Privacy Policy — Infinite Talk AI

1) Information We Collect

2) How We Use Data

• Provide, maintain, and improve Infinite Talk AI.
• Authenticate (Google OAuth and Email OTP via Supabase), manage sessions, and prevent abuse.
• Personalize UX, analyze aggregated usage, debug, and ensure safety.
• Send service communications (verification, receipts, policy updates).
• Comply with legal obligations and protect our rights and users.

3) Third-Party Providers

To operate the Service we use:

• Supabase — authentication/database, OTP and session management.
• Vercel — hosting/CDN/build and performance edge network.
• Creem — third-party service as configured by us.
• Cloudflare R2 — object storage for user uploads/outputs.

Where relevant, Stripe handles billing. These providers process data under our instructions and their own privacy terms.

4) Legal Bases (EU/UK)

We rely on Contract (to deliver the Service), Legitimate Interests (security, analytics, improvement), Consent (where required—e.g., non-essential cookies/marketing), and Legal Obligation.

5) Sharing & Disclosure

We share data with processors listed above; professional advisors; and authorities when required by law or to protect users. We do not sell personal information.

6) International Transfers

Data may be processed in US/EU. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses).

7) Data Retention

• Auth/session logs and standard analytics/error logs: retained for 14 days by default.
• Account/profile data: retained while the account is active.
• User uploads/outputs: retained until you delete them or your workspace is removed.

We may keep minimal records as required by law (e.g., invoices).

8) Your Rights

Subject to local law, you may access, correct, delete, export your data, or object/restrict certain processing. EU/UK users may contact their supervisory authority. California residents: see CCPA section. Requests: support@infinitetalkai.org (we'll verify your identity).

9) CCPA (California)

We do not "sell" personal information. If we "share" data for cross-context advertising, we will do so only with your consent and you may opt out anytime via cookie settings. Categories collected: identifiers (email, cookies), internet activity, approximate geolocation, commercial info (transactions).

10) Cookies & Tracking

• Strictly necessary: login/session and security.
• Functional: preferences/UI state.
• Analytics: aggregated usage and performance; opt-out available.
• Marketing (optional): off unless you consent.

Manage via cookie settings or your browser.

11) Security

We use industry-standard safeguards (encryption in transit, access controls, audit logging). No method is 100% secure.

12) Children's Privacy

Not directed to children under 13. If you believe a child used the Service, contact us and we'll delete related data.

13) Changes

We'll update this Policy when needed. If changes are material, we'll notify you (email or in-app). Continued use after the effective date means you accept the changes.

14) Contact