Fusedash

GDPR overview

Fusedash makes no explicit claim of GDPR compliance, and no certification such as SOC 2 or ISO 27001 appears anywhere on the site. The privacy policy, effective 14 January 2026, states that Fusedash is based in the United States and that information may be processed and stored in the US and other locations where the company or its providers operate. For international transfers it mentions only appropriate transfer safeguards, giving contractual protections as an example, and names no mechanism: no standard contractual clauses, no Data Privacy Framework. The rights section is written for US state laws, Virginia by name — access, correction, deletion, portability, opt-out of targeted advertising, sale and profiling — exercised by emailing info@fusedash.ai with the subject Privacy Request. The terms note that a Data Processing Addendum may be needed for GDPR, but none is published. No Article 27 EU representative and no DPO are named.

Who owns the data?

The terms are unambiguous: you own your Customer Data, and the agreement transfers no ownership to Fusedash. You grant the vendor a limited, worldwide, non-exclusive licence to host, store, back up, process, transmit and display that data, and only as necessary to provide, maintain and improve the Service, deliver customer support, prevent or address technical, security, fraud or abuse issues, and enforce the terms and legal obligations. The licence runs until you delete the data, except where retention is required for legal compliance, security, dispute resolution or backup integrity. Output — dashboards, charts, maps, narratives, summaries and recommendations — may contain your data and is yours to use. Fusedash owns the Service itself and may use any feedback you send without restriction or compensation. The privacy policy adds that Fusedash often processes information on a customer's behalf, in a processor role.

Reuse rights

You can reuse what you produce without asking permission. The terms state that Output — dashboards, charts, maps, narrative blocks, summaries and recommendations — may be based on or contain your Customer Data, and that you may use the Output generated for you. Nothing requires attribution or prior approval before sharing it by link, embedding it or exporting it. On the collection side, the privacy policy effective 14 January 2026 lists: account and profile data (name, email, organisation, role); billing and transaction data (invoices, plan, billing address, with card details handled by a payment processor); support communications and marketing preferences; Customer Content (CSV uploads, connected datasets, integrated sources, the dashboards, charts, maps and reports you build, plus workspace settings, filters and configurations); AI feature data (prompts and instructions, the context needed to answer, AI outputs, safety and abuse signals); usage and device data collected automatically (page and feature logs, timestamps, clicks, errors, IP address, browser, device identifiers, approximate location derived from IP); cookies for authentication, preferences, analytics and permitted marketing; and token data (balance, consumption, timestamps, the consuming feature such as AI Chat or chart generation, and billing events). Those data serve to operate and maintain the Service, manage accounts and authentication, process payments, deliver features, monitor, debug and improve, provide support, fight fraud and abuse, and meet legal obligations. Sharing is limited to service providers under contractual protections — named by category only, meaning hosting, analytics, customer support tooling, payment processing and email delivery — to third parties at your own request through integrations, exports and shares, to corporate transfers such as a merger, acquisition, financing, reorganisation, bankruptcy or asset sale, and to legal and safety obligations. The vendor states it does not sell personal data in the traditional sense of selling it for money, and that your data stays in your workspace while your model choice stays yours. Note that with MCP the AI model is chosen and connected by the customer, outside Fusedash's contractual perimeter.

Data retention & training

Hosting summary

The privacy policy, effective 14 January 2026, states plainly that Fusedash is based in the United States, and that information may be processed and stored in the US and in other locations where the company or its service providers operate. No other country is named, and no EU data-residency option is offered. No hosting provider is named either: providers appear by category only — hosting, analytics, customer support tooling, payment processing and email delivery — with no nominative subprocessor list. For cross-border transfers, the policy says appropriate safeguards are used where required, giving contractual protections as an example without naming a mechanism, so neither standard contractual clauses nor the Data Privacy Framework are invoked. One network observation made during this review, not claimed by the site: the marketing site is served through Cloudflare (AS209242, anycast IP 198.202.211.1), which says nothing about where customer data itself is hosted. In short: US jurisdiction, Virginia governing law, and no published detail on regions, hosting providers, encryption or certification.