Skip to content

Privacy policy

Last updated: October 14, 2026

This policy describes how Eslam Osama Mohamed, an individual based in Egypt and trading as INFRO (“INFRO”, “we”, or “us”), collects and uses personal information when you use our website, console, and API gateway. We are the controller of account and website data. For request content you send on behalf of your users, the roles are described in our data processing agreement.

What we collect

  • Account and contact data. Name, email address, organisation membership, support messages, and settings you provide when creating or managing an account.
  • Billing data. Billing email, purchase amounts, receipts, payment status, and transaction references. Card and bank details are collected directly by the payment provider shown at checkout and do not reach INFRO.
  • Usage metadata. Per-request metadata required for platform metering, cost attribution and abuse prevention: timestamps, model, provider connection, token counts, estimated provider cost, latency, and status codes.
  • Request content. Prompts, inputs, and model outputs are processed to serve your request. They are not stored by default. If your organisation enables content logging, they are stored for the retention window allowed by your plan. A request sent with logging: false disables optional prompt and response logging. Async job records and generated media needed to deliver the service are separate from optional request logs.
  • Provider connections. Provider credentials you connect are encrypted and used to authenticate your requests. If you enable cost reconciliation, a separately connected billing credential is used to retrieve provider cost, organization, credential-lifecycle, and rate-limit records where the provider exposes them.
  • Connected AI assistants. If you connect an AI assistant to INFRO's MCP server, by signing in from it or with a management token, we record which assistant it is (its client identifier and the name it gives itself), the organisation and permissions you allowed, and when it was connected and last used. Each tool call is logged with its name, outcome and duration for 90 days, never its arguments or results. Results go to your assistant, and from there to the model provider your assistant uses, under your own arrangement with them.
  • Security and product analytics. Authentication events, coarse country-level API-key activity, abuse signals, and how our website and console are used, as described under Analytics, cookies and session replay. We do not use advertising cookies or cross-site tracking.

Why we use it

  • Provide, secure, meter, support, and improve the service.
  • Bill the subscription, keep usage records, and prevent fraud.
  • Send transactional messages and answer requests.
  • Meet accounting, tax, legal, and regulatory obligations.

Depending on where you are, our legal bases are performance of our contract, compliance with law, and our legitimate interests in security, fraud prevention, support, and service improvement. Where consent is required, we ask for it and you may withdraw it.

What we never do

  • We do not train models on your prompts or completions.
  • We do not sell your data to third parties.
  • We transmit request content to the providers selected by your connections and routing configuration. Retries and fallbacks may send the request to more than one configured provider.

Upstream providers

Requests run through provider accounts you connect, under your agreements with those providers. Each attempted provider receives the input and parameters needed to serve the request and authenticates it against your account. Your provider's terms and account settings govern its retention, processing locations, and any use of data for training. Disabling logging in INFRO does not change those provider settings.

Analytics, cookies and session replay

We use PostHog, hosted in the European Union, to understand how our website (infro.io) and console (dash.infro.io) are used and where they get in people's way. On the website it is on by default; a banner tells you so the first time you visit and lets you turn it off under “Customize Choices”. In the console it is always on while you are signed in: there is no banner, and the choices below apply to the website only. What a recording never contains (below) applies to both.

  • Unless you decline: PostHog sets a first-party cookie on infro.io (and local storage) so that visits across the website and console are counted as the same person, and records sessions so we can replay how pages were used. In the console we also tell PostHog who you are (your account id, email address and name) and which organisation, role and plan you are using.
  • If you turn off session replay only: the cookie and counting stay, and nothing is recorded.
  • If you turn off analytics: recording stops, PostHog's cookie and stored identifier are deleted, and nothing more is sent to PostHog.
  • What a recording never contains: anything you type into a form field, keys, tokens and other secrets, email addresses shown on screen, prompts, model output and logged request content, generated images, audio and video, two-factor setup codes, network request contents, or the query string of any address.
  • Do Not Track and Global Privacy Control are treated as declining: unless you accept in the banner yourself, nothing is sent to PostHog at all.

Our legal basis is our legitimate interest in running and improving the service. Change your choice for the website at any time with “Cookie settings” in its footer. We store your choice in a cookie named infro_analytics_consent for one year. Recordings and events are kept for no longer than PostHog's retention period for our plan, and you can ask us to delete yours by writing to support@infro.io.

The console and Studio each remember whether you chose a light or dark theme, and the console whether you chose its classic or glass look, in cookies on infro.io named infro_theme_dash, infro_theme_studio and infro_look_dash, so that switching from one to the other opens in the right colours. They hold only those choices, are kept for one year, and are not used for analytics.

Separately, our own servers count page views on infro.io without any cookie or identifier (a visitor is derived from a value we discard every day), and our hosting provider measures page performance without cookies. Both honour Do Not Track and Global Privacy Control.

Payments

The provider identified at checkout processes payment information. Where that provider acts as merchant of record, it separately controls the buyer data it needs for payment, tax, fraud prevention, receipts, cancellations, and refunds, and its own privacy notice applies in addition to ours. Card details are entered on the provider's hosted checkout and never reach INFRO, and no payment provider receives your prompts, completions, or API keys. The provider in use is named before you pay and on every receipt.

The Provider Program

Applicants. When a company applies to the Provider Program, we collect what the application asks: the company's name, website and country; the applicant's name, job title and company email address; links to the company's API documentation, terms, pricing and status pages; and its answers about its API and its users. We use them to review the application and, if it is accepted, to build, verify and run the integration and to write to the applicant about it. The private status link we email is stored only as a one-way hash. To have an application and its details deleted, write to integrations@infro.io.

Test access. A test API key a provider sends through its private page is stored sealed (AES-256-GCM), used only to build, verify and monitor the integration, and destroyed when the provider asks, when the application is declined or withdrawn, or when the integration is removed. Notices a provider sends us, such as a model retirement or an incident, may be passed on to our customers.

Program figures. A provider in the program can see aggregate figures about its integration: how many organisations have a connection to it, requests served, visits to its Connect page and sign-ups that started there. They are counts only. A figure that would describe fewer than 5 organisations is withheld, and no customer's identity is shared with a provider without that customer's consent.

Who receives information

We share information only with vendors needed to operate the service, comply with law, protect users, or complete a transaction. The categories, purposes, and locations are published on our subprocessor list. We do not sell personal information or share it for targeted advertising.

You choose which provider serves a request, because it runs on your own account. You connect the provider credentials you already hold, and every request, trace and cost record names the connection that served it — both so you can reconcile our estimate against your provider's own invoice, and so you always know where your data went. You can also constrain routing per key by environment and by route.

You select and contract with your AI providers directly. Each party's data-protection role depends on the processing and applicable agreements. Vendors engaged by INFRO, and the separate role of payment providers, are described on the subprocessor list.

Data retention

Request history is available for the window included in your plan: 7 days on Developer, 14 on Startup, 30 on Team, and 90 on Business. This is the queryable history window; usage aggregates and records needed for accounting, security, and legal obligations may be retained separately. Enterprise retention is specified in the agreement.

Request content is not stored by default. Content logging is a per-organisation opt-in, and when it is on you choose the window within your plan's limit — up to 14 days on Startup, 30 on Team, and 90 on Business. Developer does not include content logging. Expired optional payload logs are deleted. Any single request can opt out of content logging with logging: false, and no request can opt in to storage the organisation has not enabled.

Account data is deleted within 30 days after account closure unless a longer period is required for security or law. Billing and transaction records are retained for seven years. Security signals are retained for 30 days. Support correspondence is retained only as long as needed to resolve the request and maintain a reasonable record of it.

International transfers

We operate from Egypt and use providers in multiple countries. Depending on your location, information may be processed outside your country. Where required, we use recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses. Processing locations are described in the DPA and subprocessor list.

Your rights

Depending on applicable law, you may request access to, correction of, deletion of, restriction of, or a portable copy of your personal data, and may object to some processing. You may also complain to your local data-protection authority. Exercise a right by contacting support@infro.io.

If you are processing personal data belonging to your own users, our data processing agreement is the document that governs it — it sets out roles, retention, subprocessors, international transfers, and what happens on termination.

Children

INFRO is a business and developer service and is not directed to children. You must be at least 18 to create an account. Contact us if you believe a child has provided account information.

Changes

We may update this policy as the service or law changes. We post the revised date here and notify account owners before a material change takes effect where required.

Contact

The controller is Eslam Osama Mohamed, trading as INFRO, in Egypt. Questions or rights requests: support@infro.io. Other contact routes are on the contact page.