Intelligence Infrastructures

Privacy Policy

Effective date: 2026-10-02

Document version: privacy-production-v1

This policy describes the Intelligence Infrastructures service at https://intelligenceinfrastructures.com. The applicable document version and effective date are identified when the policy is approved and activated. Earlier accepted versions remain historical records.

1. Who we are

Intelligence Infrastructures is operated by S Group Bulgaria Ltd. (Bulgarian legal name: „ЕС груп България“ ЕООД), UIC / EIK 208016439, at 23 Aleksandar Malinov Blvd., Mladost 1A, Sofia 1729, Bulgaria. Our official privacy and support contact is support@intelligenceinfrastructures.com.

2. Scope of this policy

This policy describes personal information handled in connection with the Intelligence Infrastructures platform, accounts, application features, subscriptions and support. It distinguishes our application records from information handled by providers on their own hosted pages. External tools, Google sign-in and Stripe-hosted services also have their own privacy notices. The service is intended for international use, subject to applicable law and availability; this does not mean it is available in every country.

3. Information and its sources

Information comes from details and content you provide, authentication and payment providers, and technical activity needed to operate the service. Categories include account and sign-in information, application content, acceptance history, subscription and transaction records, support communications and operational data. The following sections explain these categories; they do not mean that every user supplies every category.

4. Accounts and authentication

Supabase Auth supports email/password accounts and optional Google sign-in. Authentication can involve an email address, credentials handled by the authentication service, a provider account reference, confirmation or recovery status, and session information. If you use Google sign-in, Google and the authentication service exchange the information needed for that flow, which may include your provider identity and account profile or email metadata.

We associate a verified sign-in identity with a separate application account reference. An email address may be used as account or contact information, but it is not the sole basis for linking account ownership or paid access. Confirmation emails, password recovery and secure session handling support access to your account. Providing required sign-in information is necessary to create or use an authenticated account.

5. Projects, conversations and application content

The platform stores Project details, conversations, messages, learning conversations and tool references where you use those features. It also stores information needed to manage generation requests and their lifecycle, conversation context, the source or version of referenced material, timestamps and delivery or processing status. This supports features such as reopening a conversation, organizing it in a Project and managing its history.

A learning conversation uses the conversation system; this policy does not claim that a separate course-completion or learning-progress tracking system is operating. Removing a conversation from view or clearing context is not necessarily immediate permanent deletion of all related records. Do not submit passwords, payment credentials or unnecessary sensitive information in prompts or messages.

6. Records of legal acceptance

Our legal-acceptance record contains only your application account reference, the versions of the Terms and Privacy Policy accepted, and the acceptance timestamp. That record does not contain your email address, IP address, user agent or a device fingerprint. Authentication, hosting and payment providers may separately process technical information and logs; the limited acceptance record is not a claim that those providers never process such information.

Acknowledging this policy is not blanket consent to optional processing. Where a separate consent is required for a purpose, it must be obtained separately rather than inferred from accepting the Terms or creating an account.

7. Billing and payment records

Stripe-hosted services, including Managed Payments and, where applicable, Link, handle Checkout, subscriptions, payments and payment-account management. Card details are entered into the provider's payment interface; Intelligence Infrastructures does not store full card numbers or CVCs in its application billing records.

We retain customer and subscription references associated with an application account, plan and payment status, invoice and payment references, amounts and currencies, verified paid periods, cancellation information and relevant refund or dispute evidence. These records let us establish subscription ownership, confirm paid access, reconcile transactions and deal with payment issues. Payment status may affect access to Member functionality; a browser redirect alone is not proof of payment.

8. Support communications

When you contact support@intelligenceinfrastructures.com, the information you provide may include your contact details, the content of your request and relevant account or transaction references. We use it to respond and investigate the issue. Please do not send passwords, complete card details or more personal information than is needed. We may ask for proportionate information to verify an account-related request.

9. Technical and operational information

Hosting and authentication services process requests and technical information needed to run and protect the platform. Operational records can include request paths, times, response status, error information and service or session identifiers. Providers may also handle network, browser or device information under their applicable arrangements and notices. We do not characterize operational logs as an advertising system or claim that the application's minimal acceptance record covers all provider logging.

10. Cookies and similar storage

The application primarily uses strictly necessary authentication and security state: session cookies, OAuth and PKCE state, confirmation and recovery state, short-lived legal-consent markers, invitations and return-to-page state. Custom authentication markers are short-lived and protected; many are inaccessible to page scripts. Blocking necessary cookies may prevent sign-in or completion of an authentication flow.

Our current application inventory has not identified active Google Analytics, Meta Pixel, advertising trackers, session replay, an external error-monitoring SDK, Vercel Web Analytics or Speed Insights, or application marketing/analytics storage. Operational hosting logs are separate from optional analytics. Optional tracking would require an updated disclosure and any required choices before activation. Stripe-hosted and Google-hosted pages can use their own cookies; this inventory is not a complete description of their storage.

11. How we use information

We use information to provide accounts and requested features; maintain content and conversation history; administer subscriptions and paid access; send operational messages; record document acceptance; respond to requests; secure the service; investigate errors, abuse or payment disputes; and address applicable legal obligations. If required information is missing, we may be unable to provide the relevant feature or verify a request.

The purpose-by-purpose legal-basis assessment is a required part of the final Production notice and is not settled by this draft. This policy does not treat every use as consent-based or make acceptance a substitute for identifying the applicable legal basis.

12. Services involved in delivery

Supabase provides authentication and database/application persistence. Vercel hosts the application and supports runtime operations and logs. Stripe and Link provide payment, subscription, Customer Portal and Managed Payments services and support. Resend delivers authentication and operational email. Google provides optional Google authentication. These services handle information relevant to their functions, such as account data, application records, requests, transaction details or email recipient and delivery information.

Those descriptions identify service functions, not a verified contractual classification of every provider as a processor or independent controller. The relevant roles, contracts, locations and notices require final confirmation before Production publication.

13. AI processing status

AI-enabled General Chat and Learn features use server-selected direct provider integrations. The intended Production configuration uses DeepSeek as the primary provider and OpenAI as a secondary alternative, with automatic fallback disabled. A failed request does not automatically switch to the secondary provider. Requests can include your current prompt, bounded conversation context and server instructions; Learn can include compact projections of selected Tool information, not entire Tool Dossiers. The application may retain generation identifiers, token-usage and accounting records. The current OpenAI integration requests store=false, and the current DeepSeek integration disables thinking mode. These settings do not establish a provider's retention, security-logging, model-training, contractual role or processing location. Provider-specific arrangements require external review before final approval of this notice. Providers and configurations may change; material changes to processing require updated disclosures and the applicable acceptance or separate consent before introduction. This candidate does not assert that Production AI processing has already been activated.

14. Payment support and refunds

Stripe, Link and Managed Payments support may receive payment-support or refund requests and process them under applicable provider procedures. We use resulting transaction and dispute information to reconcile Billing and access. A refund is not necessarily subject only to Intelligence Infrastructures approval. The providers' payment and privacy notices explain their handling of information within those services.

15. Sharing and referral-related records

Information is shared with relevant service providers as needed for the functions described above. We may also disclose information where required by applicable law or where lawfully necessary to address a security incident, protect rights or handle a dispute. This is not permission for unrelated or unlimited disclosure of your content.

Creator promotion entry and creator notifications are currently disabled. Historical referral or campaign associations and related transaction or notification records may nevertheless remain where that functionality was used. Disabling the feature does not erase those records. The implemented creator notification format uses campaign and payment-summary information without including the customer's email address or unnecessary customer identifiers. Any future activation or materially different sharing requires an updated disclosure as appropriate; this policy is not an advertisement for an active creator offer.

16. International operation and transfers

The service is operated from Bulgaria and uses providers serving international users. Depending on the arrangements, information may be handled outside your country. This draft does not assert a particular data-center region or an already-verified transfer mechanism. The final Production policy must identify relevant locations and explain applicable safeguards and how information about them can be obtained. Required safeguards must be established before any processing that depends on them; this paragraph is not consent to unrestricted transfers.

17. Retention and deletion

We retain personal information while it is needed for the account or service relationship and the purposes described in this policy. Some records may need to be kept for security, fraud prevention, accounting, contractual or applicable legal obligations. Retention depends on the record category, purpose and any applicable obligation, rather than one fixed period for all information. On a valid deletion request, data that may be deleted is removed or anonymized according to the applicable request-handling process. Records that must be retained are kept only for the required period and purpose. We do not promise immediate deletion from every system, backup or legally required record. The category-specific implementation, exceptions and request-handling procedures remain subject to final operational and external legal review before activation.

Conversations and messages persist in the application database. Archiving a conversation is not deletion. The current conversation delete operation marks it as deleted and does not purge its underlying messages or associated accounting and context-provenance records. No automatic 30-day conversation expiry is implemented. Permanent deletion and export requests are handled separately from these interface actions, subject to identity verification, the applicable process and justified retention. Account closure and subscription cancellation are also separate actions; neither implies an immediate purge of all records or backups.

18. Security

The application uses account verification, access controls and server-side checks intended to protect information and separate one user's data from another's. Necessary authentication state is protected and limited in duration where appropriate. No security measure can guarantee that every incident will be prevented. Keep your credentials private and report suspected account compromise to support. This draft does not claim a certification, universal encryption guarantee or security standard that has not been verified.

19. Your rights

Depending on applicable law and the processing involved, you may have rights to access and correct personal information, request deletion, restrict or object to processing, and receive or transfer certain data. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also complain to a competent data protection authority without first obtaining our permission. These rights have applicable conditions and exceptions; accepting this policy does not waive them.

20. Account deletion, export and correction requests

Contact support@intelligenceinfrastructures.com to request access, correction, deletion or export where applicable, or to ask about account closure. The current application does not provide full self-service account deletion or export. A request may require proportionate identity verification and consideration of lawful retention obligations. Fulfilment is not necessarily automatic or immediate, and applicable response deadlines still apply. You do not need to send us your password. Closing an account and cancelling subscription renewal are separate actions; tell support if your request concerns both.

21. Children and age requirements

The service is not intended for children under 13. Where applicable law requires a higher age for independent consent or contracting, users must satisfy that requirement or have appropriate parent or legal-guardian authorization. We do not claim to operate a parental-consent verification system. Contact support if you believe an underage child has supplied information so the situation can be assessed under applicable law. The exact age and minor-data treatment requires final legal review before Production.

22. Changes and planned functionality

Material changes to this Privacy Policy will be published as a new immutable version with an effective date and appropriate notice. You will be asked to accept the new version through the legal-acceptance flow before continuing to use features that require acceptance. Acknowledgement is not blanket consent to optional processing; any separately required consent must still be obtained. Minor editorial corrections are not, by themselves, material changes, and historical accepted versions will not be silently rewritten. Cloudflare Turnstile is implemented for protected authentication entry flows: the browser loads its widget and obtains a token; email signup, password sign-in and recovery supply the token to Supabase Auth, while Google first-time signup uses server-side verification before OAuth. This does not establish Cloudflare's retention, contractual role or data locations; those arrangements require external review before final approval. Optional analytics and creator-feature activation remain separate disclosure decisions.

23. Contact

For privacy and account-data requests, email support@intelligenceinfrastructures.com or write to S Group Bulgaria Ltd., 23 Aleksandar Malinov Blvd., Mladost 1A, Sofia 1729, Bulgaria. Authentication and other automated messages may use no-reply@auth.intelligenceinfrastructures.com. That automated sender is not a human support address.