1. Overview & Scope
This Privacy Policy explains how Infinity Charts, operated by Infinity Blocks ("we," "us," or "our"), collects, uses, processes, and safeguards your account and integration data. We act as the Data Controller for account registration, authentication, and service diagnostics, and as a Data Processor for database and spreadsheet records accessed through your connected Notion and Google Sheets integrations.
This policy applies to all users of the Infinity Charts web application, Studio workspace, API endpoints, dashboards, and embedded visualization widgets.
2. Information We Collect
We collect only the account identifiers, authorization tokens, and chart configuration metadata required to authenticate your session and render live visualizations.
A. Account Authentication & Data Source Connections
When you sign in or connect a third-party data source (Notion or Google Sheets), we store the minimum credentials required to maintain your connection:
- Account Identity: Your email address, display name, and authentication session identifiers managed via Clerk.
- Encrypted OAuth Credentials: Read-only OAuth 2.0 access and refresh tokens issued by Notion or Google when you authorize a workspace or spreadsheet connection.
- Workspace Identifiers: Workspace ID, workspace display name, icon, and authorized user ID used to associate saved charts with your account.
B. Chart & Dashboard Configuration Metadata
To persist your saved charts and dashboards, we store structural configuration settings:
- Source Identifiers: The identifier of the Notion database or Google Spreadsheet selected for a widget.
- Axis & Filter Mapping: Selected column names, property types, aggregation modes, sorting rules, and filter conditions.
- Visual Styling: Chart type, color palette selection, theme preset, reference lines, and dashboard grid coordinates.
C. Technical Telemetry & Session Storage
We collect aggregated operational metrics to maintain service reliability:
- Performance Telemetry: Page load latency, browser type, operating system, and country-level region collected via Vercel Analytics.
- Essential Cookies & Local Storage: Authentication session cookies and local workspace preferences (such as active theme and sidebar state).
3. Legal Bases for Processing
For users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data under the following GDPR legal bases:
- Contractual Necessity: To authenticate your account, query authorized data sources on your behalf, and serve live charts and embeds.
- Legitimate Interests: To secure our infrastructure, enforce rate limits, prevent abuse, and improve rendering performance.
- Legal Compliance: To satisfy applicable statutory, tax, or regulatory obligations.
4. Security & Data Handling
We apply strict cryptographic and architectural controls to protect your workspace credentials and source data:
Encryption at Rest Credential Protection
All OAuth access and refresh tokens for Notion and Google Sheets are encrypted using industry-standard authenticated encryption before being written to our database, with encryption keys isolated in secure runtime environments.
TLS 1.2 / 1.3 Encryption in Transit
All network traffic between your browser, Infinity Charts servers, and upstream providers (Notion and Google APIs) is encrypted in transit over HTTPS using TLS 1.2 or TLS 1.3.
Transient Processing Source Table Minimization
Infinity Charts does not permanently store the raw rows or cell values of your Notion databases or Google Sheets in our primary database. Source rows are fetched on demand using read-only scopes, aggregated into chart coordinates, and optionally held in short-lived edge cache strictly to serve active embeds and prevent upstream API rate-limiting.
5. Subprocessors & Sharing
We do not sell, rent, or trade your personal information or workspace data. We share data only with the infrastructure and authentication subprocessors required to operate Infinity Charts:
Authorized Subprocessors
| Provider | Role & Purpose | Primary Region |
|---|---|---|
| Clerk, Inc. | User authentication, OAuth session management, and account security | United States / Global |
| Notion Labs, Inc. | Authorized workspace & database API integration | United States |
| Google LLC | Authorized Google Sheets read-only API integration (when connected) | United States / Global |
| Vercel Inc. | Application hosting, edge network delivery, and performance telemetry | United States / Global CDN |
| Resend, Inc. | Transactional email and support notification delivery | United States |
6. Retention & Revocation
We retain your chart configurations and encrypted connection tokens only while your account remains active. You can revoke access or delete your data at any time:
- Chart & Dashboard Deletion: Deleting a chart or dashboard in the Studio immediately removes its configuration record from our database.
- Disconnecting Notion or Google Sheets: Disconnecting a data source from the Infinity Charts settings panel (or revoking access from your Notion Connections or Google Account security settings) immediately deletes or invalidates the stored OAuth token.
- Account Deletion: Upon request to close your account, all associated profile records, saved charts, dashboards, and encrypted tokens are permanently purged within 14 business days.
7. Global Privacy Rights
Depending on your jurisdiction (including GDPR, UK GDPR, and CCPA/CPRA), you have the right to:
- Access & Portability: Request a copy of the account profile and chart configuration records associated with your account.
- Rectification: Update your account details, connected workspaces, and saved chart configurations directly in the Studio.
- Erasure ("Right to be Forgotten"): Request complete deletion of your account, saved visualizations, and stored OAuth credentials.
- Restriction & Objection: Object to non-essential telemetry processing or request restriction of processing.
To exercise any of these rights, email our privacy team at infinityblockshq@gmail.com.
8. International Transfers
Our cloud hosting and infrastructure partners operate in the United States and the European Union. Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on European Commission Standard Contractual Clauses (SCCs) and equivalent data protection safeguards with our subprocessors.
9. Children's Privacy
Infinity Charts is designed for professional and organizational use by individuals aged 13 and older (or 16 and older in the EEA). We do not knowingly collect personal information from children. If you believe a minor has created an account, please contact us so we can remove the data promptly.
10. Policy Updates
We may update this Privacy Policy to reflect new product connectors, security enhancements, or regulatory requirements. When we make material changes, we will update the effective date at the top of this page and notify users through the application interface.
11. Contact & Support
For privacy inquiries, data deletion requests, or security questions, contact our team at: