Skip to content

Privacy Policy

Last updated: September 13, 2026

This policy describes how Infograph AI ("we", "us") handles information when you use infograph.ai and the application at app.infograph.ai (the "Service"). It covers the whole product: the data you upload, the accounts you connect, and the AI features that read them.

1. What we collect

Your account

Authentication is handled by Clerk. Creating an account gives us your email address and name, plus a profile image and phone number if you provide them. If you join a team, we store which team you belong to and your role in it.

Data you bring

Files you upload (CSV, TSV, JSON, NDJSON, Excel, Parquet, SQLite and DuckDB) are converted to columnar tables and stored in an encrypted data lake belonging to your account. The original file is not retained. During the upload itself the file sits briefly in a staging area, which is cleared automatically within 24 hours.

Images and PDFs you attach to a chat message are stored separately and sent to the AI model only on the turn you attach them to.

Data you connect

When you connect an external account, we read the data you authorize and store it in the same encrypted lake so the AI can query it. What that includes depends on the source:

  • Spreadsheets and files: Google Sheets, Excel Online. Worksheet contents and file metadata.
  • Marketing and analytics: Google Analytics, Google Ads, Google Search Console, Facebook Marketing. Campaign, ad and performance data.
  • Commerce and finance: Shopify, Stripe, QuickBooks. Orders, products, transactions and accounting records. This can include personal information about your own customers, such as names, email addresses and billing addresses, which you remain the controller of.
  • Work tools: Jira, Notion, GitHub. Issues, pages, repositories and related metadata.
  • Databases: PostgreSQL, MySQL, SQL Server, Snowflake, BigQuery, MongoDB. The tables you select, using credentials you supply.

You choose which tables or streams to sync, and you can disconnect a source at any time.

What you create, and how you use the Service

We store the projects, conversations, dashboards, reports and analyses you produce, along with the AI messages behind them and the token and credit totals used to bill them. Our hosting layer records IP address, browser and device details, pages requested and errors, for security and debugging.

2. Where it lives, and who else processes it

Your data is stored on infrastructure we operate at OVHcloud in Beauharnois, Quebec, Canada. That includes the database, the object storage behind the lake, and the encryption keys that make the lake readable. OAuth tokens for connected accounts are held by a Nango instance running on our own servers, so they are not handed to a third-party integration vendor.

These are the outside companies that process data on our behalf:

  • Clerk (United States): authentication and user accounts. Privacy policy
  • Dodo Payments (merchant of record): subscriptions and payments. We never see or store your card details. Privacy policy
  • OpenRouter (United States): routes AI requests to the model you pick. The current roster includes models from Anthropic, OpenAI, Google, xAI, Moonshot AI and Alibaba. Privacy policy
  • Exa (United States): web search and page reading, used only when you enable web access and the AI chooses to search. It receives the search query and any page address it is asked to read. Privacy policy
  • Cloudflare: serves this website, provides cookieless visitor analytics, and renders preview images of dashboards and reports you publish. Privacy policy
  • OVHcloud (Canada): servers and object storage. Privacy policy

We do not sell personal information, and we do not share it for advertising or cross-context behavioural tracking. Beyond the processors above, we disclose data only where the law requires it, or to a successor in a merger or acquisition.

3. How we use it, and the limits we hold ourselves to

We process your data to run the Service: to give you an account, read the sources you connect, answer your questions with AI, store what you build, take payment, and keep the system secure. Under the GDPR our legal bases are contract performance for the Service itself, consent for connecting a third-party source, legitimate interests for security and fraud prevention, and legal obligation where a law applies.

When you ask the AI something, your message and the context it needs (which can include rows from your data, query results and code) are sent through OpenRouter to the model you selected. Four limits apply to everything covered by this policy, and to data from connected accounts in particular:

  • Nobody trains on it. We do not use your data to train or improve AI models, and we restrict every request to model providers whose policies forbid retaining or training on it. That restriction is enforced in code on each request rather than left to a provider's default.
  • It is not used for advertising or any form of cross-context behavioural tracking.
  • It is not mined for analytics. We measure how the product is used, never what your data says.
  • It leaves only to answer you. Content reaches a model provider because a request you made needs it, and is not transmitted for any other purpose.

Data obtained through Google APIs is subject to the same limits, and our use and transfer of it complies with the Google API Services User Data Policy, including its Limited Use requirements.

4. Publishing and sharing

Dashboards, reports and analyses are private to your account unless you publish them. Publishing captures a snapshot of the results and makes that version readable by anyone with the link, without signing in. Unpublishing stops new views. What you publish is your decision and your responsibility, including whether it contains personal data.

5. How long we keep it

  • Upload staging: cleared within 24 hours, automatically.
  • Superseded versions of your data: the lake keeps previous versions for 7 days so a sync can be rolled back, then destroys them.
  • A data source you delete: removed from view immediately, and the underlying bytes are destroyed on that same 7-day cycle.
  • Your account, if you delete it: your lake is destroyed immediately, including the encryption keys that make it readable, so the stored data cannot be recovered by us or by anyone else. Account records and conversation history are removed on request, within 30 days: write to support@infograph.ai and we will do it.
  • Backups: encrypted database backups are kept for 14 days, so a residual copy can persist that long after a deletion.
  • Billing records: kept as long as tax and accounting law requires, up to 7 years.
  • Operational logs: rotated automatically as they grow. We keep no searchable archive of them and never use them to profile you.

Data deletion explains how to remove your data, step by step.

6. Security

Your lake is encrypted at rest with keys held separately from the data, and every connection to the Service uses TLS. Access is scoped to your account, and each query runs in an isolated engine that can reach only your own data. The database is reachable only over a private network. No system is perfectly secure, and we do not claim otherwise.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it, or to stop processing it, and you can withdraw consent for a connected source at any time by disconnecting it. Write to support@infograph.ai and we will respond within 30 days.

In the EEA and UK your rights come from the GDPR, and you may complain to your local data protection authority. In the United States, state laws including the CCPA and CPRA give you rights to know, delete, correct, and opt out of sale or sharing. We do not sell personal information, so there is nothing to opt out of.

If you connect a source holding other people's personal data, such as your Shopify customers, you remain the controller of that data and we process it on your behalf under this policy.

8. Cookies and analytics

The application sets cookies to sign you in and keep you signed in, managed by Clerk. This website uses Cloudflare Web Analytics, which counts visits without cookies and without following you across sites. We run no advertising cookies and no third-party trackers, which is why you are never asked to consent to any.

9. International transfers

Infograph AI is based in the Cayman Islands and your data is stored in Canada. Most of the processors listed in section 2 are in the United States, so using the Service involves transferring data there. Where the GDPR applies, those transfers rely on the standard contractual clauses in our agreements with them.

10. Children

The Service is not for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal information, write to support@infograph.ai and we will delete it.

11. Changes

We may update this policy. If a change reduces your rights or widens what we do with your data, we will give you at least 30 days notice before it takes effect.

12. Contact

Questions, privacy requests and data protection enquiries: support@infograph.ai