Privacy Policy — FusionTest

Your privacy matters to us. This policy explains what data we collect, how we use it, and your rights.

1. Who We Are

FusionLeap Digital operates FusionTest (“the Service”). For questions about this policy, contact us at support@fusionleap.io.

2. Data We Collect

We collect the following categories of data:

Account data: Name, email address, organization name, and a hash of your password, provided when you sign up.

Usage data: Test run reports, goal definitions, pass/fail outcomes, timing data, and platform metadata. This is the core operational data the Service produces.

Failure screenshots: When a test goal fails, an image of the screen being tested at that moment, so you can see what went wrong. These can show whatever your application displayed. Stored privately in AWS (S3), visible only to your organization, and deleted automatically after 30 days. Organization admins can turn this off in Settings.

Replay recordings: For goals that passed, the steps taken and short phrases from the page that proved success, so later runs can repeat them without AI calls. Secret values are never recorded; they stay as placeholders such as {{PASSWORD}}.

Step logs: For each step of a run: the goal, the action taken, whether it worked, and a hash of the screen (not the screen's contents). Collected for runs started from the dashboard and for CLI runs uploaded with your API key.

Plan data: Your plan and this month's usage. FusionTest is free during the beta; we collect no payment details.

Technical data: IP address, browser type, operating system, and access logs for security and debugging purposes.

Website and dashboard analytics: We use WysLeap, our own analytics product, on this website and the dashboard to understand how they're used: pages viewed, clicks, scrolling, and session replays with sensitive fields masked. It stores visitor and session identifiers in your browser's local storage (not cookies).

Communications: Emails you send us, support tickets, and feedback.

3. How We Use Your Data

To provide, maintain, and improve the Service.
To authenticate your identity and authorise access.
To send transactional emails (password resets and service notices).
To detect, investigate, and prevent fraud or abuse.
To make FusionTest more reliable, using run reports and step logs. We do not train AI models on your data (see section 4).

We do not sell your data. We do not use your data for advertising.

4. AI Models

FusionTest uses AI models to decide each test step and to check whether a goal succeeded.

Runs and goal discovery started from the dashboard send the tested page's text structure (its accessibility tree), your goals and the actions taken to the AI provider we use: Groq, Anthropic, Google (Gemini) or OpenAI. Secret values are never sent; the model only sees placeholders such as {{PASSWORD}}.
CLI runs send this data directly from your machine to the provider you configure, using your own API key. We only receive what you upload with a FusionTest API key.
Training: we do not use your data to train AI models. If that ever changes, it will be opt-in, using anonymised data only, and announced in advance.

5. Data Sharing

We share data only in these limited circumstances:

Service providers: cloud infrastructure and screenshot storage (AWS), database hosting (Supabase), the AI model providers described in section 4, and analytics (WysLeap). These providers are contractually bound to protect your data.
Destinations you set up: run results you choose to send to your own webhooks or Slack.
Legal requirements: If required by law, court order, or to protect our legal rights.
Business transfers: In the event of a merger or acquisition, your data may transfer to the new entity under the same privacy protections.

6. Data Retention

We keep account data, run reports, step logs and replay recordings for as long as your account is active, plus 90 days after deletion to allow for recovery requests. Failure screenshots are deleted automatically 30 days after they are taken. You can request earlier deletion of any of your data at any time.

7. Security

We use TLS for all data in transit. Our database and screenshot storage are encrypted at rest (AES-256), and test secrets and webhook signing secrets are additionally encrypted by FusionTest before they are stored. Passwords are hashed with PBKDF2-SHA256 (100,000 iterations). API keys are stored as SHA-256 hashes, so we cannot recover a lost key. Access inside each organization is role-based (admin, member, viewer).

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data (“right to be forgotten”).
Port your data to another service (we export run reports as JSON).
Object to or restrict certain processing.
Turn off optional processing, such as failure screenshots (an organization setting).

To exercise any right, email support@fusionleap.io. We respond within 30 days.

9. Cookies and Local Storage

Neither this website nor the dashboard sets cookies. Both use your browser's local storage: our analytics (WysLeap, see section 2) stores visitor and session identifiers, and the dashboard stores your sign-in tokens so you stay signed in. We use no advertising trackers.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be notified by email at least 14 days before they take effect. The effective date at the top of this page always reflects the latest version.

12. Contact

Privacy questions or requests: support@fusionleap.io