INFINICUS Legal Center

Revision date: October 3, 2026. Effective date: not yet assigned. The proposed service terms below take effect only when a verified operator publishes an effective edition and obtains any required acceptance. Existing customer agreements and mandatory legal rights are not changed by this draft.

Outstanding publication details are listed in Publication Requirements. No registration number, public address, contact mailbox or certification is implied by this page.

This policy describes INFINICUS's privacy practices as the platform actually operates today. "INFINICUS," "we" and "our" refer to the operator to be verified in Entity Status; the entity name does not change what data is actually collected, described below.

Information and purposes

• Account data — when you create an account, your email address and authentication credentials are collected and stored by Supabase, our authentication and database provider, on our behalf. We do not see or store your raw password.
• Business and integration data — if you use Business Operations, Business Digital Twin, AI Decision Intelligence, Approved Business Action, Outcome Monitoring, Data Acquisition, or Continuous Learning, the records you enter (sales, expenses, inventory, customer and team events, data sources, approved decisions, and recorded outcomes) are stored server-side in our own database, associated with your account, so they persist across devices and sessions. Depending on the source, this may include information about your own customers, staff or other people — you are responsible for having authority to provide it.
• Simulation Engine inputs — the standalone Simulation Engine (business idea, capital, price, industry, location) runs its Monte Carlo calculations in your browser. Simulation history saved for a signed-in account is stored server-side; simulation history for a signed-out visitor is kept only in that browser's localStorage.
• AI inputs and outputs — business descriptions, simulation metrics, and live business-platform data you choose to analyze are sent to Anthropic's API to generate AI narrative analysis and AI Decision Intelligence recommendations. This is a currently enabled, confirmed data flow — not a hypothetical one. See Anthropic's privacy policy at anthropic.com/privacy.
• Technical information — requests, IP addresses, device/browser information, and diagnostic events are processed by our hosting, CDN and error-monitoring services (Cloudflare, Hetzner, Sentry — see Providers & Subprocessors) for delivery, security, troubleshooting and reliability.
• Advertising/analytics cookies — if you accept this page's cookie banner, we set consent-mode cookies that enable Google ad-performance measurement and analytics (see Cookies & Browser Storage).
• Browser storage — UI preferences, cached labels, feature-seen flags, your cookie-consent choice, and — for signed-out visitors — Simulation Engine history are held in your browser's localStorage.

Service operation and learning

Business data supports the Business Operations, BI/KPI, Digital Twin, simulation, AI Decision Intelligence and Outcome Monitoring workflows described above. "Continuous learning" refers to feedback and evaluation features; it does not itself authorize training general-purpose AI models on your data. Any use for model training or a materially different purpose would require a separately disclosed basis and appropriate terms. No AI-provider training or retention guarantee is made here — confirm Anthropic's current terms directly.

Roles and lawful processing

For account administration and our own service operations, the verified operator acts as a controller. When we process personal data for a business customer's purposes and instructions, roles must be defined in the applicable DPA. Business customers are responsible for having authority to provide data, give instructions and connect third-party systems. Contract performance, legitimate interests, consent and legal obligations may be the relevant basis depending on the activity and your jurisdiction; this draft does not assert that consent alone covers every activity.

Recipients and international processing

Information is made available to the confirmed service providers listed in Providers & Subprocessors, to integrations you authorize, or as required by law. Any corporate-transaction disclosure would require appropriate safeguards. Exact hosting regions, recipient legal entities and cross-border transfer safeguards for Hetzner and Supabase have not been verified for this edition; this page makes no U.S.-only, EU-only or other residency promise. We do not sell or rent your personal data to third parties; whether any ad-sharing arrangement would count as a "sale" or "share" under laws like the CCPA still needs legal confirmation.

Retention and deletion

No fixed retention period is established by this draft. The final policy must specify retention periods or criteria for account data, business records, logs, diagnostics, backups and provider-held information. Clearing your browser's local storage affects that device only — it does not delete server-side account or business data. Account closure and server-side deletion require contacting us at the channel in Contact, once verified.

Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your personal data, restrict or object to processing, or withdraw consent. Mandatory statutory rights and response periods remain applicable regardless of this draft. The INFINICUS privacy request channel is not yet verified; it must be published in Contact before this notice takes effect.

Children and sensitive information

INFINICUS is for adults using it for business purposes, not children. Do not provide unnecessary sensitive personal data, payment-card credentials, passwords or private keys in prompts or uploads.

The platform

INFINICUS is a business operations and decision-intelligence platform encompassing Business Operations, Business Intelligence and KPI analysis, Digital Twin modeling, the Simulation Engine, AI Decision Intelligence, Data Acquisition, Approved Actions, Outcome Monitoring, Continuous Learning, and POS/external integrations. Availability depends on the features actually enabled for your account and your agreement; this description is not a promise that every capability is available to every user.

Eligibility and accounts

You must be at least 18 and have authority to accept these terms for yourself or your organization. Protect your account credentials, manage authorized users, and notify us of suspected misuse through the verified contact channel once available. You are responsible for lawful access to any data and connected systems you bring into the platform.

Permissions and approved actions

An AI analysis or recommendation is not authorization to change an external system, spend money, or make a commitment. Actions require your explicit approval within the Approved Business Action workflow. Review scope, destination, cost and consequences before approving. Integration availability, permission controls, retries, reversibility and audit records depend on the specific integration and your agreement — no universal rollback guarantee is made. Disconnecting an integration stops future access but does not necessarily reverse actions already completed.

Use and third-party services

Use the platform within applicable permissions, published plan limits, and the Acceptable Use Policy. Third-party services (Anthropic, Supabase, Cloudflare, Hetzner, Google) have their own terms and availability outside our control. You must have the necessary licenses and permissions for any external data you bring in. Outputs, forecasts and AI-generated content require your review — see the AI Disclaimer.

Availability, suspension and termination

No uptime or uninterrupted-access guarantee is made in this edition. We may restrict access to address unlawful use, material breaches, or security risks. Notice and an opportunity to remedy will be given when practicable; urgent risks may require immediate action. Data export and post-termination data retention must still be specified before customer onboarding — see Publication Requirements.

Disclaimers and responsibility

To the extent permitted by law, the platform and its outputs are provided "as is" and "as available," without warranties of accuracy or fitness for a particular purpose. Forecasts, verdicts and AI-generated recommendations are not guarantees. Nothing here excludes liability that cannot lawfully be excluded, or mandatory consumer rights. No monetary liability cap has been set for this edition — that is a decision for counsel.

Changes and governing law

Material changes will be communicated with an updated effective date. Once INFINICUS LLC is verified as the contracting entity, the proposed choice is Wyoming law, excluding conflict-of-laws rules, with Wyoming courts of competent jurisdiction, subject to mandatory law and non-waivable venue rights. This is a drafting proposal, not a confirmed jurisdiction — see Entity Status.

What this site actually loads

This Legal Center page loads the same scripts as the rest of the platform: a consent-gated Google advertising/analytics tag, Sentry error monitoring, and Google Fonts. None of these are hidden from this page — a claim that any INFINICUS page loads no trackers would be inaccurate and is not made here.

• Essential storage — Supabase sets a session token (cookie or local storage, depending on sign-in method) so you stay signed in between visits. Cloudflare may set a __cf_bm cookie for bot management; this is a security cookie with no advertising purpose.
• Functional storage (localStorage) — your cookie-consent choice, UI preferences, cached labels, feature-seen flags, and signed-out Simulation Engine history. Not a cookie; kept in your browser only.
• sessionStorage — temporary event data, cleared when you close the tab.
• Optional — consent-mode cookies (only if you click Accept) — enable Google ad-performance measurement and analytics (ad storage, analytics storage, ad user data, ad personalization). Never set if you click Decline.
• Error monitoring (Sentry) — loaded on page view to capture errors and performance traces for reliability; this is not gated by the cookie banner because it does not set advertising cookies, but it does transmit diagnostic data (see Providers & Subprocessors).

Third-Party Cookies

• Google (Ads/Analytics) — if you accept the banner, Google may set cookies for ad-performance measurement and analytics. See Google's cookie policy.
• Google Fonts — may set cookies for font caching; functional and non-tracking.
• Cloudflare — the __cf_bm security cookie described above.

Your Choices

You can change your cookie choice at any time by clearing your browser's site data for this domain, which shows the consent banner again on your next visit. Declining does not affect your ability to create an account or use the Service — it only disables ad-performance/analytics cookies. Clearing all localStorage resets signed-out Simulation Engine history and UI preferences but does not delete your account or server-stored business data.

Models and limitations

The Simulation Engine uses stochastic Monte Carlo modeling over a 60-day horizon with user-supplied and industry-average inputs. Results vary with data quality, model design and real-world conditions. AI narrative analysis and AI Decision Intelligence recommendations are generated by Anthropic's Claude model based on simulation outputs and, where enabled, live business data. Digital Twins are representations of business conditions and may be incomplete or stale; they are not the business itself.

AI can generate inaccurate, fabricated, biased or outdated material. Data Acquisition and integrations do not establish that external information is accurate, licensed or current. KPI calculations and recommendations require validation against your own source records.

Human review

Verify material facts, assumptions, calculations, permissions and consequences before relying on outputs or approving actions. INFINICUS does not replace qualified legal, tax, accounting or investment advice, independent market research, or due diligence. Consult appropriate professionals for consequential decisions.

No Warranty

The Service is provided "as is" without warranty of accuracy, completeness, or fitness for a particular purpose. Simulation results will differ from real-world outcomes.

You must not use INFINICUS to:

• Commit fraud, money laundering, infringement, or other unlawful activity, or deceive others by presenting generated results as audited facts or guaranteed forecasts.
• Access data, accounts, POS systems or external sources without authorization; collect personal information without a lawful basis; or bypass access controls.
• Introduce malicious code, interfere with service availability, evade published rate limits, or exploit other users' information.
• Bypass Approved Action controls, impersonate an authorized decision maker, or trigger external actions beyond your granted permissions.
• Scrape or bulk-request the Service contrary to published limits. Authorized integrations and ordinary permitted automation are not prohibited.
• Copy, reproduce or resell the INFINICUS software, or evade license restrictions, except where applicable law expressly permits it.

Rate limiting is enforced on the API (confirmed registered in the backend). The exact published quota must be confirmed and stated here before this edition is final — the previous flat "10 requests per hour" figure is not carried forward without verification. Enforcement is proportionate to the violation and urgency, subject to law and contract.

Platform and third-party rights

The INFINICUS brand, software, simulation algorithms, UI design and documentation belong to the verified operator in Entity Status. Planned formation of INFINICUS LLC does not itself transfer existing intellectual property into the LLC — any ownership statement requires verified assignments or licenses. Third-party and open-source rights remain with their owners under their applicable licenses.

Your data and content

You retain rights you hold in submitted business data, prompts, records and other content. You must have permission to provide and process that content. Subject to the final agreement and DPA, we receive only the permissions needed to host, process, transmit and display your content to deliver the Service. That permission does not independently authorize model training or advertising use.

Outputs and permitted use

You may use and share outputs generated for your authorized business purposes, subject to third-party rights, confidentiality and privacy obligations. Do not misrepresent outputs as verified facts or imply INFINICUS endorsement. AI outputs may be non-unique and may not qualify for exclusive copyright protection; no exclusive-ownership or non-infringement guarantee is given.

Before any purchase, the applicable offer must disclose the seller, price, currency, taxes, billing interval, usage charges, trial-conversion terms, renewal terms and cancellation method. Recurring charges require whatever authorization applicable law requires.

Cancellation would stop future renewal per the disclosed plan terms. Refund eligibility, proration and credits would follow the accepted offer and applicable law — this edition does not promise a fixed refund window, since no paid plan or payment processor currently exists to define one against. Previously accepted refund terms (none currently exist) cannot be removed retroactively by this revision.

Billing and refund requests will require a verified support channel, pending in Contact. Do not send full payment-card information through support messages. Paid plans must not launch under this edition until the seller, commercial terms and support process are confirmed.

Public contact details — not yet verified

• Planned entity: INFINICUS LLC, Wyoming, United States; formation unverified.
• Current operator / privacy controller: identity awaiting confirmation.
• General, privacy, support, billing and security contact: a verified public channel is awaiting confirmation.
• Mailing address: awaiting confirmation. A registered-agent address is not automatically a customer-support or business-operating address.
• DMCA designated agent: name, mailing address, telephone and email awaiting verification and any required Copyright Office registration. A Wyoming registered agent is not automatically the DMCA agent.

No mailbox or address has been fabricated. A working public contact channel is required before this page is published as an effective notice or used to collect data.

Copyright complaints

Once the designated channel is verified, a notice should identify the copyrighted work and allegedly infringing material with enough information to locate it; provide the sender's contact details and signature; state a good-faith belief that the use is not authorized by the owner, its agent or law; and state, under penalty of perjury, that the notice is accurate and the sender is authorized to act for the owner.

Counter-notifications

A counter-notification should include a signature, identification of the removed material and its previous location, a statement under penalty of perjury that removal resulted from mistake or misidentification, your name, address and phone number, consent to jurisdiction, and acceptance of service from the original notifier.

See the U.S. Copyright Office's Section 512 guidance and designated agent directory.

A DPA is not attached or represented as executed. Before processing personal data on a business customer's behalf where required, the parties must establish the relevant processing terms and roles.

The DPA should define processing subject matter, duration, nature and purpose, data types and people affected, documented instructions, confidentiality, security measures, subprocessors and change procedures, rights-request assistance, incident handling, deletion/return, audit information, and international-transfer safeguards. No standard contractual clauses, executed DPA, or compliance certification is implied by this page.

The DPA request channel will be provided through Contact once verified. The list in Providers & Subprocessors is informational and is not itself a DPA.

These providers are confirmed as currently integrated with the live platform. Whether each one is a "subprocessor" for a given business customer still depends on the processing activity and the DPA ultimately executed.

• Supabase — confirmed. Authentication and database provider for account sign-up, sign-in and password reset. See Supabase's privacy policy.
• Anthropic — confirmed. AI analysis provider for the API. Data sent includes business descriptions, simulation metrics, and — for AI Decision Intelligence — live business-platform data you choose to analyze. See Anthropic's privacy policy.
• Cloudflare — confirmed. Edge delivery / CDN in front of the application. May log IP addresses and request metadata. See Cloudflare's privacy policy.
• Hetzner — confirmed. Hosts the origin API server and database (separate from Cloudflare's edge role). Exact region and data-residency implications have not been verified for this edition.
• Sentry — confirmed, loaded on every page including this one. Error monitoring and performance tracing; diagnostics can include error messages, stack traces, URLs, device details and contextual event data. Filtering/redaction, IP handling, retention and region require confirmation before launch. No session replay is currently configured.
• Google — confirmed. Google Fonts (typography) is loaded unconditionally; the Google Ads/Analytics consent-mode tag is loaded on every page but only activates after you accept the cookie banner.
• POS/external integrations and payment services — provider identities, permissions and controller/processor roles depend on the connections you enable; no unverified provider is named here.

Before launch, add provider legal entity, relevant data-processing locations, and the applicable change-notification process for each confirmed provider above.

Do not send passwords, API secrets or full card details through prompts or ordinary support messages. Manage your account and integration access carefully, and review Approved Action requests before authorizing them.

No certification, specific encryption standard, independent security audit, penetration test, recovery-time objective, or breach-notification deadline is claimed without supporting evidence. Before customer onboarding, this section must document access controls, tenant separation, credential handling, transport/storage protection, logging, backups, restoration, vulnerability management and incident response appropriate to the deployed service — see the known-limitations build documentation for the current, honest state of each.

Report suspected security issues through the verified security channel once published in Contact. No reward program or testing authorization is created by this notice.

• Verify LLC formation, the actual contracting entity/controller, any pre-formation operator, public mailing address, effective date, and IP ownership or licenses.
• Publish working general, privacy, billing, security and copyright contact channels; confirm a DMCA agent designation.
• Confirm Hetzner's and Supabase's hosting regions and any cross-border data-transfer safeguards needed.
• Confirm the current published API rate-limit figure for the Acceptable Use Policy.
• Finalize privacy-rights handling, any jurisdiction-specific disclosures (e.g. GDPR if you have EU users, CCPA if you have California users), the applicable DPA, and security commitments.
• Decide whether to proceed with Wyoming as the governing-law and entity jurisdiction, or a different one — this edition treats Wyoming as a proposal, not a confirmed decision.
• Finalize paid-plan terms, cancellation, refunds, data export and termination arrangements before offering any paid plan.
• Remove the draft marker and publish the effective edition only after legal sign-off.

This edition is a publication candidate, not a certification of legal compliance. Official DMCA references are linked in the Contact & DMCA section.