Privacy Policy
This policy explains what CuroForm LLC ("CuroForm", "we") collects through curoform.com and when you write to us, what we do with it, who helps us handle it, how long we keep it, and the choices you have. It applies to everyone who uses the site, wherever you are. We wrote it to the standard of the EU and UK General Data Protection Regulation (GDPR) and California law, and we give the same rights to every visitor.
Who we are
CuroForm supplies white-label packaging and supplies to medical and wellness businesses in the United States. For the personal information described here, the controller (the business responsible for it) is:
CuroForm LLC
2358 University Avenue #2197
San Diego, CA 92104
United States
Email: hello@curoform.com
We have not appointed a representative in the EU or UK and have no data protection officer. Write to the email above about anything in this policy.
What we collect
When you send the contact form
- Your name, business name and email address. These three are required so we can reply.
- What you're interested in and anything you write in the message box. These are optional.
- Details you entered on a product page before you came to the form, such as the product and brand name.
- The date and time you sent it, your browser's user agent string (browser and device type), and the country your connection comes from. Cloudflare works out the country from your IP address. We store the country, not the IP address.
When you email us
Your email address, your message and anything you attach, such as artwork.
When you visit the site
Like any website, our hosting provider, Cloudflare, receives your IP address, browser details and the pages you request so it can deliver the site and protect it from attacks. Cloudflare keeps these request logs for a short time for security and troubleshooting.
Cookies and analytics are covered in Cookies and analytics below.
Please don't send patient information
We never need information about your patients. Please leave it out of forms, emails and artwork. If we receive it, we delete it.
How we use it and our legal bases
- To answer your request with a quote, samples or a call. Legal basis: steps you ask us to take before a contract (GDPR Article 6(1)(b)).
- To follow up on your request and tell you about related CuroForm products. Legal basis: our legitimate interest in answering business inquiries and finding new customers (Article 6(1)(f)). You can object at any time, and we'll stop.
- To run and secure the site, stop spam and abuse, and fix problems. Legal basis: our legitimate interest in a safe, working website (Article 6(1)(f)).
- To keep business, tax and accounting records if you become a customer. Legal basis: legal obligation (Article 6(1)(c)) and contract (Article 6(1)(b)).
- Analytics and marketing tools, where the law requires it, only with your consent (Article 6(1)(a)). See Cookies and analytics.
We don't make decisions about you by automated means alone, and we don't build profiles that have legal or similar effects on you.
Who we share it with
We don't sell your personal information for money. We share it only with:
- Cloudflare, Inc., which hosts the site, runs the form, stores form submissions in its database service and protects the site. Cloudflare acts as our service provider and processor.
- Google LLC, which provides our email through Google Workspace. Google acts as our service provider and processor.
- Analytics and marketing providers listed in our Cookie Policy, only as described there.
- Manufacturing and shipping partners, if you place an order. They receive the specifications, artwork and business shipping details needed for that order. Some are outside the United States, including in China.
- Professional advisers, such as our lawyers and accountants, under a duty of confidentiality.
- Authorities or others when the law requires it, or to protect our rights, our customers or the public.
- A buyer or successor if our business is sold or reorganized, under this policy.
We don't share information with third parties for their own direct marketing. California residents may ask about this under California Civil Code section 1798.83.
Cookies and analytics
We use two analytics tools to see which pages help and which lead to a quote request. We run no ad tools, no ad pixels and no session replay. Our Cookie Policy lists every cookie, who sets it, how long it lasts and the legal basis. It updates when we switch a tool on or off.
What runs, and why
- Your choice (necessary). One cookie,
curo_consent, stores your choice for 6 months. When you choose, we also log a random consent ID, your choices, the policy version, the time, your country and whether your browser sent Global Privacy Control. We do not log your IP address or browser details for this. We keep the log for 24 months to show what you agreed to, then delete it automatically. - Google Analytics 4 (with your consent). Counts visits and shows which pages lead to a quote request. It sets two first-party cookies,
_gaand_ga_5EFS6JLYBP, which we cap at 13 months. We keep Google Analytics data for 2 months. Google signals, ads personalization and data sharing for Google's own products are off. Google Analytics does not log or store IP addresses, and we collect city-level location and detailed device data for US visitors only. - Cloudflare Web Analytics (cookieless). Counts page views, referrers and load speed in aggregate. It sets no cookies, stores nothing on your device and builds no visitor ID. Cloudflare does not log query strings for it. We see only totals.
Where you are matters
- EU, EEA, UK, Switzerland, Brazil and Quebec: nothing optional runs until you choose. Google Analytics and Cloudflare Web Analytics both wait for Accept all.
- US and everywhere else: you see the same choice. Until you choose, only Cloudflare's cookieless page count runs. Google Analytics waits for Accept all. Reject all turns off both.
- We work out your region from your connection's country. We do not store your IP address to do it.
Legal basis
- EU, EEA, UK and Switzerland. Analytics runs on your consent (GDPR and UK GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3) and, in the UK, PECR reg. 6). You can withdraw at any time, as easily as you gave it. The consent log rests on our duty to show consent (Art. 7(1) and 6(1)(c)). The
curo_consentcookie is strictly necessary to remember your choice. - US. Analytics cookies wait for your Accept everywhere. Cloudflare's cookieless count runs until you choose, and you can stop it with Reject all. We honor Global Privacy Control as a request to opt out of sale and sharing. We do neither: we do not sell personal information or share it for targeted ads.
Your choices
- Cookie settings (bottom of every page) reopens your choices. Reject all turns off both analytics tools and deletes the cookies we set.
- Your Privacy Choices (bottom of every page) turns off marketing tools in one step. None run today. The link is there so it works the day we add one.
- Global Privacy Control. If your browser sends it, we mark it on your choice, and marketing tools stay off even if you click Accept all. Analytics still follows your choice.
- Do Not Track. The older Do Not Track signal has no agreed meaning, so we do not act on it. We act on Global Privacy Control instead.
- Your browser. You can block or delete cookies in your browser settings. Blocking all cookies does not break this site.
Who receives the data
- Google LLC (Google Analytics), as our processor under the Google Ads Data Processing Terms, which we accepted.
- Cloudflare, Inc. (hosting, security and Web Analytics), as our processor under Cloudflare's Data Processing Addendum.
Both companies are in the US. They certify under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Their data processing terms include the EU Standard Contractual Clauses, with the UK Addendum and Swiss changes, as a fallback. Ask us for a copy of the safeguards at hello@curoform.com.
What we never do
We do not sell your personal information. We do not use session replay or record what you type. No analytics tool reads the quote form: it goes to our own server. We run no Meta, TikTok, LinkedIn or Google Ads tags. Please do not send patient information through the form.
Where your information is processed
We are based in the United States, and our providers process information here. If you write to us from the EU, UK or Switzerland, you send your information directly to us in the US. When our providers handle it for us, Cloudflare and Google each state that they are certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, and their data processing terms include the European Commission's standard contractual clauses (with the UK Addendum) as a fallback. Email us for a copy of these safeguards.
How long we keep it
- Contact form submissions: our site database deletes them automatically 24 months after they arrive.
- Emails: we keep them while we're in touch and for as long as they're useful to the business relationship, and delete them when you ask unless the law requires us to keep them.
- Quotes, orders and invoices: as long as tax and accounting law requires.
- Opt-out requests: we keep your email address on a do-not-contact list for as long as needed to honor your request.
- Cloudflare request logs: a short period set by Cloudflare for security and troubleshooting.
Your rights
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct it;
- delete it;
- stop using it for marketing, or object to other uses based on our legitimate interests;
- limit how we use it while we look into a concern; and
- send it to you or another company in a common digital format.
Where we rely on your consent, you can withdraw it at any time. That doesn't affect what we did before.
How to ask. Email hello@curoform.com with "Privacy request" in the subject. We may confirm the request comes from the email address we have on file. You can use an authorized agent, who must show us your permission. We reply within one month. If a request is complex we may take up to two more months and will tell you why. There's no charge, and we won't treat you differently for using these rights.
Complaints. Please tell us first so we can fix it. You can also complain to a data protection authority: in the EU, the authority where you live or work; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.
Do you have to give us this information?
No. But we need your name, business name and email address to reply to a request. Everything else on the form is optional.
Security
The site uses encrypted connections (HTTPS). Form submissions are stored in Cloudflare's database service, which encrypts data at rest, and only the CuroForm team can reach them. Our site checks that form submissions come from our own pages. No system is completely secure, so if a breach affects your information, we'll tell you and the authorities as the law requires.
Children
This site is for businesses and is not directed to children. We don't knowingly collect personal information from anyone under 16. If we learn we have, we delete it.
Changes to this policy
When we change this policy, we post the new version on this page and update the effective date at the top. If a change is significant, we'll also put a notice on the home page before it takes effect.
Contact
Questions or requests: hello@curoform.com, or write to CuroForm LLC, 2358 University Avenue #2197, San Diego, CA 92104, United States.