Privacy and Cookies Policy

This Privacy Policy (the “Policy”) sets out how Infere processes Personal Data in connection with the provision of the Service. This Policy forms part of the Terms of Service and should be read together with the Data Processing Agreement (DPA), its Annexes, and any applicable Order Form.

1. Scope and Application

1. This Policy applies to the processing of Personal Data in connection with:
   1. access to and use of the Service;
   2. account creation and administration;
   3. billing and payment processing;
   4. support, security, and compliance functions; and
   5. any other interaction with Infere in a business or consumer context.
2. Where Infere processes Personal Data on behalf of a User as a Processor, such processing is governed by the DPA, the User’s documented instructions, and Applicable Data Protection Law. This Policy primarily describes processing for which Infere acts as Controller and provides supplementary information concerning Infere processing activities generally.

2. Roles and Responsibilities

2.1 Controller processing (Infere)

Infere acts as Controller in relation to:

• account registration and management;
• billing, payments, and financial records;
• fraud prevention, security monitoring, and abuse detection;
• compliance with legal and regulatory obligations;
• internal analytics and service improvement (to the extent not based on User Content);
• website operation, communications, enquiries, and support; and
• establishment, exercise, or defence of legal claims.

2.2 Infere Processor processing

Infere acts as Processor in relation to:

• Personal Data contained in User Content;
• Personal Data processed as part of inference requests;
• Observability Data where it includes User Content.

2.3 User responsibility

The User is solely responsible for:

• determining the legal basis for processing Personal Data submitted to the Service;
• providing required notices and obtaining consents where applicable;
• ensuring compliance with GDPR, AI Act obligations, and other applicable laws.

3. Categories of Personal Data

Infere may process the following categories of Personal Data:

• Account Data: name, email address, login credentials, organisation details.
• Billing Data: billing address, transaction data, payment references (processed via third-party payment providers).
• Usage Data: IP address, device identifiers, timestamps, API usage metrics, routing data, logs.
• Observability Data (if enabled): sanitised request and response content, metadata (e.g., latency, request size, routing information), and technical logs.
• User Content: any Personal Data included in prompts, inputs, or outputs processed through the Service.
• Support and Communications Data: correspondence, support tickets, and feedback.
• Cookie and device data: cookie identifiers, device and browser information, session information, preferences, and similar information collected through cookies or comparable technologies, subject to applicable consent requirements.

Sources of Personal Data. Infere generally receives Personal Data directly from Users or through their use of the Service. Where an individual accesses the Service through an Organisation Workspace, Infere may also receive Account Data and access information from the relevant Business User, organisation owner, or Admin. Infere may additionally receive transaction information from payment providers and technical information automatically through use of the Service.

4. Purposes and Legal Bases

Infere processes Personal Data only where a lawful basis under Applicable Data Protection Law applies. Depending on the processing activity, Infere may process Personal Data for the following purposes and legal bases:

• Account creation, administration, and provision of the Service — performance of a contract or steps taken at the individual’s request before entering into a contract;
• Billing and payments — performance of a contract and compliance with applicable accounting, tax, and other legal obligations;
• Security, fraud prevention, and abuse detection — Infere’s legitimate interests in protecting the Service, Users, and third parties, preventing fraud and misuse, and maintaining the security and integrity of its systems;
• Support and communications — performance of a contract and/or Infere’s legitimate interests in administering its relationship with Users and responding to enquiries;
• Service analytics and improvement — Infere’s legitimate interests in understanding and improving the operation, performance, and security of the Service, provided such interests are not overridden by the rights and interests of affected individuals;
• Legal and regulatory compliance — compliance with applicable legal obligations;
• Establishment, exercise, or defence of legal claims — Infere’s legitimate interests in protecting and enforcing its legal rights; and
• Non-essential cookies and similar technologies — consent, where required by Applicable Law.

Where Infere relies on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Where Infere processes special categories of Personal Data as Processor, the User is responsible for establishing an applicable legal basis and condition under Articles 6 and 9 GDPR. Infere does not intentionally require special category Personal Data for the ordinary provision of the Service.

5. AI and Automated Processing

• The Service enables access to AI systems operated by third-party providers.
• Infere does not use Personal Data contained in User Content or Observability Data to train Infere AI models where available. Any materially different use would require a separate lawful basis, appropriate transparency, and, where applicable, the User’s express agreement.
• Outputs generated through the Service may be automated and may not always be accurate, complete, or appropriate.
• Users remain solely responsible for:
  • reviewing Outputs;
  • ensuring lawful use of Outputs;
  • compliance with AI governance obligations.

6. Sharing and Recipients

Depending on the relevant processing activity and configuration of the Service, Infere may disclose or make Personal Data available to the following categories of recipients:

• Subprocessors and infrastructure providers: including cloud providers (e.g., AWS, Cloudflare), payment processors (e.g., Stripe), and analytics or infrastructure services.
• AI Providers: Personal Data included in inference requests may be transmitted to third-party AI Providers as selected or configured by the User.
• Professional advisors and auditors.
• Competent authorities where required by law or to protect rights, security, or the Service.

Where Infere acts as Processor, subprocessors engaged by Infere are identified in the appropriate Annex or Service infrastructure and are appointed and updated in accordance with the DPA.

7. International Transfers

Personal Data may be transferred outside the EEA. Where such transfers occur, Infere ensures appropriate safeguards, including:

• Standard Contractual Clauses (SCCs);
• adequacy decisions where applicable;
• supplementary measures where required.

Where Infere relies on appropriate safeguards for an international transfer, further information concerning the applicable safeguard, including how to obtain a copy where required by Applicable Law, may be requested using the contact details in clause 16.

8. Data Retention

Personal Data is retained only for as long as necessary for the purposes described in this Policy. Indicative retention periods:

• Account Data: duration of account and legal retention periods;
• Billing Data: as required by financial regulations;
• Usage Data: limited retention based on operational needs;
• Observability Data: maximum 90 days unless otherwise agreed, unless a shorter period applies under User configuration or Applicable Law requires otherwise;
• User Content: for the period necessary to provide the Service and in accordance with User configuration, documented instructions, and the DPA, where applicable.

Data may be retained longer where required for legal obligations and requirements, dispute resolution, or fraud prevention and security. Retention periods applicable to Usage Data retained separately for billing, security, fraud prevention, accounting, legal compliance, or dispute resolution may differ from retention periods applicable to Observability Data.

9. Security Measures

Infere implements and maintains technical and organisational measures appropriate to the nature, scope, context, and purposes of processing and the risks presented to Personal Data, as further described, where applicable, in the DPA and its Technical and Organisational Measures, including:

• encryption in transit (TLS);
• access control and role-based permissions;
• token security and hashing;
• logging and monitoring;
• incident response procedures;
• data minimisation and segregation.

Security measures are continuously reviewed and updated.

10. Data Subject Rights

Subject to the conditions and limitations under Applicable Data Protection Law, individuals may have the following rights:

• obtain access to their Personal Data;
• request rectification of inaccurate Personal Data;
• request erasure of Personal Data;
• request restriction of processing;
• receive or request portability of Personal Data where applicable;
• object to processing based on legitimate interest and to processing for direct marketing purposes;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal;
• exercise applicable rights concerning decisions based solely on automated processing producing legal or similarly significant effects; and
• lodge a complaint with a competent supervisory authority.

Where Infere acts as Processor, requests may be referred to the relevant User.

11. Cookies and Tracking

The Service uses cookies and similar technologies to ensure functionality, security, and performance. Cookies are small text files stored on a User’s device. Types of cookies include:

• Strictly necessary cookies for authentication, session management, and security purposes;
• Functional cookies to remember preferences and enhance usability;
• Analytics cookies to understand usage patterns and improve performance.

Where required by law, Infere obtains consent prior to placing non-essential cookies. Users may manage cookie preferences through the cookie banner or browser settings. Disabling cookies may affect the functionality of the Service.

12. Third-Party Technologies

Where required by law, Infere obtains consent prior to placing non-essential cookies. Third parties are subject to their own privacy and terms.

13. Observability and Logging

Observability is an optional feature that may include logging of request and response metadata and technical information. Users must not enable Observability for sensitive data processing without a lawful basis and appropriate safeguards. Where Observability Data contains Personal Data derived from User Content, Infere processes such Personal Data as Processor to the extent processed on the User’s behalf. Infere may separately process limited Personal Data as Controller where independently necessary for security, fraud prevention, or legal compliance purposes.

14. Complaints

Individuals may lodge a complaint with the Maltese supervisory authority: Office of the Information and Data Protection Commissioner (IDPC).

15. Updates to this Policy

Infere may update this Policy from time to time, and continued usage of the Infere Services shall constitute acceptance of such updates. Material changes will be notified through the Service or via email where appropriate.

16. Contact

Infere — Snowball Studio Ltd., a company incorporated under the laws of Malta with company registration number MT C 45202 and registered office at 3, Advance Business Centre, Triq G. Flores, SVR 1950 Santa Venera, Malta (“Infere”, “we”, “us”, “our”), acts as a Controller for the processing activities described in this Policy, except where expressly stated otherwise.

Contact: [email protected]  ·  Privacy: [email protected]