Privacy Policy — Infinioo

1. Who This Policy Applies To

The App supports three user roles ("personas"), and this Policy applies to all of them:

• Personal — individuals managing a personal contacts CRM and digital cards.
• Organizer — users who create, publish, and manage events, tickets, stands, and teams.
• Company — businesses managing a company profile, members, and stand bookings.

2. Information We Collect

2.1 Account and Authentication Data

• Email address and password — used to create and secure your account. Authentication is handled through Supabase Auth; passwords are stored and managed by our authentication provider, not by us in plain text.
• Early-access / registration code — required to register during our early-access phase.

2.2 Profile Information

• Name, phone number, country, and profile photo (avatar).
• Your selected role(s) and onboarding status.

2.3 Digital Cards

When you create a digital card, we collect the professional and contact details you provide, which may include: name, company, position, email, phone, WhatsApp, LinkedIn URL, Instagram URL, website URL, avatar, and location (country, state, city, postal code). Digital cards can be shared publicly via a link or QR code, meaning the information you place on a card may be visible to anyone you share it with.

2.4 Contacts and Networking Data (Personal mode)

• Contact records you create manually or by scanning another user's QR digital card, including their personal/professional details and relationship status.
• Interactions you log with a contact (calls, WhatsApp, email, meetings, notes), including free-text content, outcomes, dates, and attached media.
• Reminders and follow-ups you schedule, including notes and due dates.

2.5 Audio Recordings

You may record audio to attach to interactions. Audio recordings are stored only locally on your device and are not uploaded to our servers by default. If you uninstall the App or change devices, these recordings are lost.

2.6 Media and Images

Photos and images you attach (avatars, event covers, interaction media) are uploaded to and stored by our media provider, ImageKit.

2.7 Event, Company, and Stand Data (Organizer / Company modes)

• Events you create or manage (name, description, cover image, location, dates, sessions, ticket types, categories, floor plans).
• Company profiles, company members, exhibitor records, stand reservations, and event groups/teams, including invitation details and member contact information.

2.8 Push Notification Tokens

When you sign in, we register a push notification token associated with your account, along with device platform and app version, so we can deliver notifications.

2.9 AI Assistant ("Ana") Data

When you use the in-app assistant "Ana", the messages you type and your recent conversation history are sent to a Google Gemini model (via a secure server-side function) to generate responses and search published events. Please avoid entering sensitive personal information in the Ana chat.

2.10 Device Permissions

The App may request the following permissions:

• Microphone — to record audio for interactions.
• Camera / Photos — to scan QR codes, capture photos, and attach media.
• Notifications — to send you push and locally scheduled reminders.

You can manage or revoke these permissions at any time in your device settings.

3. How We Use Your Information

We use your information to:

• Create, authenticate, and secure your account.
• Provide core features: contacts CRM, digital cards, interactions, reminders, event and stand management, invitations, and networking.
• Deliver transactional emails (e.g., a welcome email after onboarding).
• Send push notifications and scheduled reminders.
• Power the Ana AI assistant and event discovery.
• Store and display images you upload.
• Open event locations in a maps application when you request it.
• Maintain, troubleshoot, and improve the App.

4. Legal Bases for Processing (where applicable, e.g. EEA/UK)

Depending on your location, we rely on the following legal bases: performance of a contract (to provide the App), your consent (e.g., device permissions, marketing where applicable), our legitimate interests (to secure and improve the service), and compliance with legal obligations.

5. How We Share Your Information

We do not sell your personal information. We share data with the following categories of recipients:

• Other users, where you choose to share it (e.g., a publicly shared digital card, contact exchange via QR, participation in an event, group, or company team).
• Service providers / sub-processors that operate the App's infrastructure:
  • Supabase — authentication, database (PostgreSQL), and serverless functions.
  • ImageKit — image storage and delivery.
  • Google (Gemini) — powering the Ana AI assistant.
  • Expo Push service — delivering push notifications.
  • Google Maps — opening event locations at your request.
  • flagcdn.com — serving country flag images.
• Legal / compliance — where required by law, regulation, legal process, or to protect our rights and users.

Some of these providers may process data outside your country. Where required, we implement appropriate safeguards for international transfers.

6. Data Storage and Security

Your account and application data are stored in a PostgreSQL database managed by Supabase, protected by row-level security so that records are scoped to the authenticated user. We use industry-standard measures to protect your data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Audio recordings remain local to your device unless otherwise stated.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the App. When you delete your account, we delete or anonymize your associated data as described below, except where retention is required for legal, accounting, or security purposes.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

• Edit your profile and digital cards at any time within the App.
• Delete your account from the profile screen. Account deletion permanently removes your associated data, including your profile, digital cards, contacts, created companies, organized events, and other associated records.
• Manage permissions and notifications via your device settings.

To exercise other rights, contact us using the details below.

9. Children's Privacy

The App is not directed to children under the age required by your local law (e.g., 13 or 16). We do not knowingly collect personal information from children. If you believe a child has provided us data, please contact us so we can remove it.

10. International Users

The App supports multiple languages (English, Portuguese, Spanish, French) and may be used in various countries. By using the App, you understand your information may be processed in countries other than your own.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, where appropriate, notify you within the App. Continued use of the App after changes take effect constitutes acceptance of the revised Policy.