Privacy Policy

Curso is a product of Mother Hubbard Holdings Pty Ltd (ACN 632 770 113, ABN 90 632 770 113), an Australian proprietary company registered in NSW. References in this Policy to “Curso”, “we”, “us” and “our” mean Mother Hubbard Holdings Pty Ltd trading as Curso.

We are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This Policy explains how we handle personal information collected through the Curso platform (the “Service”), including gocurso.com, studio.gocurso.com, app.gocurso.com and any embedded plugin served from api.gocurso.com.

Creators (paying users)

• Account: name, email address, password (hashed by Firebase Authentication), business name, site URLs, time zone.
• Billing: handled by Stripe (see Section 4). We store the Stripe customer ID, subscription status and plan tier; we do not store card numbers.
• Usage: API calls made by your plugin, search-quota counters, plan limits.
• Support correspondence you send us.

Consumers (visitors to creator sites who use the plugin)

• Search queries and ingredient inputs submitted to the plugin.
• Anonymised interaction events (clicks, results viewed, time on plugin) captured for analytics and to improve search relevance.
• If a consumer chooses to create a universal Curso account, we additionally collect: email, dietary preferences, pantry/ingredient lists, household composition, and saved recipes.
• Technical data: IP address (truncated for analytics), browser type, device type, referring URL.

• To operate, secure and improve the Service.
• To bill creators for paid plans and manage subscriptions.
• To generate analytics dashboards for creators about their own plugin usage.
• To produce aggregated, de-identified market insights that we may license to consumer-packaged-goods (CPG) brands. These insights do not identify any individual consumer or creator.
• To send service messages (transactional emails: welcome, receipts, password reset, security alerts) and, only with explicit opt-in, marketing communications.
• To comply with our legal obligations (tax, anti-fraud, lawful requests from authorities).

We do not sell personal information. We do not share consumer identities, raw search queries or individual behaviour traces with creators or CPG brands.

We rely on the following processors to operate the Service. Each is bound by its own privacy and security obligations. Where data is stored outside Australia, we have assessed that the processor provides protections substantially similar to the APPs.

We will update this list as our processor mix changes. Material additions affecting personal information will be notified to account holders by email.

The Curso plugin uses a session-scoped first-party identifier to measure unique searches per visit. We do not set advertising cookies and we do not participate in third-party advertising networks. gocurso.com and studio.gocurso.com set strictly-necessary cookies for authentication and CSRF protection only.

• Active creator accounts: retained for the life of the account.
• Cancelled creator accounts: deleted within 90 days, except for billing records retained for 7 years under Australian tax law.
• Consumer Curso accounts: retained until deletion is requested.
• Widget event data: anonymised on capture, retained for 24 months in BigQuery for trend analysis.
• Support correspondence: 24 months.

Under the Privacy Act and the APPs you have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or out-of-date information.
• Request deletion of your account and associated personal information (subject to legal retention obligations).
• Withdraw consent for any optional processing (e.g. marketing emails).
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email daniel@motherhubbard.me. We respond to verified requests within 30 days.

We use industry-standard safeguards: TLS 1.2+ in transit, AES-256 at rest (Google Cloud default), Firebase Authentication with optional two-factor, scoped per-creator API keys with domain allow-lists, and least-privilege service accounts. No system is completely secure; if we become aware of a breach affecting your personal information we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme.

The Service is not directed at children under 16 and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, please email daniel@motherhubbard.me and we will delete it.

We may update this Policy from time to time. Material changes will be notified to account holders by email at least 14 days before they take effect. The current version is always available at gocurso.com/privacy.

Mother Hubbard Holdings Pty Ltd trading as Curso
Email: daniel@motherhubbard.me