Fuser

The user retains ownership of all content, including AI inputs; Fuser takes only a narrow license needed to operate the Service. Input is explicitly classified as the user's User Content.

The user owns AI-generated Output, and Fuser expressly assigns to the user any rights it may hold in it. The only caveat is that output use may also be subject to the underlying model provider's terms and to applicable law, which Fuser discloses transparently.

Fuser makes a clear, contractual commitment not to train AI models on user content and not to permit its third-party AI providers to do so. This commitment is repeated consistently across the Terms, Privacy Policy, Privacy FAQ, and Sub-processor list.

The documents describe a clear deletion model: content is retained while the account is active, available for export for 30 days after paid-account termination, then deleted in the ordinary course subject to backup rotation and legal retention. Users can self-serve deletion and export, or request via email. There is no fixed numeric deletion SLA for routine deletion beyond the 30-day export window and 'ordinary course' language.

Sharing is limited to disclosed service providers and AI model providers acting on Fuser's behalf, plus sharing the user directs or legal requirements. Fuser explicitly states it does not sell personal data or share it for cross-context behavioral advertising, and publishes a full sub-processor list.

Users can opt out of marketing emails, control cookies, opt out of Google Analytics, and Fuser honors Global Privacy Control signals where required. Because no training on user content occurs at all, a training opt-out is unnecessary. DPA customers can also object to new sub-processors.

Fuser claims GDPR/UK GDPR and US state privacy law alignment through its DPA and SCCs, but holds no third-party attestations yet. SOC 2 is explicitly stated to be still in progress rather than certified, and no ISO or other certifications are claimed. This is a claimed/in-progress posture rather than an attested one.

Fuser identifies the model used at the point of use and lists all model providers, and the DPA offers audit support (questionnaires, documentation, limited on-site audit rights for DPA customers). However, there is no disclosure of model behavior transparency, bias testing, or explainability features for the AI outputs themselves.

Fuser discloses encryption in transit and at rest, role-based access controls, audit logging, tenant isolation, and documented incident response, with a detailed TOM annex in the DPA. However, it is not yet SOC 2 certified, references no penetration testing or bug bounty, and no breach history is disclosed. A security summary is available under NDA rather than a public trust center.

Core protections — content ownership, output assignment, and no-training — apply to all tiers. Enterprise/Team plans add material benefits: executable DPA, sub-processor objection rights, dedicated support with a 24-hour response target, and negotiable indemnification. There is no evidence that free-tier data is treated less protectively regarding training or sale.

Internal access to non-public User Content is restricted to personnel with an operational need, bound by confidentiality obligations, and limited to defined purposes such as operating, securing, and supporting the Service or legal compliance. Session replays are available to authorized personnel but mask password fields.

Fuser discloses it will respond to valid legal process and may disclose data to authorities when legally required, which is standard. No current litigation, government data requests, or law enforcement controversies are disclosed. California governing law and informal dispute resolution are specified.

Fuser collects a moderate, clearly itemized set of PII (name, email, username, IP address, device identifiers, usage data, session replays) with stated purposes. User-submitted content and precise content could contain SPI at the user's discretion, but Fuser does not intend to collect special-category data and places that responsibility on the user. The transparent inventory and no-sale/no-training commitments mitigate risk, but session replay and IP-reputation checks warrant a moderate rating.

All dated policies carry an Effective Date of June 11, 2026, well within 12 months of the October 2026 analysis date. The documents demonstrably cover the AI-first product: generative AI features, third-party model providers, the node-based workflow nature, teams/organizations, and data flows to named model providers all appear in the policies, matching the product surface.

Six consumer documents plus two enterprise documents were supplied, enabling a cross-document check. The no-training commitment, ownership terms, retention/export windows, sub-processor notification periods (14 days), and breach handling are consistent across the Terms, Privacy Policy, Privacy FAQ, Sub-processor list, and DPA. No material contradictions were found.