Privacy notice

FusionX Media Ltd, registered in England and Wales under company number 15800878, of 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom, is the data controller for the personal data described in this notice.

Data protection enquiries: write to the data protection contact at FusionX Media Ltd, 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom, or ask the person who onboarded your organisation.

For the documents you upload about your own business, you are the controller and we act as your processor. We process that material only to provide the service to you.

• Account data: your name, work email address, hashed password and organisation name, so you can sign in and we know which workspace you belong to.
• Content you upload: the documents your team adds, and the structured evidence extracted from them. These may contain personal data, for example staff CVs, which is why they stay inside your isolated workspace.
• Usage and audit records: approvals, status changes and system events, including who approved what and when. These are deliberately append-only.
• Operational metadata: identifiers, counts, durations and AI costs used to run and support the service. Document text and prompt content are not written to logs.

Account data and content are processed to perform our contract with you. Operational metadata and security events are processed under our legitimate interest in running a reliable and secure service. Where we rely on legitimate interests, we have considered the impact on you and limited what we keep to metadata.

A short list of subprocessors, set out with their purposes on the security and data processing page. In summary: a model provider processes the excerpts a drafting or analysis task needs, under terms that do not permit that content to train their models, and a hosting provider stores the data at rest in Germany (EU). We do not sell personal data, and we do not share your content with other customers.

Your content is kept for as long as your workspace exists. When a workspace is deleted, rows, vectors, stored objects and generated artifacts are permanently removed. Backups are retained on a short rolling cycle and then overwritten. Append-only audit records are retained while the workspace exists, because their value is that they cannot be quietly rewritten.

Under UK data protection law you have rights of access, rectification, erasure, restriction, portability and objection. A full export of everything your workspace holds is built into the product rather than handled by request: an owner or admin starts it in Settings and downloads the bundle without asking us.

Deleting a workspace is run by us rather than exposed as a button, so that an account cannot be destroyed mid-pilot by a single click. An owner or admin can ask us to delete the workspace using the contact details above. We will confirm the request with an owner, run the deletion, and confirm in writing when it has completed, within one month of the request. Deletion permanently removes rows, vectors, stored objects and generated artifacts; backups that still contain the data are overwritten on the short rolling cycle described above. If the law lets us keep something, for example records needed to establish or defend a legal claim, we will tell you what we kept and why.

If your request concerns personal data inside documents your organisation uploaded, your organisation is the controller for that material and we act on its instructions, so raise it with them and we will help them answer it. If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk.

If this notice changes materially we will tell customers directly rather than relying on you to notice a new date at the top of this page.