Privacy Policy
Last updated: March 22, 2026
This Privacy Policy describes how InfinityOS collects, uses, discloses, and safeguards personal data in connection with our websites, applications, APIs, and related services (collectively, the "Services"). It also explains individual rights and choices regarding personal data.
1. Scope and Roles
InfinityOS may act as a controller for business contact and account data, and as a processor or service provider when processing customer-submitted data under customer instructions. Where InfinityOS acts as a processor, data processing terms in the applicable agreement govern such processing. This Policy is intended to align with the legal framework of the Democratic Socialist Republic of Sri Lanka, including the Personal Data Protection Act, No. 9 of 2022 (\"Sri Lanka PDPA\"), as and when applicable provisions are in force.
2. Categories of Data We Collect
We collect information directly from users, from customer administrators, and automatically through use of the Services. Categories include: identity and contact details, account credentials and security events, device and usage telemetry, support communications, billing and transaction details, and customer content submitted to the platform.
3. Legal Bases for Processing
Where required by law, we process personal data based on one or more legal bases: performance of a contract, legitimate interests (for security, product operations, and service improvement), legal compliance obligations, and consent where applicable. For Sri Lanka-based data subjects and processing activities subject to the Sri Lanka PDPA, InfinityOS seeks to process personal data on lawful grounds recognized under that Act and related implementing regulations.
4. How We Use Personal Data
We use personal data to provide and maintain the Services; authenticate users; secure systems; prevent fraud and abuse; process transactions; provide customer support; communicate product and policy updates; and perform analytics to improve product functionality, reliability, and user experience.
5. AI and Automated Processing
InfinityOS may use automated systems and AI-assisted processing to deliver features such as recommendations, classification, summarization, and workflow optimization. Such processing is designed to support operational decision-making and may require human review depending on customer configuration and regulatory context.
6. Cookies and Similar Technologies
We use essential cookies and similar technologies for session management, security, and service functionality. Where legally required, we request consent for non-essential analytics or preference technologies and provide relevant controls.
7. Sharing and Disclosure
We do not sell personal information. We may disclose personal data to: (a) service providers and subprocessors under contractual confidentiality and security obligations; (b) professional advisors; (c) competent authorities where required by law; and (d) relevant parties in connection with a merger, acquisition, or corporate reorganization subject to appropriate safeguards.
8. International Transfers
Where personal data is transferred across borders, InfinityOS uses legally recognized transfer mechanisms and supplementary safeguards appropriate to the destination jurisdiction and data sensitivity. For processing subject to Sri Lanka law, cross-border transfers are handled in a manner intended to satisfy Sri Lanka PDPA transfer requirements, including contractual protections and risk-based safeguards.
9. Data Security Measures
We maintain administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include access controls, encryption in transit, monitoring, and incident response processes aligned with risk.
10. Retention and Deletion
We retain personal data only as long as necessary for business and legal purposes, including contractual commitments, legitimate business operations, dispute resolution, and compliance obligations. Data is deleted or de-identified when no longer required, subject to lawful exceptions.
11. Individual Rights and Choices
Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to processing, data portability, and withdraw consent. For Sri Lanka data subjects, InfinityOS intends to honor data subject rights provided under the Sri Lanka PDPA, subject to statutory limitations and exemptions. To exercise rights, contact us using the details below. We may verify identity before processing requests and may deny requests where legally permitted.
12. Children's Privacy
The Services are intended for business use and are not directed to children. We do not knowingly collect personal data from children where prohibited by law.
13. Updates to This Policy
We may revise this Privacy Policy from time to time. If material changes are made, we will publish an updated version with a revised effective date and provide additional notice where required by law.
14. Contact and Complaints
For privacy inquiries, rights requests, or complaints, contact [email protected]. Where applicable, you may also have the right to lodge a complaint with the competent data protection regulator in Sri Lanka or another supervisory authority in your jurisdiction.