Privacy Policy
Effective October 27, 2026
This policy explains how Marcos Morris (“we”) handles personal information when you visit our website, use our customer portal or buy our managed SRE, DevOps and cloud security services (the “Service”). We do not sell or share personal information, and we do not use it for targeted advertising.
1. Information we collect
The table below is our notice at collection: what we collect, where it comes from and how long we keep it.
| Category | Examples | Source | Retention |
|---|---|---|---|
| Identifiers and contact details | Name, work email, phone, job title, company | You, when you sign up, request a health check or contact us | 24 months after last contact for leads; life of the account plus 30 days for users |
| Account and organization records | Organization name, address, team members and roles, consent records | You and your team | Life of the account; consent and renewal records 3 years |
| Commercial information | Plans purchased and invoices | You and Stripe | 7 years (tax and accounting records) |
| Cloud configuration metadata | Resource names, settings, IAM bindings, scan findings | Your cloud accounts, through the read-only access you grant | 12 months after the scan |
| Cloud billing data | Daily cost per cloud service, budgets, provider savings recommendations | Your billing export or cost APIs, with the read access you grant | 400 days |
| Monitoring and incident data | Uptime check results, alerts you send us, incident timelines | Our uptime checks and your monitoring tools | Check results 35 days; incidents for the life of the account |
| Internet activity | IP address, browser type, pages requested, security logs | Your browser | 30 days (server and firewall logs); audit records 24 months |
| Sensitive personal information | We do not intentionally collect it. Account passwords are handled by Google Identity Platform; we never see them | Not applicable | Not applicable |
We do not receive or store full payment card numbers. Stripe collects them directly on its checkout page.
2. How we use it
- To provide the Service: run scans you authorize, produce reports and deliverables, respond to incidents and send alerts.
- To manage accounts, billing, renewal reminders and support.
- To secure the Service: detect abuse, keep audit records and investigate incidents.
- To send product and marketing email only if you opted in. Every marketing email has a one-click unsubscribe link.
- To meet legal obligations, such as tax records and responses to valid legal process.
3. AI processing
We use AI models from Anthropic to explain findings in plain language, draft remediation steps and check deliverables against our published quality checklists. Before any data is sent, our scanner removes credentials, tokens, keys and personal data it can detect from the results.
Anthropic processes this data under commercial terms that prohibit training its models on it. AI output is checked by a separate AI review against a published checklist before it reaches you, and automatic remediation runs only actions you allowed; we do not use AI to make decisions that produce legal or similarly significant effects about individuals.
4. When we disclose information
We disclose personal information only to:
- Service providers that process it on our behalf under written contracts. See our subprocessor list; current providers are Google LLC (Google Cloud), Stripe, Inc., Anthropic, PBC.
- Your organization: owners and admins of your organization can see team members and activity in the audit log.
- Authorities, when required by law or to protect rights, safety and security.
- A successor in a merger, acquisition or sale of assets, subject to this policy.
In the past 12 months we have not sold personal information, shared it for cross-context behavioral advertising, or used it for targeted advertising or profiling.
5. Cookies and Global Privacy Control
We use only strictly necessary cookies: a session cookie that keeps you signed in, and a cookie that remembers which organization you selected. We do not use analytics, advertising or third-party tracking cookies.
We honor the Global Privacy Control (GPC) signal as a valid request to opt out of sale, sharing and targeted advertising, even though we do not do any of these.
6. Data we process for business customers
When we scan or operate your cloud accounts, we act as your service provider (processor) for the data in those accounts. That processing is governed by your agreement with us and our Data Processing Addendum, not by this policy. If you are an end user of one of our customers, please contact that customer about your data.
7. Your privacy rights
Depending on your state of residence, including California, Colorado, Connecticut, Virginia, Texas, Oregon and the other states with comprehensive privacy laws, you may have the right to:
- Know and access the personal information we hold about you, and get a portable copy.
- Correct inaccurate personal information.
- Delete personal information, subject to legal exceptions such as tax records.
- Opt out of sale, sharing, targeted advertising and profiling. We do none of these.
- Appeal our decision on your request. If we deny an appeal, you can contact your state attorney general.
- Not be discriminated against for exercising these rights.
How to make a request. Use our privacy request form or email privacy@infrascanai.com. Signed-in users can also export or delete their account from Settings in the portal. We confirm receipt within 10 business days and respond within 45 days; if we need more time (up to another 45 days), we will tell you why.
Verification. We confirm requests by sending a link to the email address on the request. We will not ask for more information than needed to verify you. An authorized agent may submit a request with your signed permission; we may ask you to confirm it directly.
8. Security
Data is encrypted in transit with TLS and at rest. Production systems run on Google Cloud with private databases, workload identity instead of stored keys, signed container images, network policies, a web application firewall and an append-only audit log. Access by our staff is limited to what the Service requires. No system is perfectly secure; if a breach affects your personal information, we will notify you as the law requires.
9. Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.
10. Where we process data
We offer the Service to businesses in the United States, and we store and process data in the United States.
11. Changes to this policy
If we make material changes, we will post the new version here with a new effective date and notify account owners by email at least 30 days before the change applies to them.
12. Contact us
Marcos Morris, Bentonville, Arkansas. Contact: privacy@infrascanai.com.