Version 2026-10-20.
The owner of the INFINITY project ("we") is the controller of personal data of members at infinityart.st. Data questions go through the cabinet's Support section.
1. What is processed
- Account data: login, email address, password and financial password hashes, language, Telegram identifier when linked, the inviter's login.
- Payment data: amounts, dates, order and refund statuses, payment system identifiers. We do not receive card details.
- Course and community data: step reports and uploaded files, works, reviews, comments, chat and support messages, questions to the assistant.
- Partner programme data: invitation structure, rewards, withdrawal requests and the details given in them.
- Technical data: IP address, device and browser, request times, error logs.
2. Purposes and grounds
Performance of the contract (access, course, payment, partner programme, support); security and abuse prevention; legal obligations (accounting, responses to authorities); improvement of the Service on anonymised metrics. Marketing emails only with consent, unsubscribe in each.
3. Recipients
Processors on our instructions: payment systems (amount and payment data), file storage, AI Studio (login, language and the volume of transferred tokens; the content of your generations is processed by it under its own policy), the email notification service, Telegram (notifications and support through the bot), the error monitoring service without message content. Authorities, upon a lawful request. Data is not sold.
4. Retention
Account and payment data — while the account exists and afterwards for the periods set by law for accounting records. Report and work files — until deleted by you or with the account; published works and reviews — until unpublished. Chat history — within the paid periods of the service. Technical logs — up to 12 months.
5. Your rights
Access to data, correction and change of login and email in settings; a copy of your data; deletion of the account via support (executed within 30 days, financial records kept for the statutory periods); withdrawal of consent to mailings; a complaint to the supervisory authority. Requests go through support from your own account.
6. Protection
Passwords are stored as hashes (argon2id), sessions as token hashes, files are available only via signed links of limited duration, course video is protected by an access key, staff access is role-based with a second factor and an address allowlist, and actions are logged. A staff member opening a member's cabinet to handle a request sees no passwords and cannot make transfers: those are locked by the member's financial password.
7. Cookies
Technical only: session, language, theme, the referral code of the invitation for 30 days. No advertising or analytics cookies.
8. Children
The Service is for persons over 18; a child's data is deleted upon request.
9. Changes
A new version is published here with its date; material changes are announced in the cabinet.