Privacy policy

Infravite is the controller for site visitors and the accounts it administers. In a client's workspace (fund or corporate), the client is the controller for its investors', borrowers' and counterparties' data, and Infravite acts as processor under Article 28 GDPR.

Accounts: name, work email, role, sign-in log and, for two-factor authentication, an encrypted authenticator key (no phone number). Files loaded by the client: transaction and borrower data, documents and KYC files. Site forms: name, email, organisation and message of contact or demo requests. Technical logs: IP address, browser and audit trail of changes.

The Infravite Agent is an artificial-intelligence assistant. By default it runs entirely on the platform: it reads the open file through the platform's own engine and composes answers from the computed figures; no question, file or figure is sent to any AI provider. Optional local AI: a user may switch on "Enable local AI". A small open-source language model (Qwen3) then runs inside that user's browser, on their own GPU (WebGPU). Only the model weights are downloaded, once, from the public web-llm CDN (Hugging Face) and kept in the browser cache; that download carries no user data. The model's tool requests are executed on the platform with the user's own rights, and every figure in its answer is checked against the platform's results before it is kept. An external language-model provider is used only if the operator enables it explicitly in a data processing agreement; it is off by default.

Providing the service (contract, Art. 6(1)(b)); access security, two-factor authentication, fraud prevention and audit trail (legitimate interest, Art. 6(1)(f)); answering contact and demo requests (pre-contractual steps, Art. 6(1)(b)); AML and KYC retention where the client is subject to it (legal obligation, Art. 6(1)(c)).

Accounts: term of the contract plus 12 months. Contact or demo requests: 3 years after the last exchange. Audit trail: 10 years by default, or the period set by the client as controller, never below 5 years. KYC files: the period required by the rules that apply to the client.

Application: Vercel Inc., functions run in the Frankfurt region (EU). Managed database in the EU: Neon Postgres in Frankfurt (aws-eu-central-1), in place. Scheduled logical backups go to private Tigris object storage restricted to Frankfurt (fra). No AI provider receives data by default; the optional local AI runs in the user's browser and only downloads model weights from Hugging Face's public CDN. An external language-model provider, if the operator ever enables one, is named in the data processing agreement. Any access from outside the EEA relies on the EU standard contractual clauses.

Named accounts, app-based two-factor authentication (TOTP) available on every account, made mandatory once the production database is live, data isolated per client workspace, encryption in transit, audit trail of changes.

Access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority (the CNIL in France). For data in a client workspace, contact the client first. Otherwise, write to us through the Contact page.

Strictly necessary cookies only: session, language preference, demo role and, for admins, the assumed role. No analytics or advertising cookies, so no consent banner.