubleshooting technical issues, or responding to security incidents.
• Authentication: the Service uses credential-based authentication. Users are responsible for maintaining the confidentiality of their credentials.
• Vendor security: third-party service providers and AI model providers used by Curter are required to maintain security practices that are at least as protective as those described herein, and are evaluated for security practices prior to engagement.

IMPORTANT LIMITATION: No security system is perfect. Curter cannot guarantee that security measures will prevent all unauthorized access, breaches, or data loss. Internet-based data transmission involves inherent risks that are beyond Curter's ability to fully eliminate. See Section 8 of the User Agreement for the full scope of Curter's limitation of liability for security incidents.

5.4 Data Retention and Deletion

Curter retains User Data for the following periods:

• Active account data: retained for the duration of your active subscription. Account data (name, email, login history) is retained for a reasonable period after account closure to support dispute resolution and legal compliance.
• User Data submitted for processing (borrower data, loan data, Submitted Content): retained for the duration of your active subscription. Upon account closure or your written request, Curter will delete or de-identify User Data within a commercially reasonable timeframe, subject to exceptions for data that must be retained under Applicable Laws, legal holds, or regulatory requirements.
• Usage logs and technical data: retained for up to 24 months for security monitoring, debugging, and compliance purposes, then deleted or de-identified.
• Payment and billing records: retained for the period required by applicable tax and financial record-keeping laws (typically 7 years).

To request deletion of your User Data, contact [email protected] with subject line 'Data Deletion Request.' Curter will acknowledge your request within 10 business days and complete deletion within a commercially reasonable timeframe, not to exceed 45 days, except where retention is required by law.

5.5 Proprietary and Sensitive Information — Your Assumption of Risk

If you submit to the Service any Proprietary Information — including trade secrets, non-public financial data, client lists, sales leads, M&A plans, deal terms, or other information you or a third party considers confidential — you do so entirely at your own risk. Curter is not responsible for the consequences of you inputting Proprietary Information into the Service beyond the security safeguards described in Section 5.3. See Section 6 of the User Agreement for the complete scope of your assumption of risk with respect to Submitted Content.

6. Third-Party AI Providers — Data Processing Disclosure

6.1 How AI Technology Works in the Service

The Service uses artificial intelligence technology, including large language models (LLMs) and generative AI systems, to process User Data and generate Outputs. To function, the AI Technology underlying the Service transmits certain User Data to third-party AI model providers whose systems perform the AI processing and return results to Curter's platform.

BY USING ANY AI-POWERED FEATURE OF THE SERVICE, YOU CONSENT TO THE TRANSMISSION OF YOUR USER DATA TO THIRD-PARTY AI MODEL PROVIDERS AS NECESSARY TO GENERATE OUTPUTS. This transmission is what makes the Service work. If you are not willing to have your User Data transmitted to third-party AI infrastructure, do not use AI-powered features of the Service.

6.2 What We Disclose to Third-Party AI Providers

Curter transmits to third-party AI providers only the User Data necessary to process your specific request and generate the requested Output. Curter does not transmit to AI providers:

• Your full account profile or billing information;
• User Data from other Curter customers;
• Data beyond what is required for the specific AI processing task you have initiated.

6.3 Third-Party AI Providers' Own Terms

Third-party AI model providers operate under their own terms of service, privacy policies, and data handling agreements. Curter enters into data processing agreements with AI providers that require them to use transmitted data solely for the purpose of providing the requested AI service and not to use Customer data to train general AI models without consent. However:

• Curter does not control third-party AI providers' internal data handling beyond the contractual requirements Curter imposes. If an AI provider violates its agreement with Curter, Curter may not be aware of the breach immediately.
• Curter is not liable for breaches, data losses, or unauthorized disclosures that occur within third-party AI provider systems beyond Curter's reasonable control. See Section 8.3 of the User Agreement.
• Third-party AI providers may update their own terms and data handling practices. Curter monitors these changes and updates its agreements accordingly, but cannot guarantee real-time alignment at all times.

To the extent you are prohibited by your institution's policies, applicable law, or client agreements from transmitting specific categories of data to third-party cloud AI services, it is your sole responsibility to ensure you do not submit such data to the Service. Curter has no obligation to independently enforce your institution's internal data governance policies.

6.4 Your Responsibility to Evaluate AI Provider Transmission

Before submitting any User Data to the Service, you are solely responsible for evaluating whether transmitting that data to third-party AI providers is permissible under: (i) your institution's information security and vendor management policies; (ii) applicable federal and state law, including GLBA and FCRA; (iii) any contractual obligations you have to your clients or borrowers; and (iv) any regulatory guidance from your institution's federal or state regulator regarding use of cloud-based AI services.

7. How We Share Information

7.1 We Do Not Sell Your Data

Curter does not sell User Data, Submitted Content, or any personal information about you to any third party for any purpose, including marketing, advertising, data brokerage, or any other commercial purpose. This is an absolute commitment, not a conditional one.

7.2 Limited Sharing for Service Operation

We share information only in the following limited circumstances:

• Third-party AI model providers: as described in Section 6, User Data is transmitted to AI providers to process your requests and generate Outputs. This is a functional requirement of the Service, not a disclosure for commercial purposes.
• Payment processors: payment card information and billing data is transmitted to our PCI-DSS compliant payment processor to process transactions. We do not store raw payment card numbers.
• Cloud infrastructure providers: User Data is stored and processed on cloud infrastructure (e.g., secure cloud storage and compute services). These providers operate under data processing agreements with Curter that restrict their use of data to providing infrastructure services.
• Professional advisors: attorneys, accountants, and auditors under duties of confidentiality, as necessary for legal, compliance, and financial operations.
• Team Account sharing: User Data submitted by a Subordinate User is accessible to the Team Leader of that Team Account for account administration and compliance monitoring purposes. Curter does not share one team's data with any other customer's team.

7.3 Legal Disclosures

Curter may disclose information when required to do so by law or in good faith belief that such disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or lawful government request;
• Protect and defend the rights or property of Curter;
• Prevent or investigate possible wrongdoing in connection with the Service;
• Protect the personal safety of users of the Service or the public;
• Protect against legal liability.

Where legally permitted and practicable, Curter will notify you of a legal request for your data before disclosing it, so that you may seek a protective order or other relief.

7.4 Business Transfers

If Curter is involved in a merger, acquisition, financing, or sale of all or a portion of its assets, User Data may be transferred as part of that transaction. If such a transfer occurs, Curter will provide notice via the Service or by email before your User Data becomes subject to a different privacy policy, and you will have the opportunity to delete your data prior to transfer if you do not consent to the new policy.

8. GLBA, FCRA & Financial Privacy Obligations

8.1 Curter's Role Under GLBA

The Service processes non-public personal financial information ("NPI") about your borrowers and clients as submitted by you. In this capacity, Curter acts as a service provider to you — a financial institution subject to GLBA. Curter processes NPI solely to provide the contracted Service to you, in accordance with GLBA's service provider provisions.

Curter maintains administrative, technical, and physical safeguards designed to protect NPI against unauthorized access and use, consistent with the FTC Safeguards Rule requirements applicable to service providers to GLBA-covered entities. Curter will not use NPI for any purpose inconsistent with providing the Service to you.

8.2 Your GLBA Obligations

You, as the GLBA-covered financial institution or service provider, retain independent obligations under GLBA, including:

• Providing required privacy notices to your customers whose NPI you submit to the Service;
• Ensuring that your use of the Service as a vendor is consistent with your institution's privacy program and any applicable regulatory requirements governing third-party vendor management;
• Maintaining appropriate oversight of Curter as a service provider under GLBA's safeguards requirements, including conducting appropriate vendor due diligence.

Curter will cooperate with reasonable vendor due diligence requests, including providing responses to vendor questionnaires and making available a summary of relevant security and privacy practices.

8.3 FCRA

If User Data you submit includes consumer report information subject to the Fair Credit Reporting Act (FCRA), you represent that you have a permissible purpose under FCRA for obtaining and using that information, and that your use of the Service with such information complies with all applicable FCRA requirements. Curter does not function as a consumer reporting agency and does not generate consumer reports. Curter processes FCRA-regulated data solely as directed by you.

8.4 No HIPAA Coverage Without BAA

The Service is not designed for processing Protected Health Information (PHI) regulated under HIPAA. Curter is not a HIPAA Business Associate by virtue of this Privacy Policy or the User Agreement alone. If you intend to process PHI through the Service, you must first execute a separate, written Business Associate Agreement (BAA) with Curter. Submitting PHI to the Service without a BAA violates the User Agreement and may expose you and your institution to significant regulatory liability.

9. Data Breach — Detection, Response & Notification

9.1 What Constitutes a Data Breach Under This Policy

A data breach under this Policy means any confirmed unauthorized access to, acquisition of, disclosure of, or loss of User Data that compromises the security, confidentiality, or integrity of that data in a manner that triggers notification obligations under applicable law.

9.2 Our Detection and Response Commitment

Curter maintains a security incident response program that includes:

• Continuous monitoring of platform infrastructure for unauthorized access attempts, anomalous activity, and security events;
• A defined incident response protocol for investigating, containing, and remediating security incidents;
• Engagement of qualified cybersecurity personnel to investigate and respond to confirmed breaches;
• Post-incident review to identify the cause of the breach and implement corrective measures.

9.3 Notification to You

In the event of a confirmed data breach affecting your User Data, Curter will:

• Notify you as the account holder (the Team Leader or individual account holder, as applicable) within a commercially reasonable timeframe that complies with applicable state and federal data breach notification laws;
• Provide notification via the email address associated with your account, or by in-platform notice if email delivery is not practicable;
• Include in our notification: a description of what happened; the categories and approximate volume of User Data involved; steps Curter has taken to address the breach; recommended steps you should take; and contact information for questions.

CRITICAL: Curter's notification obligation runs to you as the account holder — not directly to your borrowers, clients, or other third parties whose data you submitted to the Service. You are solely responsible for notifying your own customers, regulators, and other required parties under applicable data breach notification laws, including any notification obligations under GLBA, state breach notification statutes, and your institution's own incident response plan.

9.4 Notification Timeline Limitations

Curter cannot guarantee notification within any specific timeframe beyond what applicable law requires. Breach investigation takes time to confirm scope, identify affected users, and determine legal notification obligations. Curter will act with reasonable urgency and keep you informed as the investigation develops.

9.5 Your Reporting Obligation to Curter

If you become aware of any unauthorized access to your account, any suspected compromise of User Data, or any vulnerability in the Service, you must promptly notify Curter at [email protected]. Timely reporting by users helps Curter investigate and contain incidents more quickly.

10. Your Privacy Rights

10.1 Access and Correction

You have the right to access the account information Curter holds about you and to request correction of inaccurate information. To exercise this right, log into your account or contact [email protected]. Curter will respond to access requests within 30 days.

10.2 Data Deletion

You have the right to request deletion of User Data Curter holds about you. To request deletion, contact [email protected] with the subject line 'Data Deletion Request.' Curter will process deletion requests within 45 days, subject to the following exceptions:

• Data that Curter is required to retain under Applicable Laws (e.g., financial records retention requirements, tax law, legal hold obligations);
• Data necessary to resolve an open billing dispute, pending legal claim, or compliance investigation;
• Aggregate or de-identified data that does not identify you individually.

10.3 Data Portability

Upon request, Curter will provide you with a copy of your User Data in a commonly used, machine-readable format. Contact [email protected] to submit a portability request.

10.4 California Residents — CPRA / California Privacy Rights

If you are a California resident, you have additional rights under the California Privacy Rights Act (CPRA) and the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect, use, disclose, and sell (we do not sell personal information);
• The right to delete personal information we hold about you (subject to the exceptions in Section 10.2);
• The right to correct inaccurate personal information;
• The right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Curter does not sell or share personal information for advertising purposes, so there is nothing to opt out of;
• The right to limit the use and disclosure of sensitive personal information;
• The right not to be discriminated against for exercising your privacy rights.

To exercise any California privacy right, contact [email protected]. We will respond within 45 days (with a possible 45-day extension for complex requests). We will verify your identity before processing your request. California residents may also designate an authorized agent to submit requests on their behalf.

Curter does not knowingly collect personal information from individuals under the age of 16, and the Service is not directed at or intended for use by individuals under the age of 18.

10.5 No Discrimination

Curter will not discriminate against you for exercising any privacy right described in this Section — we will not deny service, charge different prices, or provide a different level of service as a result of your privacy rights request.

11. Cookies & Tracking Technologies

Curter uses a limited set of cookies and similar technologies necessary to operate the Service:

• Session cookies: required for authentication. These cookies expire when you close your browser or log out. Without them, you cannot stay logged in.
• Preference cookies: remember your display preferences and settings (e.g., saved filters, interface preferences). These can be cleared through your browser settings.
• Security cookies: used to detect and prevent unauthorized account access and CSRF attacks.

Curter does NOT use:

• Third-party advertising or behavioral tracking cookies;
• Cross-site tracking pixels from advertising networks;
• Analytics cookies that track you across third-party websites;
• Fingerprinting or other persistent device identification techniques for tracking purposes.

You can control cookies through your browser settings. Disabling session cookies will prevent you from logging into the Service. Disabling preference cookies will cause the Service to lose your saved settings between sessions.

12. Minors

The Service is intended exclusively for use by licensed financial professionals and banking institutions. The Service is not directed at, and we do not knowingly collect personal information from, individuals under the age of 18. If we become aware that we have inadvertently collected personal information from a minor, we will promptly delete it. If you believe we have collected information from a minor, contact [email protected].

13. Changes to This Privacy Policy

Curter may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

• Update the 'Effective Date' at the top of this Policy;
• Notify registered users via email or in-platform notice at least 30 days before the updated Policy takes effect for material changes;
• Provide a summary of what changed in the notification.

Your continued use of the Service after the updated Policy takes effect constitutes your acceptance of the revised Policy. If you do not accept a material change, you must discontinue use of the Service and may request deletion of your User Data before the effective date of the change.

Prior versions of this Privacy Policy are archived and available upon request at [email protected].

14. Cross-Reference Map — User Agreement Privacy Provisions

The following table maps each privacy-related commitment in the User Agreement to the section of this Privacy Policy that addresses it, so you can verify complete coverage:

User Agreement Provision	User Agreement Section	Privacy Policy Section
Privacy Policy available at curter.ai/privacy	§5.3	Entire Policy
User Data not sold to third parties	§5.3	§4.4, §7.1
Commercially reasonable safeguards for User Data	§5.3	§5.3
GLBA, FCRA compliance obligations	§5.2, §14.5	§8.1–8.3
No HIPAA without BAA	§5.2	§8.4
Data breach notification to account holder	§5.4, §8.6	§9.3
User's breach notification duties to third parties	§8.6	§9.3 (callout)
Third-party AI provider data transmission consent	§7.3	§6.1–6.4
Third-party AI providers' own privacy policies	§7.3	§6.3
No Curter liability for AI provider breach	§7.3, §8.3	§6.3
Curter not liable for user's decision to submit data	§6.1–6.5	§5.2, §5.5
Sales leads / proprietary info at user's own risk	§6.3	§5.5
Security protocols for submitted content	§6.3	§5.3
Data retained per Applicable Laws then deleted	§12.4	§5.4
Service Information derived from public sources	§4.4, §10.4	§2 (table), §3.3
User responsible for consents to submit third-party data	§6.2	§5.2
User Agreement incorporated by reference	§15.4	§1 (callout)

15. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or Curter's data practices, contact:

Curter, Inc.
Privacy inquiries: [email protected]
Security incidents: [email protected]
Legal: [email protected]
Website: curter.ai

Effective: May 18, 2026 · Version 1.0 · curter.ai/privacy
© 2026 Curter, Inc.