Privacy notice

The short version

• INFIOO is software for service businesses. It holds two kinds of data: your account data, which we are responsible for, and the data about your customers that you put into INFIOO, which you are responsible for and we process on your behalf under our data processing addendum.
• We use data to run INFIOO. We do not sell it, we do not show ads, and neither we nor our AI providers train AI models on it.
• Fioo, INFIOO's AI assistant, uses models from Google, Anthropic and OpenAI to draft and, only as far as your settings allow, send messages. Messages it sends on its own say they come from an AI assistant.
• If you connect Google, INFIOO only gets what each feature needs: the busy times in your calendar and permission to send from your Gmail. Our use of Google data follows Google's Limited Use requirements.
• Your workspace database is in Frankfurt, Germany. The app runs on servers in Singapore, and some providers are in the United States; those transfers are covered by Standard Contractual Clauses.
• You can export everything, delete customers, disconnect any tool and delete your business from Settings at any time.

1. Who we are

INFIOO is operated by ONE 28 LLC, a limited liability company organised under the laws of Delaware, USA ("INFIOO", "we", "us"). Our postal address is in the legal notice. For anything in this notice, write to hello@infioo.com.

This notice covers the INFIOO app at infioo.ai, our website infioo.com, our developer documentation, the INFIOO desktop app, the connector that lets AI assistants work with INFIOO, and the emails and messages we send.

• EU representative (GDPR Art. 27): being appointed. Until then, contact us at hello@infioo.com.
• UK representative (UK GDPR Art. 27): being appointed. Until then, contact us at hello@infioo.com.
• Privacy Officer (also the person in charge of the protection of personal information for Québec, and our privacy officer for New Zealand): hello@infioo.com.

2. Two kinds of data, two roles

We are the controller for your account and profile, billing, visits to our websites, support conversations, security logs and our own marketing. We decide how that data is used, and this notice explains it.

We are your processor(a "service provider" under US state privacy laws) for Workspace Data: everything your business puts into or connects to INFIOO about other people — your customers, leads, callers, reviewers and staff. We process it only to run INFIOO for you, on your instructions, under the data processing addendum. Your settings, including what Fioo may do on its own and which tools you connect, are part of those instructions. If someone asks us about their data in your workspace, we refer them to you and help you respond.

3. If you are a customer of a business that uses INFIOO

The business you deal with decides how your data is used and is responsible for it. Please contact that business to see, correct or delete your data; INFIOO gives it the tools to do so.

• Messages.Texts, WhatsApp messages, emails and bookings you send the business are stored in its INFIOO workspace. Fioo may draft the replies. A person at the business reviews them unless the business has allowed Fioo to send certain messages on its own; a message Fioo sends on its own says it comes from the business's AI assistant.
• Calls. If the business uses an INFIOO phone number, a missed call may be answered by an automated assistant. What you say is transcribed live by our telephony provider and sent to the business as a message. Calls are not recorded, and the greeting tells you this before you speak.
• Stopping texts. Reply STOP to stop texts from that business. We recognise the common stop words in English, German, French, Spanish, Dutch (for example STOPP, ARRÊT, BAJA, AFMELDEN).
• We do not sell your data, use it for advertising, or use it to train AI models.

4. What we collect as controller, and where it comes from

• Account and profile: your name, email address, password (stored only in hashed form by Google Firebase Authentication), business name, country, settings and team role. If you sign in with Google, we receive your name, email address and profile photo link from Google.
• Billing: your plan and billing status. Payment card details are collected and held by Stripe, never by INFIOO.
• Communications: what you write to us, for example support requests.
• Usage, device and security data:IP address, browser and device details, sign-in events and server logs. Requests from AI assistants connected to INFIOO are logged without their content: which tool was called, when, and the client's user agent and origin.
• Website analytics: only if you accept analytics cookies on infioo.com. Some of our pages load their typeface from Google Fonts, which receives your IP address — see Cookies.
• Referrals:if you arrive through a referral link, we record the referral code, a keyed hash of your IP address, your browser's user agent and the page you came from, to credit the referral and detect fraud. The code travels in the link; we set no cookie for it.
• Desktop app: the Windows app checks for updates by contacting Google Cloud Storage, which sees your IP address and the app version. The desktop app sends no telemetry.

This data comes from you, from the workspace owner who invited you, from Google when you sign in with it, and from Stripe about the status of your payments.

5. Workspace Data we process for you

Contacts (names, phone numbers, email addresses, addresses, notes, tags), conversations and messages (SMS, WhatsApp, email), call transcripts, appointments, jobs, quotes, invoices, payments, expenses, payroll records, reviews, knowledge entries, your team's conversations with Fioo, and what your connected tools send (section 9). Photos you send Fioo are passed to the AI model for that request and are not stored.

6. What we use data for, and our legal bases

For the EEA, the UK and Switzerland, the right-hand column gives the legal basis. For Workspace Data our basis is your instruction as controller.

7. AI processing

Fioo understands requests, drafts replies, quotes and invoices, and answers questions about your business using AI models from Google (Gemini, through Vertex AI), Anthropic (Claude) and OpenAI (GPT). Each request carries only what that task needs. If one provider is unavailable or returns an unusable answer, the same request can go to the next. All three process it under business terms that bar them from training their models on it, and INFIOO trains no models of its own on your data.

AI output can be wrong. If something INFIOO or Fioo says about you is inaccurate, correct it in INFIOO or tell us. No decision with legal or similarly significant effects on you is made by solely automated means. Exactly what Fioo sees, remembers and may do on its own is set out in How Fioo uses data.

8. Google user data

You can connect your Google account for three things. INFIOO accesses only what each needs, and only after you choose to connect it. This is also published on its own as our Google API disclosure.

How we handle Google user data

• We use it only to provide the features above, which you can see and control in INFIOO, and we connect each one only when you choose to.
• We transfer it only to provide those features — to Google Cloud, where INFIOO runs, and, as free time slots, to our AI providers and to AI assistants you connect — or for security, to comply with the law, or as part of a merger, acquisition or sale of assets with your explicit prior consent.
• No one at INFIOO reads it unless you ask us to for a specific item, it is needed for security (such as investigating abuse), the law requires it, or it is aggregated and anonymised for internal operations.
• We never sell it, transfer it to advertising platforms, data brokers or information resellers, use it for advertising of any kind (including retargeting, personalised or interest-based ads), or use it to judge creditworthiness or for lending.
• It is encrypted in transit; Gmail and Google Calendar tokens are encrypted (AES-256-GCM) in INFIOO's database in Frankfurt.
• Revoking and deleting:Settings → Connections → Disconnect revokes INFIOO's access at Google and deletes the tokens and connection details we hold. You can also remove INFIOO in your Google Account permissions. Deleting your business removes everything else.
• Our use follows the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy.

Limited Use. INFIOO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

AI and machine learning. INFIOO does not use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized AI or machine-learning models, and the AI providers that process requests for INFIOO are contractually prohibited from using it to train or improve their models.

9. Data from other services you connect

The tools you connect — your accounting software, calendar, CRM, payment provider or WhatsApp Business account — are your own accounts with those companies. Their terms and privacy notices govern their side. INFIOO sends and takes only what the connection exists for:

INFIOO connects each tool through its own registered app with that tool, so no connection provider sits in between. Access tokens are kept encrypted (AES-256-GCM) in INFIOO's database in Frankfurt. When you disconnect a tool, INFIOO deletes the access it holds and, where the vendor offers it (Google, Xero, QuickBooks), also revokes the access at the vendor.

10. AI assistants you connect to INFIOO

INFIOO's connector lets you use INFIOO from AI assistants such as Claude, ChatGPT, Gemini, Grok, Le Chat or Perplexity. When you connect one, you sign in to INFIOO and choose its permissions: reading your records, and making reversible changes (creating tasks and contacts, tagging customers, drafting replies, marking appointments done). Access tokens last 15 minutes; the assistant can renew them, and its access lapses after 30 days without use.

• What a tool returns — for example customer names, messages or amounts — becomes part of your conversation with that assistant and is handled under that provider's terms and your account settings there. Some consumer plans use conversations to train models unless you opt out; business plans generally do not.
• An assistant can also hand Fioo a job. Fioo's answer, which can include free time slots computed partly from your Google Calendar, goes back to the assistant. Anything that would message a customer, book, quote or invoice waits for your approval in INFIOO; public posts, payments, syncs to your other tools and settings changes are not available through the connector at all.
• We log connector requests without their content, as described in section 4.
• Disconnect any assistant in Settings → Connections → Connected assistants.

11. Who we share data with

• Our service providers, under contract and only for the purposes above — listed with their locations on the subprocessor page.
• The tools and AI assistants you connect, at your direction (sections 9 and 10).
• People in your workspace, according to their role. The workspace owner can export the whole workspace, including team members' conversations with Fioo.
• US text-message registration: to register a business for texting in the US, its business details go through our telephony provider to The Campaign Registry and the mobile carriers.
• Stripe collects identity and bank details directly from businesses that take card payments, as its own controller.
• Browser notifications:if you turn them on, encrypted notifications pass through your browser's push service (for example Google, Mozilla or Apple).
• Authorities and courts, where the law requires it or to protect rights and safety. We tell you about requests for your Workspace Data unless we are not allowed to.
• A buyer or successor.If INFIOO's business or its operator changes hands — a merger, acquisition, asset sale or change of ownership — your data passes with it under this notice. We tell you beforehand, and for Google user data we ask you first.

We do not sell personal information, share it for cross-context behavioural advertising, or show advertising. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

12. Where data is processed, and international transfers

• Workspace database: Frankfurt, Germany (Google Cloud).
• App servers: Singapore (Google Cloud), which process data in transit.
• Sign-in: United States (Google Firebase Authentication).
• AI models: United States and Google's global infrastructure.
• Other providers: as listed on the subprocessor page — mainly the United States, also Ireland and Germany.

Transfers out of the EEA, the UK and Switzerland use the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss amendments), or the EU–U.S. Data Privacy Framework where the recipient is certified. Ask us for a copy of the relevant safeguards. If you are in Canada, your data may be processed outside Canada and be accessible to authorities there under local law.

13. How long we keep data

14. Security

• Data is encrypted in transit, and at rest by our hosting provider.
• Access tokens for the tools you connect are encrypted with AES-256-GCM, with the key held in Google Secret Manager. API keys are stored only as hashes.
• Each business's data is isolated by database rules, and access inside a workspace depends on role (owner, manager, staff, accountant).
• Customer messages are passed to AI models as fenced data, never as instructions, and anything Fioo drafts is checked against your own records before it can go out on its own — our protection against prompt injection.
• Actions involving money or public posts wait for approval unless the workspace owner has deliberately allowed them, and requests are rate-limited.

No system is perfectly secure. If a breach affects your data, we tell you and the authorities as the law requires.

15. Your controls

• Export your whole workspace as JSON: Settings → Data & privacy.
• Delete a customer and their conversations: Customers.
• Delete your business: Settings → Data & privacy.
• Disconnect any tool or AI assistant: Settings → Connections.
• Decide what Fioo may do on its own, or pause it: Fioo's team.
• Change your cookie choice on infioo.com: "Cookie settings" in the footer.
• Stop marketing email from us: the unsubscribe link, or write to us.

16. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your data, to restrict or object to its use, and to withdraw consent at any time. Write to hello@infioo.com; we may need to confirm your identity, and we answer within one month (45 days under US state laws). In the US you can use an authorised agent and appeal a refusal by replying to our answer. We never treat you differently for using your rights.

Complaints

Tell us first if you can: write to hello@infioo.com with "Privacy complaint" in the subject. We acknowledge within 30 days, look into it, and tell you the outcome. You can also complain to a data protection authority: in the EU, the authority where you live or work; in the UK, the Information Commissioner's Office; in Switzerland, the FDPIC; in Canada, the Office of the Privacy Commissioner (in Québec, the Commission d'accès à l'information); in Australia, the OAIC; in New Zealand, the Office of the Privacy Commissioner.

17. Region-specific information

EEA, UK and Switzerland

Our representatives are named in section 1, the legal bases are in section 6 and the transfer safeguards in section 12. Swiss data may go to the United States, Singapore, Germany and Ireland.

United States

In the last 12 months we collected identifiers (name, email address, IP address), customer records and commercial information (your plan and billing status), internet and device activity, approximate location derived from IP addresses, professional information (your business details) and account log-in credentials — from the sources and for the purposes in sections 4 and 6, kept as in section 13. We disclose them to service providers for those business purposes only. We do not sell or share personal information for cross-context behavioural advertising, and we use sensitive information only to provide INFIOO. You can ask to know, delete or correct your information. Our websites do not respond to Do Not Track signals because we do not track you across other sites; we treat a Global Privacy Control signal as an opt-out request. For Workspace Data we act as your service provider under the data processing addendum.

Canada, including Québec

Our Privacy Officer is the person in charge of the protection of personal information: hello@infioo.com. Data may be processed outside Canada and Québec, as described in section 12.

Australia and New Zealand

We may disclose personal information to recipients in the United States, Singapore, Germany and Ireland. Our privacy officer for New Zealand is reachable at hello@infioo.com.

18. Text messages

Texts that businesses send their customers through INFIOO come from those businesses. Message frequency varies with the conversation, and message and data rates may apply. Replying STOP stops further texts from that business; the customer receives one confirmation. How we handle mobile numbers and text-messaging consent is covered in section 11.

19. Voice

When you talk to Fioo in the app, your browser's built-in speech recognition turns your voice into text, and its built-in voice reads answers aloud. Depending on your browser, this may send your audio to the browser's maker (for example Google for Chrome) to be transcribed; INFIOO receives only the text. You can always type instead. Calls to a business's INFIOO number are covered in section 3.

20. Children

INFIOO is a service for businesses, used by adults. It is not directed at children, and we do not knowingly collect children's data.

21. Other websites

INFIOO links to and connects with other companies' services. Their own privacy notices apply to what happens there.

22. Changes to this notice

When we change this notice materially, we tell account owners by email or in the app before the change takes effect, normally 30 days ahead. We will not use Google user data in a new way without asking you first. The version date is at the top of this page.

23. Contact

hello@infioo.com — or by post, at the address in the legal notice.

Changes to this document

• 26 October 2026: Every connection now runs on INFIOO's own registered app with each tool, so the sign-in screen names INFIOO and no connection provider sits in between. Nango is no longer used and leaves the subprocessor list; access tokens are kept encrypted in INFIOO's own database in Frankfurt and deleted when you disconnect. Nothing changes in what each connection reads or does.
• 25 October 2026: More connections now run through Nango, our connection provider: Outlook, Google Calendar, Outlook Calendar, HubSpot, Pipedrive, Zoho CRM, Square, Mailchimp and Constant Contact join Gmail, Calendly and Acuity. Nango holds their access tokens; Google Calendar tokens move there from INFIOO's own database. Nothing changes in what each connection reads or does.
• 6 October 2026: One set of documents for the INFIOO software, replacing the older website-services terms. Adds the data processing addendum, the Google API disclosure, How Fioo uses data, acceptable use, cookies, switching and export, and the illegal-content report route; the subprocessor list now names every provider and where it processes data.