Privacy Policy & Zero Data Retention

This Privacy Policy explains how Fusion Technologies ("Fusion", "we", "us") collects, processes, and protects information when you use our website, APIs, command-line interface (CLI), and developer platform.

Under global data protection laws (including GDPR and UK GDPR):

• Fusion as a Data Controller: We act as a controller for account management information, developer profile credentials, billing and payment records, and technical server telemetry.
• Fusion as a Data Processor: When you submit prompts, code, or end-user data through our inference API endpoints, we act as a data processor acting solely on your documented instructions pursuant to our Data Processing Addendum (DPA).

We collect minimal personal data strictly necessary to provide the Services:

• Account & Identity Data: Name, email address, OAuth account identifiers (e.g., GitHub, Google), and hashed authentication credentials.
• Billing & Payment Records: Billing address, transaction history, payment method tokens, and tax identification numbers. Note that credit card and banking details are processed directly by our secure payment partners (e.g., Suby at suby.fi) and are never stored on Fusion servers.
• API Usage & Operational Telemetry: API key identifiers, model IDs requested, input token counts, cached token counts, completion token counts, HTTP status codes, request latencies, and client IP addresses.

Unlike traditional API aggregators that store prompts for analytics or retraining, Fusion is engineered with a strict Zero Data Retention (ZDR) proxy pipeline:

• In-Memory Streaming: Requests received at our Cloudflare edge workers are parsed, authenticated, and piped to upstream model nodes entirely in volatile memory (RAM).
• Immediate Discard: As response chunks stream back to your application, memory buffers are released immediately. No persistent database record contains your prompts, completions, or tool call arguments.
• Edge Prefix Caching: Where prompt caching is enabled, ephemeral cache entries are stored in encrypted in-memory key-value caches with short time-to-live (TTL) expiry, partitioned strictly to your customer workspace.
• No AI Training: Your data is never used to train, fine-tune, evaluate, or improve any public or proprietary machine learning models.

We use the personal data we collect exclusively to:

• Authenticate your identity and manage workspace permissions;
• Route API requests and calculate token-based billing accurately;
• Enforce rate limits, prevent brute-force attacks, and mitigate abuse;
• Send critical transactional notices (e.g., security alerts, low balance notifications, invoice receipts);
• Comply with applicable legal, statutory, and accounting obligations.

For individuals located in the European Economic Area (EEA) and the UK:

• Performance of a Contract (Art. 6(1)(b)): To provide the Services, process payments, and honor our Terms of Service.
• Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure security, prevent fraudulent API key abuse, and optimize edge gateway latency.
• Legal Obligation (Art. 6(1)(c)): To satisfy tax, audit, and statutory accounting regulations.

We do not sell, rent, or trade your personal information. We only disclose data to trusted third-party service providers who assist in operating our infrastructure:

• Edge & Cloud Infrastructure: Cloudflare (global edge computing, D1 database, KV edge caching).
• Payment Processors: Suby (suby.fi) for cryptocurrency and checkout settlement, and local payment providers.
• Upstream Model Providers: When you invoke specific models, inference traffic is routed to the selected provider (e.g., DeepSeek, MiniMax, Moonshot/Kimi, OpenAI, Anthropic) solely to execute the requested inference.

For a complete list of all third-party service providers and upstream AI compute nodes, visit our Subprocessors Registry.

Fusion minimizes browser tracking. We do not use third-party behavioral advertising cookies or sell data to data brokers.

• Essential Cookies: Secure session cookies managed by Better Auth to maintain authenticated login states.
• Local Storage: Used exclusively to preserve UI preferences, such as light/dark theme selection.
• Privacy-Preserving Telemetry: Aggregate system health metrics to identify 5xx gateway errors and latency spikes.

Fusion operates globally across Cloudflare edge data centers. Personal data collected through account registration may be stored and processed in the United States or other jurisdictions where our infrastructure partners operate.

When we transfer personal data originating from the EEA, UK, or Switzerland to third countries without an adequacy decision, we rely on standard contractual clauses (SCCs) approved by the European Commission and UK International Data Transfer Addendum, supplemented by technical encryption safeguards.

We implement comprehensive technical and organizational measures (TOMs) to safeguard your data against accidental loss, destruction, or unauthorized access:

• Encryption in Transit: Mandatory TLS 1.3 encryption for all HTTP API calls and WebSocket connections.
• Authentication Hardening: Passkey (WebAuthn) support, secure hash algorithms for passwords, and hashed storage of API keys.
• Cloudflare Edge Protection: Automated WAF, rate limiting, bot detection, and multi-terabit DDoS scrubbing.
• Principle of Least Privilege: Internal administrative access is restricted via zero-trust access controls with multi-factor authentication.

Depending on your location, you hold statutory rights regarding your personal data:

• Right of Access & Portability: Request a copy of personal data we hold about you in a structured format.
• Right to Rectification: Correct inaccurate or incomplete account details.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account and associated personal data.
• Right to Restriction & Objection: Restrict or object to processing under certain circumstances.
• CCPA/CPRA Non-Discrimination: California residents have the right not to receive discriminatory treatment for exercising privacy rights. Fusion does not sell or share personal information for cross-context behavioral advertising.

To exercise your rights, email privacy@fusioncode.app. We respond to all verified requests within thirty (30) days.

The Services are designed strictly for developers, technical enterprises, and commercial applications. Fusion does not knowingly collect or solicit personal data from children under the age of 18. If we discover that a child under 18 has provided us with personal data, we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect technological advancements, regulatory updates, or changes in our infrastructure. We will indicate the date of the latest revisions at the top of this page. If we make material changes, we will notify you through email or an alert in the developer dashboard.

For questions, privacy requests, or security disclosures: