Privacy Policy
Last updated: October 30, 2026
This Policy explains how Infusion handles the personal data of people who visit the site and of people who use the platform to build apps, under Brazil's General Data Protection Law (Law 13.709/2018, LGPD) and, for people accessing from the European Union or the United Kingdom, the General Data Protection Regulation (GDPR).
1. Who we are
Infusion is operated by Mitra Tecnologia em Sistemas Ltda., CNPJ 32.286.417/0001-59, headquartered at Av. Uirapuru, 840, Loja 1, Cidade Jardim, Uberlândia, Minas Gerais, Brazil, ZIP 38412-166, the controller of the data described here. Privacy contact: [email protected].
Data protection officer: Bruno Bortolini, [email protected].
2. Data we collect
When you visit the site:
- Browsing data: pages viewed, clicks, visit origin (campaign, ad click identifier and referring site), IP address, country, language and device and browser characteristics.
- Identifiers from metrics and advertising cookies, according to your choice in the banner (item 4).
- Teams plan form, if you send it: name, work email, company, team size and the description you write.
When you create an account and use the platform:
- Sign-up: your email and, if you sign in with a Google account, its name and photo. Your email is required to create an account. If you register your phone number, it is used to contact you, including through WhatsApp.
- What you build: the requests you write to the AI, conversations, projects, apps, files and the data you put in them.
- Connected AI subscription: if you connect your Claude or Codex account, the access credential for it, stored encrypted.
- Platform usage: events and clicks, such as sign-up, previews, limits reached and payment, and how you navigate the screens.
- Payment: plan, amount and billing status.
- Messages: what you send us by email, WhatsApp or through Infusion's chat assistant, including replies to messages we send.
- Reports: the name, email and content you send us when reporting an app at [email protected].
3. Why we use it and on what legal basis
- To provide the service: create and maintain your account, build, publish and host your apps, support you and notify you about your account (performance of a contract, art. 7, V of the LGPD; art. 6(1)(b) of the GDPR).
- To respond to Teams plan requests (steps prior to a contract, same articles).
- To bill your subscription and meet legal and tax obligations (legal obligation, art. 7, II of the LGPD; art. 6(1)(c) of the GDPR).
- To measure use of the site and the platform, measure campaign results, keep the service secure, prevent abuse, improve the service and send news about Infusion by email or WhatsApp (legitimate interest, art. 7, IX of the LGPD; art. 6(1)(f) of the GDPR). You can object at any time.
- Personalized advertising (consent, art. 7, I of the LGPD; art. 6(1)(a) of the GDPR), as described in item 4.
- To keep proof of your acceptance of the Terms and this Policy and defend Infusion in legal proceedings (exercise of rights, art. 7, VI of the LGPD; legitimate interest, art. 6(1)(f) of the GDPR).
4. Cookies and your choice in the banner
The banner has three independent categories:
- Metrics: how the site and the platform are used.
- Campaign measurement (Google Ads): whether an ad led to a visit, sign-up or payment. Includes sending your email to Google in encrypted form (hash), only for measurement.
- Personalized advertising (Google Ads, Meta and OpenAI): Infusion ads for people who already visited, on other sites and networks, and conversion data sent to Meta and OpenAI, with your email in encrypted form (hash), your IP address and browser identifiers.
In Brazil, Metrics and Campaign measurement are on by default based on legitimate interest, and you can turn them off. Personalized advertising only turns on with your consent. Outside Brazil, or when we cannot identify the country, no category turns on without your consent.
Your choice applies to both the site and the platform. If you decide in different places, the most recent decision applies. You can change it at any time via the "Cookies" link.
We also use essential storage to remember your theme, language and choice. Our cookies are set on the infusion.cloud domain and can be read by apps published at .infusion.cloud addresses.
Duration: banner choice, 12 months; visit origin and journey, up to 90 days; advertising cookies, up to 90 days.
Infusion does not respond to the "Do Not Track" signal from browsers. Your cookie choice is made through the banner.
5. Who we share with
We share only what is necessary with processors in these categories:
- AI model providers, which process the requests you make to build your apps. If you connected your own subscription, its terms with the provider also apply.
- Payment processor.
- Email delivery service.
- Usage metrics tool.
- Cloud infrastructure and bot protection providers.
- Google, Meta and OpenAI, as described in item 4.
- Authorities, when required by law.
Platform data is stored in Brazil. Some processors, such as AI, payment and advertising providers, handle data outside Brazil, mainly in the United States, with the safeguards required by the LGPD and the GDPR.
6. The apps you build
In the apps you build and publish on Infusion, you decide what data to collect from your users and why. For that data, you are the controller and Infusion is the processor: it stores and processes it according to your instructions, without using it for its own purposes.
7. How long we keep it
- Account: for as long as it exists. If your subscription ends, your account goes back to the free plan and follows its rules. Free plan accounts that are not in use may be closed, with notice beforehand, and their data is deleted.
- Connected AI subscription credential: until you disconnect the account.
- Record of your acceptance of the Terms and this Policy (version, date, time and IP): up to 5 years after the account is closed, even after the rest of the data is deleted.
- Backups: automatically deleted within 7 days.
- Teams plan form: up to 12 months after the last contact.
- Metrics in Google Analytics: up to 14 months.
- Cookies: as described in item 4.
- What the law requires us to keep: access logs for 6 months (Brazil's Internet Civil Framework) and payment data for the period required by tax law, even after the account is deleted.
8. Your rights
You may request at any time the rights provided in art. 18 of the LGPD: confirmation that we process your data, access, correction, anonymization, blocking or deletion, a copy of your data (portability), information about who we share it with, information about the possibility of not giving consent and its consequences, objection to processing based on legitimate interest, and withdrawal of consent. If you do not consent to personalized advertising, you only stop seeing personalized Infusion ads, and the service stays the same.
To delete your account, ask from the email registered on it. Deletion covers the account, projects, apps and the data stored in them, is permanent and keeps only what the law requires and the record of your acceptance (item 7).
To exercise any right, write to [email protected]. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or, if you are in the European Union or the United Kingdom, with the data protection authority in your country.
9. Changes to this Policy
When this Policy changes in a relevant way, we notify you through the platform or by email. The date of the last update is at the top.