Privacy policy

Martin Verrier, sole trader (EI, French micro-enterprise), SIRET 932 769 912 00019, 262 allée de la Cascade des Pins, 06610 La Gaude, France, publisher of Fuzain, is the controller of the processing described below. Data protection contact: contact@fuzain.ai. No data protection officer has been appointed (not required at this stage).

For project content (briefs, specifications, mockups, comments, invited members), Fuzain acts as a processor on behalf of the client organisation, which is the controller (article 28 GDPR; data processing agreement on request): please address your requests to that organisation first.

• Data: email address, name, chosen sign-in method (email link, Google or Microsoft), technical identifier, organisations, roles, invitations, notification preferences, sign-in dates.
• Purposes: create and secure your account, give you access to your organisations and projects, send you service emails (sign-in link, invitations, share links, notifications, quota and trial-end alerts). Every notification contains an unsubscribe link.
• Legal basis: performance of the contract (terms of use).
• Retention: lifetime of the account, then one year.
• Access: Fuzain; members of your organisations see your name and role.

• Data: briefs, imported specifications (extracted text), mockup specifications, mockups, comments, arbitration decisions, sign-offs and acceptance reports (signer’s name, email and date).
• Purposes: provide the service to the client organisation, including AI mockup generation and automatic classification of comments.
• Legal basis: contract with the client organisation (Fuzain as processor).
• Retention: duration of the subscription, trial or pilot access. When it ends, the organisation becomes read-only and its deletion, with all its content, is scheduled 30 days later; its administrators are notified by email, then again 7 days before. This period is extended while purchased AI credits remain valid, up to 12 months; a new subscription cancels the deletion. An organisation is also deleted 30 days after its administrator’s request, with a self-service export beforehand. The audit log, which serves as evidence of sign-offs, is kept for 12 months.

Do not enter or import any real personal or business data: mockups only work with fictitious data.

• Data: free nickname (public link) or name and email (named link), comments, encrypted fingerprint (HMAC) of the IP address, never the address itself.
• Purposes: collect feedback on a mockup, prevent abuse (rate limiting, moderation).
• Legal basis: legitimate interest of the client organisation and of Fuzain (service security).
• Retention: comments: same as project content; IP fingerprint: 30 days.

• Data: name, business email, firm, size, number of Power BI consultants, optional message, language, date and version of consent, encrypted fingerprint of the IP address.
• Purpose: contact you about the pilot programme.
• Legal basis: your consent, which you can withdraw at any time by writing to contact@fuzain.ai.
• Retention: 3 years after the last contact; IP fingerprint: 30 days.
• Access: Fuzain only; no data is sent to any third-party tool.

• Data: company name, billing address and email, VAT number and its verification (VIES), plan, seats, AI credits bought and used, invoices. Card details are entered only on Stripe’s payment page and never pass through Fuzain.
• Purposes: collect subscription and credit payments, issue invoices, apply VAT.
• Legal basis: performance of the contract and legal obligation (accounting records).
• Retention: invoices and accounting records: 10 years; other billing data: duration of the subscription, then deleted with the organisation; payment event log: 12 months.

• Data: audit log (author, action, date), AI call metadata (task, model, tokens, cost, status, no content), the host’s technical logs (IP address, browser, request).
• Purposes: service security, traceability of sensitive actions, cost control.
• Legal basis: legitimate interest.
• Retention: audit log: 12 months; AI metadata: 400 days; host logs: as set by the host.

Messages sent to contact@fuzain.ai or securite@fuzain.ai are processed to answer you (legitimate interest) and kept for 3 years after the last exchange.

• Vercel Inc. (United States): application hosting, functions run in Paris.
• Supabase (Supabase Pte. Ltd., Singapore): database and authentication, hosted in Paris.
• Resend (Plus Five Five, Inc., United States): email delivery, from the European Union (Ireland).
• Stripe (Stripe Payments Europe, Limited, Ireland): payment and invoices.
• OpenRouter (OpenRouter, Inc., United States) and the AI model providers it selects: AI generation and classification, with no retention (zero retention enforced on every call) and no training.
• OVHcloud (OVH SAS, Roubaix, France): contact@fuzain.ai mailbox and domain names.
• Google and Microsoft: only if you choose to sign in with their account, under their own policies.

Some providers are established outside the European Union or use their own sub-processors there: these transfers are covered by the European Commission’s standard contractual clauses and, where applicable, by the EU-US Data Privacy Framework. The database and authentication remain in the European Union. No data is sold or used for advertising.

Planned but not enabled to date: Sentry (error monitoring) and PostHog (product usage analytics). This policy will be updated before they are enabled.

You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time and to give instructions on your data after your death. Write to contact@fuzain.ai: you will receive an answer within one month. An organisation administrator can also export its data and request its deletion from the “Data and GDPR” page of the application.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).

Fuzain sets no advertising or audience-measurement cookies and uses no tracker that requires consent: no cookie banner is therefore shown. Only items strictly necessary for the service are used:

• Session cookies (set by Fuzain through Supabase; names starting with “sb-”; on app.fuzain.ai only): keep you signed in; secure and not accessible to scripts; 7 rolling days, or until you sign out.
• NEXT_LOCALE cookie (set by Fuzain): remembers the chosen language; 1 year.
• “theme” local storage (set by Fuzain, in your browser): remembers the light or dark theme; until you clear it.

Stripe’s payment page, to which you are redirected to pay, sets its own cookies (security, fraud prevention) under its own responsibility. You can delete these items in your browser settings; you will then need to sign in again.

This policy evolves with the service; the date of the last update is shown at the top of the page. Users are informed of any significant change by email or in the application.