Privacy Policy

1. Who we are (data controller)

Infinity Platform is the data controller for personal data processed through this platform. Use our contact form for any privacy-related questions or requests.

2. What data we collect and why

• Account data: Name and email address — to create your account and send transactional emails (verification, deletion confirmation). Lawful basis: performance of a contract.
• Module progress data: Data you enter in the learning modules — saving and investing amounts, habit names, descriptions, completion dates, and notes — to provide the modules and track your progress. Lawful basis: performance of a contract.
• Quiz responses: Quiz answers you submit. For logged-in users, results are stored with your account to track progress and prevent duplicate submissions. Lawful basis: legitimate interest.
• Buddy accountability data: If you use the peer verification feature, we store the connection between you and your accountability partner and verification records. Lawful basis: performance of a contract.
• Reading progress: Scroll-based reading progress (0–100%) per module, stored to show how far you have read. Lawful basis: performance of a contract.
• Newsletter subscription: Email address — only if you explicitly subscribe. Lawful basis: consent. You can unsubscribe at any time.
• Usage data: Basic server logs (IP address, request time) retained by our hosting provider Vercel for up to 30 days for security purposes. Lawful basis: legitimate interest.

3. Who we share data with

We do not sell your data. We use the following sub-processors to operate the platform:

• Turso (ChiselStrike): Database hosting. Data stored in EU (Frankfurt). gdpr.turso.tech
• Resend: Transactional email delivery. Processes email addresses to send verification and notification emails.
• Vercel: Website hosting and serverless functions. Processes requests from your browser.
• Upstash: Rate limiting. Processes hashed (one-way) IP addresses to prevent abuse. No identifiable personal data is stored.

4. How long we keep your data

We keep your data for as long as your account exists. When you delete your account, all personal data is permanently deleted immediately, including your account record, all module progress, history, habits, and quiz responses. Server logs managed by Vercel are retained for up to 30 days.

5. Your rights

Under GDPR you have the following rights. To exercise any of them, use the contact form or the tools on your profile page.

• Right of access: Request a copy of all data we hold about you. Use the "Download my data" button on your profile page.
• Right to erasure: Delete your account and all data using the "Delete account" button on your profile page.
• Right to portability: Download your data in machine-readable JSON format via your profile page.
• Right to rectification: Correct your name or email address via your profile page.
• Right to restriction / objection: Contact us via the contact form to restrict or object to processing of your data.
• Right to withdraw consent: Unsubscribe from the newsletter at any time using the unsubscribe link in any email.

6. Cookies

We use a single session cookie to keep you logged in. We do not use advertising cookies or third-party tracking cookies. No cookie consent banner is required.

7. Security

Passwords are hashed using bcrypt. Data is transmitted over TLS. Database access is restricted to the application. We notify affected users and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of a personal data breach.

8. Complaints

If you believe we are not handling your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.

9. Changes to this policy

We will update this page if our practices change and update the "last updated" date above. Continued use of the platform after changes constitutes acceptance.