Privacy Notice

This Privacy Notice explains how Fusebox OÜ (“Fusebox”, “we”, “us”, or “our”) collects and uses personal data when you visit fusebox.energy and its subpages, when you chat with Fusie, and when you interact with us through contact forms, downloads, sign-ups, or marketing communications.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable laws.

This notice applies to our public website, the Fusie knowledge bot and related marketing activities. It does not apply to data processed within the Fusebox platform, where we act as a data processor on behalf of our customers — those activities are governed by the relevant Service Agreement and Data Processing Addendum (DPA). The Fusebox portal privacy policy is available on the portal and applies to registered portal users.

Our website may contain links to third-party sites or services. These are not operated by us, and we are not responsible for their privacy practices. We encourage you to review their privacy notices before sharing any personal data.

Who we are

Fusebox OÜ
Lõõtsa 8a, 11415 Tallinn, Estonia
Reg. No 12773434 · VAT No EE101820503
privacy@fusebox.energy

Fusebox OÜ is the data controller for the processing described in this notice.

The website and marketing

We collect only the information necessary to operate the website, respond to your inquiries, and manage our relationship with you. This may include your name, professional contact details, company name, and anything you provide when you contact us, request a demo, subscribe to updates, or download materials.

When you register for a Fusebox event or webinar, we collect the details needed to manage your participation, such as your name, role, company, and contact information. If you choose to share other preferences, we process that information only to accommodate your needs for the event.

We also collect technical and usage data generated when you browse the website, including your IP address, device and browser type, operating system, and general site-use information such as pages visited and duration of visits. This helps us understand how our content performs and how to improve it.

If you visit our offices, we may record your name, organization, and time of visit for access control and safety purposes. Building-level CCTV is operated by the property manager under their own privacy notice.

To keep our business contact database accurate, we may verify or update professional contact information using reliable public or commercial sources.

What we collect — always

• The questions you type are sent to Google Gemini (Google LLC) for processing. Google may retain prompts and responses for limited periods per their API terms.
• Your conversations (questions and answers) are stored in our Supabase database (EU region) so you can revisit your past chats. We also keep operational logs of each turn — latency, model used, retries, token usage — in Langfuse Cloud (EU region) for quality monitoring and debugging by the Fusebox team.
• An anonymous identifier is set when you first chat without signing in, so your own chat history follows you between visits. It is a random ID and holds no personal data; the cookie it lives in is listed in our cookie policy.
• Your IP address is stored in our Supabase database (EU region)with a request count, so we can rate-limit abuse — this is what stops one visitor exhausting the chat, or the forecast demo's weather lookups, for everyone else. It is recorded per minute and per hour, and it happens whether or not you accept cookies: a request budget you could decline would not be a budget. A country lookup derived from it is kept alongside.
• If you sign in (Microsoft / Entra for Fusebox staff), we store your email and a Fusebox-issued user identifier alongside your conversations so they follow you across devices.

What we collect — only with your consent

If you click Accept on the consent banner, the following additionally apply. You can decline; Fusie still works.

• PostHog (EU region) records page views, button clicks, and chat events. User-typed text is masked at capture time. Used to understand which parts of the bot get used.
• On our /demo pages only, and only there, we additionally record a session replay — a reconstruction of what the page looked like and where the pointer moved — and aggregate heatmaps of where visitors click. Text and form inputs are masked in the replay, so values you type are not readable. No replay is recorded anywhere else on this site, including the chat.
• The PV forecast demo offers two optional PostHog surveys. If you choose to answer one, whatever you type is stored with your response — including an email address, if you give us one so we can reply. Both are optional, and skipping them changes nothing about what the page shows you.
• If you ask us to work out the best tilt and facing for your siteandchoose the in-page form rather than email, the site details you entered (location, size, orientation, date) are sent with that request so we can act on it — a reply address on its own tells us nothing to work from. They stay attached while that form is open, so your answer arrives with the site it is about, and stop as soon as you send or dismiss it. Before you make that request — browsing the demo, running a forecast, switching inverters — none of it is sent.
• On the PV forecast demo, the site parameters you enter (location, size, orientation, date) are kept in the page URL so you can share or reload a result. They are notstored in our database, and the query string is stripped before anything is sent — from the page address on every event, from the heatmap data, and from the address recorded inside the session replay. What we do keep is coarse: the country PostHog infers from your IP, and a size band (under 100 kWp / 100 kWp–1 MWp / over 1 MWp).
• A pseudonymous PostHog identifier groups your interactions into a session. It is separate from the anonymous chat identifier above, which carries no consent gate because the chat would otherwise be unusable — you could not see your own history. Both are itemised in the cookie policy.

What we don't do

• No marketing cookies, ad targeting, or remarketing.
• No selling your data to third parties.
• No cross-site tracking.
• No session replay outside /demo, and no recording of the text you type anywhere.
• No browser fingerprinting beyond the standard PostHog distinct ID (set only after consent).

Data processed outside the EU

Google Gemini may process your messages on infrastructure outside the EU. By using Fusie you accept this processing under Art. 49 (1) (a) GDPR. This involves the risk that your data could be processed by foreign authorities for control or monitoring purposes, potentially without legal recourse.

PostHog (when consented), Langfuse Cloud, Vercel (hosting), and Supabase (database — including your chat history) are all configured for EU-region storage and serving.

Your rights

• Clear cookies and site data for this domain to drop the anonymous chat identifier. Future chats will be linked to a fresh anonymous identity — your earlier chats stay in the database but become unreachable from any browser without the old cookie value. Request server-side deletion below for a hard purge.
• Withdraw analytics consent at any time by clearing the consent cookie (clear site data) or via your browser settings.
• To request server-side data deletion of your chat history and observability traces (Supabase, Langfuse, PostHog), contact fusebox.energy/get-in-touch.

Questions or requests regarding this notice, or the processing of your personal data, go to privacy@fusebox.energy. See also our terms of use and cookie policy. Back to Main Page