Privacy Policy

Last updated: 2026-09-22

Infinihash LLC, a Wyoming limited liability company ("Infinihash", "we", "us"), provides compliance and identity-verification infrastructure for the digital-asset industry. This policy explains what data we collect, how we use it, and your rights.

1. What we collect

The categories of data we process depend on which Infinihash product you use:

• Account data (all products): email, name, organization, role, password hash, IP at login.
• KYC product: identity documents and selfies your customers submit through your account; extracted fields (name, DOB, document number, address); liveness signals; sanctions screening results.
• KYT product: wallet addresses you screen, chain identifier, transaction hashes, and the risk decision generated by our pipeline.
• Billing data: Stripe customer ID, last-4 of card, invoice history. Card numbers themselves are tokenized by Stripe and never reach our servers.
• Telemetry: request paths, response codes, latency, browser type, errors. Aggregated for operational health.

2. How we use it

• To provide and operate the products you've signed up for.
• To meet our regulatory obligations (BSA, AML, sanctions, GDPR, CCPA).
• To bill, support, and communicate with customers.
• To detect abuse, fraud, and security threats.

We do not sell, rent, or trade personal data. We do not use customer data to train AI models without explicit opt-in.

3. Retention

• KYC documents: retained per tenant configuration (default 7 years for BSA-eligible records).
• KYT screening results: 5 years for audit trails, then anonymized.
• Account data: deleted within 30 days of account closure, except where retention is legally required.
• Logs: 90 days, then aggregated.

4. Sub-processors

• AWS (US-East-2) — primary hosting, databases, and object storage.
• Cloudflare — CDN, DDoS protection, WAF; terminates TLS in front of our estate.
• Stripe — subscription billing. Card numbers are tokenized by Stripe and never reach our servers.
• Bridge — regulated payments partner for Rails/BaaS. Receives business KYB data, beneficial-owner personal data (including date of birth, residential address, personal tax identification number and government-ID images), and ACH collection and stablecoin disbursement instructions.
• Persona — Bridge's identity-verification and screening vendor. Receives the individuals submitted through KYB, via Bridge, for identity and sanctions checks.
• Google (Gemini) — vision inference for KYC document extraction; receives identity-document images (encrypted in transit).
• Google Analytics and Google Fonts — website analytics on our marketing pages, gated behind the cookie consent banner, and web-font delivery. Receives visitor IP address, cookie identifiers and page views. No product or identity data.
• Anthropic (Claude) — AML case narrative text generation only. Receives entity name and type plus pass/fail check summaries. It is not part of the document pipeline and never receives identity-document images.
• Resend — transactional email.

The primary model used for KYC document extraction is MyAi, which Infinihash builds and hosts on its own infrastructure; it is not a third-party subprocessor and is listed here only so the pipeline is not misread. The full list, with what each vendor receives and in which region, is maintained at infinihash.com/trust.

5. Cookies & analytics

Our marketing pages use Google Analytics 4 behind a consent banner (Google Consent Mode v2: analytics storage stays denied until you click Accept), and web fonts come from Google Fonts, which receives your IP address but sets no cookie. Your choice is saved in your browser under ih_cookie_consent; we use no advertising cookies and no cross-site tracking. Every cookie and storage key we set, what each is for, and how to change your choice are in our Cookie Policy.

6. Your rights

If you are an EU/UK/CA resident, you have rights of access, rectification, erasure, portability, and objection. To exercise these rights, email [email protected]. We respond within 30 days.

7. SMS / Text Messaging

Infinihash operates an SMS customer-support line. By providing your mobile number and sending a text message to our published support number, you consent to receive automated and human customer-support text messages from Infinihash in reply to your inquiry. Message frequency varies by conversation. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for assistance.

Mobile information — including your phone number and your SMS opt-in or consent — will not be shared, sold, or rented to any third parties or affiliates for their marketing or promotional purposes. SMS opt-in consent is not shared with third parties. We use mobile information solely to operate the support conversation you initiated and to meet our legal and security obligations described in this policy.

8. Security

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We follow industry best practices for access control, audit logging, and incident response. Detailed security posture is published at infinihash.com/trust.

9. Children

Our products are not intended for users under 18. We do not knowingly collect data from minors.

10. Changes

Material changes will be announced via email to account contacts at least 30 days before taking effect.

11. Contact

Privacy — [email protected]
Security — [email protected]
Legal — [email protected]