Privacy Policy

Who we are

Infera Engine Ltd is a private company limited by shares, registered in England and Wales (company number 17520775), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are the controller of the personal information described in this policy, and we are registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZC275369.

For any privacy question or request, email privacy@inferaengine.com.

Information we collect

Project enquiries. When you submit the enquiry form we receive your name, email address and message, and any optional details you choose to add: company or organisation, product or service of interest, preferred timeline and budget range.

Accounts. If you create an account we keep your name, email address and preferred language, a salted one-way hash of your password (never the password itself), whether two-factor sign-in is on together with its secret key and one-way hashes of your recovery codes, and when you joined and last signed in. Requests you send while signed in, or from the same email address, are shown in your account. For members of our team we also keep their role and permissions. If you add a profile photo, we keep it to show on your account and, for our team, in the company console; it is not shown publicly. The company owner may choose to show their own photo, title and biography on the Company page. If you link your Infera Agent account, we keep the access keys Infera Agent issues for that link, encrypted, and use them only for that account: to show your own Infera Agent projects in your account, where the link can only read your project list. The company owner can also use their own link in the company console to work with Infera Agent’s owner and staff spaces; that information is read live from Infera Agent when the owner opens it and is not stored by this website. The owner’s link is also used to measure the company’s own projects on Infera Agent for an internal estimate of the company’s value; only the size of their files and line counts are kept, never the files themselves. You can remove a link at any time in My account → Connected apps. The company owner can also read and answer the company mailbox inside the console; those messages stay with our email provider and the website keeps no copy of them.

Signing in to Infera products. When you choose “Sign in with Infera Engine” in one of our products, we share with that product an identifier for your account and, depending on what it asks for, your name, language, email address and account role. You can see and disconnect these products on your account page.

Sign-in with Google. If you choose “Continue with Google”, Google tells us your name, email address, that the address is verified and an identifier for your Google account. We never see your Google password, and we do not receive access to your Google data.

Company ID and Owner ID links. If we share our Company ID, company documents or our owner’s ID with you through a private link, we record when the link is opened and which documents are viewed or downloaded, with a short device description such as “Chrome on Windows” (never your IP address). If the link is limited to named people, we also record the email address you confirm: by a one-time code, of which we keep only a one-way hash for 10 minutes; by Google, which tells us only that the address is verified; or by your Infera Engine account. An address you confirm for one of these links can open our other links shared with that address for up to 12 hours, without a new code. Documents we keep elsewhere (for example on Google Drive) open there, under that service’s own terms. No account is created for you. These records are seen only by the company owner and are deleted with the link, or after 12 months.

Sign-in and security records. If you turn on email verification codes, we email you a one-time code at sign-in and keep only a one-way hash of it for 10 minutes. For each signed-in device we keep a session record with a short device description, such as “Chrome on Windows”, and when it was created and last used. We record security events such as sign-ins, failed sign-in attempts and changes to passwords, two-factor settings or team permissions. To protect sign-in and forms from abuse, we keep one-way hashes of IP addresses and email addresses for up to 24 hours.

AI features. If you use the website assistant (“Ask Infera”) or the AI brief writer, the text you type is sent to our AI service provider to produce the answer. We do not save assistant conversations on our servers: your browser keeps the current conversation until you close the tab. Our team may also use the same service to summarise a project request and draft a reply; a person always reviews it before anything is sent to you.

Emails. When you write to any @inferaengine.com address we receive your message, your email address and anything you include.

Technical information. Our hosting infrastructure processes standard server information, such as IP address, browser type, the pages requested and the time of the request, to deliver the website and protect it from abuse.

Visits from search engines. Our server counts, for each day and page, the visits that arrive from a search engine or an AI assistant (by the name of the referring service only, for example Google) and the visits of search engines’ crawlers. These counts hold no IP address, identifier or cookie and cannot identify anyone.

Preferences on your device. Your language choice and any products you select for comparison are stored in your own browser and are not sent to us. See our Cookie Policy.

We do not ask for, and you should not send us, special category information such as health data, or passwords and confidential records.

How we use information and our lawful basis

To answer your enquiry, prepare a proposal and take the steps you ask for before entering into a contract (UK GDPR Article 6(1)(b)).

To provide your account and the services you sign up for, including account emails such as address confirmation, password reset and security notices (Article 6(1)(b)).

To operate, secure and improve the website, keep accounts safe and prevent misuse and fraud, answer questions put to the website assistant and help our team respond to project requests efficiently, which are our legitimate interests (Article 6(1)(f)).

To keep business records and meet our legal, tax and accounting obligations (Article 6(1)(c)).

We do not sell personal information, we do not use advertising or analytics trackers, and we only send marketing emails if you have asked to receive them.

Who we share it with

We share personal information only with service providers that help us run our business and act on our instructions: website hosting and infrastructure providers, our business email provider and our AI service provider, Anthropic, PBC, which processes the text sent to the AI features under its commercial terms and does not use it to train its models. The AI features may reach Anthropic through Infera Agent, our own AI platform, which passes the text on in the same way. When you pay an invoice online, the payment provider you choose (Stripe, PayPal, Paymob or Tap, as the invoice offers) receives what it needs for the payment, such as your name, email address, the invoice number and the amount, and handles your card or account details itself; each provider also acts under its own privacy policy. We may also share information with professional advisers, or with authorities where the law requires it.

Links to our own products, such as inferaagent.com, and to third-party sites lead to services with their own privacy policies.

International transfers

Some of our service providers may process information outside the United Kingdom. Where this happens, we make sure the transfer is protected by appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

How long we keep information

Enquiries and related correspondence are kept for up to 24 months after our last contact with you. If we enter into a contract with you, the related records are kept for the length of the contract and up to six years afterwards, for legal and accounting purposes.

Account information is kept while your account is open. When you delete your account, your profile, password hash, two-factor settings and sessions are deleted straight away; project requests you sent remain as business records for the periods above, no longer linked to an account.

Sign-in sessions end when you sign out and expire after 30 days, or 12 hours for team accounts. Email confirmation links expire after 24 hours and password reset links after 1 hour. Security and activity records are kept for 12 months, and the abuse-protection hashes for 24 hours.

Server information is kept by our hosting infrastructure only for as long as needed for security and troubleshooting.

How we protect information

The website is served only over encrypted HTTPS connections. Access to enquiries is limited to authorised people at Infera Engine Ltd, and our company email accounts are protected by two-factor authentication.

Passwords are stored only as salted PBKDF2-SHA256 hashes. Sign-in uses secure, HttpOnly cookies, and you can turn on two-factor sign-in with an authenticator app. Team accounts must use two-factor sign-in, and each team member can see only what the permissions given by the company owner allow.

Your rights

Under UK data protection law you can ask us for a copy of your personal information, and ask us to correct it, delete it or restrict its use. You can also object to our use of it and, where it applies, ask for it in a portable format. Email privacy@inferaengine.com; we will respond within one month.

If you have an account, you can also download your data and delete your account yourself from the Privacy & data section of your account page.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to resolve your concern first.

If you are in the European Union or the European Economic Area, the EU General Data Protection Regulation may also apply to you, and you can complain to the data protection authority in the country where you live or work.

Children

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children under 13.

Changes to this policy

We will update this page if the way we handle personal information changes, and show the date of the latest version at the top.