FuseBase Privacy Policy

Thank you for visiting thefusebase.com, Nimbusweb.me and/or nimbusweb.co (collectively, the “Websites”) and/or one of our interconnected products, such as a FuseBase, Nimbus Note, Nimbus Clipper (kiokdhlcmjagacmcgoikapbjmmhfchbi), FuseBase Pro (fddbloohgcjopkmnjdeodjcfbgiimpcn), FuseBase Assistant (haafigbapbpbpnmgcknnmilaaaimggpk) and others (collectively, the “Products”), whether you access them online or by downloading the Product to your computer and/or mobile device.

This Privacy Policy describes how FuseBase collects, uses, discloses, stores, and otherwise processes Personal Data in connection with thefusebase.com, our applications, APIs, browser extensions, customer workspaces, AI-enabled features, and related products and services (collectively, the “Services”).

Who this applies to	Website visitors, prospects, account owners, workspace members, customer end users whose data is processed through the Services, support contacts, event attendees, and other individuals who interact with FuseBase.
Core AI position	FuseBase’s AI-enabled features rely primarily on third-party AI providers. FuseBase does not currently position itself as operating native first-party AI compute across the product.
Core AI position	FuseBase is responsible for the Services and infrastructure it controls. Third-party AI providers, customer-selected providers, customer-provided API keys, and external integrations remain subject to their own terms, policies, retention practices, and compliance posture.
Where customer terms may control	When we process customer content on behalf of a business customer, the customer agreement and any Data Processing Addendum may control over this Privacy Policy to the extent of any conflict.

1. Scope and Roles

This Privacy Policy applies to Personal Data processed through the Services and our website, including when you create an account, use a workspace, use AI-enabled features, contact support, request a demo, subscribe to communications, attend an event, integrate third-party services, or otherwise interact with us.

Depending on the context, FuseBase may act as a controller (or business) for Personal Data we collect for our own purposes, such as account administration, website analytics, billing, marketing communications you choose to receive, product improvement, security, and support; and as a processor (or service provider) when we process customer content, workspace data, or end-user data on behalf of a business customer under the applicable customer agreement and, where applicable, our Data Processing Addendum.

If you use the Services through an organization, that organization may control your use of the Services and may control certain processing of your Personal Data within the workspace.

2. Categories of Personal Data We Collect

We may collect the following categories of Personal Data, depending on how you interact with the Services:

• Account and profile information, such as name, email address, password or authentication credentials, profile photo, job title, company name, team role, workspace identifiers, and contact preferences.
• Contact, communications, and support information, such as phone number, mailing address, calendar and meeting details you provide, support tickets, survey responses, webinar registrations, demo requests, messages, attachments, and communications with us.
• Billing and transaction information, such as billing contact details, subscription information, order details, invoices, payment status, and limited payment-related metadata. Payment card data is typically processed by our payment service providers rather than stored by FuseBase.
• Device, network, and usage information, such as IP address, approximate location derived from IP, device and browser details, operating system, app version, timestamps, referral URLs, crash data, audit logs, authentication events, session data, feature usage, clicks, and performance telemetry.
• Workspace and content data, such as documents, files, notes, portal content, knowledge base entries, messages, comments, forms, workflow inputs, app configuration data, permissions settings, and other content uploaded to or created in the Services.
• AI-related content and metadata, such as prompts, instructions, code, files, attachments, generated outputs, summaries, automations, workflow artifacts, and application or portal configurations when you use AI-enabled features.
• Integration and connected-service data from systems you link to the Services, including Google Workspace, CRM systems, file storage, email systems, and similar integrations.
• Marketing and cookie-related data, such as cookie identifiers, analytics identifiers, page views, conversion data, campaign source data, and preferences collected through cookies and similar technologies, subject to your choices where required by law.
• Information from third parties, such as lead enrichment data, account invitation data, fraud-prevention signals, and information we receive from your employer or workspace administrator.

3. Sources of Personal Data

We collect Personal Data directly from you; automatically when you use the Services or visit our website; from your organization, workspace administrator, or account owner; from integrated third-party services and authentication providers; from our vendors, analytics providers, security providers, and payment providers; and from publicly available or lawfully obtained third-party sources used for business contact data, fraud prevention, or account support.

4. How We Use Personal Data

We use Personal Data to provide, operate, host, secure, and maintain the Services; create and administer accounts, organizations, workspaces, permissions, and billing; provide collaboration, portal, workflow, automation, API, and AI-enabled functionality; authenticate users, prevent fraud, detect abuse, investigate incidents, and enforce our terms and policies; provide customer support and troubleshoot issues; process purchases, subscriptions, renewals, invoices, and related commercial transactions; improve performance, reliability, usability, accessibility, and functionality of the Services; develop, evaluate, and improve product features, subject to our contractual commitments and applicable law; send service-related notices, account communications, legal notices, and administrative messages; send marketing communications where permitted by law or with your consent; comply with legal obligations, resolve disputes, exercise legal rights, and protect users, FuseBase, and others; perform analytics, reporting, forecasting, and business operations; and support mergers, acquisitions, financings, or other corporate transactions, subject to appropriate safeguards.

Where required under applicable law, we rely on one or more legal bases, including performance of a contract, compliance with legal obligations, legitimate interests, and consent.

5. De-identified and Aggregated Information

We may de-identify, aggregate, anonymize where appropriate, or otherwise process Personal Data so that it no longer reasonably identifies, relates to, describes, or can be linked to an identified or identifiable individual (“De-identified Information”). Subject to applicable law, De-identified Information is not treated as Personal Data under this Privacy Policy to the extent it cannot reasonably be used to identify you. We may use De-identified Information to operate, administer, analyze, secure, improve, and develop the Website, Services, and related features; for reporting, benchmarking, product analytics, research, and service improvement; and for other lawful business purposes. We may also disclose De-identified Information to service providers and other third parties for these purposes, provided that the information does not reasonably identify you or any specific individual.

6. AI-Enabled Features and Third-Party AI Providers

FuseBase uses Microsoft Azure to provide its standard managed AI features. When you use these features, prompts, instructions, relevant workspace content, uploaded materials, generated outputs, and associated technical metadata may be processed to provide the requested functionality. The information involved depends on the feature and the content submitted or made available to it.

Microsoft and, where applicable, third-party model operators involved in the selected service may process this information. Our Third-Party Services and Subprocessor List describes the relevant providers and their roles. A model’s name or developer does not, by itself, identify who receives your information.

Processing locations, retention, and safety-monitoring arrangements depend on the applicable service and deployment, subject to our contractual commitments and applicable Data Processing Agreement. Customer-connected AI providers and external integrations may have different arrangements.

When you use AI-enabled features, we may process AI-related content and metadata to provide the requested functionality, secure and maintain the Services, monitor abuse, troubleshoot issues, support users, perform analytics, and improve the Services, as described in the applicable agreement, this Privacy Policy, any DPA, and related documentation.

For FuseBase’s standard provider arrangements, FuseBase seeks to use commercial provider offerings that do not permit general-model training on customer AI content by default unless the customer expressly chooses to share data for that purpose. At the same time, ‘not used for training’ does not necessarily mean that data is never retained, logged, or otherwise processed for service delivery, security, support, abuse prevention, troubleshooting, analytics, or similar operational purposes.

Customers are responsible for confirming that their chosen AI setup is suitable for their intended use and the information they submit, whether they use FuseBase-managed AI or connect a provider through their own API keys or subscription accounts. For managed AI, customers can review FuseBase’s service documentation, provider disclosures, and agreed scope and contact FuseBase for clarification. For their own provider accounts, customers are responsible for reviewing and, where necessary, confirming the provider’s applicable terms, storage and processing arrangements, retention settings, and required agreements directly with that provider. These responsibilities do not change FuseBase’s obligations for the Services and processing it controls.

Health information may be submitted only within the scope expressly agreed under the DPA and any required Business Associate Agreement. Permission to store that information does not by itself authorize its use with AI features or integrations outside that scope.

7. Customer-Built Apps, Portals, Workflows, and Integrations

FuseBase may allow customers to build, configure, publish, host, deploy, or connect applications, portals, workflows, agents, automations, forms, websites, or other implementations using the Services, including with the assistance of AI-enabled features.

This Privacy Policy describes how FuseBase processes Personal Data for its own Services. It does not replace any privacy notices or disclosures that a customer may need to provide for a customer-built implementation. If you build or deploy an implementation that collects or processes Personal Data from end users, visitors, customers, patients, applicants, or other third parties, you are responsible for determining what additional privacy notices, consents, cookies disclosures, rights workflows, or compliance controls are required for that implementation.

For example, if you use FuseBase to build a portal, app, or workflow that is hosted in your environment, connected to your own AI provider, or integrated with another third-party service, the third-party providers involved in that setup may have their own privacy, security, retention, and compliance posture that you should evaluate.

8. Disclosure of Personal Data

We may disclose Personal Data to our affiliates and corporate group members; to hosting, infrastructure, security, analytics, support, communications, AI, payment, and other service providers and subprocessors acting on our behalf; to integration partners or providers where required to support a feature you request or enable; to your organization, workspace administrator, or account owner where your use of the Services is managed by that organization; in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction; to comply with law, legal process, lawful requests, court orders, or government requests; to protect the rights, safety, property, or security of FuseBase, our users, or others; and with your direction or consent.

We do not sell Personal Data for money. Depending on how you interact with our website and cookie settings, some analytics or advertising-related disclosures may be treated as ‘sale,’ ‘sharing,’ or targeted advertising under certain U.S. privacy laws. Where required, we provide notice and applicable opt-out rights.

For website analytics and advertising, cookie identifiers and related usage or campaign data may be disclosed as described in section 13 and the Third-Party Services disclosures, subject to applicable choices and law. These disclosures may fall within legal definitions of sale, sharing or targeted advertising without monetary payment. Customer content processed on instructions remains subject to the DPA; this notice does not authorize unrelated advertising use of that content.

9. International Data Transfers

FuseBase may process Personal Data in the United States and in other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where required, we take steps intended to provide an appropriate level of protection for transferred Personal Data, such as contractual safeguards, vendor due diligence, and security measures appropriate to the nature of the data and processing. If you would like additional information about available transfer safeguards, you may contact us using the details below.

10. LEGAL BASES FOR PROCESSING (EEA, UK, AND SIMILAR JURISDICTIONS)

Where required by applicable law, we process Personal Data on one or more of the following legal bases:

• to perform a contract with you or take steps at your request before entering into a contract;
• to comply with legal obligations;
• with your consent;
• to protect your vital interests or those of another person; and
• for our legitimate interests, such as operating, securing, maintaining, improving, supporting, and developing the Website and Services, preventing fraud and abuse, enforcing our agreements, conducting analytics, communicating with customers and prospective customers, and protecting our business, users, and infrastructure, where those interests are not overridden by your rights and freedoms.

If you have questions about the legal bases we rely on for a particular processing activity, you may contact us using the contact information provided in this Privacy Policy.

11. Your Data Protection and Privacy Rights

For processing FuseBase performs as controller, contact legal@thefusebase.com. For customer-controlled content, contact the relevant organization or workspace administrator; we support that customer under the DPA. Customer-authorization restrictions for processor requests do not prevent FuseBase from fulfilling its own controller duties. Customers acting for other controllers must maintain the necessary authorization and instruction chain.

Depending on your location and applicable law, you may have certain rights regarding your Personal Data. These may include the right to request access to the Personal Data we hold about you; request correction of inaccurate or incomplete Personal Data; request deletion of Personal Data; object to or request restriction of certain processing; withdraw consent where processing is based on consent; receive a portable copy of certain Personal Data in a structured, commonly used, and machine-readable format; opt out of certain marketing communications; appeal certain privacy-rights decisions where applicable; and lodge a complaint with a supervisory authority, regulator, or other competent data protection authority.

You may exercise applicable rights by contacting us using the contact information provided in this Privacy Policy. We may need to verify your identity before fulfilling certain requests, and we may limit or decline requests where permitted by applicable law.

11.1.1. to access the Personal Data which means you may obtain a confirmation if we process your Personal Data, and / or to access your Personal Data and the information, how we use your Personal Data;

11.1.2. to rectify inaccurate Personal Data which means you may request that we correct any incomplete or inaccurate Personal Data about you;

11.1.3. to object to processing which means that you may object to processing your Personal Data if we process them based on the legitimate interests (see the examples of our legitimate interests in section 10), use them for statistical purposes;

11.1.4. to make us your Personal Data portable which means that you may request that in certain circumstances we provide you with a copy of your Personal Data in structured, commonly used and machine-readable format. If you wish to have a copy of your Personal Data, we will aim to provide you with them within 14 days;

11.1.5. to have your Personal Data erased which means that you may request that we delete your Personal Data in some circumstances: for example, we no longer need them, or you withdraw your consent which was the basis for processing;

11.1.6. to withdraw consent to processing your Personal Data which means that you may withdraw your consent for processing your Personal Data. Such withdrawal will only affect processing of your Personal Data after it is given;

11.1.7. to restrict the processing which means that you may ask us to restrict or stop collection, use, processing and/or disclosure of your Personal Data;

11.1.8. to withdraw consent to electronic marketing which means that you may opt out receiving our marketing emails (if any);

11.1.9. to be informed about the safeguards which we arrange to transfer your Personal Data transfer to a third country or an international organization which means that you may ask us about these safeguards;

11.1.10. to file complaints which means that you may complain to a data protection authority about our collection and use of your Personal Data.

11.2. If you wish to exercise any of the rights specified in clauses 11.1.1-11.1.9, or have any questions concerning the Policy and / or your Personal Data, please, contact us at legal@thefusebase.com. We will review your request and offer a resolution or help to begin a dialogue to find a way out.

11.3. If you wish to opt out receiving our marketing emails (clause 11.1.8), please, contact us at legal@thefusebase.com or click the unsubscribe link in any our marketing email

11.4. You may complain directly to a competent supervisory authority or seek available judicial remedies without contacting FuseBase first. You may also contact us for help with your concern.

11.5. We may request proportionate identity-verification information where necessary. EU GDPR requests concerning our controller processing are normally free; any fee or refusal must have a lawful basis, such as a demonstrably manifestly unfounded or excessive request. We respond without undue delay and within one month. A necessary extension of up to two further months requires notice and reasons within the first month. Any more favorable applicable commitment, including the portability aim in clause 11.1.4, remains unaffected. Other requests follow applicable legal deadlines.

11.6. If you opt out of our marketing emails (clause 11.1.8) we may still need to send you emails in relation to the Website and Services; for instance, to inform you of the changes made to this Policy (section 19).

11.7. Please keep in mind that there may be exceptions to these rights under the EU data protection law, with which we must comply, or under the legislation, with which a data processor we engage must comply. Thus, we may reject the request about execution of your rights where permitted or required by these laws.

11.8. If we reject your request, we will describe the grounds for it in our response. In any case, you may file a complaint for our refusal to the supervisory authority.

12. Data Retention

Where FuseBase acts as processor or further processor, the applicable DPA’s instructions, retention limits and return/deletion duties govern. General retention purposes or technical limitations below do not override them. Cancellation of renewal, expiry of an entitlement, deletion of one hosted application, suspension and account closure have different effects. Ending one app does not close an otherwise active account. Applicable return duties remain in effect when access is suspended; optional migration or conversion work does not condition legally required assistance.

We retain Personal Data for as long as necessary to provide the Website and Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, protect against fraud and abuse, and support legitimate business and operational needs. The specific retention period depends on the type of data, the context in which it was collected, the nature of the applicable relationship, and our legal or operational requirements.

For example:

• Account and profile data may be retained for the duration of your account and for a reasonable period thereafter for recordkeeping, account reactivation, dispute resolution, enforcement, and legal compliance.
• Customer workspace content, submissions, files, prompts, outputs, and related materials may be retained in accordance with the applicable subscription, account settings, deletion requests, backup cycles, support requirements, and legal obligations.
• Support, communications, and inquiry data may be retained as needed to respond to requests, improve support operations, maintain records, and protect the Website and Services.
• Billing, transaction, and tax-related data may be retained as required for accounting, financial reporting, tax, audit, and legal compliance purposes.
• Security, audit, and system logs may be retained for security, fraud prevention, troubleshooting, compliance, service integrity, and incident-response purposes.
• Marketing and lead information may be retained until you opt out, withdraw consent where applicable, or until the information is no longer needed for the relevant business purpose.
• De-identified and aggregated information may be retained for analytics, research, security, benchmarking, and service improvement to the extent permitted by applicable law.

When we no longer need Personal Data for the purposes described in this Privacy Policy, we will delete, de-identify, aggregate, or otherwise dispose of it in accordance with applicable law and our retention practices, subject to backup, archival, legal, or technical limitations.

13. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, SDKs, local storage, and similar technologies (collectively, “Cookies”) to operate, secure, maintain, measure, and improve the Website and Services.

These technologies may include:

• Strictly Necessary Cookies, which are required for core functionality such as authentication, security, fraud prevention, session management, and network management.
• Functional or Preference Cookies, which help remember settings and preferences such as language, interface choices, and user configuration.
• Analytics or Performance Cookies, which help us understand how users interact with the Website and Services, measure traffic and usage patterns, diagnose technical issues, and improve performance and functionality.
• Advertising or Targeting Cookies, if used, which help support, measure, or optimize marketing and advertising activities.

Depending on your location and applicable law, we may request your consent before using non-essential Cookies. You can also manage cookie preferences through your browser settings, device settings, or cookie consent tools made available on the Website, where applicable.
Please note that disabling certain Cookies may affect the availability or functionality of some Website or Service features.

Types of Cookies we Use

Cookies Type	Why do we use them. Other comments
essential cookies	they are necessary to operate our Website and Services. Without the use of these cookies, some parts of our Website and Services would not function
functional cookies	we use them to identify your preferences and customize the Website and Services subject to them. Functional cookies allow us to remember the choices you have made on our Website or during using the Services and store information that you have already provided (e.g. language and other preferences) to enhance your browsing experience. These features help us to improve your visit to the Website and the process of using the Services
analytical and performance cookies	they: (1) collect the information about how you use our Website and Services, including to which pages you go most often; (2) allow us to see the patterns of how you use the Website and Services; and (3) help us to record any errors appearing during your use of the Website and Services. These cookies may involve identifiers and other Personal Data; analytics information is not necessarily anonymous. We use analytics to measure and improve the Website and Services as described in this Policy. We may engage third parties to track and analyze how you use our Website and Services as described in the Policy
third party cookies	some of our third-party service providers use their own cookies on our Website and we do not control such cookies. Third parties use their cookies for analytical and targeting purposes. Using the information, which third parties collect using their cookies, is governed by their privacy policies. Our disclosures apply to information we collect or disclose; a provider’s independent processing is also described in its notice. See section 8 and our Third-Party Services disclosures for recipients.

Analytics and advertising disclosures depend on the service and enabled technologies. The Third-Party Services disclosures describe provider functions and available provider controls. Google’s Analytics opt-out add-on affects supported Analytics scripts; it is not a universal opt-out for Google products, advertising or other data collection. Contact legal@thefusebase.com about applicable privacy choices. Where consent, an opt-out or recognition of an applicable preference signal is required, that requirement applies independently of accepting this Policy.

14. Security

We use administrative, technical, and organizational safeguards designed to protect Personal Data appropriate to the nature of the data and the Services. These measures may include access controls, encryption in transit, logging, monitoring, vendor management, security testing, incident response processes, and role-based access restrictions.

No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for using appropriate safeguards for your own environment, credentials, connected providers, and deployed implementations, including where you use external integrations, customer-provided API keys, or customer-selected AI providers.

15. U.S. State Privacy Disclosures

Residents of certain U.S. states may have additional privacy rights, including rights to know, access, delete, correct, appeal, and opt out of certain profiling, targeted advertising, sale, or sharing practices as defined under applicable state law.

The Personal Data we collect is only accessible by a limited number of employees. Any of them have special access rights to the systems where we store the Personal Data. They are all bound by obligations of confidentiality.

FuseBase does not knowingly sell Personal Data for monetary consideration. Where state law requires us to treat certain analytics, advertising, or similar disclosures as ‘sale,’ ‘sharing,’ or targeted advertising, we will provide any required notice and opt-out mechanisms.

Authorized agents may submit requests where permitted by law. We will not discriminate against you for exercising applicable privacy rights.

Acceptance of this Policy is not itself a lawful international-transfer mechanism. Transfers must meet applicable legal requirements and the governing DPA, including appropriate safeguards or an applicable adequacy decision and any required assessments and additional measures. Contact us for information about the safeguards applicable to your service.

16. Children

The Services are not directed to children, and we do not knowingly collect Personal Data directly from children under the age required by applicable law without appropriate authorization. If you believe a child has provided Personal Data to us inappropriately, please contact us and we will take reasonable steps to investigate and, where appropriate, delete the information.

If you are 14-17 years old and nonetheless request for the Services yourself we may require you to provide us with the documents confirming your emancipation or your parents’ or legal guardian’s permission to access and use the Website and / or the Services.

If you provide us with the Personal Data of other data subjects than yourself, you shall ensure that such Personal Data do not contain information of individuals under 14 years old.

17. Third-Party Links and Services

The Services may contain links to third-party websites, applications, marketplaces, or services that are not controlled by FuseBase. This Privacy Policy does not apply to those third-party services. Please review their privacy notices and terms before using them or submitting Personal Data to them.

18. Google Workspace and Similar APIs

If you connect Google Workspace or similar APIs, we process the data made available through those integrations to provide the integration feature you request, such as automation, syncing, invitation flows, productivity features, or workflow execution. We do not use Google Workspace API data to develop, improve, or train generalized AI or machine learning models, except as may be expressly permitted by the applicable Google terms and your settings or instructions.

Other connected APIs and integrations may have their own contractual and privacy requirements, and your use of those integrations may also be governed by the applicable third-party provider terms.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes are communicated through the Services, on our website, by email or by other appropriate means as required by law and the applicable agreement. The adopted version identifies its effective date. A website update does not itself amend a signed agreement or authorize new processing that requires a separate lawful basis, notice or consent.

20. Contact Us

If you have questions, requests, or complaints regarding this Privacy Policy or our privacy practices, you may contact us at:

Nimbus Web Inc. (dba FuseBase)

Email: legal@thefusebase.com