Privacy notice

Last updated: [1 November 2026]

This notice explains what personal information PaxCast collects, why, how long it is kept and what your rights are. PaxCast is a bus network planning tool made by Infin8 Digital Limited.

Who we are

PaxCast is provided by Infin8 Digital Limited, a company registered in England and Wales (company number 11906215). Our registered office is Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW. We are registered with the Information Commissioner's Office under reference ZC197263.

We are the data controller for information about visitors to our website, people who contact us, feedback and support, and how the PaxCast service is run. Where your organisation has a contract with us for PaxCast, we act as a data processor for your organisation for the account and project information it asks us to hold, and your organisation is the controller.

If you have a question about this notice or your information, or want to contact our Data Protection Officer, email contact@infin8.digital.

The data PaxCast analyses

The maps, figures and reports in PaxCast are built from published data, such as bus and rail timetables, stop registers, census statistics, OpenStreetMap and government transport statistics. Census figures are published as totals for small areas, never for individual people. PaxCast holds no information about individual passengers or journeys.

One published register, the Traffic Commissioners' record of operator licences, can name sole traders and partners and their premises. PaxCast does not show those names or exact addresses. It shows only the postcode sector.

Information we collect about you

What we collect depends on how you use PaxCast.

Your account

If your organisation has given you a PaxCast account, we hold your name, email address, organisation, role and the licence your organisation holds. We also record when you agreed to our terms of use and which version you agreed to.

Signing in

You sign in either with Google or with a six-digit code we email to you. If you use Google, Google tells us your email address and confirms it has been verified. If you use a code, we send it to your email address through Google Workspace's email service. We keep only a scrambled (hashed) copy of the code, it expires after ten minutes, and the email contains no sign-in link.

Your work

PaxCast keeps the projects, reports, comments and shared links you create, who you have shared them with, and the history of changes. People you share with can see what you shared and who it came from. Administrators of your organisation can see and manage your organisation's work.

If you save a scenario to the server on purpose (a "deposit"), we keep its route and settings under a random link for two years. We do not record who saved it.

How you use PaxCast

When you are signed in to an account, we record how PaxCast is used so that we can improve it and report usage to your organisation: for example, which layers, reports and features are used and roughly where on the map (to about a kilometre). We count searches but do not keep what you searched for.

AI features

If your organisation's licence includes AI features, we keep your conversations with the assistant and the explanations and notes it writes, so you can return to them. For each AI request we record who made it, which feature it was for, how much it used and whether it succeeded, so we can meter your organisation's allowance.

To answer your request, the text of your question, the relevant PaxCast figures and the information on your screen are sent through our own AI gateway to Anthropic, which provides the Claude AI models. Our gateway controls which models may receive which data. Pictures of your screen are not sent. Anthropic does not use this information to train its models, and deletes it within 30 days, except for content its safety systems flag, which it may keep for up to two years.

Feedback and support

If you send feedback, we keep what you write, a screenshot of your screen at that moment, the map settings you had on, the PaxCast version and who you are (your signed-in email address, or a name you choose to type). The form shows you this before you send it.

If you use Contact Support, we keep your messages, any pictures you attach and some basic information about your browser. When nobody is signed in, the conversation is linked to your browser by a random code, and we keep only a scrambled copy of it. Our team may be notified of new messages in Google Chat, including the first few lines of what you wrote. If the AI support feature is on, it may suggest an answer from the user guide, using Anthropic as described above.

The contact form on our website

If you use the contact form, we keep the details and message you send so that we can reply. Our team may be notified of it in Google Chat.

Visiting our website

We count visits to the PaxCast product pages without cookies and without storing your IP address. To tell one visit from another, we combine your IP address, browser details and a random value that changes every day, and keep only a scrambled result. We cannot use it to recognise you on a later day or on another website. We keep the page you visited, the site that linked to it, your screen size, language and time zone, and what you clicked.

Connecting Claude

If an administrator connects an AI assistant such as Claude to PaxCast, we keep a record of the connection and who approved it. Access tokens are stored only in scrambled form.

Security

To protect the service, we briefly use IP addresses to limit how many requests one connection can make. These are held in memory and not stored. We do not store IP addresses with feedback, support messages or website visits.

Cookies and your browser

PaxCast uses only cookies that are strictly necessary:

• a session cookie that keeps you signed in, for up to seven days
• short-lived cookies used while you sign in

We do not use advertising cookies or third-party tracking.

PaxCast also stores some information in your own browser (local storage): your map and layer settings, the projects you have saved on this device, and a random code that links you to your support conversation. This stays on your device and is not sent to us unless you use the feature it belongs to. You can clear it in your browser settings.

Why we use your information (lawful basis)

• To provide PaxCast to you and your organisation (accounts, sign-in, projects, reports, support): performance of our contract with your organisation and our legitimate interest in providing the service it has licensed.
• To meter licences and report usage to your organisation: our legitimate interest, and our contract with your organisation.
• To improve PaxCast and respond to feedback and enquiries: our legitimate interest.
• To keep the service secure: our legitimate interest.
• To keep records we are required to keep: legal obligation.

Who we share it with

We do not sell your information. We share it only with:

• Akamai Cloud (formerly Linode), which hosts the PaxCast servers in the United Kingdom
• Infin8 Central, our own data platform, also hosted on Akamai Cloud in the United Kingdom, where accounts, projects, reports, feedback and AI conversations are stored
• Google, through Google Workspace, which sends our emails, including sign-in codes, and carries our team's notifications in Google Chat; and Google sign-in, if you choose to use it
• Anthropic, which provides the AI models behind PaxCast's AI features
• administrators of your organisation, and the people you choose to share your work with
• law enforcement or regulators, where the law requires it

We only share personal information with suppliers under a written contract that protects it.

Where your information is stored

PaxCast and Infin8 Central are hosted in the United Kingdom. Some of our suppliers, including Google and Anthropic, may process information outside the UK, including in the United States. Where they do, we use a recognised safeguard, such as UK adequacy regulations or the ICO-approved UK Addendum to the EU standard contractual clauses.

How long we keep it

• Account information, projects and reports: for as long as your organisation's contract is in force, and for up to 30 days after it ends, unless the law requires us to keep them longer.
• Usage records: 396 days.
• AI conversations: 180 days. Anthropic deletes what it receives within 30 days, as described above.
• AI usage records (no content): for as long as your organisation's contract is in force, and for up to 30 days after it ends.
• Deposited scenarios: two years.
• Feedback, support conversations and contact form messages: until they are dealt with and deleted, and no longer than 30 days after your organisation's contract ends.
• Website visit statistics: 396 days.
• Sign-in codes: ten minutes.
• Records of agreeing to the terms of use: for as long as your organisation's contract is in force, and for up to 30 days after it ends.

Keeping it safe

PaxCast runs over encrypted connections, and personal information is encrypted when it is stored and when it is sent. Sign-in codes, access tokens and support codes are stored only in scrambled form. Administrative access needs multi-factor authentication. Infin8 Digital Limited holds Cyber Essentials certification. If a personal data breach puts your rights at risk, we will tell the Information Commissioner's Office within 72 hours and tell you without undue delay.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct it
• ask us to delete it
• ask us to restrict or object to how we use it
• ask for your information in a portable format

To use any of these rights, email contact@infin8.digital. We will reply within one month. Where we hold your information on behalf of your organisation, we may pass your request to them.

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Children

PaxCast is a professional tool and is not intended for children.

Changes to this notice

We may update this notice. The date at the top shows when it last changed.