Privacy policy

Who we are

Infrafused is the product described on this website. No company has been registered to operate it yet, and this section will name the legal entity once one exists.

For anything in this policy, including a request about your own data, write to privacy@infrafused.com.

What this policy covers

Two things: this website, and the Infrafused product. They differ in one important way. On the website we decide what happens to your data. Inside the product our customer decides.

If you are a developer at a company that uses Infrafused, your employer is responsible for your data and we handle it on their instructions. Ask them first, and come to us if that does not settle it.

What this website collects

This is a small site with one form. If you use it, we receive what you type:

• Your name, your company and a work email address
• A rough developer count and a short message, optional
• The time the form was submitted

There is no database behind the form. A submission is sent to our mailbox as an email and kept there like any other message.

The provider that serves this site keeps ordinary server logs: IP address, browser, page and time. They exist to deliver the site and to defend it against abuse, and we use them for nothing else.

Cookies and analytics

This site sets no cookies and writes nothing to your browser. There is no consent banner because there is nothing to consent to.

We do use Cloudflare Web Analytics, which counts visits and page loads without cookies, without fingerprinting you and without following you to other sites. It reports totals, not a profile of a person.

What the product processes

The product reads source material from systems a customer already runs, sends it to a language model and writes structured documentation from the result. That documentation is stored as Git repositories and served to the customer’s developers by a client on their machines.

Most of what moves through it is source material rather than personal data. Personal data is present in commit history, in whatever a repository happens to contain, and in the records described below.

The client records which documentation an AI coding tool read and which tools are installed on a machine. Those records are tied to a named developer through the identity the customer’s own directory provides, so they are personal data about that person and we treat them as such.

Credentials, keys and tokens are stripped before anything reaches a model. That is a safeguard and not a guarantee, and it is not a filter for personal data.

A customer chooses which model does the work, including a model inside the customer’s own cloud account. We do not use customer source code, generated documentation or those records to train models.

Why we may process it

On this website we rely on our legitimate interest in answering the people who contact us.

In the product we process personal data to perform our contract with the customer and on the customer’s instructions. The customer, as controller, is answerable for the legal basis.

We may also process data where the law requires it, such as keeping accounting records.

Who else sees it

A small number of service providers, named on the subprocessors page. They host the site, deliver its email and count its visits.

We do not sell personal data, and we do not share it for advertising.

Some of those providers are outside the EEA. Where that is the case, the transfer relies on a safeguard the law recognises, such as the European Commission’s standard contractual clauses.

How long we keep it

An enquiry from this website is kept while it is useful, and deleted on request.

Inside the product, retention follows the customer’s instructions and the agreement. Data a customer asks us to delete is deleted, and ages out of backups after that.

How we protect it

Access is limited to the people who need it, data is encrypted in transit and at rest, and the systems holding it are patched and monitored.

No system is perfect. If a breach affects your data, we tell the customer without undue delay, and the supervisory authority where the law requires it.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Where consent is what we rely on, you can withdraw it at any time.

Write to privacy@infrafused.com and we answer within a month. Where your data sits inside a customer’s tenancy, we pass the request to that customer and help them answer it.

If you are not satisfied, you can complain to the data protection authority in the country where you live or work.

Changes to this policy

If this policy changes in a way that matters, the date at the top changes with it. Where a change affects you, we say what changed.