# Data policy for the CuratorBot prototype

| Material | Where it may live | Notes |
| --- | --- | --- |
| Code, docs, synthetic interview | GitHub (public), Hugging Face Space | MIT licence |
| Released interviews: media, raw transcripts | `private/`, encrypted Drive or university storage | Never in git or the Space image |
| Released interviews: briefs | Private Hugging Face dataset, shown in the **private** Space | Not in git; confirm release terms before any public showing |
| Donor submissions shared for this project (Box, pre-accession) | Media in `private/` or encrypted Drive; briefs in the private Hugging Face dataset, shown in the **private** Space | Museum authorisation confirmed by the project lead; never in git or a public Space |
| Catalogue exports | `private/` | Used for back-tests and the collection profile |
| API keys, passcodes | `.env` locally, Space secrets, GitHub secrets | Never committed |

## Model providers
Live analysis and offline briefs send transcript text to the configured provider (Anthropic or OpenAI) under your API account. Use accounts and terms your institution approves, prefer zero-retention options where available, and do not send pre-accession material without approval.

## Chat projects
The Claude and ChatGPT projects receive only material from the "GitHub (public)" row plus released transcripts you are cleared to share. See `project-kit/`.

## Deletion
When a partner withdraws permission, delete the interview's `private/` folder, remove its brief from `data/interviews/`, push (the Space redeploys) and record the date in `private/<ID>/permissions.md` before deleting that too.