Privacy policy

1. Who we are

UltraInfra is a product and trading name of Auditore Ltd, a company registered in the United Kingdom. Our registered office and contact details appear at the end of this page. Address privacy correspondence to our Privacy Lead.

This initial notice covers website visitors, early access enquiries, account users, customer business contacts and people who communicate with us. Details identified as “to be confirmed” will be completed as the service arrangements are finalized.

Auditore Ltd generally acts as controller for its own account administration, billing, marketing and security activities. When a customer instructs us to process personal information in its repositories, cloud systems or workloads, we generally act as processor or subprocessor under an agreement with that customer. The roles depend on the activity. The customer’s own notice explains its purposes, while the applicable processing agreement describes our responsibilities.

2. Information we handle

The information depends on the features you use and the systems your organization connects. It can include:

• Enquiries and early access: email address, optional company details, answers about your needs, correspondence and communication preferences.
• Accounts and organizations: name, email, profile information from an enabled sign-in provider, workspace membership, roles, invitations and settings.
• Billing: business and billing contacts, subscriptions, invoices, payment status and transaction references from our payment provider.
• Connected systems: cloud account and resource identifiers, configuration, tags, topology, usage and cost records, deployment history, metrics, logs and incident information.
• Repositories and builds: repository and commit details, source material and configuration needed for enabled analysis, build or deployment features.
• AI features: instructions, permitted context, generated outputs, recommendations, approval records and operational outcomes. Enabled retrieval features may also create derived or embedding records.
• Technical and security records: IP addresses, request times, browser or device information, authentication events, errors and relevant diagnostics.
• Optional measurement: selected page or product events, identifiers, performance information and portal replay information where enabled and consented to.

We receive information from you, your organization, systems you authorize us to connect to, sign-in and payment providers, and interactions with our services. Technical material can contain personal information even when its main purpose is operational.

Please avoid including unnecessary personal information or credentials in prompts, support messages and logs. Use the designated secret management features for secrets. We remain responsible for the information we process and the safeguards applicable to it.

3. Purposes and lawful bases

For activities where we are controller, the proposed purposes and UK lawful bases are:

• Responding to business enquiries and early access requests: legitimate interests in answering requests and assessing service fit; steps before a contract where the individual would personally be a party.
• Providing accounts and administering customer relationships: legitimate interests in serving the customer’s organization, or performance of a contract where the individual is personally a party.
• Billing and business records: legitimate interests in administering payments and applicable legal duties for accounting and tax, with contract where relevant.
• Security, reliability and abuse prevention: legitimate interests in protecting and operating the service, and specific legal obligations where applicable.
• Support, complaints and legal claims: legitimate interests in resolving issues and protecting legal rights, together with applicable legal obligations.
• Optional marketing updates: consent for the updates offered by our early access form.
• Optional analytics, performance measurement and enabled recordings: consent under our measurement policy.

We must assess the necessity and effect of processing based on legitimate interests and apply appropriate limits. Where we process information only on a customer’s instructions, that customer determines its lawful basis and our responsibilities are governed by the processing agreement.

Some account and contact details are necessary to supply the requested service or answer you. Without them we may be unable to do so. Optional survey responses and optional marketing or measurement consent are not conditions of requesting early access.

Service, security and billing messages are separate from optional marketing. Withdrawing marketing consent does not stop communications needed to administer a service you use.

4. Cookies and privacy choices

We use cookies and similar storage for authentication, security and remembering privacy choices. Optional measurement can be controlled through Privacy choices in the website footer and the relevant product controls. You can reject optional measurement and change your choices later.

The website’s PostHog configuration collects selected consented events and disables automatic capture and session recording. The portal can have additional performance or replay features where enabled and consented to. Necessary security and limited error diagnostics are assessed separately, so rejecting optional measurement does not mean that no technical or security information is processed.

Privacy preferences and the website’s measurement cookies are currently configured with a 180 day expiry. Browser storage lifetime is different from the period for which an analytics provider retains event records.

To be confirmed: the complete deployed inventory of authentication, Cloudflare, PostHog and Sentry storage, including names, domains, lifetimes and provider retention. We are also verifying withdrawal behaviour across the website and portal before this notice is finalized.

Browser settings can remove or block storage, although blocking necessary authentication or preference storage can affect those functions. Changing a browser preference does not itself erase information already collected; you can contact us about your data rights.

5. AI and connected infrastructure

When an AI feature is enabled, it may send your request and the context needed for that feature to an approved model service. Depending on the feature, that context can include selected repository material, permitted cloud configuration, incident information and relevant history. Outputs may be retained with the related investigation, deployment or decision record.

Our model handling policy is designed to minimize information sent to models and exclude restricted credentials and secret values. It should not be read as a guarantee that technical material can never contain sensitive information.

Training arrangements to be confirmed: our proposed default is no use of private customer content to train shared or general purpose models without a separate express agreement. Cross customer learning is not authorized by acknowledging this notice. Tenant scoped retrieval and embeddings used for your workspace are distinct from training for general use. Provider processing may involve operational, security or legally required retention; this notice does not promise zero retention.

The actual providers, endpoints, locations and retention arrangements will be identified in the finalized provider information. Infrastructure automation is not intended as a service for making decisions about an individual’s employment, creditworthiness or similar personal matters. Any processing that makes solely automated decisions with legal or similarly significant effects requires its own assessment, explanation and safeguards.

6. Who may receive information

Information may be shared with the providers needed to supply the enabled service, people authorized by your organization, professional advisers subject to confidentiality, and authorities where lawfully required. Organization administrators can manage access and service records according to their roles.

Relevant provider categories include:

• cloud hosting, storage, delivery and security services;
• repository integrations and sign-in providers;
• payment processing and email delivery;
• analytics and error monitoring;
• approved AI model services; and
• workflow execution and support tooling.

The implementation supports services such as AWS, Cloudflare, GitHub, Google sign-in, Stripe, PostHog, Sentry and approved model providers. The active vendor list, exact contracting entities and processing arrangements are to be confirmed. Not every supported integration is enabled, and not every recipient has the same controller or processor role.

Suppliers you contract with independently explain their own processing in their notices. This does not remove our responsibility for processing we control or arrange. Any use of customer information for an additional purpose, including advertising or model training, requires its own lawful basis, disclosure and any necessary permission.

7. International processing

UK company registration does not mean that all information stays in the UK. Cloud hosting, AI processing, analytics and provider support may involve other countries. Selecting a region for a customer workload does not necessarily select the region for account records, service diagnostics or AI processing.

Where a restricted transfer requires safeguards, the appropriate arrangement must be in place for that recipient and activity. This may involve an applicable adequacy arrangement or approved contractual safeguards and any required transfer assessment.

Countries, recipients and transfer mechanisms are to be confirmed before this notice is finalized. Contact our Privacy Lead for information about the arrangements applicable to your service. We do not make a UK-only or EU-only residency commitment in this draft.

8. Retention and deletion

We retain information for its relevant purpose, taking account of service delivery, security, recovery, legal obligations and justified claims. Different records require different periods:

• enquiry information is needed while responding and assessing an active business relationship, with inactive enquiries subject to review;
• account information is needed for the active service and its agreed exit arrangements;
• operational and AI records follow the agreed feature and customer processing schedule;
• support and security records are retained for resolution, necessary follow-up and justified security or claims purposes;
• financial records follow applicable accounting and tax requirements;
• minimal marketing suppression records may be needed to respect an opt-out; and
• backups require a separate expiry and restore process that respects deletion requests.

The detailed retention schedule and backup expiry periods are to be confirmed. This draft does not promise automatic erasure within a fixed number of days.

Subscription cancellation, offboarding, personal information erasure and deletion of cloud resources are separate processes. Where we act as processor, return and deletion follow the customer’s lawful instructions and the processing agreement. Information temporarily retained for a justified legal hold or in backups must have restricted use and an applicable expiry or deletion process.

9. Security

We use technical and organizational measures appropriate to the information and service, including access restrictions, authentication, protected communications and operational monitoring. Detailed commitments for customer processing belong in the applicable security and processing schedules.

No service eliminates every security risk. Incidents are assessed and notifications provided as required by applicable law and agreements. This draft makes no certification or guaranteed security claim. Do not include secret credentials in an ordinary support message or letter reporting a concern.

10. Your rights

Depending on the law and processing, you may have rights to access personal information, correct it, request deletion, restrict processing, receive certain information in a portable form and withdraw consent. Conditions and exceptions apply, including where records must be retained for a legal obligation.

You can object to processing based on legitimate interests for reasons relating to your circumstances. You can object to direct marketing at any time, including related profiling. Use the unsubscribe option in marketing messages or contact our Privacy Lead.

Withdrawing consent does not affect the lawfulness of earlier processing. Use Privacy choices for optional measurement and unsubscribe or contact us for marketing preferences.

We may request proportionate information to verify identity or clarify a rights request. We respond within the period required by applicable law, normally one month for UK rights requests, and explain any lawful extension or exception. For information processed on a customer’s behalf, we may direct your request to that customer or assist it as required.

11. Privacy complaints

You can raise a data protection complaint with our Privacy Lead using the company details below. We will acknowledge it within 30 days, investigate appropriately and communicate the outcome without undue delay. Acknowledgment within 30 days is not a promise that every investigation will finish in that period.

You can also complain to the UK Information Commissioner’s Office or another competent authority where applicable. Contacting us first may help resolve the issue but does not remove your legal rights.

12. Children and notice changes

UltraInfra is intended for business users aged 18 or over and is not designed for children. Contact us if you believe a child has provided personal information directly to us. This scope does not mean customer systems can never contain information about children; those activities require their own lawful scope and safeguards.

We will revise this notice as the service and its practices develop, and show the updated date above. Material changes will receive appropriate notice, with consent obtained where required before new processing begins. This notice is not an agreement to waive privacy rights.