Privacy Policy

Last updated on April, 2026

This privacy policy ("Privacy Policy") describes the types of personal information that Shanghai Xinchen Suben Intelligent Technology Co., Ltd. (dba Innflows) ("Innflows," "we," "our," and/or "us") collects, uses, and discloses from individuals ("you" or "your") who use our website (including https://www.innflows.com/) and services that link to this Privacy Policy (collectively, our "Services"). As used in this Privacy Policy, "personal information" means any information relating to an identified or identifiable individual.

By using our Services, you agree to the collection, use, disclosure, procedures, and other processing described in this Privacy Policy. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service.

This Privacy Policy does not apply to the extent we process personal information in the role of a processor or service provider on behalf of our customers, including where we offer to our customers our AI GEO platform and related software-as-a-service products. In that context, our customers are the data controllers, and our processing of that personal information is governed by our applicable customer contracts.

Personal Information We Collect
How We Use the Personal Information We Collect
AI Video Generation, Digital Avatars, and Biometric Information
Legal Bases for Processing European Personal Information
How We Disclose the Personal Information We Collect
Your Choices
Third Parties
Retention
Security
Children's Privacy
International Visitors
Changes to this Privacy Policy
Contact Information

1. Personal Information We Collect

We may collect a variety of personal information from or about you or your devices from various sources, as described below. Where applicable, we indicate whether and why you must provide us with your personal information, as well as the consequences of failing to do so. If you do not provide your personal information when requested, you may not be able to use our Services if that personal information is necessary to provide you with our Services or if we are legally required to collect it.

A. Personal Information You Provide to Us

Contact Information. We may collect your personal information when you inquire about our Services or when you sign up for, attend, or take part in our demos, events, webinars, or programs. This information may include your full name, work email, company name, company size, and any information you choose to provide to us.

Communications. If you contact us directly, we may receive information about you, such as your name, email address, the contents of a message or attachments that you may send to us, and other information you choose to provide. When you sign up for news and updates, we will collect your email address. When we send you emails, we may use embedded pixels or other technologies to track information about your receipt and interaction with our emails, such as whether and when you open them, whether you access any links included in our emails, your Location Information (described below), and your Device Information (described below), to learn how to deliver a better customer experience and improve our Services.

Account Information. We collect the information you provide to create, update, or manage your account on the Services, including, without limitation, your email address, phone number, and your name. You may also elect to provide a profile photograph for your account and the organization you have established on the Innflows platform.

Careers. If you decide that you wish to apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience.

Payment Information. If you make a payment on our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf.

Likeness, Voice, and Biometric Information. If you use our AI Video Generation features, including creating a custom digital avatar or recording real-person video for AI-generated content, we may collect the following categories of sensitive personal information:

Facial imagery and video recordings: Photos, videos, or live recordings of your face and body that you upload or capture through our Services for the purpose of creating AI-generated video content or a digital avatar.
Voice recordings: Audio recordings of your voice that you provide for voice cloning or AI voice synthesis features.
Biometric identifiers: Data derived from your facial imagery and voice recordings that may constitute "biometric identifiers" or "biometric information" under applicable laws, including scans of facial geometry and voiceprints. These are used to generate and animate your digital avatar or to produce AI video content that reproduces your likeness.
Likeness data: Digital representations of your physical appearance, facial expressions, gestures, and mannerisms created through AI processing of your uploaded media.

We collect this information only with your explicit, informed consent prior to any processing. You will be presented with a separate consent form before using any AI Video Generation feature that involves your likeness, voice, or biometric data.

B. Personal Information We Collect When You Use Our Services

Location Information. When you use our Services, we infer your general location information, for example, by using your internet protocol (IP) address.

Device Information. We receive information about the device and software you use to access our Services, including IP address, device type, device identifiers, web browser type and version, and operating system version.

Usage Information. We automatically receive information about your interactions with our Services, like the pages or other content you view, referrer information (the website you visited before coming to our Services), the dates and times of your visits, your log data, and the purchases you make.

Information from Cookies and Similar Technologies. We and our third-party partners may collect information using cookies, which are small files of letters and numbers that we store on your browser or the hard drive of your computer. We and our third-party partners may also use pixel tags and web beacons on the Services. We use cookies, beacons, invisible tags, and similar technologies (collectively "Cookies") to collect information about your browsing activities and to distinguish you from other users of the Services. This aids your experience when you use the Services and allows us to improve the functionality of the Services.

We use the following types of Cookies:

Strictly Necessary Cookies. Some Cookies are strictly necessary to make the Services available to you. We cannot provide you with the Services without this type of Cookies.
Functional Cookies. Functional Cookies are used to recognize you when you return to the Services. This enables us to adapt our content for you and remember your preferences.
Analytical and Performance Cookies. We also use Cookies for website analytics purposes to operate, maintain and improve the Services. We may use our own analytics Cookies or use third-party analytics providers such as Google Analytics.
Advertisement Cookies. We also use Cookies for advertisement purposes to provide visitors with customized advertisements based on the pages you visited previously, and to analyze the effectiveness of the ad campaigns.

Please review your web browser's "Help" file to learn how you may modify your Cookie settings. Please note that if you delete or choose not to accept Cookies from our Services, you may not be able to utilize the features of our Services to their fullest potential.

2. How We Use the Personal Information We Collect

We use the personal information we collect:

To provide, maintain, improve, and enhance our Services;
To personalize your experience on our Services such as by providing tailored content and recommendations;
To understand and analyze how you use our Services and develop new products, services, features, and functionality;
To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
To generate anonymized or aggregate data containing only de-identified, non-personal information that we may use for any lawful purposes;
To facilitate transactions and payments;
To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;
For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
For other purposes for which we provide specific notice at the time the information is collected.

3. AI Video Generation, Digital Avatars, and Biometric Information

This section applies specifically to users who utilize our AI Video Generation features, including real-person AI video creation and digital avatar services. If you do not use these features, this section does not apply to you.

A. Scope and Definitions

"AI Video Generation" refers to our Services that use artificial intelligence to create video content featuring real human likenesses or digital avatars, including but not limited to text-to-video generation, avatar-based video creation, and AI-powered video editing with human subjects.
"Digital Avatar" means a computer-generated digital representation of a real person's appearance, facial expressions, gestures, voice, and mannerisms, created using AI models trained on that person's uploaded media.
"Depicted Person" means the natural person whose likeness, voice, or appearance is reproduced or simulated in AI-generated video content, whether through a digital avatar or real-person video features.

Prior Written Consent. Before we collect, capture, or otherwise obtain any biometric identifiers or biometric information from you or any Depicted Person, we will:

Inform you in writing that biometric identifiers and biometric information will be collected, stored, and used;
Inform you in writing of the specific purpose and length of time for which your biometric identifiers and biometric information will be collected, stored, and used; and
Obtain your written consent (which may be provided electronically) to the collection, storage, and use of your biometric identifiers and biometric information.

Third-Party Depicted Persons. If you upload media depicting a person other than yourself for the purpose of creating AI-generated video content or a digital avatar, you represent and warrant that:

You have obtained the explicit, informed, written consent of the Depicted Person for the collection, use, and processing of their likeness, voice, and any biometric information derived therefrom;
You have informed the Depicted Person of the nature and purpose of the AI video generation, including that their likeness will be used to create AI-generated content;
You have the legal authority to grant such consent on behalf of the Depicted Person, or the Depicted Person has directly provided such consent; and
The Depicted Person has been informed of and agrees to the terms of this Privacy Policy as they relate to their likeness and biometric information.

Innflows reserves the right to require verification of third-party consent, including but not limited to requiring a recorded consent statement from the Depicted Person, before processing any AI video generation request involving a third party's likeness.

C. How We Use Likeness and Biometric Information

We use likeness, voice, and biometric information solely for the following purposes:

To create, generate, render, and deliver AI-generated video content as requested by you through the Services;
To create, train, and operate your custom digital avatar within the Services;
To improve the quality, accuracy, and realism of AI-generated video output;
To verify the identity of the Depicted Person and confirm consent authorization;
To detect and prevent misuse, fraud, or unauthorized use of another person's likeness; and
To comply with applicable laws and respond to lawful requests from governmental authorities.

We do not use your likeness or biometric information for any purpose other than those listed above without obtaining your separate, explicit consent. We do not sell, lease, or trade your biometric information for profit.

D. Disclosure of Biometric Information

We may disclose your biometric information only to the following categories of recipients:

AI processing service providers: Third-party vendors that provide AI model inference, video rendering, and related computational services necessary to generate AI video content on our behalf. These service providers are contractually restricted with respect to their use and disclosure of biometric information they process on our behalf.
Cloud infrastructure providers: Hosting and storage providers that store encrypted biometric data as part of our service infrastructure, subject to contractual data protection obligations.
As required by law: We may disclose biometric information if required by a valid court order, subpoena, or other legal process, or if necessary to protect the rights, property, or safety of Innflows, our users, or others.

We do not disclose biometric information to any other third parties, including advertising partners or analytics providers.

E. Retention and Deletion of Biometric Information

Active account retention: We retain your biometric identifiers and biometric information for as long as your account is active and you maintain an active digital avatar or have active AI video generation projects.
Post-deletion retention: Upon your request to delete your digital avatar or biometric data, or upon termination of your account, we will permanently and irretrievably delete all biometric identifiers and biometric information within thirty (30) days, except where a longer retention period is required by applicable law.
Illinois residents: For residents of Illinois, biometric information will be retained until the earlier of (i) the initial purpose for collecting or obtaining such biometric information has been satisfied, or (ii) three (3) years following your last interaction with us, in accordance with the Illinois Biometric Information Privacy Act (740 ILCS 14/1, et seq.) ("BIPA").
Automated deletion: If your account has been inactive for a continuous period of twenty-four (24) months, we will automatically delete all biometric identifiers and biometric information associated with your account and notify you of such deletion.

F. Security of Biometric Information

In addition to the general security measures described in Section 9 of this Privacy Policy, we implement the following additional safeguards for biometric information:

Biometric data is encrypted both in transit (using TLS 1.2 or higher) and at rest (using AES-256 or equivalent encryption);
Access to biometric data is restricted to authorized personnel on a need-to-know basis;
Biometric data is stored separately from other personal information where technically feasible;
We maintain audit logs of all access to and processing of biometric data; and
We conduct periodic security assessments of systems that store or process biometric information.

G. Your Rights Regarding Biometric Information

In addition to the rights described in Section 6 of this Privacy Policy, you have the following rights with respect to your biometric information:

Right to withdraw consent: You may withdraw your consent to the collection and use of your biometric information at any time by contacting us at sales@innflows.com or through the account settings in the Services. Withdrawal of consent will result in the deletion of your digital avatar and any stored biometric data, and you will no longer be able to use AI Video Generation features that require biometric processing.
Right to request deletion: You may request the permanent deletion of all biometric identifiers and biometric information we hold about you at any time.
Right to information: You may request information about the specific categories of biometric data we have collected about you, the purposes for which it is used, and the third parties to whom it has been disclosed.
Right to restrict processing: You may request that we restrict the processing of your biometric information to specific purposes.

Illinois Residents — Additional Rights Under BIPA: If you are a resident of Illinois, you have the right to bring a private cause of action against any party that violates BIPA's requirements regarding the collection, use, storage, and disclosure of your biometric identifiers and biometric information. No individual's likeness, voice, or biometric data is ever used to create a digital avatar or AI-generated video content without explicit, documented consent.

H. Prohibition on Unauthorized Use of Likeness

Users of our AI Video Generation features are strictly prohibited from:

Creating AI-generated video content using the likeness of any person without that person's explicit consent;
Using AI-generated video content to deceive, defraud, defame, harass, or impersonate any person;
Creating deepfake content or non-consensual intimate imagery;
Using AI-generated video content for any purpose that violates applicable laws, including but not limited to laws governing publicity rights, privacy rights, intellectual property rights, and anti-fraud statutes; and
Distributing AI-generated video content in a manner that falsely suggests endorsement by or affiliation with the Depicted Person.

Violation of these prohibitions may result in immediate termination of your account, deletion of all associated content and data, and referral to appropriate law enforcement authorities.

4. Legal Bases for Processing European Personal Information

If you are located in the European Economic Area ("EEA") or the United Kingdom ("UK"), we only process your personal information when we have a valid "legal basis," including as set forth below.

Consent. We may process your personal information where you have consented to certain processing of your personal information. For example, we may process your personal information to send you marketing communications or to use Cookies where you have consented to such use.
Contractual Necessity. We may process your personal information where required to provide you with the Services. For example, we may need to process your personal information to respond to your inquiries or requests.
Compliance with a Legal Obligation. We may process your personal information where we have a legal obligation to do so. For example, we may process your personal information to comply with tax, labor and accounting obligations.
Legitimate Interests. We may process your personal information where we or a third party have a legitimate interest in processing your personal information. Specifically, we have a legitimate interest in using your personal information for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of the Services. We only rely on our or a third party's legitimate interests to process your personal information when these interests are not overridden by your rights and interests.

5. How We Disclose the Personal Information We Collect

Partners and Affiliates. We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.
Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services.
AI Service Providers. We may disclose information we receive to vendors that provide artificial intelligence services that provide backend support for our Services.
Analytics Partners. We use analytics services such as Google Analytics to collect and process certain analytics data. You can learn more about Google's practices by visiting https://www.google.com/policies/privacy/partners/.
Advertising Partners. We work with third-party advertising partners to collect and process your information in order to show you ads that we think may interest you. Some of our advertising partners are members of the Network Advertising Initiative (https://optout.networkadvertising.org) or the Digital Advertising Alliance (https://optout.aboutads.info). Please visit their opt-out pages to learn about how you may opt out of receiving certain web-based personalized ads.
As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; (c) protect your, our, or others' rights, property, or safety; (d) protect against legal liability; or (e) to investigate fraud or other unlawful activity.
Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.
Consent. We may also disclose your information with your permission.

6. Your Choices

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.

Do Not Track. There is no accepted standard on how to respond to "Do Not Track" signals, and we do not respond to such signals.

Your European Privacy Rights. If you are located in the EEA or the UK, you have additional rights described below.

You may request access to the personal information we maintain about you, update, and correct inaccuracies in your personal information, restrict or object to the processing of your personal information, have your personal information anonymized or deleted, as appropriate, or exercise your right to data portability to easily transfer your personal information to another company.
In addition, you have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work or where an incident took place.
You may withdraw any consent you previously provided to us regarding the processing of your personal information at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdrew your consent.

You may exercise these rights by contacting us using the contact details at the end of this Privacy Policy.

How to Block Cookies. You can block Cookies by setting your internet browser to block some or all Cookies. However, if you use your browser settings to block all Cookies (including essential Cookies) you may not be able to access all or parts of the Services. Where required by applicable law, you will be asked to consent to certain Cookies and similar technologies before we use or install them on your computer or other device.

7. Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

8. Retention

When you request that we do so, we take measures to delete your personal information or keep it in a form that does not permit identifying you when this personal information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When we process personal information for our own purposes, we determine the retention period taking into account various criteria, such as the type of services provided to you, the nature and length of our relationship with you, possible re-enrollment with the Services, the impact on the Services we provide to you if we delete some personal information from or about you, and mandatory retention periods provided by law and the statute of limitations.

9. Security

We make reasonable efforts to protect your information by using security measures designed to safeguard the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

10. Children's Privacy

We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Services is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us at sales@innflows.com.

11. International Visitors

Our Services are intended for visitors located worldwide. If you choose to use our Services from the European Economic Area, the United Kingdom, or other regions of the world with laws governing data collection and use that may differ from the laws of the People's Republic of China, then please note that you may be transferring your personal information outside of those regions for storage and processing.

We may transfer personal information from the EEA or the UK to other jurisdictions based on European Commission-approved or UK Government-approved Standard Contractual Clauses, or otherwise in accordance with applicable data protection laws. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

12. Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted.

13. Contact Information

Innflows is responsible and the data controller for processing your personal information. If you have any questions, comments, or concerns about our processing activities, please email us at:

Email: sales@innflows.com

Company: Shanghai Xinchen Suben Intelligent Technology Co., Ltd. (dba Innflows)

Address: Shanghai, China