Your service, data and rights
Privacy Policy
How we handle your information, which services help us provide Fuzed Flow, and the choices and rights available to you.
Last updated:
1. Who we are and who this policy covers
Fuzed Flow ("we", "us" or "our") provides subscription software for contractors and trade businesses. This policy explains how we handle personal information through www.fuzedflow.com, app.fuzedflow.com, support, and the related client, employee and contractor portals.
We offer the service in English to businesses in English-speaking countries worldwide, including Canada, the United States, the United Kingdom, Ireland, Australia and New Zealand, subject to applicable law and provider availability. Your privacy rights depend on the laws that apply to you; this policy does not replace those rights.
We determine how account, billing, website and support information is used. For personal information a subscribing business puts into its workspace, such as customer and employee records, that business normally determines the purposes of processing and we handle the information to provide the service on its behalf. If your contractor or employer entered your information, contact that business about its records. We can help route a request.
Contact our privacy team by calling 1(855) 904-5509 or using our contact form. You do not need an account to make a privacy request.
2. Information we collect and where it comes from
- Account and business details: names, email addresses, telephone numbers, company details, account identifiers, roles, permissions and preferences supplied by you or your company administrator.
- Workspace records: lead and customer contacts, site and billing addresses, quotes, invoices, change orders, files and photographs, project notes and schedules, tasks, time entries, expenses, employment details entered by your company, approvals, client updates and project closeout records.
- Communications: demo and contact form details, support messages, email and SMS content and recipients, delivery events, and portal responses or approval records.
- Billing and payment records: subscription and transaction references, billing addresses, tax details, payment status and related accounting records. Stripe processes payment credentials and connected-account verification information through its payment and onboarding services; we do not store full payment card numbers or card security codes in our application database.
- Technical and usage information: IP addresses, browser and device information, access and security logs, page paths, general location derived from network information, performance measurements and events such as a trial-link click or resource download.
- AI requests: text you submit for rewriting or help, relevant recent help conversation and the context needed to return an answer, as explained below.
Information comes from you, your business and its authorized users, people responding to shared documents or portals, enabled service providers, and your browser or device. Provide only information you have the right to share. Avoid unnecessary sensitive information, passwords, payment credentials and government identifiers in free-text fields, support messages or AI requests.
3. How and why we use information
We use information to create and secure accounts, provide workspace and portal features, process subscription billing and payment records, deliver communications you request, respond to enquiries, operate selected AI features, investigate problems, prevent misuse and improve service reliability. We also keep records and respond to legal requests where required.
Where UK or European data protection law applies and we determine the processing purpose, our legal bases are performing our agreement with you, meeting legal obligations, and legitimate interests such as securing and maintaining the service, answering business enquiries and understanding aggregate website use. We consider your interests and rights when relying on legitimate interests. Where processing requires consent, including any marketing or optional tracking that requires it, we obtain that consent separately; you can withdraw it.
For workspace information we process on a business's behalf, the business is responsible for its lawful basis, notices and instructions. Providing required account or billing details is necessary to supply the relevant service; optional enquiry fields are marked as optional.
4. OpenAI features and ChatGPT development tools
AI features you choose in the app
AI Rewrite, available on eligible Professional and Business plans, sends the text in the selected supported field to OpenAI to generate revised wording. The rewrite usage record contains operational details such as company and user identifiers, field category, character counts, status and timing; that usage record does not contain the submitted or rewritten text. Text you save in a quote, invoice, update or other document remains in that document.
AI Help sends your question and relevant recent conversation to OpenAI. It uses relevant help articles you are permitted to access to prepare an answer. The current page path helps select those articles. A help question may also be processed to find related guidance. Review what you type and avoid including customer details that are unnecessary for your question.
OpenAI states that API inputs and outputs are not used to train its models by default, unless the API customer opts in. Provider security logs and other retention can still apply under OpenAI's terms and account settings. See OpenAI's API data controls. We do not promise zero retention by the AI provider.
ChatGPT, plugins and integrations used by our team
Our team uses OpenAI's ChatGPT and connected apps, plugins or integrations to help plan, develop, test, maintain and support Fuzed Flow. Depending on the permissions granted and the task, these tools may process source code, technical documentation, configuration, deployment information, diagnostic logs, and operational or account information needed to investigate an issue or administer the service.
When personal information is needed for a development or support task, we limit its use to the task and reduce or redact it where practical. Connected providers receive the information needed for the operation their integration performs. Their terms and privacy practices also apply. ChatGPT's handling of development information depends on the product, account controls and connected service; the API statement above is not a blanket promise about every ChatGPT conversation or third-party plugin.
Using Fuzed Flow does not connect your personal ChatGPT account or require you to install these development tools. AI assistance does not replace our responsibility for the service. You should check AI output before saving, sending, approving or relying on it.
5. Who receives information
We do not sell personal information or share it for cross-context behavioural advertising. We disclose information for the following service and operational purposes:
- Your business and intended recipients: authorized workspace users, customers, employees, contractors and other recipients selected by your business. Information available to them depends on the relevant role, document, portal or sharing action.
- Supabase: application database, authentication and file storage.
- Vercel: website and application hosting, deployment, website analytics and performance measurement.
- Stripe: subscription billing, online payments, connected-account onboarding, payment records and fraud prevention. Stripe also processes some information for its own legal and payment obligations.
- Resend and Twilio: email and SMS recipients, message content and delivery information when those communications are used.
- OpenAI: selected AI requests and the development or support information described above.
- GitHub and connected development tools: source control, technical collaboration and the information required for authorized development operations.
We may also disclose information to professional advisers, to comply with applicable law, to protect rights and security, or as part of a business transfer subject to appropriate confidentiality and applicable privacy requirements. An integration you enable may have its own processing purposes and privacy notice. Availability of the SaaS does not mean every payment or messaging feature is supported in every country.
People with access to a shared document or portal link may see the information made available through that link. Choose recipients carefully and contact support if a link needs to be withdrawn.
6. International processing and data location
Our current primary application database is hosted in the United States. Our team and service providers may process information in Canada, the United States and other countries where they operate. These countries may have different privacy laws, and information may be accessible to authorities under their laws. We do not offer a general promise that information stays in your country.
Where applicable law requires safeguards for an international transfer, we must use a permitted transfer arrangement. Depending on the provider and destination, this may involve a recognized adequacy decision, contractual protections such as standard contractual clauses and any required supplementary measures, or another lawful mechanism. Call 1(855) 904-5509 or use our contact form to ask about the arrangements applicable to your information and how to obtain details of relevant safeguards.
If your business has particular data residency, employment or regulated-data requirements, contact us before uploading that information so we can establish whether the service is suitable.
8. Security, retention and deletion
We use access permissions, company-based database restrictions, encrypted connections and other safeguards designed to protect information. No online service can guarantee complete security. Protect your account, review authorized users and shared links, and report a suspected security issue by calling 1(855) 904-5509 or using our contact form.
We retain account and workspace information while needed to provide the service and meet the business's instructions. Retention also depends on the purpose of the record, account status, legal or accounting requirements, unresolved disputes, security needs and backup cycles. We remove or de-identify information when it is no longer needed for those purposes. Copies in backups may remain until those backups are replaced, and providers may have their own retention obligations.
Subscription cancellation stops billing as confirmed in the billing portal; it is not automatically a request to delete every workspace or transaction record. Contact support for deletion or export assistance. A deletion request may be subject to legal retention requirements and the subscribing business's authority over its records. We explain relevant limitations when responding.
9. Your rights and how to exercise them
Depending on your location, our role and applicable law, you may request access to your information, a copy of it, correction, deletion, portability or restriction of processing. You may withdraw consent where we rely on it, use an authorized agent where permitted, and complain to a relevant privacy regulator. Some laws also provide a right to appeal a declined request.
Your right to object: where applicable, you may object to processing based on legitimate interests and to direct marketing. Contact us to exercise this right. Withdrawing consent does not affect processing already lawfully carried out or records we must retain.
- Canada: rights may arise under PIPEDA and applicable provincial privacy laws, including access, correction and withdrawal of consent where permitted. You may contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority.
- United Kingdom and Ireland / EEA: where UK GDPR or EU GDPR applies, rights may include access, rectification, erasure, restriction, objection and data portability. You may complain to the UK Information Commissioner's Office, Ireland's Data Protection Commission, or your local supervisory authority.
- United States: applicable state laws may provide rights to know, access, correct, delete and obtain portable copies, and rights concerning sale, targeted advertising, certain profiling or sensitive information. We do not sell information or share it for cross-context behavioural advertising. We do not discriminate against you for exercising applicable rights.
- Australia and New Zealand: applicable privacy laws may provide access, correction and complaint rights, including complaints to the Office of the Australian Information Commissioner or New Zealand's Office of the Privacy Commissioner.
- Other countries: contact us about rights provided by your applicable local law. The countries listed here do not limit where eligible businesses can use the English-language service.
Use our contact form and start your message with "Privacy request", or call 1(855) 904-5509. Tell us what you are requesting and which business or account is involved. We may ask for proportionate information to verify an access or deletion request. Please do not send a password or payment card details. We respond within the period required by applicable law and explain any permitted extension or refusal.
If the information belongs to a business's customer or employment records, we may need to refer your request to that business or act on its instructions. You can still contact us for help. Marketing choices, account preferences and a business's operational messages are separate; contact the sender or support if you need help stopping a message.
10. Children and sensitive information
The service is intended for business use by adults authorized to act for their organization, not for children to open accounts. Do not knowingly submit children's information unless your business has a lawful reason and appropriate permissions. If you believe a child's information has been collected improperly, contact us.
Do not use the service for regulated health records or other specially regulated information without first confirming suitability with us. An ordinary subscription does not establish that we have agreed to every sector-specific data requirement.
11. Policy changes and contact
We update this policy as the service or our practices change and show the current revision date above. Where required, we provide notice of a material change and obtain any additional consent before using information for a new purpose that requires it. Continued use alone is not a substitute for consent where the law requires a separate choice.
For privacy, international transfer, security or data-processing questions, call 1(855) 904-5509 or use our contact form. Our Terms & Conditions explain subscription and service responsibilities.