Last updated: May 2026
This page is the single canonical Privacy Policy for Cursive across both meetcursive.com (marketing site) and leads.meetcursive.com (the Cursive application, including installs from the Shopify and GoHighLevel marketplaces).
At Cursive (“we,” “us,” or “our”), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard information when you visit our websites, use our platform, install our app via our marketplace partners, or interact with our services.
This Privacy Policy is designed to comply with, and is interpreted in accordance with, the following frameworks:
Where these frameworks conflict, the stricter requirement governs for residents of the applicable jurisdiction. We monitor case law developments — including the Camplisson line of pixel-tracking decisions and the 2025 volume of CIPA filings — and update our consent, disclosure, and opt-out implementation accordingly (see §13).
Sec-GPC: 1) and Do Not Track header (see §7)The Cursive pixel deployed on customer websites collects:
We do not collect the content of communications, capture keystrokes, or record session replays. We do not cross-track across third-party advertising networks. The Cursive pixel sets only a first-party cookie (_cursive_cid) on the installing site.
Shopify: when a customer installs the Cursive Shopify app we receive shop information, customer email addresses (for matching to resolved visitors), and order events (used to suppress customers from acquisition retargeting).
GoHighLevel: when an agency installs the Cursive app on a GHL location we receive location metadata, custom values, and contact data necessary to write back identified visitors as GHL contacts with intent tags.
Cursive's identity resolution layer matches anonymous visitors to verified business and consumer profiles. The underlying identity graph is sourced from:
Records undergo regular verification (305M+ records re-verified monthly). Skip-traced data is flagged in the record. Do-Not-Contact (DNC) flags returned from the upstream identity layer are persisted to every record and enforced before any outbound action by Cursive or its customers.
De-listing. Any individual may request removal from the Cursive identity graph by emailing privacy@meetcursive.com. De-listing is honored within 30 days, propagates platform-wide (see §8), and is stored as a persistent suppression so the individual is not re-resolved if their data reappears in a future graph refresh.
Cursive uses a Consent Management Tool (CMT) on our websites to inform visitors about data collection and obtain clear, documented consent before activating non-essential tracking technologies. When you first visit, you will be presented with a cookie consent notice describing the categories of data we collect and giving you a choice to accept or decline.
If you click “Accept,” we activate analytics, visitor identification, and marketing technologies as described in this policy. Your consent is recorded with a timestamp and stored in your browser so you are not asked again on subsequent visits for a period of 12 months.
If you click “Decline,” we limit data collection to essential, functional cookies only. Non-essential cookies, analytics scripts, and visitor identification pixels are not activated. Your decline preference is stored and honored on subsequent visits.
We maintain records of consent decisions including date, time, IP, and consent-notice version. These records are retained for audit and compliance purposes. You may withdraw your consent at any time by clearing your browser's local storage or contacting privacy@meetcursive.com.
Shopify installs. The Cursive pixel installed via the Shopify Web Pixels API gates resolution calls behind the visitor's consent state, as reported by Shopify's native consent banner. Resolution calls fire only after consent is granted for analytics + marketing purposes. EU and CCPA-region visitors see the native consent banner before any resolution occurs. Post-purchase conversion events fire regardless of consent state but are used solely for suppression (so existing customers stop seeing acquisition ads) — never for new identity resolution.
GoHighLevel and direct installs. The Cursive pixel relies on the merchant's consent management. Merchants are required (under §15 below and our Terms of Service) to ensure their consent capture complies with applicable law (GDPR, CCPA/CPRA, Quebec Law 25).
GPC handling. Cursive recognizes the Global Privacy Control specification. When a request to a Cursive-controlled endpoint (meetcursive.com, leads.meetcursive.com, or the Cursive pixel ingestion endpoint) carries the Sec-GPC: 1 header, we treat that signal as:
The GPC signal is processed server-side at the pixel ingestion endpoint and persisted as a suppression tied to the visitor's first-party cookie. Where Cursive operates downstream of a customer's Consent Management Platform (e.g. Shopify Web Pixels API), the upstream CMP's recognition of GPC governs whether the pixel fires at all; Cursive's server-side GPC handling provides a second layer of enforcement.
Do Not Track (DNT). We honor the DNT browser header on Cursive-owned properties on the same terms as GPC. We treat DNT as advisory on customer-installed pixels because the DNT specification was never finalized and behavior across browsers is inconsistent; the dominant signal for downstream installs is the upstream CMP decision plus GPC.
A consumer opt-out reaches Cursive through any of the following channels:
Sec-GPC: 1 signal (see §5)customers/redact, shop/redact, or customers/data_request webhookOnce received, the opt-out is propagated as follows:
_cursive_cid cookie and to a server-side suppression list. The pixel will not re-resolve the visitor on subsequent visits even if the cookie is cleared, because the suppression list is keyed by the visitor's resolved identity (hashed email, where known).The Cursive pixel uses a first-party cookie (_cursive_cid) on installed sites for visitor consistency across sessions. We do not use third-party advertising cookies.
You can manage your cookie preferences through the cookie consent banner displayed on our website. Clicking “Decline” will prevent non-essential cookies and tracking technologies from loading. You can also configure your browser to refuse all cookies or alert you when cookies are being sent. Note that disabling essential cookies may affect site functionality.
We do not sell personal information. “Sale” is defined under CCPA/CPRA as exchanging personal information for monetary or other valuable consideration. We do not engage in such exchanges.
We do not “share” personal information for cross-context behavioral advertising as that term is defined under CPRA. The CPRA-specific definition of “sharing” covers the disclosure of personal information to a third party for cross-context behavioral advertising. Cursive does not engage in cross-context behavioral advertising, does not pass identifiers to ad networks for retargeting on third-party properties, and does not participate in real-time bidding ecosystems.
Delivery of lead data to the Cursive customer whose pixel resolved the visitor is the service the consumer's data is processed for; it is a disclosure to a service-related party rather than cross-context behavioral advertising.
We share information only with:
The following sub-processors process personal data on Cursive's behalf:
We maintain a current sub-processor list and provide 30 days' notice of material changes to enterprise customers under DPA. Request the current list at privacy@meetcursive.com.
For individuals in the EEA / UK, we process personal data on the following legal bases:
You may request a copy of our Legitimate Interests Assessment (LIA) by contacting privacy@meetcursive.com.
California residents have the additional rights to know what personal information is collected, to delete, to correct, to opt out of sale or sharing of personal information, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights. Cursive does not engage in sale or sharing as defined under CPRA (see §9). GPC is honored as a valid opt-out signal (see §5).
EEA / UK residents may exercise the rights listed in 12.1 and may lodge a complaint with their local data protection authority. Our legal bases are described in §11.
Quebec residents have the rights listed in 12.1, plus additional rights under Law 25, including:
Privacy officer. Cursive's designated person in charge of the protection of personal information (privacy officer) for Law 25 purposes is reachable at privacy@meetcursive.com.
Automated decision-making. Cursive does not use solely automated decision-making to render decisions that produce legal or similarly significant effects on individuals. Lead scoring is advisory; final decisions about outreach are made by the customer.
Cross-border transfers. Cursive operates in the United States. Transfers of Quebec residents' personal information outside Quebec are subject to a Privacy Impact Assessment (PIA) and contractual safeguards. See §17.
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, and Delaware have rights under their respective state laws that parallel CCPA / CPRA. We honor these rights on the same SLA and through the same channels.
Email privacy@meetcursive.com. We respond within 30 days (extendable to 45 where law permits, with notice). We will not discriminate against you for exercising your rights.
Cursive operates as a data processor when handling personal information on behalf of our customers, and as a data controller for our own platform and marketing. A Data Processing Agreement is available for execution by:
The Cursive DPA includes:
We are aware of the Camplisson line of California pixel-tracking decisions and the substantial increase in CIPA (Cal. Penal Code §§ 631, 632.7) filings in 2025 targeting third-party pixels and session-replay technologies. Our implementation is designed to avoid the conduct those cases address:
Sec-GPC: 1 (see §5).Customers remain responsible for their own consent capture on their own properties (see §15). Cursive's implementation provides controller-side mitigations; it does not eliminate the customer's controller-side obligations.
If you are a Cursive customer who installs our pixel on your website, you are required under our Terms of Service and applicable law to:
Cursive is not responsible for our customers' consent management practices on their own websites. The Cursive DPA includes customer obligations in this regard.
We implement industry-standard security: TLS encryption in transit, encryption at rest, role-based access controls, audit logging, and regular security review. Access to production systems is restricted to a small set of authorized engineers and is logged. Multi-tenant isolation is enforced at the database layer via Row-Level Security policies, not by application logic alone.
We retain account data while your account is active. Visitor lead data is retained for the duration of your subscription plus 30 days after cancellation, after which it is permanently deleted. Consent records are retained for audit purposes for the period required by applicable law.
Upon receipt of a Shopify customers/redact, shop/redact, or customers/data_request webhook, we comply within 30 days. Upon any other deletion request received at privacy@meetcursive.com we honor it within 30 days.
Cursive operates in the United States. By using the Service you acknowledge that your information may be transferred to and processed in the United States, where data protection laws may differ from your jurisdiction. For EEA / UK transfers, we rely on Standard Contractual Clauses (and the UK Addendum) as described in our DPA. For Quebec transfers, we conduct a Privacy Impact Assessment as required by Law 25 §17.
Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Policy on this page, updating the “Last updated” date, and notifying active customers via email.
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at: