Privacy Policy

1. Who we are

Infinity Mirror Ltd is a private limited company registered in England and Wales (Company No. 17047263), with its registered office at 101 New Cavendish Street, 1st Floor South, London, W1W 6XH, United Kingdom. You can reach us about privacy at admin@infinitymirror.org.

2. Information we collect

• Account data — your email address and authentication identifiers. If you sign in with Google, we receive the basic profile information that sign-in provides.
• Content you create — the topics, prompts, messages, participant and persona configurations, debates, and beliefs you generate while using the Service.
• Subscription data — your plan, status, and billing period. Card and payment details are collected and stored by our payments provider, not by us (see Section 5).
• Usage and technical data — log data, approximate location derived from IP address, device and browser information, and similar diagnostics, including data used to protect the Service from abuse.

3. How we use your data and our legal bases

• To provide and operate the Service, including generating AI responses — performance of a contract.
• To process subscriptions and prevent fraud and abuse — contract and our legitimate interests in running a secure service.
• To maintain, secure, and improve the Service and understand usage — legitimate interests.
• To comply with legal obligations — legal obligation.
• For any optional communications or analytics that require it — consent, which you may withdraw at any time.

4. AI processing of your content

Infinity Mirror is an AI service. The topics, prompts, and messages you submit are sent to our AI model provider, Anthropic, to generate responses. We do not use your content to train our own models. Anthropic processes this content under its own terms and does not train its models on data submitted through its commercial API.

5. Service providers and sharing

We share personal data only with service providers who process it on our behalf under appropriate agreements:

• Supabase — authentication and database hosting.
• Anthropic — AI model processing.
• Lemon Squeezy — payments and subscription billing (Merchant of Record).
• Vercel — application hosting and analytics.
• Cloudflare — bot and abuse protection.
• Upstash — rate limiting.

We do not sell your personal data. We may disclose data where required by law or to protect our rights, users, or the Service.

6. International transfers

Some of our providers are located outside the United Kingdom. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or transfers to jurisdictions deemed adequate.

7. Data retention

We keep your account data and content for as long as your account is active. If you delete content or close your account, we delete or anonymise the associated personal data within a reasonable period, except where we must retain it to meet legal, accounting, or security obligations.

8. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability; and
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at admin@infinitymirror.org. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

9. Cookies

We use cookies and similar technologies that are necessary to sign you in and keep the Service secure, and limited analytics to understand usage. You can control non-essential cookies through your browser settings.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and per-user data isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you.

13. Contact us

Questions about this policy or your data? Email us at admin@infinitymirror.org or write to Infinity Mirror Ltd, 101 New Cavendish Street, 1st Floor South, London, W1W 6XH, United Kingdom.