Privacy Policy

1. Who we are and our role

Controller of your account data. For the personal data we collect to create and operate your account, bill you, secure the service, and communicate with you, LLM Fusion is the controller.

Processor of your submitted content. For the content you (or your organization's users) submit to be processed by AI models — prompts, attachments, and outputs — we act as a processor on behalf of your organization, which is the controller of that content. Enterprise customers are additionally covered by a Data Processing Agreement (DPA), which governs in the event of any conflict with this policy.

Contact. INS Sales and Solutions FZE LLC, SPC Free Zone, Sharjah, UAE. Data-protection contact: [email protected]. See §14.

2. Personal data we collect

• Account data — organization name, work email, hashed password, and role/membership.
• Authentication data — session/refresh tokens, your multi-factor (TOTP) secret (encrypted at rest), and OAuth identifiers if you use social sign-in.
• Billing data — prepaid credit balance, transaction history, and payment identifiers. We do not store full card numbers — card data is handled by our payment processor.
• Submitted content — prompts, attached files, and model outputs processed during a session. This may contain PII you choose to include.
• Anonymization metadata — counts and categories of detected PII, cryptographic tokens, and hash-chained audit records of processing events.
• Support data — messages and attachments you send to support.
• Technical & security data — IP address, timestamps, and request/error logs.
• Product analytics — feature-usage events, only if you consent (see §9).

We do not intentionally seek special-category data. If you place such data in submitted content, you are responsible for having a lawful basis to do so.

3. How the anonymization gateway processes content

For traffic routed through the Fusion gateway, submitted content is processed as follows before it reaches any external model:

1. Detect — recognizers and a Named Entity Recognition (NER) model identify PII, including personal names, addresses, organizations, phone numbers, email addresses, GCC national identity numbers, IBANs, payment card numbers, and passport numbers, in English and Arabic.
2. Tokenize — each detected value is replaced with a deterministic cryptographic token. The token → value mapping is held in an access-controlled vault, encrypted at rest, partitioned per organization, and subject to a time-to-live.
3. Forward — only the tokenized (anonymized) content is transmitted to one or more LLM providers for inference (see §6).
4. Restore — tokens in the model's response are substituted back with the original values from the vault so you receive a coherent answer.
5. Audit — each processing event is recorded in a tamper-evident, hash-chained audit log that your administrators can export.

4. Why we process your data and our legal basis

5. Data residency

We build LLM Fusion to keep customer data within the GCC region.

• Platform state — organization records, conversations, the anonymization vault, and audit logs — is held in Cloudflare storage pinned to UAE data residency.
• Attachments are stored in in-region object storage.
• Anonymized content is transmitted to LLM providers located outside the GCC (see §6). Only tokenized/anonymized content leaves the regional boundary under normal operation.
• Limited operational data (for example, error diagnostics and transactional email) may be processed by service providers outside the GCC, as described in §6.

Enterprise customers who require a stronger guarantee — that even anonymized prompts never touch shared, globally-hosted provider accounts — can use a bring-your-own-key (BYOK) or dedicated in-region deployment, in which inference runs against the customer's own regional model deployment.

6. Service providers and international transfers

We engage a limited number of carefully vetted third-party service providers (sub-processors) to help us deliver the Services — for example, cloud infrastructure and hosting, model inference, payment processing, transactional email, and error monitoring, plus consent-gated product analytics. Each provider receives only the minimum data necessary for its function and is bound by contractual confidentiality and data-protection obligations.

• Model providers receive anonymized content only and cannot identify individuals from it.
• Where a transfer of personal data leaves the GCC, we rely on an appropriate transfer mechanism under the applicable PDPL (an adequacy decision, contractual safeguards, or your explicit consent).
• A current, itemized list of our sub-processors and their locations is available to enterprise customers on request under confidentiality, and material changes are notified as provided in the applicable DPA.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

7. Data retention

• Account data — retained while your account is active and for a reasonable period afterward as required for legal, tax, and audit purposes, then deleted or anonymized.
• Submitted content and the vault — the vault mapping is short-lived (governed by a time-to-live) and is not a long-term store of your content. Conversation history is retained per your organization's configured retention setting (default 90 days), which administrators can adjust.
• Audit logs — retained per your organization's configured compliance retention period.
• Billing records — retained as required by applicable tax and accounting law.

Prepaid credits do not expire while your account remains open.

8. Security

We apply administrative, technical, and organizational safeguards appropriate to the risk, including: encryption in transit (TLS) and at rest for sensitive stores; hashed passwords and hashed API keys; encrypted MFA secrets; role-based access control; per-organization key authentication with least privilege; a tamper-evident hash-chained audit trail; and network isolation between components. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work to protect your data and to detect and respond to incidents.

Breach notification. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected controllers/individuals as required by the applicable PDPL and any DPA, without undue delay.

9. Cookies, analytics, and communications

• Essential cookies are required to sign you in and secure your session.
• Website & app analytics. On our marketing site and the signed-in app shell (llmfusion.app / web.llmfusion.app) we run a minimal, cookieless pageview counter (PostHog, EU-hosted). It stores no cookies or local storage on your device, does not record clicks, input, or screen content, masks IP addresses at collection, and cannot identify you personally; it tells us which pages were visited. We process this on the basis of legitimate interest in understanding site usage. We honor "Do Not Track" / Global Privacy Control.
• In-product analytics beyond the above run only inside your authenticated organization's settings and identify you by an internal user id, not your raw email; anything non-essential there requires your organization's admin configuration and, where required, your consent.
• Service communications (verification, security, billing, and material service notices) are part of the service and are not marketing.
• Marketing communications are sent only with a lawful basis, and every marketing message includes an unsubscribe mechanism.

10. Your rights

Subject to the applicable PDPL and lawful exceptions, you may: access the personal data we hold about you; rectify inaccurate or incomplete data; erase your personal data; restrict or object to certain processing; port your data in a structured, machine-readable format; withdraw consent at any time (without affecting prior lawful processing); not be subject to solely-automated decisions producing legal or similarly significant effects where the law provides that right; and lodge a complaint with the competent data-protection authority (in the UAE, the UAE Data Office).

Where LLM Fusion acts as a processor for your organization's submitted content, we will refer individual requests concerning that content to the relevant customer (controller) and support them in responding. To exercise a right, contact us at §14. We respond within the period required by law and may verify your identity first.

11. Children

The service is intended for organizations and their authorized users and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

12. Automated processing

The platform uses AI models to generate responses to submitted content. These outputs are informational; the platform is designed to keep every stage inspectable and does not, by itself, make legally significant decisions about individuals. You are responsible for any decisions you make using the outputs.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice (e.g., by email or an in-product notice). Continued use after the effective date constitutes acceptance of the updated policy.

14. Contact

Questions, requests, or complaints regarding this policy or your personal data:

• Data-protection contact: [email protected]
• General: [email protected]
• Postal: INS Sales and Solutions FZE LLC, SPC Free Zone, Sharjah, UAE

If you are an enterprise customer, your DPA and order form prevail over this policy to the extent of any conflict.