Privacy Policy

1.1 Who We Are

This Privacy Policy applies to all websites, products, browser extensions, APIs, software applications, and services operated by FluxFuse Technologies Limited ("FluxFuse", "we", "us", or "our").

For the purposes of the General Data Protection Regulation (GDPR), the UK Data Protection Act, and applicable international privacy legislation, FluxFuse Technologies Limited acts as the Data Controller for personal data collected through our public websites and marketing channels, and acts as a Data Processor when handling data on behalf of enterprise clients under a Master Services Agreement.

1.2 Our Architectural Privacy Principle

We engineer software with a local-first and minimal-telemetry philosophy. Where possible, our standalone tools store databases and documents locally on your devices rather than syncing them indiscriminately to remote cloud vaults. We never sell your personal data, and we do not monetize user tracking.

2.1 Information You Provide Directly

• Contact & Communication Data: When you submit inquiry forms, book architecture calls, or email our support desk, we collect your name, email address, company name, and details of your request.
• Account Registration Data: When signing up for developer dashboards or cloud tools, we record your username, email, encrypted credentials, and profile settings.
• Billing Information: Payment transactions are handled directly by PCI-DSS certified payment processors (e.g. Stripe). FluxFuse does not store full credit card numbers or security codes on our servers.

2.2 Product-Specific & Local Data

• Desktop & Local-First Applications (DeskSync): DeskSync stores your file indexes, local vector databases, and assets on your local hardware. Background cloud synchronization only occurs if you explicitly link and authorize a remote backup provider.
• Browser Extensions (PromptCraft, TabShield): Our browser extensions operate on minimal permissions. They do not monitor, store, or transmit your overall browsing history. Prompt vaults and user preferences are retained locally in your browser’s extension storage sandbox.

2.3 Automatically Collected Technical Data

When you browse our websites or use online APIs, our servers automatically log technical metadata, including: IP address (anonymized where applicable), browser type and version, operating system, referrer URL, timestamps, and performance telemetry necessary to prevent DDoS attacks and ensure server reliability.

3.1 Zero Model Training on Customer Data

We respect the confidentiality of your proprietary business logic, prompts, and document contents. FluxFuse does NOT use customer inputs, client codebases, or private prompts to train, fine-tune, or improve public machine learning models.

3.2 Secure API Processing

When our AI automation pipelines communicate with enterprise foundation models (such as OpenAI, Anthropic, or Google Vertex AI), requests are transmitted exclusively over encrypted TLS connections using enterprise-tier API endpoints bound by contractual zero-data-retention or strict non-training policies.

4.1 Purposes of Processing

We process personal data strictly for legitimate operational purposes:

• To build, deploy, execute, and maintain our software applications and services.
• To perform engineering sprint deliverables and client commitments outlined in signed contracts.
• To process billing, invoices, account renewals, and subscriptions.
• To provide technical support, troubleshoot bug reports, and respond to inquiries.
• To monitor security, investigate unauthorized activities, and safeguard system integrity.
• To comply with statutory tax, accounting, and legal requirements.

4.2 Legal Bases Under GDPR

If you reside in the European Economic Area (EEA) or UK, our lawful bases for collecting personal data include:

• Performance of a Contract: Providing services you have requested or purchased.
• Legitimate Interests: Securing our networks, improving software stability, and managing client relationships.
• Legal Obligation: Maintaining accounting and tax compliance records.
• Consent: Where you provide explicit opt-in consent for specific notifications or cookies.

5.1 Essential Cookies & Local Storage

Our website uses essential local browser storage to save your UI preferences (such as light or dark theme modes). These items are strictly functional and do not track you across external websites.

5.2 Privacy-Respecting Analytics

We may utilize aggregated, privacy-conscious analytics tools (such as Google Analytics 4 with IP anonymization enabled) to understand traffic patterns and optimize page speed. You can disable cookies at any time via your browser settings without impacting website functionality.

6.1 Third-Party Service Providers

We do not sell, rent, or trade your personal information to third parties. We share data only with trusted service providers who adhere to strict data security standards:

• Hosting & Edge Delivery: Vercel and Cloudflare.
• Payment Processing: Stripe, Inc.
• Cloud Databases & Storage: Supabase, AWS, or client-specified infrastructure.

6.2 Security Safeguards

We implement industry-standard organizational and technical safeguards, including modern TLS 1.3 encryption in transit, AES-256 encryption at rest for cloud databases, multi-factor authentication for administrative access, and regular code reviews.

6.3 Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, maintain active customer accounts, resolve disputes, and satisfy statutory tax and legal obligations.

7.1 Rights Under GDPR (EEA & UK Users)

If you reside in the EEA or UK, you possess the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data under certain conditions.
• Right to Restrict Processing: Request temporary restriction of processing activities.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct marketing.

7.2 Rights Under CCPA / CPRA (California Residents)

California residents have the right to know what personal information is collected, request deletion of their information, opt out of any sale or sharing of personal data (FluxFuse does not sell personal data), and receive equal service without discrimination.

7.3 Exercising Your Rights

To exercise any of these rights, please submit a written request to privacy@fluxfuse.net. We will respond within thirty (30) days following identity verification.

Data Protection Inquiries

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data protection practices, please contact our Data Protection Officer: