Privacy Policy
Last updated: 7 October 2026Last updated: 7 October 2026
1. Who we are
Infrahaus AI Ltd (“Infrahaus AI”, “we”, “us”, “our”) is the data controller for personal data we collect about you when you visit our websites or use Exator and related services (the “Services”).
Registered in England and Wales (company number 17249836). Registered office: 167-169 Great Portland Street, London W1W 5PF, United Kingdom.
Email: privacy@infrahaus.ai
We have not appointed a Data Protection Officer (see our internal determination). For privacy queries, use the contact above.
EU GDPR / European markets. We offer Services to customers in the UK and in the EU (including Italy and Germany). Where the EU GDPR applies to us as a controller not established in the EEA, we will designate an EU representative under Article 27. Representative details will appear here once appointed: [EU representative — name, address, contact — TBD]. Meantime contact privacy@infrahaus.ai. Target to name the representative by ~17 October 2026 (≤30 days from board stamp 17 Sep 2026) — do not claim Art 27 satisfied until then.
2. What this notice covers
This notice explains what personal data we collect, why (purposes), the lawful basis for each purpose under the UK GDPR, who we share it with, how long we keep it, your rights, and how to complain to the ICO.
It applies to website visitors, account users, prospective customers, and applicants. Separate contractual terms (including our Terms of Service) govern use of the Service; this notice is about personal data.
AI inputs. Do not put unnecessary personal data in prompts or uploads. If you do, that data may appear in outputs and be processed as Customer Data / Input under our Terms.
3. Personal data we collect
Depending on how you interact with us, we may collect:
| Category | Examples |
|---|---|
| Identity | Name, title |
| Contact | Email, phone, postal address |
| Account / profile | Username, password hashes, preferences, support history |
| Transaction / billing | Plan, invoices, payment metadata (card details handled by payment processor) |
| Technical / usage | IP address, device/browser data, approximate location from IP, logs, feature usage |
| Communications | Emails, form submissions, call/meeting notes |
| Customer content | Project/site inputs, files, prompts, and related outputs that contain personal data |
| Recruitment | CV, work history, application details (if you apply) |
We do not seek special category data. Please do not send it to us unless we expressly ask and identify a lawful condition.
4. Purposes and lawful bases
| # | Purpose | Typical data | Lawful basis (UK GDPR Art 6) |
|---|---|---|---|
| P1 | Create and manage accounts; authenticate users | Identity, contact, account | Contract (Art 6(1)(b)) — to provide the Service you request |
| P2 | Provide the Service (including AI features you use) | Account, customer content, technical | Contract (Art 6(1)(b)) |
| P3 | Customer support and service communications | Contact, communications, account | Contract (Art 6(1)(b)); legitimate interests (Art 6(1)(f)) — to support users |
| P4 | Billing, fees, accounting | Identity, contact, transaction | Contract (Art 6(1)(b)); legal obligation (Art 6(1)(c)) where tax/accounting law requires |
| P5 | Security, fraud prevention, abuse detection, enforcing Terms / acceptable use | Technical, account, content as needed | Legitimate interests (Art 6(1)(f)) — protect Service, users, and business; legal obligation where applicable |
| P6 | Operate, debug, maintain, and improve the Service (product analytics, performance) | Technical, usage, limited account | Legitimate interests (Art 6(1)(f)) — improve and secure the Service |
| P7 | Essential cookies / strictly necessary site operation | Technical | Legitimate interests (Art 6(1)(f)) and/or contract as needed to deliver the site; non-essential cookies only with consent (Art 6(1)(a)) if introduced |
| P8 | Direct marketing (product updates, offers) where permitted | Contact, preferences | Consent (Art 6(1)(a)) and/or soft opt-in / legitimate interests where PECR allows — you can opt out anytime |
| P9 | Comply with law, regulators, lawful requests; establish/defend legal claims | As required | Legal obligation (Art 6(1)(c)); legitimate interests (Art 6(1)(f)) — legal defence |
| P10 | Business transfers (merger, acquisition, restructuring) | Relevant sets | Legitimate interests (Art 6(1)(f)) — orderly business transaction |
| P11 | Recruitment / hiring | Recruitment data | Legitimate interests (Art 6(1)(f)); contract steps (Art 6(1)(b)) at offer stage; consent where used for optional equal-opps data |
Where we rely on legitimate interests, we balance our interests against your rights. You may object (see rights below).
Controller vs processor. For personal data in Customer Data that you instruct us to process in the Service, our Terms treat you as controller and us as processor under a DPA when one applies. This notice covers processing where we are controller (e.g. account, billing, website, our marketing).
5. How we collect data
- Directly from you (signup, forms, support, inputs you provide)
- Automatically (logs, cookies/similar technologies — currently we aim to use only strictly necessary cookies on the marketing site; we will update this notice before adding non-essential cookies)
- From service providers or partners where needed (e.g. payment, hosting), as described in disclosures
6. Who we share data with
- Service providers (processors): hosting, email, payments, analytics (if used), support tools — under contracts requiring appropriate protection
- Professional advisors and authorities where required by law or to protect rights
- Successor entities in a business transfer
- Others only with your instruction or another lawful basis
We do not sell personal data.
7. International transfers
If we transfer personal data outside the UK, we use appropriate safeguards (e.g. UK Addendum / International Data Transfer Agreement, or adequacy) as required by UK GDPR.
8. Retention
We keep personal data only as long as needed for the purposes above, then delete or anonymise it, unless a longer period is required by law or needed for legal claims.
Indicative periods (may be shortened or extended where justified):
- Account data: life of account + up to 12 months
- Billing/tax records: up to 6 years (legal)
- Support tickets: up to 24 months after closure
- Marketing: until opt-out / suppression needs
- Logs/security: typically 30–180 days unless investigating an incident
- Recruitment: usually up to 6–12 months after process ends unless hired
9. Security
We use appropriate technical and organisational measures. No method is perfectly secure. We maintain incident procedures and will notify the ICO and affected individuals when UK GDPR requires.
10. Your rights (UK GDPR)
You may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data in certain cases
- Restrict processing in certain cases
- Object to processing based on legitimate interests (and to direct marketing — absolute)
- Portability where processing is based on consent or contract and is automated
- Withdraw consent where processing is based on consent (does not affect prior lawful processing)
To exercise rights: email privacy@infrahaus.ai, or use request access for product access (privacy requests should still go to the privacy inbox).
11. Complaints — ICO
You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We would appreciate the chance to resolve concerns first via privacy@infrahaus.ai.
12. Children
Services are aimed at businesses and professionals. We do not knowingly collect personal data from children under 16. Contact us to delete any such data.
13. Changes
We may update this notice. We will change the “Last updated” date and, for material changes, take reasonable steps to notify you (e.g. email or in-product notice) where appropriate.
14. Contact
Product access: exator.ai/request-access. General enquiries: contact control on infrahaus.ai.
privacy@infrahaus.ai Infrahaus AI Ltd, 167-169 Great Portland Street, London W1W 5PF, United Kingdom
EU Article 27 representative: [TBD — name, address, email] (see §1).