Privacy Policy.

This policy explains what personal data TypeFuse collects, why, how long we keep it, who helps us process it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

TypeFuse is provided by Sharp.Works Ltd (trading as TypeFuse), a company registered in England and Wales under company number 09679033, whose registered office is at 75 Vicarage Avenue, Cheadle Hulme, Cheadle, Cheshire, SK8 7JP. We are registered with the Information Commissioner's Office under registration number ZB270730.

For anything about your personal data, write to hello@typefuse.dev. We have not appointed a data protection officer, as the law doesn't require one for what we do; that address reaches the people responsible for data protection at TypeFuse.

2. Our two roles

We are the controller of account data: the details of the people who sign up, join the waitlist, belong to organisations, pay for plans or write to us. This policy mainly describes that.

We are a processor for our customers' Decision data: the Definitions, context, Examples, test cases and Datasets an organisation puts into TypeFuse, the inputs its applications send to its Decisions, and the answers and records that come back. The organisation that owns the Decision decides what goes in and why, and is the controller. We process that data only to provide TypeFuse to them, under our Terms of Service (section 12). If your personal data is in a customer's Decision data, please contact that customer first; we'll help them answer you.

3. What we collect, and why

Your account

• Name and email address, from sign-up or from Google if you sign in with Google. With Google we also receive your Google account identifier and profile picture link. When the app shows your picture, to you or to people in your organisations, our server fetches it from Google and it is cached briefly (up to a day), so Google never sees the browser of the person looking at it.
• How you sign in: a password, stored only as a one-way hash; your passkeys' public keys; your authenticator app's secret, stored encrypted; and your recovery codes, stored only as hashes.
• Your account's security history: changes to your email address, password or two-factor settings, account recovery and similar events, so you and we can see what happened.
• Your organisations and roles, the invitations you send and accept, your teams, and which notifications you have read or dismissed.
• When you were last active: when you were last seen and the dates on which you used TypeFuse, so that we can count how many people use it and see which organisations are active.

Why: to create and run your account and organisations (contract), and to keep them secure (legitimate interests: protecting you, other customers and TypeFuse).

What you do in TypeFuse

We keep an audit trail of changes in each organisation, such as who created, published, approved or deployed a Decision, who made or revoked a key, and who exported records. Each event names the person, token or app that acted. Each recorded call to a Decision names the key, token or person that made it. This is part of what TypeFuse provides to the organisation, and it lets the organisation show who did what (contract, and the organisation's legitimate interests).

Billing

When an owner starts a paid plan we create a customer record at Stripe with the organisation's name and identifier and the owner's email address. Stripe collects card and tax details itself: we never see or store your card number. For Founder and Scale, Stripe is the seller of record and handles payment, VAT and receipts. We keep the organisation's plan, subscription status and usage counts, and send Stripe counts of production calls for billing. Enterprise is invoiced by us directly. As the seller, Stripe also handles the purchase details as a controller in its own right, under Stripe's privacy policy. Why: contract, and our legal obligations to keep accounting records.

Email

We send only service email: confirming your email address, password resets, invitations, security and recovery notices, approval requests, waitlist replies and invitations, and notices to owners when an organisation nears an allowance. We don't send marketing email or newsletters. If an email to you bounces or is marked as spam, we record the address so we don't send to it again. Why: contract, and legitimate interests (security notices and not sending unwanted mail).

The waitlist

While TypeFuse is invite-only, anyone without an invitation can ask for a place. We keep your email address and name, and the optional answers you give: your company, what you'd like TypeFuse to decide, and how you heard of us, with where you came from (see "Where you came from" below). We send one email to confirm your request and, later, an invitation. If we haven't invited you, we delete your entry 12 months after you last asked for a place. Once we have, we delete it 90 days after you accept the invitation or it expires. If you delete your account, your entry goes with it. To be removed sooner, write to hello@typefuse.dev and we'll delete your entry. Why: you asked us to (steps before a contract), and legitimate interests in deciding whom to invite next.

Where you came from

When you sign up or join the waitlist, we record where you came from so that we can count which links and campaigns bring people to TypeFuse. It comes only from the link you followed: the campaign parameters in its URL (utm_source, utm_medium, utm_campaign, utm_term and utm_content), the referring website's domain (never the page), and the first page you landed on. These travel in the URLs of our site's links to sign-up and are sent with the form. We use no cookie, tracker or identifier for this, store nothing in your browser for it and don't share it with anyone. It is kept with your account or waitlist entry. Why: legitimate interests in understanding how people find TypeFuse.

Security and abuse prevention

• Your IP address is used briefly to limit repeated sign-in, sign-up, password reset and waitlist attempts, and is sent to Cloudflare Turnstile with its check that a real browser is using the form. We don't store IP addresses with your account.
• Our hosting provider's logs of requests to TypeFuse are kept for 7 days to investigate faults and attacks.
• Error reports from your browser are sent to us with email addresses, tokens and URL query strings removed; we keep only the browser's family and version with them.
• Alerts to our team about faults and possible misuse (for example of the Definition assistant) name the organisation and an internal person identifier, never an email address or Decision input.

Why: legitimate interests in keeping TypeFuse secure and working.

When you write to us

We keep your message and our reply to answer you and to deal with any follow-up (legitimate interests), for 2 years after the last message in the conversation, or longer if we need them for a legal claim.

4. Decision data we process for customers

As a processor, we store and process what an organisation puts into TypeFuse:

• Definitions and their context, Examples, Test sets and cases, Datasets and Comparisons, until the organisation deletes them or itself.

• Recorded calls. For each call to a Decision we keep a record: which version answered, when, through which key, the answers, the token count, and fingerprints (hashes) of the input, the request sent to the model and its raw response, which let the organisation prove the record hasn't changed. We don't keep the input of a call to a deployed Decision unless the organisation switches keeping inputs on (available on Scale and Enterprise, for the whole organisation or for one Decision). When it is on, the full input and a short preview are kept and deleted after the plan's retention period:

  Plan	Inputs kept for, when switched on
  Scale	90 days
  Enterprise	365 days, or as agreed

  Sandbox runs, on every plan, keep their input, request and raw response for 90 days; calls recorded before keeping inputs became a setting keep theirs for the retention period that applied when they were made (7, 30, 90 or 365 days). When the detail is deleted, the input preview goes with it; the rest of the record stays for the life of the organisation. Detail still used by a test case, Example, Dataset or Comparison is kept while it is used. Test runs and Evaluations keep their detail, as evidence behind each release.

• Exports an organisation asks for are kept for 7 days.

How a Decision is answered. Each call sends the Decision's questions, its context and the input to TypeSafe's model. With BYOK, the caller's own TypeSafe key is used for that call only and is never stored or logged. With Relay, the caller's application sends the request to TypeSafe itself, so its key never reaches us. With Managed (Enterprise), and for the Sandbox, Test runs, Evaluations and Comparisons on our key, we send it with our TypeSafe key. A TypeSafe key you add in Settings → Billing for testing is kept only in your browser session, encrypted, for at most 12 hours, and is forgotten when you sign out.

Authoring and the Definition assistant use OpenAI's models, on our account, to draft and name Definitions, generate Examples, test cases and READMEs, and suggest fixes. They send what is needed for the task: your brief or goal, the Definition, and for some tasks existing Examples, test cases and summary figures about how the Decision answers. They never send recorded calls' inputs. A test case made from a recorded call is, however, part of the test cases they can read. Every request asks OpenAI not to store it for later retrieval. Under OpenAI's API terms, OpenAI doesn't use what we send to train its models, and may keep requests for a limited period (up to 30 days) to detect abuse before deleting them.

Each organisation chooses whether to use the Definition assistant. It is on for a new organisation, and whoever creates one can switch it off before creating it. Owners and admins can turn it on or off at any time in Settings → Security, and each change is recorded in the organisation's audit log with who made it and when. While it is off, nothing from that organisation is sent to OpenAI: drafting a Decision from a description, generating Examples, test cases and READMEs, Suggest a fix and Ask the assistant are all refused, and the assistant review (which uses TypeSafe's model on our key) doesn't run either. The rule checks, which run on our own servers, keep working. An organisation created before this setting existed sends nothing to OpenAI until an owner or admin turns the assistant on.

5. Cookies and browser storage

TypeFuse uses only cookies that it needs to work. There are no analytics, tracking or advertising cookies, and no third-party trackers on our site.

The app also keeps your light or dark theme in your browser's local storage, along with when you last answered "Not now" to turning on the Definition assistant (so you're asked at most once a day) and the way you last chose to start a new Decision, and the page to go back to in the app in session storage. None of these leaves your browser except as part of using the app. Cloudflare Turnstile, which checks the sign-up, log in, waitlist and password reset forms, runs a script from Cloudflare and may use its own data to tell people from bots (Cloudflare's Turnstile privacy addendum).

The layout and dismissed-notice cookies only remember choices you made in the app, are never shared and don't track you. We treat them, like the sign-in cookies, as strictly necessary for the service you asked for, so we don't ask for consent to them. You can clear them in your browser at any time; the app then goes back to its defaults.

6. Who we share data with

We don't sell personal data, and we don't share it for advertising. We share it only with the companies that help us run TypeFuse (our subprocessors), with people you choose to share it with (such as other members of your organisation), and where the law requires.

Signing in with Google is your choice: Google tells us your name, email address and profile picture, under Google's privacy policy. Your picture is fetched from Google by our server, not by anyone's browser (section 3).

TypeSafe under your own agreement. When your applications call a Decision with your own TypeSafe key (BYOK) or through Relay, TypeSafe processes that call under your agreement with TypeSafe, not ours.

We'll update this list before we add or replace a subprocessor, and tell customers in advance as our Terms describe. We may also disclose data if the law requires it, to protect people's safety or our rights, or to a company that takes over TypeFuse, which would have to honour this policy.

7. International transfers

Where TypeFuse keeps data. We store your data in the EU. Our main database (accounts, organisations, Decisions and their versions), the records of the calls your Decisions answer (their inputs, answers and sealed batches), your organisation's call ledger and our backups are all held under Cloudflare's EU jurisdiction, which keeps them stored inside the EU. Our API runs beside the database, also in the EU.

Some data still crosses borders, because of how a global network works. Each request is first received at the Cloudflare data centre nearest the person or application making it, which may be outside the UK and the EU. What a call needs to be answered quickly is copied to Cloudflare's data centres worldwide: each deployed release of a Decision (its questions and fixed context, as published), your organisation's plan limits, and a fingerprint of each runtime key, never the key itself. The inputs and answers of calls are not copied this way. Cloudflare's request logs may also be processed outside the UK and the EU. All of this is covered by Cloudflare's data processing addendum, which includes the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

Some of the other companies in section 6 process data outside the UK, mainly in the United States. For them, where personal data leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies) or on the UK's International Data Transfer Agreement or Addendum, as each provider's terms set out. Ask us for details.

8. How long we keep data

9. Deleting your account or an organisation

Deleting an organisation. An owner can delete an organisation from Settings → Billing. It is locked at once and its keys stop working. For 7 days it can be restored. After that, its Decisions, versions, recorded calls, test evidence, keys and audit trail are erased. The one exception is the sealed copy of each recorded call (section 8): it is held in locked storage so that a record can't be changed or removed without deliberate action on our cloud account, which our provider records, and it stays until your plan's retention period for that call ends, at most a year, when it is deleted automatically. Until then it is not used or shown anywhere, and we remove it sooner only where the law requires it. We keep a record of which organisation was deleted, by whom and when, and hold its identifier for 90 days so that nobody else can take it in the meantime. The record of the deletion holds no Decision data, only the organisation's identifier, who asked and when, and how much was removed; we keep it so that we can show what was deleted, when and at whose request.

Deleting your account. Choose Account, then Delete account. Your personal space and any organisation where you are the only member are deleted with it, in the same way, and you leave the others. You can restore your account for 7 days. After that, your sign-in methods, sessions, tokens, memberships, security history, the dates you were active and any waitlist entry are erased. If records in an organisation you belonged to still refer to you (for example, a Decision you made), your account is reduced to "Deleted account", with no name, email address, picture, record of where you came from or of when you were last active, so those records stay intact for that organisation.

Backups. Deleted data is removed from our backups within 30 days. Backups are kept for 30 days, on every plan.

10. How we protect data

• All traffic to TypeFuse is encrypted in transit (HTTPS), and Cloudflare encrypts stored data at rest.
• Passwords are stored only as bcrypt hashes. API keys, tokens, refresh tokens and recovery codes are stored only as hashes, so we can't read them back.
• Sign-ins last 10 minutes and are renewed with single-use refresh tokens; reusing an old one ends the session.
• You can protect your account with passkeys or an authenticator app, and an organisation can require two-factor of its members. Authenticator secrets are stored encrypted.
• Your own TypeSafe key is never stored on our servers.
• Each organisation's audit trail is tamper-evident: every event is chained to the one before by a cryptographic hash, recorded calls are sealed in batches, and the chain is checked every night.
• Sign-in and sign-up are rate limited and protected by Turnstile.
• Only our operators can reach production data, through a console behind Cloudflare Access.
• We take a backup every day. Backups are kept in the same Cloudflare account as TypeFuse.

No system is perfectly secure. If we learn of a breach that puts your personal data at risk, we will tell you and, where required, the Information Commissioner's Office (ICO).

11. Your rights

You have the right to:

• access the personal data we hold about you;
• correct it if it is wrong (you can change your name and email address in Account);
• erase it (you can delete your account yourself; see section 9);
• restrict or object to how we use it, including where we rely on legitimate interests;
• receive it in a portable, machine-readable form; and
• withdraw consent, where we rely on it.

To use any of these, write to hello@typefuse.dev. We'll reply within one month, and may ask you to confirm who you are. If your data is in a customer's Decision data, we'll pass your request to that customer.

We don't make decisions about you that have legal or similarly significant effects solely by automated means.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.

12. Children

TypeFuse is not for anyone under 18, and we don't knowingly collect their data. If you think a child has given us personal data, write to us and we'll delete it.

13. Changes to this policy

We'll update this policy when what we do changes. If a change matters, we'll tell account holders by email or in the app before it applies. The date at the top of this page shows when it last changed.