Sub-processors

Mailbox metadata and message bodies for connected operator inboxes. For Gmail connections, an OAuth refresh token scoped to reading mail. For IMAP connections, the mailbox credentials themselves — these are entered into Aurinko's hosted form, so Fusion Link never sees them, but Aurinko does hold them, and that is a broader grant than the Gmail token: no scope limit, and no per-application revocation.

Three categories, and only the first is redacted. (1) REDACTED TEXT — email subject, body and attachment text at extraction time: PII (passport/NRIC/phone/email/credit card) is hashed and tokenised before the prompt is sent. (2) UN-REDACTED TEXT — job notes submitted for translation, booking notes checked for extra charges, free-text questions asked of the help or booking assistant (including by signed-out visitors), and, for the operator assistant, the job records in view: passenger name and phone, full pickup and drop-off addresses, flight number, assigned driver name and phone, and the amounts on each side. These are sent as written. (3) IMAGES, also un-redacted, because reading them is the task — driving-licence and supporting-document photographs, including the holder's name, licence or permit number, expiry date and face photograph, plus booking attachments, whether uploaded by an operator or received in a connected mailbox. Calls route through Vercel AI Gateway with zero data retention at the gateway layer; the provider's own retention is governed by Moonshot's privacy policy.

Text only, in two categories. (1) REDACTED — email subject, body and attachment text at extraction time, with PII (passport/NRIC/phone/email/credit card) hashed and tokenised before the prompt is sent. (2) UN-REDACTED — job notes submitted for translation, booking notes checked for extra charges, free-text questions asked of the help or booking assistant (including by signed-out visitors), and, for the operator assistant, the job records in view: passenger name and phone, full pickup and drop-off addresses, flight number, assigned driver name and phone, and the amounts on each side. These are sent as written. No document or licence image ever reaches DeepSeek. Calls route through Vercel AI Gateway with zero data retention at the gateway layer; the provider's own retention is governed by DeepSeek's privacy policy.

Vehicle make, model, and year as entered by a driver, plus the market the vehicle operates in. No name, contact detail, document, licence plate, or trip data is included in the prompt. Calls route through Vercel AI Gateway with zero data retention at the gateway layer.

Help-centre article text, and the search query a user types when asking a question — free text, which may therefore contain whatever the user chooses to include, and which is sent as written. Voyage returns embeddings and is not asked to retain the query. Separately, and regardless of Voyage: Fusion Link logs the question itself to an internal query log for answer-quality review, stored against the asker's account identifier, or a salted hash of their IP address when the question comes from a signed-out visitor. No automatic expiry is currently applied to that log.

All inbound web requests, application logs, and AI-extraction prompts. Vercel does not persist AI-gateway prompts or responses (zero-retention contract).

Raw email bodies and attachment binaries, retention bounded by Fusion Link's retention cron (90 days default, 30 days for rejected drafts). Job photographs and evidence media. Where call recording is enabled, the audio recording of a call between an operator's staff and a driver, uploaded straight to R2 by LiveKit rather than passing through Fusion Link, and deleted 30 days after the call.

The operator's mailbox itself. Fusion Link only ever requests the read-only Mail.Read scope granted at OAuth time.

The operator's mailbox itself. Note the difference from the Google path: IMAP credentials are entered into Aurinko's hosted form rather than exchanged for an OAuth token, so access is not scope-limited to reading mail and cannot be revoked per-application — it is revoked by changing the mailbox password.

Pseudonymised product-interaction events (page views, clicks, feature usage, web-vitals timings) keyed to the Firebase user identifier for signed-in users, or to an anonymous visitor identifier on marketing pages after cookie-banner consent. Sensitive UI (wallet balances, ledger amounts, driving-licence numbers, NRIC/ID documents) is masked from session replay via maskTextSelector + maskAllInputs.

Error stack traces, breadcrumb event trails, device/browser information, IP address, and the Firebase user identifier of the affected user. No financial figures or document numbers are sent in the payload.

Phone number and the OTP code at delivery time. Twilio does not receive any other account, vehicle, or trip data.

The live audio of a call, for its duration, and the finished recording for as long as it takes to upload it to R2. Alongside it: the identity minted into each call token — the account identifier and the display name shown to the other party, which for an operator is the company name and for a driver is their own name — an opaque room name derived from the call identifier, and, on a transcribed call, the call, operator and driver identifiers carried in the transcription agent's dispatch metadata so the finished transcript can be filed against the right call. No passenger is ever a party: in-app calling connects Fusion Link accounts only, and a passenger cannot be rung through it. A recording does capture whatever the driver's microphone hears, so a call taken on speaker in a vehicle captures the cabin with it. No job record, address, document, phone number, or money figure is sent — the job reference shown on the ring travels by push notification, not through LiveKit.

The audio of a call, streamed for recognition, and the text it returns. That audio is un-redacted, because recognising it is the task — so whatever the two people on the call chose to say reaches Deepgram as spoken, including any passenger name, address, or phone number they say aloud, and anything audible in the vehicle on a call taken via speaker. Nothing else is sent: no account record, no job document, and no identifier beyond what the speakers themselves say. Fusion Link stores the returned text as the transcript and deletes it 30 days after the call. Deepgram's own handling of the audio is governed by its agreement with LiveKit rather than by one with us — there is no direct Fusion Link contract, which is the trade-off of reaching it through LiveKit instead of holding our own key.

Card details, which are entered directly into Stripe's own hosted fields and never reach Fusion Link's servers. Alongside them: the payer's name and email, the amount and currency, and the booking or wallet reference the payment is against. For an operator taking payouts through Connect, the onboarding identity and bank details Stripe collects for its own KYC, held by Stripe rather than by us.

Recipient address, reply-to address, and the rendered message content at send time — which may include a customer or contact-form submitter's name, email, phone, booking details, and free-text enquiry message.