Infragrowth AI app — Privacy Policy

Last updated: November 6, 2026 · Versión en español

This page explains what data we process when a business connects its WhatsApp Business account or its Google Calendar to the Infragrowth AI app: what we use it for, where it is stored, who we share it with, how long we keep it and how to ask us to delete it. It covers only this service and the data that goes through that app.

Hosted Panorama: how this service differs

The Infragrowth AI app also supports hosted Panorama, which runs on our infrastructure. This differs from custom development in a customer's own accounts. This section explains Panorama; the later sections identified as custom development retain that service's terms. Coexistence lets you keep using the same number in the WhatsApp Business phone app if Meta considers it eligible. We do not currently offer this mode to health or finance businesses. The company and contact address are the same: Infragrowth AI LLC, registered in New Mexico, United States; hola@infra-growth.com.

Where we store data. For Panorama, Cloudflare hosts contacts, conversations, synced history, agent settings and operating records. We also store the permissions you grant external assistants and the content needed to review their proposed operations. Meta and AI-provider keys are encrypted on the server. Supabase manages login accounts, sessions, business memberships and assistant-connection registration. Different businesses share infrastructure with access controls per business; we do not create a database in your account. Account-access emails and operational notices to the business owner are sent through Resend. These notices report when the AI agent stops responding or a flow generates a notice, and are sent to the email address the owner uses to sign in. They contain no contacts’ names, phone numbers or messages. We use this data to provide the Panorama functions you authorize and resolve operating problems. We do not sell it or use it for advertising or to train our own models.

Panorama's agent and copilot. You can view the initial guide without an AI key. To test the agent and chat with the copilot, enter your own Anthropic API key in «Conectar». Tests and requests may consume credit from that account; Panorama does not include it. The provider receives the information needed for that request or conversation and the agent's settings. Syncing contacts and history from your phone does not add them to the history used to generate agent replies. Connecting WhatsApp or saving a key does not activate replies: first test the saved version, then review and approve its activation. The initial test uses text; audio support on a demonstration number does not enable it for every business.

Connecting Claude Code or Codex. You authorize it with your account and choose permissions for that business and session. The assistant can receive results those permissions allow, such as contacts, chats, settings or exports. That data leaves Panorama for your chosen assistant and may reach your Anthropic or OpenAI account, depending on the product and settings you use. Before authorizing access, review that account's terms and settings to understand how it processes and retains the data. The assistant uses your own subscription or credentials; it does not run a second conversation through Panorama's copilot or fund the WhatsApp agent. Results do not include our infrastructure keys, your Meta or AI keys, or a client secret. Passwords, Meta consent, QR scanning and key entry are completed by you in the secure browser.

Retention, download and deletion. The panel reads up to 180 days of history. This limit does not mean older data has been deleted; general scheduled deletion is not enabled yet. Saved contacts, usage records and pending-operation records are handled separately. You can download available business data in parts; this is not a complete snapshot taken at one moment. Downloads exclude attachments, keys, global login data, backups and other providers' own records. To request deletion, email hola@infra-growth.com from your account's email address and identify the business. Do not send keys or conversations. This is an assisted operation for a closed business: its scope is confirmed before execution and the result is checked afterward. Minimal closure, usage and unconfirmed-operation information is retained, with personal fields reduced or replaced by operating identifiers. This does not make it anonymous. The details and exclusions are at legal.infragrowthai.com/data-deletion. We do not promise a new deadline or complete automatic deletion through the panel.

Revoking access and closing a business differ. Revoking an assistant's access prevents new access to Panorama by that session. It does not delete data already received or stop the WhatsApp agent by itself. Closing the business stops new local replies and revokes its operating permissions, while retaining data for download. It does not delete the login account or remove the Meta app. An operation already accepted by a provider may still complete. Neither action deletes data on your phone, in external assistants or with other providers.

Google Calendar

This part takes effect on 20 November 2026.

It applies to Infragrowth, the panel this page calls Hosted Panorama, and only if the owner of the business connects their Google account. They choose one calendar they own and the panel works only on that one. There are two separate connections, one for their schedule and one for their WhatsApp agent, and each is authorized on its own.

What we read from Google

• The list of calendars you own (name, time zone and identifier), so you can choose one.
• The busy times of the chosen calendar, to know when there is room.
• The events of the chosen calendar, to show them to you in Agenda and Reuniones: title, date and time, guests, and the Meet and event links. We do not request descriptions, locations or attachments. For a private event we show only its time.

What we do on your calendar

• We create an event when you confirm a meeting or a slot, when you approve a meeting your AI assistant proposed, when someone books on your booking page, or when your WhatsApp agent books a slot. If there is a guest, Google sends them the invitation. Meetings and bookings from your page carry a Meet link. Each event also carries an internal mark of ours, so we can recognize it later.
• If someone changes or cancels from your booking page, or you cancel that booking, we move or delete that same event, and Google tells the guest.
• We do not change or delete any other event on your calendar.

What we do not store

The events we read are shown at that moment and are not copied into our database. Nor do we store the comparison we make between guest addresses and your contacts to show you who is who. For your booking page, free times are reused for up to 30 seconds and stay in temporary memory until they are replaced or the server restarts.

What we store

• The key that lets us stay connected to your Google account (refresh token), encrypted, one per connection.
• The chosen calendar: its identifier, which may be your email address, its name, its time zone and your working hours.
• Each meeting or slot created from Infragrowth: title, date and time, calendar name, time zone, event identifier and, if there is a guest, their email address. The title of a slot booked by the agent carries the person's name and reason. That slot and its reason also stay on the contact's record, and your WhatsApp agent can read them.
• From your booking page, what the person booking fills in (name, email address, phone and answers), which campaign they came from, the Meet link and a fingerprint of their network that is erased after two days. That person also becomes a contact in your CRM.
• If you ask your AI assistant to propose a meeting, we store the proposal: title, date and time, duration and guest's email address. If you reject it or it expires, it is erased after one day. If you approve it, it stays like any other meeting. Proposals are not part of your data download.

Who we share it with

• Cloudflare hosts all of the above. Supabase manages your sign-in account and receives no calendar data.
• Your AI provider (OpenAI, Anthropic or OpenRouter, depending on what your business uses) and Meta, only if you turn the calendar on in a WhatsApp agent. The provider receives the free times and what the person says in order to book, such as their name and reason, plus your time zone and the slot's length; never the titles or guests of your events. Those times travel over WhatsApp and stay in the conversation, like the rest of the chat.
• The AI assistants you connect to your account do not read your events or your busy times. Depending on the permissions you give them, they see the bookings from your page with their Meet link, stored meetings with their title and guest, and whether a meeting they proposed was sent. With write permission they can check a booking at Google and, with your approval, cancel it. What they receive is subject to that assistant's terms.
• Anyone who opens your booking page sees your free times, and whoever books sees the Meet link.
• Only the owner of the business sees the events in Agenda and Reuniones. Whoever has the Integraciones permission sees your calendars, and whoever has the Contactos permission sees the bookings. Infragrowth staff do not read your Google data unless you ask us to, for security, or because a law requires it.

Meeting summaries

This meeting-summary section takes effect on 21 November 2026.

In addition to the WhatsApp-agent AI use described above, the following processing applies when the owner chooses to summarize a meeting:

You can use summaries for transcripts Google allows you to access, whether you organized or participated in the meeting. Use the feature only when you are authorized to process that transcript and give participants the appropriate notice. Access at Google and use of Infragrowth do not by themselves establish participant notice or consent.

• If you choose “Transcribir” when creating a meeting, after confirmation we ask Google to enable automatic transcription for that Meet space. The meeting can be created even if Google does not allow transcription to be enabled. The app reports that result; it does not guarantee a transcript will be available when the meeting ends.

• When you choose “Resumir” for a past meeting on the selected calendar, we read its Meet transcript entries and available speaker names at that time. You can also paste transcript text for that meeting. Meetings are not summarized automatically, and opening the calendar alone does not send transcript text to an AI model.

• We send the text being summarized to the AI provider configured for your business, using its own AI key. That provider processes the request under your account terms; if you use an intermediary such as OpenRouter, the providers it routes the request to also participate.

• We do not store the full transcript or pasted text in our database. We store the summary, decisions and next steps; the model, generation time and generating user; the meeting identifier, text source and whether the read was incomplete. If Google supplies a valid document identifier, we also store its link. A summary may include names or other personal data from the meeting; it is not anonymization.

• The link opens a document at Google. We do not copy that document or change its access permissions. Seeing the link in the panel does not establish that an account can open it at Google.

• Access to these summaries is limited to the business's current owner through the panel. Invited team members and external assistants connected through MCP do not read or generate them through that connection. The panel's data download includes summaries; the assistant's export does not.

• You can delete a summary. Regeneration replaces the previous summary if the new generation succeeds. Summaries are also removed when the business's data is permanently erased. Disconnecting Google or disabling the feature does not itself delete a stored summary. These actions do not delete the document or transcript Google keeps in your account.

• Reads are bounded. If limits or an additional conference page leave part unread, the panel warns that the summary may be incomplete. If Google has no available transcript, the app reports that condition and offers pasted text.

• Google states that Meet API transcript entries are deleted 30 days after the conference. Retention of the document in Google Drive or Vault is separate; this does not mean that document is deleted after 30 days or that Infragrowth controls how long Google retains it.

Limited Use

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

We use this data only for the calendar features you see in the panel. We do not sell it, we do not use it for advertising or to assess credit, and we do not use it to create, train or improve AI models. What we send to your AI provider is also subject to your account's terms with that provider; through OpenRouter it goes only to Anthropic.

How long we keep it and how to delete it

• Disconnecting (Integraciones, Google Calendar) erases the key and the chosen calendar of that connection. It does not erase your events at Google or the stored meetings, and it does not remove the permission from your Google account: you do that at myaccount.google.com/connections. Your agent's settings keep the calendar's identifier and your hours until you change them.
• Stored meetings, slots and bookings stay until the business is erased. The guest's email address is erased earlier, 90 days after the meeting, also in bookings and in meetings your assistant proposed. A fingerprint (hash) of the request remains, which does not show the address. If that person is also a contact in your CRM, they stay there until you delete them: deleting them from your contacts does not remove them from a stored meeting before those 90 days.
• Downloading your data includes the chosen calendar, the meetings and the bookings, never the keys.
• Closing the business erases the keys and the chosen calendar, and stops the use of Google; stored meetings and bookings stay available to download.
• Erasure is requested as explained at legal.infragrowthai.com/data-deletion. If you booked or were invited to a meeting by a business that uses Infragrowth, ask that business or write to hola@infra-growth.com.

Custom development in the customer's accounts

The following sections describe custom development: the database, agent and CRM run in the customer's accounts. The handover commitments and time periods remain applicable to that service. They do not describe Panorama's hosting or deletion procedure. The company identity, contact details, governing law and change notice on this page apply to both services.

Who we are

• We: Infragrowth AI LLC, a company registered in New Mexico, United States. Address: 1209 Mountain Road Pl NE, Ste N, Albuquerque, New Mexico 87110, United States. Email: hola@infra-growth.com. This page is on infragrowthai.com and our email, on infra-growth.com: both domains are ours.
• Infragrowth AI (the app): the app we registered with Meta (app ID 1617148799783650) to connect our clients' WhatsApp. It is ours, not Meta's.
• You: the business that hires us and connects its WhatsApp Business account to the app.
• Your contacts: the people who message your WhatsApp or who you message.

What the app does

With your permission, the app:

• connects your WhatsApp Business account through Meta's sign-up button (Embedded Signup), also if you keep using the WhatsApp Business app on your phone with the same number (Meta calls this coexistence);
• receives the messages your contacts send you and the notices of whether your messages were delivered and read;
• sends messages and templates on your behalf through the WhatsApp API (Cloud API), Meta's official connection for a system to send and receive messages;
• creates and manages your templates: the messages Meta reviews and approves before you can use them to message someone who hasn't written to you in the last 24 hours, like an appointment reminder;
• connects the AI agent and the CRM we build for your business.

What data we process

• From your account: the identifiers of your WhatsApp Business account and of your number (WABA ID and Phone Number ID), and the access keys (tokens) Meta issues so the app can operate your account.
• From your contacts:
  • their phone number. Someone who uses a WhatsApp username can message you without showing their number: in that case we receive an ID that WhatsApp assigns them for your business (BSUID);
  • their WhatsApp profile name;
  • what they talk about with your business: text, audio, images and files.
• From your templates: the text of each one and its status (for example, approved or rejected).
• If you use coexistence: the contacts saved in your WhatsApp Business app, the messages you send from your phone and, if you choose to sync it, your chat history.

Where it is stored

• In your database: your conversations, your contacts and what is synced through coexistence. The database is yours: we create it in your name on Supabase, a database service, and we operate it while the service lasts. The CRM we build for you works on that same database.
• In our systems: only the access keys and your account identifiers, and technical logs used to find errors, which keep identifiers and dates, never message content.
• At Meta: your account, your number, your templates and the messages that go through WhatsApp, under Meta's rules.

What we use it for

Only to provide the service you hired us for: running your WhatsApp through the API, the AI agent and the CRM. That includes storing your conversations in your database, letting the agent answer your contacts about your business, sending the messages and templates you decide on, and finding and fixing errors.

What the AI agent reads. Only the conversation with the person who is writing to it at that moment. It doesn't read your chats with other people, or the history or contacts synced from your phone: those are stored in your database, but they are never sent to the AI provider. What else it reads within that conversation (for example, audio or images) and which topics it covers, we agree with you in writing in your proposal.

Sensitive data. If, in the conversation the agent is handling, someone shares something about their health or other sensitive data, the agent reads it like the rest of that conversation. What the agent does with those topics is also set in writing in your proposal. For now, we don't offer coexistence to health or financial businesses.

What we don't do

• We don't sell your data or your contacts' data.
• We don't use it for advertising.
• We don't use your WhatsApp data to train or improve AI models, and we use the AI provider only under terms that don't allow it to do so either.

Who we share it with

Only with the providers that run the service, and each one gets only what it needs for its part. Also with anyone you ask us to in writing, or when a law requires it.

• Meta (WhatsApp Business Platform): messages travel through it.
• Cloudflare: receives Meta's notices and hosts our system.
• Supabase: hosts your database and ours.
• The AI provider, Anthropic or OpenAI: the one set in your proposal. It receives only the conversation the agent is handling, to write the reply. It doesn't train its models on what we send it through the API, and it keeps that data for a limited time for usage checks, under its current terms, which we link in your proposal.

The data we process may be stored or processed in the United States, by us (Infragrowth AI LLC) and by these providers. By hiring the service, you accept this.

How long we keep it

• Your database: it's yours, so you decide what it keeps and for how long. When the service ends, we hand you its full export and it stays yours.
• What we hold (access keys and identifiers): while the service lasts. We delete it 30 days after the service ends, and that's also when we stop having access to your database.
• Technical logs: kept for 30 days, then deleted.
• If you ask for deletion, we delete everything the app brought in, including from your database, within 5 business days. Details at legal.infragrowthai.com/data-deletion.

How we protect it

• We store access keys encrypted, outside the code.
• Each client has its own database: your conversations and contacts don't mix with other clients'.
• Data travels encrypted between Meta, our systems, your database and the AI provider.
• Only the people at Infragrowth AI who work on your service have access, each with their own logged access.
• If something affects the security of your data, we'll tell you within 72 hours of confirming it.

Your rights and how to exercise them

If you are a client: you can ask us to show you the data we hold about you, give you a copy (the full export of your database), correct it, or delete it and disconnect your account. Email hola@infra-growth.com. We confirm we received your request within 2 business days. If you ask to see your data or for a copy, we answer within 10 calendar days; if you ask to correct or delete it, within 5 business days. Step-by-step deletion instructions are at legal.infragrowthai.com/data-deletion.

If you messaged a business that uses our app: that business is responsible for your data, the one that decides what it's used for. We process it on its behalf and following its instructions.

• To see, correct or delete your data, ask that business. The simplest way is to message it on the same WhatsApp.
• You can also email us at hola@infra-growth.com with the business's name. We confirm we received it and pass it on within 2 business days.
• If you asked for deletion and the business doesn't answer within 10 calendar days of us passing on your request, we delete your data anyway from the systems we operate, including that business's database.

Step-by-step instructions are at legal.infragrowthai.com/data-deletion.

Complaints: if you are in Argentina, you can also complain to the Agencia de Acceso a la Información Pública (AAIP), the authority that enforces Law 25,326 on personal data protection. Notice from AAIP Resolution 14/2018, in its official Spanish wording:

«LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales».

In English: the AAIP, as the enforcement authority of Law 25,326, has the power to handle the complaints and claims filed by anyone whose rights are affected by a breach of the data protection rules in force.

Governing law

This policy and our terms of service are governed by the laws of the State of New Mexico, United States. If you are in Argentina, you keep all the rights that Law 25,326 on personal data protection gives you, and the deadlines we give here comply with it.

Changes to this policy

We'll email you about any change 15 days in advance, with what changes, and update the date above. If you don't agree, you can end the service without penalty within those 15 days.

Contact

hola@infra-growth.com