Privacy Notice

This notice explains how Infera Engine Ltd ("we", "us") uses personal data when you use Infera Ad Studio (the "Service").

Who we are

Infera Engine Ltd is the controller of your personal data. We are a private company limited by shares registered in England and Wales (company number 17520775), with our registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are registered with the Information Commissioner's Office (ICO) under registration number ZC275369.

Contact for privacy matters: [to be confirmed].

What we collect and why

When we capture a web page we automatically blur email addresses, phone numbers and personal form fields before any image is stored. Please only submit links and files you own or are authorised to use for advertising.

We do not sell personal data, we do not use advertising or analytics cookies, and we do not use your content to train AI models.

Payments

• You enter your card or wallet details on the payment provider's own page. We never see or store your full card number.
• When Paddle or Lemon Squeezy is the seller (the "merchant of record"), it sells you the plan or credits and is a separate controller of the data it collects for the sale. Its own privacy notice applies. It tells us your name, email address, country, what you bought, the amount and tax, and the status of the subscription.
• When we are the seller and you pay through Stripe, PayPal, Paymob or Tap, the provider processes the payment for us. Some providers are also separate controllers for their own legal duties, such as fraud prevention and anti-money-laundering checks.

Signing in with another provider

If you choose to sign in with Google, Microsoft, Apple, GitHub, Facebook, LinkedIn or X, that provider confirms who you are and sends us your name, email address, profile picture and account ID. We never receive your password for that provider, and we do not post anything to it. If you use Apple's "Hide My Email", we only receive a relay address. You can add or remove sign-in methods in your account settings.

Publishing to your social accounts

• When you connect TikTok, Instagram, Facebook, YouTube, LinkedIn or X, you see the platform's own screen listing the permissions we ask for. We ask only for what publishing needs: your basic profile, permission to upload and publish videos, and, where available, the statistics of the posts we published for you.
• Access tokens are encrypted at rest. We use them only to publish or schedule what you ask, and to read the statistics of those posts. We do not read your messages, followers or other posts.
• You can disconnect an account in the app at any time. We then delete its tokens. You can also revoke our access in the platform's settings.
• Google and YouTube. The Service uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of data is described in the Google Privacy Policy. You can revoke our access at Google security settings. Infera Ad Studio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI and media providers

To make your ad, we send the content needed for each step to the AI provider that does it:

• Planning, writing, editing and reviewing: your chat messages, your product's text, and images of the captured screens and of frames of your ad.
• Images, video clips and music: scene descriptions and, where needed, reference images. No personal data is intended to be sent.
• Voiceovers: the voiceover text.

We use these providers' business services, under terms that do not allow them to use what we send to train their models. We check this before we switch a provider on.

Providers we may use

We use carefully selected providers. We use a provider only while it is switched on in our owner console, so not every provider below is in use at any one time. The current list, with each provider's location and transfer safeguard, is at [to be confirmed].

We may also share data with professional advisers, with a buyer if our business is sold (they must keep this notice), and with authorities when the law requires it.

International transfers

Some providers are outside the UK. When we send personal data abroad we use one of these safeguards:

• UK adequacy regulations, for countries the UK recognises as protecting personal data adequately (for example the EU and EEA);
• the UK–US data bridge, for US recipients certified under it;
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment and extra measures where needed.

You can ask [to be confirmed] for a copy of the safeguards that apply.

How long we keep data

• Accounts never confirmed. If you sign up but never confirm your email address and never use the account, we delete it after the period set in our console, currently 30 days.
• Account data: while your account is open, then deleted within 30 days of closure.
• Your uploads, captures and finished ads: while your account is open, unless you delete them sooner. [to be confirmed]
• Intermediate files made during production: [to be confirmed].
• Invoices and payment records (including the credits each payment bought): 6 years from the end of the financial year they relate to, because UK tax law (HMRC) requires it. We keep them even if you close your account, but only what the law requires; your credit history inside the app is deleted with your account.
• Connected social accounts: tokens are deleted as soon as you disconnect the account or close your account.
• Email delivery and technical logs: [to be confirmed].
• Owner-console audit log: [to be confirmed].
• Backups: deleted data may remain in encrypted backups for up to [to be confirmed] until they are overwritten. We do not restore it, except to recover the Service after an incident, and then we delete it again.

Security

• Passwords are hashed with Argon2. Sessions use secure, HTTP-only cookies.
• Data is encrypted in transit (HTTPS).
• Credentials are encrypted at rest with AES-256-GCM: our keys for the providers we use, your social access tokens and your two-factor secrets.
• You can protect your account with two-factor authentication. It is mandatory for our staff who use the owner console.
• Workspace roles limit what each member can do. Every action in the owner console is recorded in an audit log.
• Every credit movement is recorded in an append-only ledger.
• Card details are entered only on the payment providers' own pages.

Emails and marketing

• We send service emails that you need: confirming your email, password resets, receipts, trial and renewal reminders, failed payments, security alerts and notices about your ads. These are not marketing.
• We send product news and offers only if you agree (the Privacy and Electronic Communications Regulations). The box is never ticked for you. You can change your mind at any time in your account settings or with the unsubscribe link in every marketing email.

Automated decisions

The Service checks content automatically: for example, it flags unsupported advertising claims, applies daily limits to prevent abuse, and may block content that breaks our policies. These checks do not have legal or similarly significant effects on you on their own. If you disagree with a decision, write to [to be confirmed] and a person will review it.

Your rights

You have the right to access, correct, delete, restrict, object to the use of, and receive a portable copy of your personal data. Where we rely on your consent, you can withdraw it at any time. In the app you can download all your data and permanently delete your account at any time (Settings → Your data). You can also contact us at [to be confirmed]. We reply within one month.

For data a merchant of record (Paddle or Lemon Squeezy) holds as the seller, you can also contact it directly.

If you are unhappy with how we handle your data you can complain to the ICO (ico.org.uk, 0303 123 1113), although we would appreciate the chance to help first.

Children

The Service is for businesses and people aged 18 or over.

Changes

We will post any changes here and, for significant changes, tell you in the app or by email before they take effect.