Privacy Policy

Fusey B.V. - Last updated: August 2026

This Privacy Policy explains how Fusey B.V. ("Fusey", "we", "us", "our"), a private limited company registered in the Netherlands, collects, uses, stores, and protects your personal data when you use the Fusey platform ("Platform").

We process personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch Uitvoeringswet Algemene verordening gegevensbescherming (UAVG).

1. Data Controller

Fusey B.V. is the data controller responsible for your personal data.

Registered address: Tesselschadestraat 39, 2026SM, Haarlem, the Netherlands
Chamber of Commerce (KvK): 42076398
VAT identification number (BTW): NL869597620B01
Email: fuseybusiness@gmail.com

This is our registered business address. We are not staffed for in-person visits; for the fastest response, please contact us via the Platform or by email. Formal legal correspondence may be sent to this address.

2. Personal Data We Collect

2.1 Account Data (provided by you or your OAuth provider)

Username and display name
Email address
Profile picture (avatar) and banner image
Bio and description
Preferred language and timezone

2.2 Authentication Data

You may sign in via Google, Discord, X/Twitter, TikTok and Twitch, or by registering with email and password. You may optionally enable two-factor authentication (2FA) for additional account security.

OAuth providers (Google, Discord, X/Twitter, TikTok and Twitch): when you authenticate, we receive:

Provider account identifier
Provider profile information (name, avatar)
OAuth tokens (stored encrypted at rest, used solely to maintain your session)

We do not receive or store your password from any OAuth provider.

Email and password (classic sign-in): your password is never stored in plaintext and never recoverable. We store only a one-way Argon2id hash (memory-hard, OWASP-recommended) with a unique random salt per account.

Two-factor authentication (optional): if you enable 2FA, we store:

The TOTP secret used to generate authentication codes, encrypted at rest with AES-256-GCM
A small set of one-time recovery codes, stored as Argon2id hashes (one-way, single-use, never recoverable in plaintext)

When Creators connect social media accounts for verification, we collect:

Platform type (Discord, YouTube, X/Twitter, TikTok and Twitch)
Account identifier and display information
Public metrics (subscriber/follower/member counts, view counts)

This data is synced periodically to display accurate analytics on Creator profiles.

2.4 Transaction Data

Order details (packages purchased, prices, timestamps)
Delivery content links and notes
Community instructions provided by Sponsors
Dispute information (reason, resolution)
Payout and withdrawal history
Billing address and, for business purchases, the VAT identification number provided at checkout (processed by Stripe)

2.5 Communication Data

Messages exchanged between users on the Platform
File attachments (max 5 files per message/order, max 500 MB each)

2.6 Technical Data

Browser type and version (from HTTP headers)
IP address (server logs, not stored long-term)
Session metadata recorded on sign-in: browser name and operating system name (parsed from your User-Agent header), and a last-used timestamp. You can review and revoke active sessions at any time from Settings > Account > Sessions.

2.7 Analytics Data

We use Plausible Analytics, a privacy-friendly analytics tool, self-hosted on our own infrastructure. Plausible does not use cookies, does not collect personal data, and does not track users across sites or sessions. The data collected is aggregated and anonymised:

Page visited and referrer source
Browser type and operating system
Country (derived from IP address; IP is not stored)

We do not use tracking pixels, advertising cookies, or fingerprinting.

2.8 Identification and Tax Data (Creators)

To set up payouts, we collect your payout account country (chosen once during payout setup). All other payout data is collected by Stripe during payout onboarding (see Section 5): name, date of birth, address, bank account details, and where required an identity document.

To comply with EU tax reporting rules ("DAC7", see Section 4.1), Stripe also collects and verifies the following data for Creators resident in an EU member state, and provides it to us for tax reporting:

First and last name, and primary address
Date of birth
Tax identification number (TIN) and the member state that issued it
VAT identification number, if available
Business registration number, for Creators operating as a business
The identifier of the financial account payouts are made to (for example an IBAN)

3. Legal Basis for Processing

Purpose	Legal Basis (GDPR Art. 6)
Account creation and authentication	Performance of contract (Art. 6(1)(b))
Payment processing (via Stripe)	Performance of contract (Art. 6(1)(b))
Facilitating messaging between users	Performance of contract (Art. 6(1)(b))
Dispute resolution	Performance of contract (Art. 6(1)(b))
Email notifications about orders	Performance of contract (Art. 6(1)(b))
Social media metrics display	Consent (Art. 6(1)(a)) - you choose to connect accounts
Platform security and fraud prevention	Legitimate interest (Art. 6(1)(f))
Aggregated analytics (Plausible)	No personal data is processed (outside GDPR scope)
Legal compliance (tax, financial regulations)	Legal obligation (Art. 6(1)(c))
DAC7 reporting of Creator identity and earnings	Legal obligation (Art. 6(1)(c))
Invoicing and VAT calculation	Legal obligation (Art. 6(1)(c))

4. How We Use Your Data

We use your personal data to:

Create and manage your account.
Process transactions between Creators and Sponsors.
Facilitate payments and payouts processed by Stripe.
Facilitate communication between users.
Display Creator profiles with connected social media metrics.
Send order-related email notifications.
Resolve disputes between users.
Detect and prevent fraud or abuse.
Measure aggregated, anonymised platform usage via Plausible Analytics (no personal data involved).
Comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4.1 EU Tax Reporting of Creator Earnings (DAC7)

As a digital platform operator, Fusey must comply with EU Council Directive 2021/514 ("DAC7"), implemented in the Netherlands by the Wet implementatie EU-richtlijn gegevensuitwisseling digitale platformeconomie. Under these rules our payment processor Stripe collects and verifies identification data of Creators resident in an EU member state who earn money through the platform, and we report it every year to the Dutch tax administration (Belastingdienst). The Belastingdienst exchanges this data with the tax authorities of the EU member states where a Creator resides. There is no earnings threshold for services, so a single paid order makes a Creator reportable.

The reported data includes the identification data listed in Section 2.8 and, for each quarter of the calendar year: the total amount paid to the Creator, the number of paid orders, and the fees Fusey withheld. We submit the report no later than 31 January of the year following the calendar year in which the Creator was paid, and we provide every reported Creator with a copy of the reported information by that same date. If a Creator does not provide this information after two reminders, Fusey must, no earlier than 60 days after the second reminder, withhold the Creator's payouts or close the account until the information is provided. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

5. Third-Party Processors

We share personal data with the following processors, each engaged under their GDPR Article 28 data processing terms:

Processor	Purpose	Data Shared	Location
Stripe	Payment processing, payouts, identity verification	Name, email, billing & payment details, tax/VAT identifiers, KYC data	EU/US (EU SCCs)
Namecheap	Transactional email delivery	Email address, display name, message content	US (EU SCCs)
Google / Discord / X/Twitter / TikTok / Twitch	Authentication	OAuth tokens, profile data	US (EU SCCs)
Discord / YouTube / X/Twitter / TikTok / Twitch	Creator social media sync (analytics, metrics)	OAuth tokens, public metrics	US (EU SCCs)

All processors are required to protect your data in accordance with GDPR standards. Where data is transferred outside the EU/EEA, appropriate safeguards (such as the EU Standard Contractual Clauses) apply under each processor's data processing terms.

For Creators with a payout account, Stripe processes personal data as an independent controller in accordance with the Stripe Privacy Policy.

6. Cookies

We use only strictly necessary and functional cookies. We do not use tracking cookies, analytics cookies, or advertising cookies.

Cookie Name	Purpose	Type	Duration
`authToken`	Keeps you signed in to your account. Contains an encrypted authentication token.	Strictly necessary	1 year
`I18N_LOCALE`	Remembers your preferred language.	Functional	1 year
`TIMEZONE`	Remembers your preferred timezone.	Functional	1 year
`CURRENCY`	Remembers the currency you prefer to see prices in.	Functional	1 year
`oauth_state`	Protects against cross-site request forgery (CSRF) during the sign-in process.	Strictly necessary	10 minutes

Under the Dutch Telecommunicatiewet (Art. 11.7a) and the EU ePrivacy Directive (Art. 5(3)), consent is only required for cookies that are not strictly necessary for the service requested by the user. All cookies on Fusey are either strictly necessary (authentication, security) or functional (display preferences). Therefore, no cookie consent banner is required.

7. Data Retention

Data Type	Retention Period
Account data	Marked inactive on deletion, restorable for 15 days, anonymized after 1 year
Transaction data	Preserved indefinitely (Dutch fiscal retention obligation, Algemene wet inzake rijksbelastingen Art. 52)
Messages	Deleted 1 year after self-deletion (cascade during anonymization). Retained indefinitely for admin-banned accounts.
File uploads	Deleted when associated order or account data is removed
Authentication credentials	Password hash, OAuth login links, 2FA secret, and recovery codes are retained for 15 days after account deletion so you can restore your account, then deleted
Social media OAuth tokens	Deleted 1 year after account deletion (during anonymization)
Sessions	Deleted immediately on account deletion or admin ban, on password reset, and on 2FA disable. Idle sessions are also automatically cleaned up after 1 month of inactivity
Reviews you left	Rating and text are kept, but your name and avatar are replaced with "Deleted User" immediately on account deletion. Fully deleted after 1 year
Username	Stays reserved while the account exists, and becomes available to other users after 1 year
Server logs (IP, user agent)	Dependent on infrastructure, not stored long-term
DAC7 due diligence records and reported data	Retained for at least 5 and at most 10 years after the end of the reported calendar year (EU Directive 2021/514)

When you delete your account, the account is marked inactive, you are signed out everywhere, and your profile stops being publicly visible. Reviews you left on creator profiles keep their rating and text so creators' ratings stay accurate, but they no longer show your name or avatar. For 15 days afterwards you can restore your account by simply signing in again, so your sign-in details (email, password, linked social logins, and two-factor settings) are kept during that period. Once it passes, those sign-in details are permanently deleted and the account can no longer be restored. After 1 year, all remaining personal data (display name, avatar, bio, social media connections, conversations, and messages) is permanently anonymized or deleted. Transaction records and DAC7 due diligence records are preserved for legal and financial compliance.

If your account has been disabled by Fusey administration (e.g., due to a ban for Terms of Service violations), your account data is retained indefinitely and is not subject to the anonymization schedule above. This is necessary to enforce bans and prevent re-registration using the same credentials (GDPR Art. 17(3)(b), processing necessary for the establishment, exercise, or defence of legal claims).

You have the following rights regarding your personal data:

Right of access (Art. 15) - Request a copy of your data. Available via Settings > Privacy & Data > Export My Data.
Right to rectification (Art. 16) - Update your profile information at any time.
Right to erasure (Art. 17) - Delete your account via Settings > Privacy & Data > Delete My Account. For 15 days afterwards you can undo the deletion by signing in again. Subject to legal retention obligations. Account deletion may be temporarily restricted if you have active or in-progress orders, or if you are a Creator with an outstanding balance to withdraw. Resolve these before requesting deletion.
Right to restriction (Art. 18) - Request that we limit processing of your data.
Right to data portability (Art. 20) - Export your data in a machine-readable format via the Export function.
Right to object (Art. 21) - Object to processing based on legitimate interest.
Right to withdraw consent (Art. 7(3)) - Withdraw consent for social media connections at any time by disconnecting the account.

To exercise any right not available through the Platform interface, contact us at fuseybusiness@gmail.com.

We will respond within one month (extendable by up to two further months for complex or numerous requests) as required by GDPR Art. 12(3).

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encrypted data transmission (HTTPS/TLS) for all communication between your device and the Platform.
Argon2id password hashing, a memory-hard, OWASP-recommended algorithm. Your password is salted and hashed; we never store or transmit it in plaintext, and it cannot be recovered from our database.
AES-256-GCM encryption at rest for OAuth tokens (authentication and social media providers) and two-factor authentication (TOTP) secrets. The encryption keys are managed separately from the database.
Argon2id hashing of two-factor authentication recovery codes. Recovery codes are one-way hashed, single-use, and cannot be recovered in plaintext.
JWT-based authentication stored in secure, HttpOnly cookies to prevent client-side script access.
PKCE (Proof Key for Code Exchange, S256) on all OAuth2 authorization code flows to mitigate authorization code interception.
CSRF protection via cryptographic state cookies and the SameSite=lax cookie attribute.
Rate limiting on sensitive authentication endpoints (sign-in, sign-up, password reset, 2FA verification) to mitigate brute-force and abuse.
Session invalidation on password reset, 2FA disable, and admin ban; active sessions are revoked so leaked credentials cannot be reused.
Access controls and role-based permissions to limit who can access administrative functions.
Regular security assessments.

10. Children's Data

Fusey is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, contact us and we will delete the account.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. Automated order actions (e.g., auto-decline after 72 hours) are contractual processes, not profiling.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or Platform notification. The "Last updated" date at the top reflects the most recent revision.

13. Supervisory Authority

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Autoriteit Persoonsgegevens
PO Box 93374, 2509 AJ The Hague

14. Contact

Fusey B.V.
Registered address: Tesselschadestraat 39, 2026SM, Haarlem, the Netherlands
Chamber of Commerce (KvK): 42076398
VAT identification number (BTW): NL869597620B01
Email: fuseybusiness@gmail.com