Privacy Policy
Immersive Fusion LLC ("Immersive Fusion", "we", "us") makes DeepCube, its Tessa AI assistant and its desktop clients, and runs our websites. We are the controller of the personal information this policy describes. It explains what we collect, why, who else handles it, how long we keep it, and what you can do about it.
We try to keep little. Where we have not yet set a limit, this policy says so.
1. The short version
- We do not sell your personal information, and we do not share it for advertising.
- We do not train AI models on your data.
- Our marketing websites, immersivefusion.com and deepcube.ai, set no cookies and load no third-party service until you click on it.
- Tessa conversations are not stored on our servers. Our AI provider, Microsoft, may keep them for up to 30 days to detect abuse (section 5).
- You can ask us to see, correct or delete your information, wherever you live (section 9).
2. Who this policy covers
It covers you if you visit our websites, create an account, use DeepCube, Tessa or the desktop clients, or contact us.
It does not cover data inside the applications you monitor with DeepCube. Telemetry your software sends us (traces, logs and metrics) can contain information about your users. For that data you decide what is sent, and we process it on your behalf under our Data Processing Agreement. If you are one of our customer's users, please contact that customer first.
3. What we collect
3.1 When you visit our websites
- Our marketing websites set no cookies, use no analytics or advertising scripts and keep no web server
request logs. Services there load only when you click on them:
- Forms. Demo and partner requests use a Typeform form. Typeform receives your answers and the campaign tags in the page address.
- Chat. Zendesk loads and receives what you type: your name, email and message.
- Video players and the Steam widget, run by their providers.
- Our documentation site loads Google Analytics, Zendesk chat and fonts from Google when a page opens. Google and Zendesk receive your IP address and browser details, and Google Analytics records the pages you view.
3.2 When you create and use an account
| Information | Why |
|---|---|
| Name, email address, and how you sign in: email and password, a Microsoft account, or Steam | To create your account and sign you in |
| Organization name and contact email; billing name and email; the data region you choose | To run your organization's account and bill it |
| Card details | Entered directly into Stripe's payment form. They never reach our servers |
| Seats, sessions in shared views, preferences, and how much of Tessa you use (counts, not content) | To run the service and enforce plan limits |
| A record of which views and traces each user opened, and when | To secure the service and keep it accountable |
| Invitations: the invitee's email, who invited them and the role | To deliver the invitation |
| How you use the web app: page loads, addresses requested, and clicks and key presses (the type of event, never the keys you typed) | To find and fix problems |
| Application logs, which can include your email address and IP address | To run the service and investigate problems and attacks |
| What you write to us | To answer you |
We send you account email (invitations, notices) through our email provider. Other members of your organization can see your name and email. The web app also loads Zendesk chat and fonts from Google when it opens, so they receive your IP address and browser details.
If you arrive through a partner's link, Trackdesk sets a referral cookie and receives your IP address and the page you came from, so the partner can be credited. When a referred organization subscribes, we tell Trackdesk; today that message includes the organization's billing email, and we are replacing it with an internal number.
You need to give us your name, email and sign-in to have an account, and billing details to buy a paid plan. Everything else is optional or collected as you use the service.
3.3 When you use the desktop clients
| Information | Where it goes | Why |
|---|---|---|
| Hardware statistics (graphics card, processor, memory, operating system) | Unity Technologies, the maker of the engine the 3D client is built on | Engine compatibility statistics |
| Your computer's name | A message service run by one of our providers, as a connection label | To route diagnostics |
| Microphone audio, when you speak to Tessa, and text to be read aloud | Us, then Microsoft's speech service | To turn speech into text and text into speech |
The desktop clients are built to send us crash reports, performance metrics and, only if you opt in, feature usage. This is not switched on today. We will update this policy before we switch it on.
The desktop clients also keep files on your own computer: logs (30 days), Tessa conversations (30 days), Tessa's memory of facts and preferences you share with it, your preferences, and the sign-in token for the Studio desktop client. You can delete these at any time.
4. Why we use it, and on what basis
We use personal information only to provide the service and keep your account working; keep it secure; support you; bill you and meet tax obligations; fix problems; credit partners who refer customers; and tell you about important changes. We send marketing email only if you ask for it, with an unsubscribe link in every one. We make no decisions about you by automated means that have legal or similarly significant effects.
If you are in the European Economic Area, the United Kingdom or Switzerland, the legal bases are performing our contract with you, our legitimate interests in running a secure and working service and in crediting our partners, legal obligation (billing records), and your consent where we ask for it (marketing email). Our documentation site and the web app do not yet ask for consent before loading the services described in our Cookie Policy; we plan to add that choice.
5. Tessa, our AI assistant
- What is sent. Your prompts, any images, the conversation so far, and the results of tools Tessa uses for you, which can include the contents of files on your computer that Tessa reads at your request, go to our servers and from there to Microsoft Azure OpenAI, which generates the answer.
- Where. Our Azure OpenAI service is based in the United States, but Microsoft may process prompts in other regions. We are moving it to US-only processing and will update this policy when that is done.
- Microsoft's retention. We do not store your conversations on our servers. Microsoft may keep prompts and answers for up to 30 days to detect abuse, and authorized Microsoft staff may review content flagged as abuse. Microsoft does not use them to train its models.
- Speech. Audio you speak to Tessa is processed by Microsoft's speech service under Microsoft's terms for it.
- Web search. When Tessa searches the web, the search goes straight from your computer to DuckDuckGo. It can include details Tessa has remembered about you, such as your location.
- No training. We do not use your prompts, your data or your telemetry to train, fine-tune or evaluate any AI model.
- Mistakes. Tessa can be wrong. Do not rely on it for decisions that need a professional's judgment.
6. Who else handles your information
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- Our providers that process data for us: Microsoft (hosting, sign-in, AI, speech), Stripe (payments), our email provider, Zendesk (support) and our message service. They are listed at Subprocessors.
- Companies that receive data under their own terms, as described above: Trackdesk (partner referrals), Typeform (forms), Google (analytics on our documentation site, and fonts), Unity Technologies (hardware statistics), and the services you click on or choose: Microsoft or Valve when you sign in with them, DuckDuckGo for Tessa's web searches, and video and store widgets.
- The law: when it requires disclosure, or to protect people from harm or fraud. We tell you first where we lawfully can.
- A buyer or successor, if Immersive Fusion is merged, acquired or sells its assets. This policy continues to apply to your information.
7. Where it is stored
We are a United States company. We store your information in the United States, in Microsoft Azure, and process customer telemetry on our own servers in the United States. Some of the companies in section 6 are based elsewhere: Typeform in Spain, Trackdesk in the Czech Republic, and our message service provider in Sweden. Tessa is described in section 5. If you use our service from outside the US, your information is transferred to the US; our Data Processing Agreement sets out the safeguards for customers in the EEA, UK and Switzerland.
8. How long we keep it
| Information | How long |
|---|---|
| Account, organization and usage information | While your account is open, then deleted when you or your organization ask us to (section 9), except your basic account record (name, email and sign-in identity), which our system cannot yet remove |
| Records of which views and traces were opened | Kept to secure the service. We have not yet set a time limit; we are adding one |
| Invitations | Kept with the invitation; we are adding automatic removal of expired ones |
| Billing records and invoices | 7 years after the transaction, as tax law requires |
| Application logs | 90 days |
| Support conversations | Kept in Zendesk; we are setting them to be deleted 24 months after the conversation closes |
| Customer telemetry | Your plan's retention period |
| Tessa prompts at Microsoft | Up to 30 days |
| Partner referral cookie | 30 days |
| How you use the web app (usage events) | About 30 days, like customer telemetry |
| Data held by Stripe, our email provider, Microsoft's speech service, our message service provider, Typeform, Trackdesk, Google and Unity | Set by each company; see its privacy policy |
| Backups | Up to 12 months, encrypted and protected against deletion, so we can recover from a disaster or an attack |
Information deleted from the live service stays in backups until they expire. We do not use it, and if we ever restore a backup, we delete it again before the service returns to normal use.
9. Your choices and rights
Wherever you live, you can ask us to see the personal information we hold about you and get a copy, correct it, delete it, restrict how we use it, or stop us using it for a purpose based on consent or our legitimate interests.
Email legal@immersivefusion.com with "Privacy request" in the subject. We may need to confirm it is you. We answer within 30 days, free of charge, and we do not treat you differently for asking.
Deletion today is done by our team, not by a button. Within one month we delete your usage, seats, invitations, preferences and Tessa usage counts, and your records at Stripe, Zendesk and our email provider. Our system cannot yet remove your basic account record (name, email and sign-in identity) or the record of which views you opened. We keep those, use them only to secure the service, and remove them once our system can. When we act on your request, we tell you what we deleted, and what we kept, why and for how long, including invoices that tax law requires. We never call something "deleted" when it has only been made anonymous or set aside.
United States residents: some state laws give you these rights by statute and let you name an authorized agent to ask for you. We honor them for everyone, whether or not a particular law applies to us. If we turn down your request, reply to our answer to appeal; we respond to appeals within 45 days.
EEA, UK and Swiss residents: you also have the right to data portability, to object, and to complain to your local data protection authority. We have not appointed a representative in the EU or the UK, or a data protection officer; contact us directly at the address below.
California residents: in the last 12 months we have collected identifiers (name, email, IP address, sign-in identity), commercial information (plan and billing records), internet activity (how you use our sites and app), audio (when you speak to Tessa) and professional information (your organization), from you, your devices and your organization, for the purposes in section 4, and disclosed them to the recipients in section 6. We have not sold or shared any of it for advertising, and we do not use sensitive personal information to infer characteristics about you.
We do not track you across other websites, so "Do Not Track" and Global Privacy Control signals change nothing.
10. Security
We protect your information with encryption in transit, encryption at rest for data stored in Microsoft Azure, multi-factor authentication for administrative access, least-privilege access for our staff and services, and secrets stored in Azure Key Vault or in Azure's encrypted application settings. No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.
11. Children
Our services are for businesses and professionals, and you must be at least 18 to use them. We do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.
12. Changes to this policy
Each version has a version number and an effective date, and we will send you an earlier version on request. If we make a change that matters, such as collecting something new or sharing it in a new way, we will tell you before it takes effect: by email if you have an account, and on this page.
13. Contact
Immersive Fusion LLC Privacy and legal: legal@immersivefusion.com Security issues: security@immersivefusion.com Mail: 600 N Broad St, Ste 5, PMB 3407, Middletown, DE 19709-1032, USA