Privacy
Companies that handle your data
These are the companies that process data on our behalf to run CurveNumber. Each is named with what it does, what it receives and where. The privacy notice is the full statement of what is collected and where it goes, and the security page describes how the service is protected.
| Company | What for | What it receives | Where |
|---|---|---|---|
| Amazon Web Services | Hosting: the server, the database and its backups, and the logs | Everything the service stores | United States, us-east-1 (Northern Virginia) |
| Amazon Web Services: CloudFront and AWS WAF | Delivering this website (curvenumber.com) and filtering abusive traffic | Your request for a page: your IP address, the address of the page and your browser's request headers | The CloudFront location nearest you, in North America, Europe or Israel; passed on to our server in us-east-1 |
| Amazon Web Services: Simple Email Service | Sending email: invitations, address checks, password resets, receipts and reminders | Your email address and the message | United States, us-east-1 |
| Amazon Web Services: Amazon Bedrock, running Anthropic's Claude models (Claude Sonnet 4.6 for the assistant, Claude Haiku 4.5 for writing help) | The AI features: the assistant when you ask it something or press one of its buttons, the check of a report when you publish it, and writing help while you type in a text box with it on | Your question and the site's record, with email addresses replaced by codes and the site address and client name fields withheld; the text in the box for writing help; the pages of a plan sheet you ask it to read, as printed | United States: requested from us-east-1, and processed only in US regions |
| Amazon Web Services: Bedrock Knowledge Bases, with Amazon Titan Text Embeddings V2. No reranking model is in use; one may be added later, and this list will name it before it is switched on | Searching the assistant's library of public manuals | The search text drawn from your question | United States, us-east-1 |
| Stripe | Card payment, when it is switched on (it is off on this service today) | What a card payment needs: the amount, your email address, our identifiers for you and the purchase, and your billing address where sales tax applies. Card details go to Stripe directly and never to us. No site name, boundary or figures are sent | United States |
What is not on this list
- Public data services. To read soils, land cover, elevation, rainfall, climate records and aerial photographs, the server sends your site's boundary, or a point or box around it, to public data services run by United States government agencies and, for climate data, by the University of Idaho; an address typed into the search box goes to the Census Bureau. They are not processing data for us, so they are not on this list, but the privacy notice names every one and says exactly what each receives.
- Typefaces and the map library. These are served from our own server. No font or code service is contacted when you load a page.
- Map tiles. Your browser fetches the base map directly from the US Geological Survey, which sees the map area you are viewing and your IP address, as the privacy notice says. No site record, name or boundary is sent.
Changes to this list
If we add a company to this list, or change what one receives, we will update this page before the change takes effect and email the address on your account. This sentence is draft wording, awaiting review by our lawyer. Questions go to support@curvenumber.com.