Privacy Policy

4.1 Information You Provide Directly

When you register for FoxSuite.ai or use its products, you provide us with information that may include:

• Business account registration data: company name, business email address, phone number, designation, and billing address.
• Profile information: name, profile photo, and role within your organization.
• Billing and payment information: credit/debit card details, billing address, and payment method — processed and stored securely by our third-party payment processors (e.g., Stripe, Razorpay). We do not store full card numbers on our servers.
• Communications: messages, support tickets, feedback, survey responses, and other content you submit to us.
• Fox Forms data: any information collected through forms created and deployed by our clients using the Fox Forms product. The nature of this data depends on the fields defined by the client.
• Fox Bookings data: appointment details, attendee information, and scheduling preferences.
• Fox CRM data: customer names, email addresses, phone numbers, company details, deal information, notes, and interaction history. All personally identifiable information (PII) stored in Fox CRM is encrypted at rest using industry-standard encryption.

4.2 Information Collected Automatically

When you use the Platform, we automatically collect certain technical and usage information:

• Log data: IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps.
• Device information: device type, unique device identifiers, and mobile network information.
• Usage data: features accessed, time spent on modules, click-stream data, and interaction patterns with the Platform.
• Location data (approximate): derived from IP address for security and analytics purposes. Fox Tracking may collect more precise location data when integrated with Google services, subject to your consent.
• Cookies and tracking technologies: as detailed in Section 8 of this Policy.

4.3 Information from Fox Meetings and Fox AI NoteTaker

Fox Meetings facilitates virtual meetings and video conferences. Fox AI NoteTaker provides AI-powered transcription, summarization, and note-taking capabilities during meetings.

4.4 Biometric Data — Fox Tracking (AI Attendance & Video Analytics)

Fox Tracking includes advanced attendance management and video analytics features powered by facial recognition technology. This module uses AWS Rekognition, a cloud-based computer vision service provided by Amazon Web Services, to perform face detection and recognition for attendance marking and workforce analytics purposes.

When you deploy the Fox Tracking Biometric Attendance module:

• Explicit written consent must be obtained from each individual whose biometric data is captured, prior to enrollment. Our platform provides consent management tooling for this purpose.
• Facial images and biometric templates are transmitted to and processed by AWS Rekognition under our data processing agreement with Amazon Web Services. Facial templates generated by AWS Rekognition may be stored by AWS subject to their data retention terms.
• Clients deploying this feature are responsible for ensuring they have a lawful basis and the necessary consents to process biometric data in their respective jurisdictions, and for providing required notices to their employees and visitors.
• Biometric data must not be used for purposes other than attendance management and video analytics as configured by the Client.
• Clients must maintain a publicly accessible biometric data retention policy and destruction schedule in compliance with applicable local laws.

Buzytech IT Solutions Pvt. Ltd. acts as a data processor for biometric data collected via Fox Tracking. The Client is the data controller and bears primary responsibility for lawful processing.

4.5 Information from Third-Party Integrations

When you connect FoxSuite.ai with third-party services (such as Google Calendar, Microsoft Outlook, Slack, Zoom, Zapier, HubSpot, or others), we may receive data from those services as authorized by you. The scope of data received depends on the permissions you grant during the integration setup.

5.1 To Provide and Operate the Platform

• Creating and managing user accounts and organizational workspaces.
• Delivering the features and functionalities of all FoxSuite.ai products.
• Processing payments and managing subscription billing.
• Facilitating AI-powered features including meeting transcription, note-taking, CRM automation, and AI agent workflows.
• Storing and organizing data entered by users across all Platform modules.

5.2 To Improve and Develop the Platform

• Analyzing usage patterns and feature engagement to improve product design and performance (Beta Phase 1.0 feedback is especially important to us).
• Conducting internal research and analytics to understand how our products serve our customers' needs.
• Identifying and resolving technical issues, bugs, and vulnerabilities.
• Training and refining internal AI models and workflows, using aggregated and/or anonymized data where possible.

5.3 To Communicate with You

• Sending transactional communications including account confirmations, payment receipts, and service alerts.
• Providing customer support and responding to inquiries.
• Sending product updates, feature announcements, and release notes relevant to your subscription.
• Sending marketing communications (subject to your opt-in consent where required by law).

5.4 For Security and Compliance

• Detecting, preventing, and responding to fraud, unauthorized access, and other security threats.
• Verifying user identity and enforcing access controls.
• Complying with applicable legal obligations, court orders, and regulatory requirements.
• Enforcing our Terms of Use and other Platform policies.

5.5 For Analytics and Business Intelligence

• Using Google Analytics, Hotjar, and Microsoft Clarity to understand platform usage, user behavior flows, and performance metrics. These tools may collect data through cookies, session recordings, and heatmaps. See Section 8 for details.

7.1 Authorized Sub-Processors

We engage carefully vetted third-party service providers (sub-processors) to assist in delivering the Platform. These providers process data strictly under our instructions and are bound by data processing agreements. Our key sub-processors include:

• Artificial Intelligence Services: We use large language models and AI APIs — including those provided by OpenAI, Anthropic, and Google — to power AI features across Fox AI Agents, Fox AI NoteTaker, Fox Meetings, and other AI-enabled modules. Data submitted to these AI services is processed under our agreements with each provider and their applicable terms. We recommend that users avoid submitting highly sensitive personal data through AI-powered features where not necessary.
• Video Analytics and Facial Recognition: AWS Rekognition (Amazon Web Services) is used to provide AI-powered attendance and facial recognition capabilities within Fox Tracking.
• Meeting and Audio/Video Processing: We use authorized third-party API providers to process meeting audio and video streams in real time for transcription and analysis. Raw audio and video are not stored by us. The identity of specific sub-processors used for this functionality may change as we evolve the platform; updated lists are available upon request at hello@foxsuite.ai.
• Payment Processing: We use third-party payment processors (such as Stripe and/or Razorpay) to process subscription payments. Your financial data is handled directly by these processors and is not stored on our servers.
• Analytics Providers: Google LLC (Google Analytics), Hotjar Ltd., and Microsoft (Microsoft Clarity) provide website and product analytics services. See Section 8 for more detail.
• Cloud Infrastructure: Our Platform is hosted on cloud infrastructure provided by reputable providers operating under appropriate security certifications.
• Customer Support Tools: Third-party helpdesk and communication tools may process your support inquiry data on our behalf.

7.2 Business Clients (Data Controller Relationships)

When FoxSuite.ai is used by a business client to manage their own customers' data (e.g., through Fox CRM or Fox Forms), the client is the data controller for that end-customer data, and we act as their data processor. Clients are responsible for ensuring they have a lawful basis for sharing their customers' data with us.

7.3 Legal Requirements and Safety

We may disclose your information when required to do so by law, legal process, or regulatory authority, or when we believe in good faith that disclosure is necessary to protect our rights, prevent fraud, enforce our agreements, or protect the safety of our users or the public.

7.4 Business Transfers

In the event of a merger, acquisition, sale of assets, or similar corporate transaction, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy. We will notify you via email and/or prominent in-app notice if a material change in data control occurs.

8.1 What We Use

FoxSuite.ai uses cookies and similar tracking technologies (including pixels, local storage, and session identifiers) to operate the Platform, understand user behavior, and improve user experience. The analytics tools we currently deploy include:

• Google Analytics (Google LLC): Used to measure website and platform traffic, user session behavior, geographic distribution of users, and feature engagement. Google Analytics uses cookies to collect this data and may transfer it to Google's servers in the United States.
• Hotjar (Hotjar Ltd.): Used to generate heatmaps, session recordings, and user behavior flow analyses. Hotjar may capture mouse movements, clicks, and form interactions on our Platform.
• Microsoft Clarity (Microsoft Corporation): Used to capture session replays and behavioral analytics to understand usability and performance. Microsoft Clarity may collect data about how users interact with the Platform.

8.2 Types of Cookies

• Strictly Necessary Cookies: Required for the Platform to function. These cannot be disabled.
• Performance / Analytics Cookies: Help us understand how the Platform is used and where improvements can be made. Can be disabled via cookie settings.
• Functional Cookies: Enable enhanced functionality such as remembering preferences and language settings.
• Targeting / Advertising Cookies: If deployed in the future, these would be used to deliver relevant advertising. We will update this Policy and obtain consent before deploying any such cookies.

8.3 Cookie Management

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. However, disabling certain cookies may impair the functionality of the Platform. Our Platform includes a cookie consent banner that allows you to accept or reject non-essential cookies.

For EU/UK users, we obtain consent before deploying non-essential cookies, in accordance with the ePrivacy Directive and GDPR.

12.1 India DPDPA 2023 Compliance

• Right to Access Information (Section 11): Full explanation of what you can request: summary of data held, categories, purposes, legal basis, and identity of every third party your data was shared with. Includes response timelines, verification process, and grounds for partial decline.
• Right to Correction, Completion & Updating (Section 12a): Separately defines all three sub-rights — correction (wrong data), completion (incomplete data), updating (outdated data) — with real examples like CRM fields, account profiles. Covers downstream notification to processors who received the old data.
• Right to Erasure (Section 12b): Lists all five specific circumstances that trigger the right, explains the 90-day post-deletion window, covers downstream deletion obligations, and enumerates exact legal exceptions (Income Tax Act, Companies Act 7-year retention, ongoing legal proceedings, fraud prevention).
• Right to Grievance Redressal (Section 13): 4-step escalation ladder: Submit → 48hr Acknowledgement → 30-day Resolution → Data Protection Board of India. Describes the Board's powers including penalties up to INR 250 Crore.
• Right to Nominate (Section 14): Covers who can be nominated, how to submit a nomination, nominee's scope of authority, revocation, and identity verification process.
• Quick Reference Table: A formatted table mapping all 5 rights to: email address, response time, and exact subject line to use — ready for users to act on immediately.
• Escalation to the Data Protection Board of India: Full description of the Board's adjudicatory powers, complaint process, and penalty authority — with a note to update once the Board's portal is live.

12.2 Rights Under GDPR (EU/UK Users)

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to certain legal exceptions.
• Right to Restriction of Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive a copy of your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Rights in Automated Decision-Making: Not be subject to solely automated decisions that produce significant legal effects, except where permitted by law.
• Right to Lodge a Complaint: Lodge a complaint with your local data protection supervisory authority (e.g., your EU Member State's DPA or the UK ICO).

12.3 Rights Under CCPA (California Users)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: The categories and specific pieces of personal information collected about you, the purposes of collection, and the categories of third parties with whom it is shared.
• Right to Delete: Request deletion of personal information we have collected, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. If this changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at hello@foxsuite.ai with the subject line "CCPA Rights Request." We will respond within 45 days of receipt.

12.4 Rights Under India's DPDP Act 2023

Indian Data Principals (individuals whose personal data is processed) have the following rights under the Digital Personal Data Protection Act 2023:

• Right to Access Information: Access a summary of personal data being processed and the identities of data fiduciaries with whom data is shared.
• Right to Correction and Erasure: Request correction, completion, updating, or erasure of personal data where no legal obligation requires retention.
• Right to Grievance Redressal: Lodge a complaint with us; if not resolved to your satisfaction, escalate to the Data Protection Board of India.
• Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity.