Privacy Policy

1. Introduction

Infinity AI (Private) Limited (“Infinity AI”, “we”, “our”, or “us”) is a company incorporated in Sri Lanka. We build SaaS and AI products and deliver customized software through Infinity Dev Hub.

We are committed to protecting your privacy and to handling personal data responsibly, lawfully, and transparently. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data, and the rights available to you. We process personal data in alignment with the EU General Data Protection Regulation (GDPR) and applicable ISO information security standards.

2. Scope of This Policy

This Policy applies to personal data we process about:

• Visitors to our websites and applications;
• Users of our SaaS and AI products;
• Clients and prospective clients of Infinity Dev Hub;
• Business partners, suppliers, and contractors; and
• Individuals who communicate with us by any channel.

This Policy does not apply to third-party websites, products, or services that may be linked from our platforms. Those third parties operate under their own privacy policies, and we encourage you to review them.

3. Information We Collect

Information you provide directly

• Name, company name, and job title;
• Email address and telephone number;
• Billing and payment information;
• Project documentation, requirements, and other content you submit to us.

Information collected automatically

• IP address and approximate location;
• Browser type, settings, and device identifiers;
• Usage logs, pages viewed, and interaction data;
• Cookies and similar tracking technologies.

Client data

Where we process data on behalf of a client under a contract, Infinity AI may act as a Data Processor. In such cases the client is the Data Controller and is responsible for the lawful basis of that processing.

4. Legal Basis for Processing (GDPR)

Where the GDPR applies, we process personal data on one or more of the following legal bases:

• Performance of a contract — to provide the products and services you have requested;
• Legitimate interests — to operate, secure, and improve our business, where not overridden by your rights;
• Legal obligation — to comply with applicable laws and regulations; and
• Consent — where you have given clear consent, which you may withdraw at any time.

5. How We Use Personal Data

We use personal data to:

• Provide, operate, and maintain our products and services;
• Deliver custom software and AI solutions;
• Respond to inquiries and provide support;
• Manage contracts, invoicing, and payments;
• Ensure the security and integrity of our systems;
• Perform analytics to improve our offerings; and
• Comply with legal and regulatory obligations.

We do not sell personal data to third parties.

6. Data Sharing and Disclosure

We may share personal data with:

• Our employees and authorized contractors;
• Cloud hosting and infrastructure providers;
• Payment processors;
• Professional advisors (e.g., legal, accounting); and
• Government or regulatory authorities, where required by law.

All third parties acting on our behalf are bound by contractual confidentiality and data protection obligations and may only process personal data in accordance with our instructions.

7. International Data Transfers

Personal data may be transferred to, and processed in, countries other than the one in which it was collected. Where such transfers occur and are required to be safeguarded, we implement appropriate measures, such as:

• Standard Contractual Clauses (SCCs);
• Contractual data processing agreements;
• Adequate technical and organizational security controls aligned with ISO standards.

8. Data Security

We implement technical and organizational measures aligned with ISO standards to protect personal data, including:

• Encryption of data in transit;
• Role-based access controls and least-privilege access;
• Secure, monitored infrastructure; and
• Periodic security reviews and assessments.

While we take reasonable steps to protect personal data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy, including to:

• Fulfil our contractual obligations;
• Comply with legal and regulatory requirements;
• Resolve disputes; and
• Enforce our agreements.

When personal data is no longer required, we securely delete or anonymize it.

10. Your Data Protection Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the right to:

• Access the personal data we hold about you;
• Request rectification of inaccurate data;
• Request erasure of your data;
• Restrict or object to processing;
• Request data portability; and
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us using the details in Section 14. You also have the right to lodge a complaint with your local data protection authority.

11. Cookies and Tracking Technologies

Our websites use cookies and similar technologies to enhance user experience and analyze traffic. You can manage your preferences through your browser settings. For more information, please see our Cookie Policy.

12. Children's Privacy

Our services are not directed to individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

13. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date. We encourage you to review this Policy periodically.

14. Contact Information

If you have any questions about this Privacy Policy or how we handle personal data, please contact us:

• Infinity AI (Private) Limited
• 12/2B, Sudarshana Road, Off Hill Street, Dehiwala 10350, Sri Lanka
• Email: [email protected]