Privacy Policy

Effective 13 October 2026

1. Who we are

This policy explains how Poojak Patel, doing business as Inferify (“Inferify”, “we”, “us”) handles personal information in connection with the Inferify website and service (the “Service”). For account and waitlist information, we decide how it is used. For the documents and data your organization uploads (“Customer Content”), we process it on your organization’s behalf and under its instructions, as described in our Terms of Service.

2. What we collect

• Waitlist: your work email address, its domain, when you joined and verified it, and whether you have been approved. We store only a one-way hash of verification links.
• Account: your name, email address and password. Passwords are stored hashed by our authentication provider; we never see them.
• Company profile: company name, website, country, size and primary market, and your job title and function.
• Customer Content: documents you upload, text extracted from them, analysis results, review notes, drafts and exports.
• Your Anthropic API key: encrypted before it is stored. Only its last four characters are ever shown again.
• Technical data: IP address, browser type, request metadata and error codes in server logs kept by our hosting provider. Our application logs do not contain document text or AI prompts.

The Service is not designed for patient-identifiable health information. Please de-identify documents before uploading them, as our Terms require.

3. How we use it

• to provide the Service: sign-in, your workspace, text extraction, analyses, drafts and exports;
• to manage the waitlist and invitations, and send service emails such as verification, invitations and password resets;
• to keep the Service secure, prevent abuse (for example rate limiting) and fix problems;
• to comply with law and enforce our Terms.

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we do not use Customer Content to train AI models. Where the GDPR applies, our legal bases are performance of a contract (providing the Service), our legitimate interests (security, improving and operating the Service) and compliance with legal obligations.

4. Who we share it with

We share personal information only with service providers that help us run the Service, under their terms and only as needed:

• Supabase: authentication, database and file storage.
• Vercel: application hosting and server logs.
• Resend: delivery of service emails.
• Anthropic: when you run an analysis or draft, relevant excerpts of your documents are sent to Anthropic using your organization’s own API key. Anthropic processes them under your organization’s agreement with Anthropic. Your full document library is not sent in a single request.

We may also disclose information if required by law or legal process, to protect the rights, safety or property of Inferify, our users or others, or as part of a merger, acquisition, sale of assets or transfer of the Service to a company formed to operate it, in which case this policy will continue to apply to your information.

5. Cookies

We use only cookies that are strictly necessary to run the Service: sign-in session cookies and a cookie that remembers which workspace you have open. We do not use advertising or analytics cookies.

6. Where data is processed

Our providers process data in the United States and other countries where they operate. Where personal data is transferred from the European Economic Area, the UK or Switzerland, we rely on the safeguards our providers offer, such as the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Account, company and Customer Content: while your account is active. After you ask us to delete your account, we delete it within 30 days, except where we must keep information to comply with law.
• Removed documents: the original file is deleted from storage straight away. Excerpts already cited in past analyses are kept, marked as removed, so that historical findings stay traceable, until your workspace is deleted. Replaced CER versions are kept in your workspace history.
• Waitlist entries: until access opens for you or you ask us to remove you.
• Server logs: for the limited period our hosting provider retains them.

8. Security

Each organization’s data is isolated with database row level security. Files are kept in private storage and served through short-lived signed links or authorized requests. Connections are encrypted in transit, and API keys are encrypted at rest with a key held only on our servers. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you without undue delay as required by law. Inferify does not currently hold security or compliance certifications.

9. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or US state privacy laws such as California’s), you may have the right to access, correct, delete or export your personal information, to restrict or object to certain processing, and to withdraw consent. You can update your name and company details in Settings. For anything else, email legal@inferify.io. We will respond within the time the law requires and will not discriminate against you for exercising your rights. You may also complain to your local data protection authority.

If your organization uploaded Customer Content that includes your personal information, we may direct your request to that organization, which controls that content.

10. Children

The Service is for professionals and is not directed to anyone under 18. We do not knowingly collect personal information from children.

11. Changes

We may update this policy. We will notify you of material changes by email or in the Service before they take effect, and the effective date above will change.

Contact

Poojak Patel, doing business as Inferify · legal@inferify.io