Skip to content
Infinex AI

Privacy Policy

Last updated: June 20, 2026

This Privacy Policy describes what information Infinex AI ("we", "us", the "Service") collects when you use infinexai.io, how we use it, who we share it with, and what rights you have. It applies to all users worldwide.

1. Information we collect

We only collect data necessary to operate the platform. We do not run third-party advertising trackers, no Google Analytics, no Facebook Pixel, no Mixpanel/PostHog.

Account data (you provide):

  • Email address
  • Display name (optional)
  • Password (stored hashed with bcrypt - never in plaintext) orGoogle OAuth identifier (immutable "sub" claim) if you sign in via Google
  • Profile avatar URL (optional)

Content you create:

  • Text prompts you submit to generate animations or videos
  • Image, video, and audio uploads you provide as reference material or as source data for voice clones / avatar creation
  • Output files generated by the platform (motion graphics, avatar videos, cloned videos) and their associated configuration

Payment data:

  • Customer identifier issued by our payment processor
  • Subscription status, plan tier, billing period start/end dates
  • Credit balance and per-transaction credit log (for accounting + abuse detection)
  • We do not see or store your full credit card number, CVV, or bank details. Our payment provider (currently Polar.sh, acting as Merchant of Record) handles card data directly - it never reaches our servers.

Authentication cookies:

  • One refreshToken HTTP-only cookie used to keep you signed in. It is marked HttpOnly, Secure, and SameSite=None. No third-party cookies. No advertising cookies.

2. Third-party processors

We use the following sub-processors to operate the platform. Each receives only the minimum data required for its function. By using the Service, you consent to your data being processed by them.

  • Anthropic, Inc. - generates animation code from your prompts. Receives the prompt text + reference image descriptions.
  • HeyGen Labs - AI avatar and voice synthesis. Receives your uploaded photos / videos / audio + the narration script. HeyGen runs its own identity-verification and consent workflow for any custom avatar or voice clone.
  • Cloudinary, Inc. - media storage. Stores your uploads and the rendered output files.
  • fal.ai - AI b-roll video generation (Veo). Receives the segment description text only.
  • Cobalt - YouTube video extraction fallback. Receives the YouTube URL only.
  • Polar.sh (active payment provider) - payment processing and Merchant of Record. Receives your email and (collected by Polar directly) your payment instrument.
  • Google LLC - Sign-in with Google identity verification (only if you choose Google SSO). We receive only your email and Google sub-claim.
  • Railway Corp. - hosting and database. Our application servers and PostgreSQL database run on Railway.

3. How long we keep your data

  • Account data - kept until you delete your account.
  • Generated motions (single animations) - auto-delete 3 days after creation. The platform displays a countdown so you can download anything you want to keep.
  • Video Clone jobs - temporary processing artifacts (extracted frames, intermediate uploads) auto-delete 24 hours after the job completes or fails.
  • Studio projects - kept while your account is active.
  • Avatar videos and Custom voices - kept while your account is active.
  • Credit log and subscription history - kept for accounting and tax purposes for as long as legally required (typically 7 years under Israeli tax law).

4. Your rights

Regardless of where you live, you can:

  • Request a copy of all data we have about you
  • Correct inaccurate data via your account page
  • Delete your account - which removes your profile, credit balance, and all generated content from our database. Sub-processor data (e.g. HeyGen training data on a custom voice) may persist according to their own retention policy.
  • Export your generated content before deletion

If you are an EU/EEA resident, the GDPR also gives you the right to data portability, the right to object to processing, and the right to lodge a complaint with your local data protection authority. If you are a California resident, CCPA rights apply. To exercise any of these, email support@infinexai.io.

5. Security

  • All traffic between you and the Service runs over HTTPS.
  • Passwords are stored as bcrypt hashes; we cannot view your plaintext password.
  • Authentication uses HTTP-only cookies - JavaScript on the page cannot read them, mitigating XSS-based token theft.
  • Database is hosted on Railway with TLS in transit and at-rest encryption.
  • Payment data never touches our servers - handled directly by Polar.sh.

6. Children

The Service is not intended for children under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will delete it.

7. Changes to this policy

We may update this Privacy Policy as the platform evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced via in-app notification.

8. Contact

For any privacy question, data request, or to delete your account, email support@infinexai.io.

Questions? support@infinexai.io · Privacy · Terms · Payments