Privacy Policy · nfinit

1. Who we are

Moayyad Shahid (“Nfinit”, “we”, “us”), based in Toronto, Ontario, Canada, runs the Nfinit website and studio and is responsible for your personal data. This policy is part of our Terms of Service.

Our privacy officer, Moayyad Shahid, is accountable for how we handle personal data. Contact our privacy officer at muayyad.shahid1@gmail.com.

2. What we collect

Data you give us

Account data: when you sign in with Google, we receive your name, email address, profile picture and a Google account ID.
Your content: the prompts you type, images you attach, faces you select and code you edit. We also keep what the Service makes for you: the design plan, the CAD code, the 3D part files, a preview image and the history of each project.
Messages to us: what you write when you email us.

Data we create when you use Nfinit

Run records: each time the AI builds a part, we record the request, the model used, the steps it took, the time they took, the number of AI tokens used and the cost.
Subscription data: your Stripe customer ID, subscription status and renewal date. We do not receive or keep your full card number.
Technical data: our hosting providers record technical logs, such as IP address, browser type, the pages and actions requested, times and errors. We use them to keep the Service working and secure.

Data stored in your browser

We use only the cookies and browser storage that the Service needs to work:

sign-in cookies, which keep you signed in;
your light or dark theme choice;
the last project you opened, and a run in progress, so a reload can continue it;
an action you started before checkout, so it can finish after you pay.

We do not use advertising cookies, analytics trackers or social media pixels.

3. How we use your data

to sign you in and run your account;
to generate, build, store and export your parts;
to process payments and manage your subscription;
to find and fix errors, measure speed and cost, and prevent abuse;
to answer your messages and send important notices about the Service; and
to obey the law and protect our rights.

We send you only emails about your account and the Service, such as receipts and notices of changes. We do not send marketing emails unless you agree to receive them, and you can stop them at any time.

We do not sell your personal data. We do not show ads. We do not use your content to train AI models. If we ever want to use your content to improve the Service in a new way, we will ask for your permission first, and you can say no.

4. Who receives your data

We share personal data only with the service providers below, and only to run Nfinit. They process it for us under their own terms and privacy policies.

Supabase: Database and sign-in.
Receives: Your account details, projects, chat history, runs and subscription status.
Google: Sign-in with your Google account.
Receives: That you sign in to Nfinit. Google then sends us your name, email address and profile picture.
OpenRouter: Sends your requests to the AI model.
Receives: Your prompts, attached images, the current code of your part and the face you selected.
Anthropic: Claude AI models that write the CAD code.
Receives: The same data that OpenRouter receives, through OpenRouter.
Stripe: Payments and receipts.
Receives: Your email address, card details and the billing details you enter at checkout.
LangFuse (only if enabled): Measures the speed, cost and errors of AI runs.
Receives: Run IDs, step timings, token counts, costs and short fingerprints; never your prompts, images or code.
Pinecone (only if enabled): Finds CAD code examples that match your request.
Receives: The text of your latest request.
Vercel: Hosts the website.
Receives: Technical data such as IP address and pages requested.
Railway: Hosts the servers that build your parts.
Receives: Your requests to the servers, and technical data such as IP address.

If we add a service that receives your personal data, we will add it to this list before we use it. We can also share data when the law requires it, to protect people’s safety or our rights, or as part of a sale or transfer of the Service. In a transfer, this policy continues to apply to your data.

5. Consent and legal bases

When you create an account and use Nfinit, you consent to the collection, use and disclosure of your personal data as this policy describes. You can withdraw your consent at any time by deleting your account. We cannot run the Service for you without the data it needs.

Where EU or UK data protection law applies, we use your data because:

it is necessary to provide the Service you asked for, under our contract with you (account, parts, payments);
we have a legitimate interest in keeping the Service secure, fixing errors and preventing abuse;
the law requires it (for example, tax records); or
you gave consent, which you can withdraw at any time.

6. Where your data is processed

We are in Canada, but we and our service providers store and process your data in the United States and possibly in other countries. While your data is in another country, it is subject to that country’s laws, and its courts, police and government can get access to it under those laws.

We choose service providers that protect personal data, and we use their contracts to require that protection. When we transfer personal data from the EU or the UK, we rely on the safeguards that our providers offer, such as the European Commission’s Standard Contractual Clauses.

7. How long we keep your data

Projects: until you delete the project or your account. When you delete a project, we delete its history, part files and preview image.
Account data and run records: while your account is open.
Build previews: the previews shown while a part builds stay in server memory for a short time and are not saved.
Account deletion: when you select Delete account on the Account page, we cancel your subscription and delete your account and all your data at once. If you ask by email instead, we do this within 30 days. Copies in backups are deleted when the backups expire.
Payment and tax records: Stripe and we keep these for as long as tax and accounting laws require, even after you close your account.
Technical logs: for the short period our hosting providers keep them.

8. Your rights and choices

You can ask us to:

tell you what personal data we have about you and give you a copy;
correct data that is wrong;
delete your data or your account;
give you your data in a format that you can move to another service; and
stop or limit some uses of your data, or withdraw consent.

Email our privacy officer at muayyad.shahid1@gmail.com from the email address of your account. We answer within 30 days. We may ask for more information to confirm that the request comes from you. We will not treat you differently because you used these rights.

You can do some of this yourself: delete a project in the studio, cancel your subscription with Manage billing, and delete your account, both on the Account page.

Complaints: if you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec, you can also contact the Commission d’accès à l’information du Québec. If you live in the EU or the UK, you can complain to your data protection authority.

California residents: we do not sell or share your personal information for cross-context behavioral advertising. Sections 2 to 4 list the categories of personal information we collect, where they come from, why we use them and who receives them. You have the rights listed above.

Do Not Track: we do not track you across other websites, so we do not change anything when your browser sends a Do Not Track signal.

9. Security

We use encrypted connections (HTTPS), database rules that let each user read only their own data, and an isolated sandbox for the code that builds your parts. No system is perfectly secure. If a breach of our security creates a real risk of significant harm to you, we will tell you as soon as possible, report it to the Office of the Privacy Commissioner of Canada, and inform other authorities as the law requires. We keep a record of every breach.

10. Children

Nfinit is not for children under 13. We do not knowingly collect personal data from children under 13. If you think a child under 13 has given us personal data, email us and we will delete it.

11. Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change is important, we will tell you by email or in the studio before it applies.

12. Contact

Moayyad Shahid, privacy officer
Toronto, Ontario, Canada
Email: muayyad.shahid1@gmail.com