Privacy Policy
1. Who we are
Infraset, Inc., a Delaware corporation with its principal office at 2810 North Church Street, STE 89156, Wilmington, DE 19802, United States ("Infraset," "we," "us"), operates the website https://www.infraset.ai (the "Site") and the Infraset platform (the "Service").
Privacy contact: [email protected]
2. Our two roles
- Controller. For the data of website visitors, of people who contact us, and of the account, usage and billing data of platform users, Infraset decides how the data is used and is the controller.
- Processor. For the content that a customer and its users put in the Service or make available through connections ("Customer Data"), Infraset processes data on behalf of the customer, which is the controller. If you are an employee or contact of one of our customers and want to exercise rights over Customer Data, contact that customer; we will help them respond.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, work email, company, industry, role (optional), language, password (stored in a form that cannot be reversed), sign-in records, and the campaign that brought you, if any | You, when you create or are invited to an account |
| Acceptance records | Date and time, IP address, browser, and the version of each document you accepted | Created when you accept our terms |
| Sign-up and security data | When you request a trial: the country you choose, the country our network provider places your connection in, a one-way hash of your network address (to allow one trial per network), the result of an automated check that you are a person, the link that brought you, and whether the request was confirmed | You, your browser and our network provider |
| Customer Data | Messages and instructions to agents, documents and files you upload, outputs agents produce, and content of connected accounts that you authorize | You and your users |
| Connected account data | For Microsoft Outlook: the busy times in the calendar link you provide. For Google Drive: only the files you select. | The provider, after you authorize the connection |
| Phone and messaging data | Phone number and messages, only if your workspace enables WhatsApp or Telegram agents (not available on the free trial) | You |
| Usage metadata | Features used, number of messages, timestamps, response times, errors, token counts, device and browser type | Generated by the Service |
| Billing data | Billing contact and plan. Card data goes directly to our payment provider; we do not store full card numbers | You, when you buy a paid plan |
| Contact and marketing data | What you send us when you write to us; whether you agreed to receive marketing email | You |
| Site data | Pages visited and how you arrived at the Site, including the campaign parameters in the link | Your browser |
We do not request sensitive personal data and ask that you do not submit it (see the Acceptable Use Policy). If content you connect or upload includes it, we process it only on the customer's behalf, as described in Section 2. The Service is for businesses and for users aged 18 or older.
4. How we use it
- To provide the Service: create and secure your account, prevent abuse of the free trial, run your agents, carry out the actions you instruct through your connections, and provide support you request.
- To operate and improve the Service using usage metadata only. We use usage metadata, which does not include Customer Data, to bill, enforce usage limits, detect abuse, fix errors and decide what to improve.
- To understand who uses the Service. We use the company, industry and role you give us at sign-up, together with usage metadata, to learn which industries use the Service and to decide what to build. This never includes Customer Data.
- To measure our advertising. We use the campaign that brought you, if any, to learn which campaigns bring customers. You can ask us to stop at any time by writing to [email protected].
- To communicate with you: service messages (security, changes to terms, billing) and, only if you opted in, marketing email, which you can stop at any time.
- To comply with law and protect our rights.
We do not use Customer Data to train artificial intelligence models or to improve the Service, and our model providers do not use it to train theirs. We do not sell personal data, and we do not share it for targeted advertising.
5. Who processes Customer Data and how it is protected
Encryption. Customer Data is encrypted in transit and at rest.
Access by our team. Infraset personnel do not access Customer Data except: (a) when required by law or by a binding order of a competent authority; (b) to investigate or respond to a security incident or abuse; or (c) when the customer requests support and authorizes the access. If an authority requests Customer Data, we notify the customer before disclosing it, unless the law prohibits us from doing so.
Subprocessors. We use providers in these categories to run the Service. Each processes data only on our instructions and under contract.
| Category | Purpose | Location |
|---|---|---|
| AI model and search providers | Generating agents' responses, searching your documents, transcribing voice, and running the web searches an agent writes | United States |
| Cloud infrastructure | Application hosting, database, authentication and file storage | United States |
| Security and monitoring | Network security, content delivery, error monitoring and cookieless website analytics | United States |
| Communications | Account emails such as invitations and password resets, emails agents send, agent mailboxes and calendars, and the messaging channels a workspace enables | United States; messaging channels vary |
| Payments | Payments, when paid plans are offered | United States |
Our AI model providers process prompts only to return a response, and under their commercial terms do not use them to train models. Some may keep prompts for a limited time to monitor abuse, as their terms allow.
Customers can request the current list of subprocessors by writing to [email protected]. We notify customers that have a written agreement with us before adding a subprocessor that processes their Customer Data.
6. Google user data
Infraset's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the user-facing features you use (for example, letting an agent read a Drive file you selected); we do not use it for advertising; we do not transfer it to third parties except as needed to provide those features, to comply with law, or as part of a merger or acquisition; we do not allow humans to read it except with your express consent for specific content, for security purposes such as investigating abuse, or to comply with law; and we do not use it to train AI models. When an agent uses a Drive file, its content is sent to our AI model providers only to generate the response; some may keep it for a limited time to monitor abuse, as Section 5 explains, and they do not use it to train models.
7. Cookies and advertising
In the Service. The Service uses only what it needs to work: session and authentication storage, and your language preference. There are no advertising cookies or pixels inside the Service, and Customer Data and connected account data are never used for advertising.
On the Site. We use:
- Essential storage, needed for the Site to work and to remember your language.
- Analytics that uses no cookies.
Today the Site uses no advertising cookies or pixels. If we add them, we will ask for your consent in a banner on the Site before using them, which you can reject and change at any time, and we will update this Policy to name each advertising platform. We will treat a Global Privacy Control signal from your browser as a rejection. We do not respond to Do Not Track signals because there is no standard interpretation of them.
Campaign links. When you arrive through one of our ads, posts or emails, the link can carry campaign parameters (for example, which ad you clicked). If you create an account, we save them with your account so we know which campaigns bring customers. This needs no cookie.
8. Retention
- Account data: while the account is active, and up to 24 months after it closes for legal and security records.
- Customer Data: while the workspace is active. After a trial ends without a paid plan, or after a paid workspace closes, we keep it at least 30 days for export. After that we may delete it, and we delete it within 30 days of a request to [email protected]. Backups are overwritten on their normal cycle.
- Acceptance records: for as long as the terms they evidence may be relied on, and at least 5 years.
- Usage metadata: up to 24 months, then aggregated or deleted.
- Correspondence: for as long as the conversation and any resulting relationship continue, plus 24 months.
9. Security incidents
If a security incident affects your personal data, we will notify affected customers and, where the law requires, affected individuals and authorities, without undue delay.
10. Your rights
United States. Depending on your state, you may have the right to know, access, correct, delete or port your personal data, and to opt out of sale, sharing or targeted advertising. We do not sell personal data or share it for targeted advertising. To exercise any of these rights, write to [email protected]. We verify the request using the email associated with your data and respond within the time required by law. We do not discriminate against you for exercising your rights.
Mexico. Our Spanish-language Aviso de Privacidad Integral sets out your ARCO rights and how to exercise them under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares.
Other regions. The Service is offered only in the countries listed on the sign-up page, and we do not direct it to anyone outside them, including the European Economic Area, the United Kingdom and Switzerland. If you use it from elsewhere, your data is processed in the United States, and you can exercise the rights above by writing to [email protected].
11. International processing
Infraset is a U.S. company and stores and processes data in the United States. Our subprocessors also process it in the United States, except messages sent through messaging channels that a workspace enables, which pass through the systems of those channels' providers. By ticking the acceptance box when you join, you consent to this processing and to the transfer of your personal data to the United States.
12. Changes
We will post changes on this page with a new date. For material changes we will notify account administrators before they take effect.
13. Contact
Infraset, Inc. 2810 North Church Street, STE 89156, Wilmington, DE 19802, United States [email protected]