inficaEarly access

Privacy Policy

Last updated: September 17, 2026

1. Who we are

This policy explains how Infica (“we”, “us”), available at infica.app, handles your personal data when you use the Service. We act as the data controller for the data described here. You can reach us at support@infica.app. Our Terms of Service describe the Service itself.

2. Data we collect

  • Account data — email address, name and, if you sign in with Google, your Google profile identifier and picture (via Firebase Authentication).
  • Content — the boards, files, scripts, links and media you upload or import, and the content the Service generates for you.
  • Voice data — recordings you provide when you use voice cloning. We treat them as sensitive: they are used only to build and run the voice you requested, and only with your consent.
  • Payment data — handled entirely by Stripe; we never see or store your card number. We receive your subscription status and purchase history.
  • Usage and technical data — logs, IP address, browser and device information, credit consumption, and your onboarding answers.

3. How we use your data

  • To provide the Service — including sending your inputs to the AI and infrastructure providers needed to fulfill each request.
  • To manage billing, credits and subscriptions.
  • To provide support, prevent abuse and keep the Service secure.
  • To improve the product. We do not sell your personal data.
  • To measure our own advertising, only if you accept it (see section 9): when you arrive from one of our ads, a TikTok pixel tells TikTok that the ad led to a visit, a signup or a purchase. We do not use your data to target you with third-party advertising.

4. Legal bases

Where the GDPR applies, we process your data to perform our contract with you (providing the Service), based on our legitimate interests (security, product improvement), with your consent (voice cloning, ad measurement), and to comply with legal obligations (tax, accounting).

5. Who we share data with

We share data only with the processors that make the Service work: Google Firebase (authentication), cloud hosting and storage providers (including Amazon Web Services), Stripe (payments), the AI model and media-generation providers used to fulfill your requests, and the social platforms you explicitly connect or publish to. Each receives only what it needs for its role. If you accept ad measurement (section 9), TikTok receives the events described there. We may also disclose data when the law requires it.

6. International transfers

Some providers process data outside the European Economic Area. Where that happens, transfers are protected by recognized safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep your data while your account is active. If you delete your account (or ask us to), we delete your personal data and content within a reasonable period, except for what we must keep for legal reasons (for example invoicing records) and residual copies in backups, which expire on their own schedule.

8. Your rights

You can ask us to access, correct, delete or export your data, object to or restrict certain processing, and withdraw consent (for example for voice cloning) at any time by writing to support@infica.app. If you are in the EU you can also lodge a complaint with your data protection authority — in Spain, the AEPD.

9. Cookies and local storage

The Service uses essential browser storage that needs no consent: your sign-in session (Firebase) and product preferences such as theme.

Advertising measurement uses the TikTok pixel to measure whether our TikTok ads work. It is off until you accept it in the banner shown on your first visit. If you accept, TikTok sets a cookie and receives page views and three events — account created, checkout started, payment completed — together with your IP address, browser information and, when you sign up, a hashed (irreversibly encoded) form of the email address you typed, used only to match the signup to the ad you came from, under TikTok's privacy policy. If you decline advertising measurement, the pixel is not loaded.

Product analytics is a separate, optional choice. Only after you accept it, Infica stores a random browser identifier and records normalized page paths, device category, campaign labels and actions such as registration, onboarding, generation, download initiation and checkout. When you sign in, we associate this identifier with your internal account ID. Confirmed payments and media generations can then be linked to your first observed campaign. We also use PostHog as an analytics processor. We do not send it your name, email, IP address, prompts, chats, uploaded files, generated content or access tokens, and we do not record your screen.

Detailed analytics events in Infica are retained for 90 days; browser identifiers expire after 90 days, and inactive visitor records are removed after their events expire. Retention in PostHog is managed separately. Billing and operational records follow the retention rules above. Withdrawing analytics consent stops collection and future delivery of queued events; it does not automatically erase data already collected. Contact us to request deletion, including deletion from PostHog. Analytics and advertising can be accepted or rejected independently, without affecting access to the Service.

10. Security

We protect your data with encryption in transit, access controls and isolation between accounts. No system is perfectly secure — if a breach affects your data, we will notify you and the competent authority as the law requires.

11. Children

The Service is not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service evolves. For material changes we will notify you in the product or by email. The date at the top always reflects the latest revision.

13. Contact

Privacy questions and requests: support@infica.app.