Privacy Policy

Last updated: August 2026 · Polyfox Studio Ltd · Registered in England & Wales

1. Who we are

FoxLink is a CRM product built and operated by Polyfox Studio Ltd, a company registered in England & Wales under company number 17227391, with its registered office at 66 Paul Street, London, England, EC2A 4NA. References to "we", "us", or "our" in this policy refer to Polyfox Studio Ltd.

We are the data controller for the personal data processed through FoxLink. If you have questions about this policy or how we handle your data, contact us at privacy@foxlink.network.

2. What data we collect

Account data

• Your name and email address (provided when you sign up)
• Your password (stored in encrypted form — we never see it in plain text)
• Your workspace name

CRM data you enter

• Contact details (names, emails, phone numbers, companies) that you import or add manually
• Deal information (names, values, stages, close dates, notes)
• Activity logs (calls, meetings, emails, notes)
• Tasks you create and assign
• Web form submissions from your customers or leads

Usage data

• Pages and features you use within the app
• Timestamps of logins and actions
• Browser type and device information (collected automatically)

Billing data

• Payment information is handled entirely by Stripe — we never see or store your card details
• We store your Stripe customer ID and subscription status to manage your plan

3. Why we collect it and our legal basis

Under UK GDPR, we must have a legal basis for processing your personal data. Here are the bases we rely on:

• Contract performance — we process your account and CRM data to provide the FoxLink service you signed up for
• Legitimate interests — we process usage data to improve the product, fix bugs, and ensure security
• Legal obligation — we may retain certain data to comply with UK law (e.g. financial records)
• Consent — we send trial onboarding emails during your free trial. You can unsubscribe at any time using the link in any email

4. How we use your data

• To provide and operate the FoxLink CRM service
• To send you account-related emails (confirmation, password reset, billing receipts)
• To send trial onboarding emails during your 30-day trial (unsubscribe any time)
• To send the daily agenda email if you have it enabled (you can turn this off in Settings)
• To process payments via Stripe
• To improve the product based on how features are used
• To respond to support requests

We do not use your data for advertising. We do not sell your data to any third party. We do not share your CRM data with other FoxLink customers.

5. AI features and your data

FoxLink uses the Anthropic Claude API to power AI features including lead scoring, contact summarisation, email drafting, call-notes cleaning, daily prioritisation and briefings, and deal, workflow and board insights. When you use these features, relevant data (contact details, deal information, notes) is sent to Anthropic's API to generate a response.

Anthropic processes this data in accordance with their own privacy policy and data processing agreement. Anthropic does not train their models on API data by default. You can review Anthropic's privacy practices at anthropic.com/privacy.

AI features are optional and on-demand — data is only sent to Anthropic when you actively use an AI feature.

6. Where your data is stored

FoxLink stores all account and CRM data on Supabase infrastructure located in the EU West (London) region. Data does not leave the UK/EU region for storage purposes.

We use the following sub-processors:

• Supabase — database and authentication (EU West, London)
• Vercel — application hosting and compute (London)
• Upstash — rate limiting and usage counters (Redis) (EU, London)
• Sentry — error monitoring and diagnostics (EU, Frankfurt)
• Resend — transactional email delivery (United States)
• Anthropic — AI features, on-demand only (United States)
• Stripe — payment processing (United States / EU)

International transfers

Your data is stored in the UK. Some sub-processors above process limited personal data outside the UK/EEA — Anthropic and Resend (United States), and Stripe (United States / EU). Where data is processed outside the UK/EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement and/or the European Commission's Standard Contractual Clauses. The current, authoritative list is at foxlink.network/subprocessors.

7. How long we keep your data

• Active accounts — data is kept for as long as you have an account with us
• Deleted accounts — we delete your data within 30 days of account deletion
• Billing records — kept for 7 years to comply with UK financial record-keeping requirements
• Email logs — kept for 90 days for debugging and support purposes
• Audit logs — workspace activity logs are kept for 12 months, then automatically deleted

8. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you
• Right to rectification — you can correct inaccurate data (most of this you can do yourself in Settings)
• Right to erasure — you can delete your data yourself at any time. Team members can erase their own account and personal data from Settings → Delete Account; workspace owners can delete the entire workspace from Settings → Delete Workspace. Export everything first from Settings → Data Export if you'd like a copy
• Right to restrict processing — you can ask us to stop using your data in certain ways
• Right to data portability — you can export all your data as a ZIP file at any time from Settings → Data Export
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — you can unsubscribe from marketing emails at any time

To exercise any of these rights, email privacy@foxlink.network. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

FoxLink uses essential cookies only — these are required for the service to function (authentication sessions, security tokens). We do not use advertising, tracking, or analytics cookies.

The landing page (foxlink.network) uses localStorage to remember that you have acknowledged the cookie notice. No personal data is stored in this.

10. Security

We take security seriously. FoxLink uses row-level security on all database tables, meaning your workspace data is completely isolated from other customers. All data is encrypted in transit (HTTPS/TLS) and at rest. Passwords are hashed and never stored in plain text. We also monitor workspace activity and logins for suspicious patterns and alert our team so we can respond quickly.

If you discover a security vulnerability, please report it responsibly to security@foxlink.network.

11. Children

FoxLink is a business tool intended for adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. When we make significant changes, we will notify you by email and update the "Last updated" date at the top of this page. Continued use of FoxLink after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions or requests:

• Email: privacy@foxlink.network
• General: hello@foxlink.network