Privacy policy

This policy says what we do with the data of the people who use our products: what we process, why, how long we keep it, who else sees it, and what you can require of us. It is written to be read.

Who is responsible

Infinite People SAS, 16 rue Cuvier, CS 70381, 69457 Lyon Cedex 06, France (RCS Lyon 101 431 435), is the data controller. For any question, or to exercise your rights: [email protected].

What this policy covers

The infinitepeople.ai site and the products that stand on an Infinite People account: Infinite Studio (studio.infinitepeople.ai, the mobile app and its API), Infinite Characters and Infinite Critics. One account and one subscription serve them all. Using the service is otherwise governed by its terms of use.

The data we process

• Your account — your email address, your name and your picture, handed to us by Google when you sign in, then the name and the image you choose afterwards. No password: we hold none.
• What you give us to create with — your descriptions, your pictures, your recordings, your documents, the voices you keep on your account.
• What we make for you — your videos, songs, pictures, presentations, voices, montages and jury verdicts, with their files.
• Your usage — the record of each creation (which trade, when, what it asked of our machines), the state of your week, your projects, your shares, the API keys and the agents you authorize.
• Your subscription — the plan, the dates, the invoices and the customer identifier at our payment provider. We never see your card number.
• Your exchanges with us — the messages sent to support and the feedback you send from the app.
• Technical logs — IP address, timestamp and route called, kept for the security of the service and to understand failures; requests refused by moderation are recorded there.

Why, and on what basis

• Performing the contract — holding your account, making your creations, keeping them, running your week and your subscription, answering you.
• Legal obligation — invoicing and accounting; marking creations as machine-made and moderating requests beforehand, as the European AI Act requires.
• Legitimate interest — the security of the service, preventing fraud and forbidden uses, measuring our machine costs and improving the service.

We do no advertising prospecting, and we make no automated decision producing legal effects concerning you.

How long we keep it

• Your creations — for the retention chosen on your account, creation by creation: 48 hours (ephemeral, then erased for good), one year by default, or as long as your account exists.
• A deleted creation — 48 hours in your bin, from which you can take it back, then 30 days during which we can restore it at your request, then final erasure with its files. An expired ephemeral creation is erased with no bin.
• Your account — as long as it exists. When it closes, your creations and your files are erased within 30 days.
• Invoices — ten years, as accounting law requires.
• Technical logs — twelve months at most.
• Messages to support — three years after the last exchange.

Who else sees it

Nobody receives your data for their own account. We call on providers, each for one precise task, all bound by a processing agreement:

• Google Ireland Ltd — signing in to your account, and our professional mail.
• Stripe — subscription payment and invoices.
• Hetzner Online GmbH (Germany) — our servers and our database.
• Cloudflare — serving our sites and storing your files.
• OpenAI — moderating requests, writing lyrics, the direction help, transcription, some pictures and the jury of critics.
• Alibaba Model Studio — part of the direction help and of the presentations.
• Vast.ai, RunPod, AWS, Alibaba Cloud — compute machines rented when ours are not enough; in the high privacy mode, only machines located in Europe.
• Apple — distributing the iOS app.

The privacy setting on your account decides what may leave our machines: at the highest level, your contents leave neither our machines nor Europe, and the steps that would call on a partner are simply unavailable. The models that make your videos, your songs, your voices and your presentations run on our own machines.

Outside the European Union

Some of these providers process data outside the European Union, notably in the United States. Those transfers are framed by the European Commission's standard contractual clauses or by an adequacy decision. You may ask us for a copy of the safeguards in place at [email protected].

What we do not do

• We do not sell or rent your data, to anyone.
• We train no model on your contents or on your creations, and our providers contractually undertake not to either.
• We do not read your creations, except at your request to support or where a report or the law requires it.
• We publish none of your creations: a creation is visible to you, and to the people you handed a share link to.

Your rights

You may ask for access to your data, its rectification, its erasure, the restriction of or objection to its processing, and its portability. Write to [email protected]: we answer within one month. Much of it is done straight in the app: changing your name and your image, deleting a creation, emptying the bin, setting the retention and the privacy level, withdrawing a share, revoking an API key, closing your account. If our answer does not satisfy you, you may refer the matter to the CNIL (cnil.fr), the French data protection authority.

Cookies and trackers

No advertising tracker, no third-party analytics, on any of our sites. The infinitepeople.ai site only keeps your language choice in your browser. The studio keeps the token that holds you signed in and your display preferences, both needed for the service to work.

Security

Exchanges are encrypted in transit. Each account is walled off: a creation is readable by its account, and by the people a share link was handed to. Access to the servers is limited to the people who need it and is traced. Should a data breach be likely to put you at risk, we will notify the CNIL and, where required, you.

Minors

Our services are for adults. We do not knowingly collect data about a minor; should that happen, write to us and we will erase the account and its data.

Changes

This policy may change with the service. The version in force is always the one published at this address, with its date. An important change is signalled to you in the app.

Last updated: 22 September 2026