Privacy Policy

1. Who we are and how to reach us

InfrAgent AI is run by INFRAGENT AI LIMITED, a company registered in England and Wales (company number 17291063), registered office 28 Baden Road, Ilford, IG1 2HS, United Kingdom ("we", "us"). Our Data Protection Lead answers every privacy question, request and complaint - including as the contact person under section 8(9) of India's Digital Personal Data Protection Act 2023 ("DPDP Act"): email support@infragentai.com with the subject "Privacy", or use Settings → Security → Privacy & your data. This policy is written to meet the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations (PECR), and India's DPDP Act and DPDP Rules 2025.

2. Our role

For data about you and your business - your account, billing, settings and support - we decide how it is used: we are the controller (the "Data Fiduciary" under the DPDP Act). For your customers' data that flows through the platform (their messages, bookings, orders and contact details), your business is the controller or Data Fiduciary and we are your processor, acting only on your instructions under our Data Processing Agreement. If you are a customer of a business that uses InfrAgent AI, please contact that business first - we will help them answer you.

3. What we collect, why, our lawful basis, and how long we keep it

We only collect what each purpose needs:

• Creating and running your account - your name, email, password (stored hashed by our authentication provider), business name, type, address, phone and settings. Basis: contract. Kept while your account is open, then for your plan's grace period (section 4).
• Billing - your plan, invoices, billing name and address, and tax details. Card and UPI details go straight to Stripe or Razorpay; we never see or store full card numbers. Basis: contract and legal obligation. Invoices are kept for 6 years (UK tax law), or 8 years where Indian law requires it.
• Proof of what you agreed to - the documents and versions you accepted, your typed name, email, the date and time, IP address and browser, and every consent you give or withdraw with the exact words shown. Basis: legal obligation and our legitimate interest in being able to prove agreement. Kept for 6 years after your account closes (the UK limitation period for contract claims), even if the rest of your data is deleted.
• Keeping the service secure - IP address, device and browser, sign-in events and system logs, and a bot check on sign-up forms (Cloudflare Turnstile). Basis: legitimate interests (security and fraud prevention), and legal obligation under the DPDP Rules. Security logs are kept for 13 months (at least one year, as India's DPDP Rules require), then deleted.
• Service messages - emails about your trial, billing, security and changes to these documents. Basis: contract. These aren't marketing and can't be switched off while you have an account.
• Product updates and tips - only if you opt in. Basis: consent. Until you withdraw it, which you can do in one click in Settings or from any such email.
• Support and data-rights requests - what you send us and our replies. Basis: contract and legal obligation. Support messages are kept up to 2 years after the conversation ends; data-rights requests for 6 years.

4. Your customers' data and how long it stays

Your customers' messages, bookings, orders and contacts are processed only to provide the service to you. They are kept separate from every other business's data and are never used for cross-business profiling or to train AI models. While your subscription is active, conversation history older than your plan's window is removed automatically (Trial 30 days, Starter 90, Growth 120, Pro and Enterprise 365); bookings and CRM records stay for the life of the account. When a subscription ends, we keep the account for a grace period so you can come back or export your data - Trial 30 days, Starter 90, Growth 120, Pro and Enterprise 365 - and then delete it permanently, including logins. You can ask us to delete everything sooner from Privacy & your data; we do it within one month. If you connect a Shopify store, Shopify sends us your products and your shoppers' checkouts, orders and delivery updates (name, email, phone, items and amounts) so your AI can quote your catalogue, remind shoppers about a basket they left and answer 'where is my order'. We keep that data only while the store is connected: when Shopify tells us a shopper asked to be forgotten, their name, email and phone are removed from those records straight away; when a shopper asks the store for a copy of their data, we send you everything we hold so you can reply to them; and when the app is uninstalled, Shopify tells us 48 hours later and we delete the store's connection, its synced products and every checkout and delivery it sent us the same day.

5. AI and automated decisions

AI replies are generated by model providers through their business APIs (section 6), which do not use the data to train their models, and are constrained to the knowledge you provide. Customers can always ask for a person, and uncertain or sensitive conversations are handed to your team. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

6. Who we share data with

We never sell personal data. We use these service providers (sub-processors), each under a written contract that requires them to protect it and use it only for us:

• Supabase - database, sign-in and file storage - EU (Frankfurt, Germany)
• Hetzner Online - application servers - Germany
• Vercel - website hosting and delivery - United States and global edge network
• OpenAI - AI replies, speech and document reading - United States
• Google - AI image generation (Gemini API) and Google sign-in - United States
• Resend - email delivery - EU (Ireland)
• Stripe - card payments in the UK and elsewhere - United States / EU
• Razorpay - payments in India - India
• Meta Platforms - WhatsApp, Instagram and Messenger connections - United States / Ireland
• Cloudflare - bot protection on sign-up and sign-in - global network
• Twilio - phone calls, only if you use the voice agent - United States

We also pass data to services you choose to connect (for example Shopify or a courier tracking service) on your instruction; to authorities when the law requires it; and to a buyer if our business is sold, under the same protections. We give at least 14 days' notice before adding a sub-processor that handles your customers' data.

7. International transfers

Our main hosting is in the EU. Where a provider processes data in another country - for example the United States - we protect it with the UK International Data Transfer Agreement or Addendum, or the UK-US data bridge where the provider is certified, and the EU Standard Contractual Clauses. For data of people in India, we transfer only to countries not restricted by the Government of India under section 16 of the DPDP Act.

8. Security

All connections are encrypted (TLS). Data is encrypted at rest by our hosting providers, and the access tokens for your connected channels are additionally encrypted by us with a separate key per business. Every request is checked against the business it belongs to, so one business can't reach another's data. Messages from Meta, Stripe and other providers are signature-checked, and access to our admin tools requires two-factor authentication. No system is perfectly secure, but we act quickly on any issue (section 12).

9. Your rights

In the UK you can: get a copy of your data; have it corrected; have it deleted; restrict or object to how we use it - and object to marketing at any time; receive it in a machine-readable format (portability); withdraw consent at any time; and not be subject to solely automated decisions with significant effects. In India you can: get a summary of your data and of who we've shared it with; have it corrected, completed, updated or erased; withdraw consent as easily as you gave it; have a grievance addressed; and nominate someone to exercise these rights if you die or become unable to. Use Settings → Security → Privacy & your data, or email us. It's free. We reply within one month (we may extend by up to two more months for complex requests and will tell you why within the first month). We may ask you to confirm your identity first. Withdrawing consent doesn't affect anything we did lawfully before.

10. Complaints

Please tell us first - through Privacy & your data or by email. We acknowledge every complaint straight away (and always within 30 days), investigate it, and tell you the outcome. If you're not satisfied, you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in India, to the Data Protection Board of India after using our grievance process. People in the EU can contact their local data protection authority.

11. Cookies and similar technology

We only use what's strictly necessary for the service to work: keeping you signed in, remembering settings on your device, and the bot check on our sign-up and sign-in forms. We don't use analytics, advertising or tracking cookies, so we don't show a cookie banner. If that ever changes, we'll ask for your consent first.

12. Personal data breaches

If a breach puts people at risk, we report it to the ICO within 72 hours of becoming aware of it where required, notify the Data Protection Board of India and affected people as the DPDP Act requires, and tell affected businesses without undue delay so they can meet their own duties.

13. Children

InfrAgent AI is a business tool for people aged 18 and over. We don't knowingly collect data about children as our own customers; if we learn we have, we delete it. Businesses using the platform are responsible for how they handle their own customers' data, including any children's data.

14. Changes to this policy

Each version is numbered and dated. We tell you about material changes by email and in the app at least 14 days before they take effect, and ask you to review them. Earlier versions are available on request.