Privacy Policy

1. Who we are and what this covers

FoxKnock is operated by [Company legal name], [registered address] ("FoxKnock", "we", "us"). This policy explains what personal data we handle when you use the FoxKnock website and application.

We play two roles. For your account, billing and usage data we are the controller. For the lead data you load into a workspace (the companies and people you want to contact) you are the controller and we are your processor. Section 4 explains how that works for the people whose details are in a workspace.

Privacy questions and requests: [privacy contact email]. Data protection officer or EU/UK representative, if required: [name and address].

2. What we collect

• Account data: your name, work email, a salted password hash (or the identifiers from Google sign-in), your workspace memberships and role.
• Workspace content: your company brief, segments, knowledge base, sequences, drafts, sent messages and replies, tasks and notes.
• Lead data: company and contact details such as names, job titles, work emails, phone numbers when found, locations and technology stack, each with a record of where it came from.
• Mailbox and provider credentials: SMTP and IMAP passwords and any provider API keys you add. These are encrypted before they are stored.
• Website visitor data, if you install the FoxKnock tracking snippet: page URLs, referrers, user agent and a company-level match. Raw IP addresses are not stored; a keyed hash is.
• Billing data: your plan, credit balance and Stripe customer identifiers. Card details go to Stripe and never reach our servers.
• Usage and security data: audit log entries, the IP address and user agent of your sessions, error logs and usage counts for credits and provider costs.

Cookies and local storage: we use a session cookie so you stay signed in, a small cookie for the sidebar state, and local storage for your light or dark theme. The tracking snippet you install on your own site sets no cookies. It keeps a random visitor identifier in the browser's local storage and does nothing when the browser sends Do Not Track or Global Privacy Control.

3. How we use data and our legal bases

• To provide and operate the service, including discovery, research, drafting, sending and the inbox (performance of a contract).
• To bill you and prevent fraud and abuse, including checking sending against bounce and complaint limits (contract, legal obligation and our legitimate interest in a safe service).
• To secure the service, debug problems and keep audit records (legitimate interests).
• To send service emails such as password resets, invitations and billing notices. We do not use these to market to your leads (contract and legitimate interests).
• To improve the product using aggregated usage statistics (legitimate interests). We do not use the content of your workspace to train AI models.

4. People whose details are in a workspace (Article 14 notice)

FoxKnock customers use the service to find and contact business people. If you received an email sent through FoxKnock, the company that sent it decided to contact you and is responsible for that decision. FoxKnock processes the data on its behalf.

The data usually comes from public web pages and from commercial data providers, and may include your name, work email, job title, employer and location. We do not scrape LinkedIn. Every first email carries a link to a notice like this one, and every email has a one-click unsubscribe.

To unsubscribe, use the link in any email: the address is added to a suppression list for that sender and no further email is sent. To ask what data a customer holds about you, to have it corrected or erased, or to object, write to [privacy contact email] with the email address concerned. We will find the data, pass your request to the responsible customer where needed, and erase it ourselves where the law requires.

5. AI processing

FoxKnock uses Claude from Anthropic for research, scoring, writing and reply handling. To do that, relevant parts of your workspace (your brief, the company or contact being worked on, a draft or an inbound reply) are sent to Anthropic. Review the provider's current data-use terms before launch: [confirm and summarise Anthropic's retention and training terms].

AI output can be wrong. Drafts carry source citations, claims without a source block sending, and nothing is sent unless you approve it or you have earned and enabled automatic sending for that sequence.

6. Who we share data with

We share data with the service providers that help us run FoxKnock, listed on the Security page under sub-processors. Which of them see data depends on the provider keys configured for your workspace. If you bring your own keys, those calls go to the vendors you chose.

We disclose data when the law requires it, to protect our users or the service, or in a merger or sale of the business, in which case this policy continues to apply to the data. We do not sell personal data.

7. International transfers

Some of our providers are outside the European Economic Area and the United Kingdom. Where that is the case we rely on [adequacy decisions or Standard Contractual Clauses, as applicable] and the provider's own safeguards. Hosting location: [region].

8. How long we keep data

• Account data: while your account is open and for [30] days after you delete it, then erased.
• Prospects who never engaged: deleted after the workspace's retention window. The default is 365 days and you can change it in Compliance settings.
• Suppression records: kept so that an opt-out keeps being honoured.
• Billing records: [number] years, as tax law requires.
• Backups: overwritten within [number] days.

9. Your rights

Depending on where you live you can ask us to give you access to your data, correct it, erase it, restrict or object to its use, receive it in a portable format, and withdraw consent you gave. You can also complain to your data protection authority. Write to [privacy contact email]; we aim to reply within one month. Workspace owners can export and erase a person's data from the app.

10. Security

We protect data with workspace isolation, encryption of stored secrets, access controls and audit logging. The Security page describes them in detail. No system is perfectly secure, and we will tell affected customers promptly if a breach affects their data.

11. Children

FoxKnock is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.

12. Changes and contact

We will post changes to this policy here and tell account owners about material ones by email before they take effect. Questions: [privacy contact email], [postal address].