Privacy Policy

The Infxl Angle (the “Service”) is operated by Infxl LLC (“we”, “us”). It researches published news about a company and its competitors, clients and prospects, and turns it into briefs delivered on the web and by email at angle.app.infxl.com and related infxl.com addresses (the “Site”).

This policy explains what personal information we collect, how we use it, who processes it for us, how long we keep it, and the choices you have. It covers visitors, guests who try the Service without an account, account holders, and people who receive briefs by email.

• Account information: your name, email address and, if you sign in with Google, your profile picture, provided through Firebase Authentication. We store your name and email encrypted.
• What you ask us to track: company websites, the competitor, client and prospect lists in your Market Map, preferred and excluded news sources, delivery days, time and timezone, email layout, and any optional location setting.
• Delivery addresses: the email addresses you choose to send briefs to, which may belong to other people. They are stored encrypted, together with a one-way coded (hashed) form we use to honour unsubscribes.
• Briefs and history: the briefs, market maps and source links generated for your account.
• Billing information: payments are handled by Stripe. We keep your Stripe customer and subscription identifiers, your plan, billing period, payment status and any account credit. We never receive or store your card number.
• Device and session information: your browser, operating system, device type and user-agent for each signed-in session, so you can see and sign out of your active sessions. Your IP address is used to protect the Service from abuse and to apply usage limits.
• Usage analytics, only with your consent: if you choose “Accept All” on our cookie banner, we record which company domains are analysed and how guests move through the trial. Full URLs and any email address in these records are encrypted.
• Support requests: the messages you send us through the contact form or support tickets, and our replies.
• Email delivery events: our email provider tells us when a message to an address bounces or is reported as spam.

• To research, generate and deliver your briefs on the schedule you set.
• To run your account, process payments, apply your plan’s limits and send service emails, such as free-month reminders, renewal notices and security messages.
• To keep the Service secure: preventing abuse, enforcing rate limits, verifying that requests come from our app, and protecting accounts.
• To provide support and answer your requests.
• With your consent, to understand in aggregate how the Service is used so we can improve it.
• To comply with the law and to protect our rights and the rights of others.

We do not sell your personal information, we do not use it for targeted or behavioural advertising, and we do not share it for cross-context advertising.

Briefs, company profiles and market maps are produced by Google Gemini, running on Google Cloud Vertex AI, using Google Search grounding to find recent published coverage. To do this we send the company names, domains, keywords and source preferences you have entered. If Google Search does not return usable results, the same search terms may be sent to independent search providers (Brave Search, Tavily and Exa).

We send company and search information to these services, not your name or email address. Under Google Cloud’s terms, Vertex AI does not use customer data to train Google’s models, and we do not train AI models on your data.

We share information only with the providers that run parts of the Service for us, and only what they need:

• Google Cloud and Firebase host the application, the database, sign-in and our serverless functions. See Google’s privacy policy.
• Google Gemini (Vertex AI) and Google Search generate briefs, as described above.
• Brave Search, Tavily and Exa may receive search terms as a fallback news source.
• Resend sends briefs and account emails, which means it processes recipient addresses and message content, and reports bounces and spam complaints back to us.
• Stripe processes payments and holds your payment details. See Stripe’s privacy policy.
• Google reCAPTCHA Enterprise, through Firebase App Check, verifies that requests come from our app rather than from bots.

These providers may process information in the United States and other countries where they operate. A small number of authorised Infxl staff can access account, delivery and support records to provide support, prevent abuse and operate the Service. We may also disclose information when the law requires it, to respond to a lawful request, or to protect our rights.

We use your browser’s local storage, not advertising cookies, to keep you signed in, remember your cookie choice, cache data so pages load quickly, and hold a random identifier for your device’s session. Google reCAPTCHA Enterprise runs on the Site to block bots and may set its own cookies.

On your first visit we ask whether you accept optional analytics. Nothing optional is recorded until you click “Accept All”; “Essential Only” turns it off. To change your choice later, clear this site’s data in your browser and choose again.

We honour the Global Privacy Control (GPC) signal: if your browser sends it and you have not made a choice on our banner, we treat it as “Essential Only”. We do not respond to the older Do Not Track header. We do not use Google Analytics, advertising pixels or third-party tracking tags.

Briefs are sent to the addresses account holders choose. If you receive briefs, every brief email has an unsubscribe link with three options: stop that brief, stop all briefs sent to your address, or stop all Infxl Angle email. Many mail apps also show a one-click Unsubscribe button, which stops that brief immediately. Essential account, security and billing messages are still sent to account holders.

If an email to an address bounces permanently or is reported as spam, we stop sending to it and keep a hashed record of the address so that we do not send to it again.

All traffic to the Site is encrypted in transit (HTTPS). Names, email addresses and delivery addresses are encrypted at rest with AES-256-GCM, using a key unique to your account. Database rules restrict your trackers and briefs to your own account. No method of storage or transmission is completely secure, but we work to protect your information and to limit who can access it.

• Account, trackers, briefs, market maps and session records: for as long as your account exists. Session records also end when you sign out of that device.
• Lapsed free-plan trackers: deleted automatically about 90 days after the free month ends, unless you renew.
• Delivery records (the company tracked, the time, and the recipient address in encrypted form): about 13 months, for delivery troubleshooting.
• Guest usage events: about 60 days.
• Records of analysed company domains: for signed-in users, until the account is deleted. Records made while signed out are not linked to an account and are deleted about 60 days after they were made.
• IP addresses used for rate limiting: no longer than the limit’s time window plus one day.
• Company research and search results (about companies, not about you): up to about 90 days for company profiles and market maps, and up to 8 days for search results.
• Payment event records: 30 days, and up to one year for failed payment events. Stripe keeps its own payment records under its own policy and the law.
• Unsubscribe and bounce records: kept in hashed form for as long as needed to keep honouring them.
• Server logs, which may include IP addresses: kept in Google Cloud Logging for 30 days (the default Google Cloud Platform retention period) for security monitoring and troubleshooting.

You can delete your account at any time from Settings & Privacy, in the Danger Zone. Deletion happens straight away. It removes your profile, encryption keys, trackers, briefs, market maps, analysis history, session records, support tickets and your sign-in account. It also cancels any subscription immediately, without refund, and deletes your billing profile at Stripe; if you hold account credit, contact us before deleting.

Some limited records remain after deletion, for the periods listed above: delivery records (the recipient address in them can no longer be decrypted once your key is deleted), hashed unsubscribe and bounce records, payment records held by Stripe, and, only if a subscription could not be cancelled automatically, your Stripe customer identifier until billing is resolved.

Depending on where you live, including under the GDPR and UK GDPR and US state privacy laws, you may have the right to:

• Access and portability: get a copy of your data. Use “Export My Data” in Settings & Privacy, or ask us.
• Correction: have inaccurate information corrected.
• Deletion: have your data erased. Use “Delete Account” in Settings & Privacy, or ask us.
• Objection and restriction: object to or limit certain processing, and withdraw consent to analytics at any time.
• Complaint: complain to your local data protection authority.

To exercise any of these rights, email support.angle@infxl.com. We respond within 30 days. If you receive briefs but have no account, you can stop them at any time from the unsubscribe link in any brief.