In their website[1] you can read about their true "privacy" behavior:
> identity verification procedure may be triggered in the following cases (non-exhaustive list):
> - forgetting an Infomaniak account password (user account)
> - forgetting a login email address
> - deactivation of double authentication (2FA)
> - unlocking an Infomaniak account
> - during the first transfer of revenue for the product Ticketing
> - when ordering a product (suspicion of spam or fraud, brand name, etc.)
The same page also says the process may require mandatory geolocation, choosing ID card or passport, photographing the document, and taking a selfie with it.
[0]: https://play.google.com/store/apps/details?id=com.infomaniak...
[1]: https://www.infomaniak.com/en/support/faq/2418/getting-start...