Privacy Policy

Overview

Foefox Labs, a division of Vaansoft Technologies. ("Foefox Labs," "we," "our," or "us") is committed to protecting your privacy with the same rigor we bring to helping our clients achieve compliance. This Enterprise Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our platform, or engage our compliance consulting services.

We operate as a data processor when handling client compliance data and as a data controller for our own business operations. This policy primarily covers our activities as a data controller.

Our Privacy Commitment

At Foefox Labs, privacy isn't just a policy—it's a core principle. We believe you should have complete transparency and control over your personal data.

Information We Collect

Information You Provide Directly

• Contact Information: Name, email address, phone number, company name, job title when you contact us or request information
• Account Information: Login credentials and profile information if you create an account on our platform
• Communication Data: Messages, feedback, support requests, and any information you provide in correspondence
• Business Information: Company size, industry, compliance requirements, and project details
• Payment Information: Billing details processed securely through PCI-DSS compliant payment processors

Information Collected Automatically

• Device Information: IP address (anonymized after 24 hours), browser type, operating system, device type
• Basic Usage Data: Pages visited, time spent on pages, referring URL (collected via privacy-respecting server logs only)
• Location Data: Country and region derived from anonymized IP address

Important: We do NOT collect behavioral tracking data, create advertising profiles, use fingerprinting techniques, or employ any cross-site tracking mechanisms.

How We Use Information

We use collected information strictly for the following purposes:

• Service Delivery: Providing and improving our compliance consulting services and platform
• Communication: Responding to inquiries, providing support, and sending service-related notifications
• Marketing (with consent): Sending newsletters and updates only when you've explicitly opted in
• Transaction Processing: Processing payments and sending invoices
• Security: Protecting against fraudulent, unauthorized, or illegal activity
• Legal Compliance: Meeting regulatory and legal obligations
• Aggregate Analytics: Understanding overall website performance (no individual tracking)

Legal Basis (GDPR): We process personal data based on: (a) contract performance, (b) legitimate interests, (c) legal obligations, and (d) explicit consent where required. You may withdraw consent at any time.

Information Sharing

We do not sell, rent, or trade your personal information. Ever.

We may share information only in these limited circumstances:

• Essential Service Providers: Cloud infrastructure (AWS), email delivery, and payment processing—all bound by strict data processing agreements
• Professional Advisors: Legal counsel and accountants under confidentiality obligations
• Legal Requirements: When required by law, court order, or to protect rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with prior notice)
• With Your Consent: For any other purpose with your explicit permission

View our complete list of sub-processors on our Security page.

Cookies & Tracking

What We Use

What We Don't Use

• No Analytics Tracking: No Google Analytics, Mixpanel, Amplitude, or similar services
• No Advertising Cookies: No Facebook Pixel, Google Ads, LinkedIn Insight, or retargeting
• No Third-Party Trackers: No social media widgets that track you
• No Fingerprinting: No browser or device fingerprinting techniques

Data Retention

We retain personal information only as long as necessary for the purposes outlined in this policy:

• Active Clients: Duration of engagement plus 7 years (for legal/regulatory requirements)
• Prospects: 2 years from last meaningful interaction
• Marketing Contacts: Until you unsubscribe or 2 years of inactivity
• Server Logs: 90 days, with IP anonymization after 24 hours
• Support Tickets: 3 years from resolution

Upon expiration, data is securely deleted or anonymized. You may request earlier deletion at any time.

Your Privacy Rights

Regardless of your location, we extend comprehensive privacy rights to all users:

To exercise any right: Email legal@foefox.com with your request. We respond within 30 days (often sooner). No fees are charged for reasonable requests.

California Residents: Under CCPA/CPRA, you have additional rights including the right to know what data is collected, opt out of sale (we don't sell data), and non-discrimination for exercising your rights.

Security Measures

We implement enterprise-grade security measures to protect your information:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Control: Role-based access, multi-factor authentication, principle of least privilege
• Infrastructure: SOC 2 Type II certified cloud providers, isolated VPCs, DDoS protection
• Monitoring: 24/7 security monitoring, intrusion detection, audit logging
• Testing: Annual penetration testing, continuous vulnerability scanning
• Incident Response: Documented procedures with 72-hour breach notification
• Training: Mandatory security awareness training for all employees

For detailed security information, visit our Security page.

International Data Transfers

Foefox Labs is headquartered in the United States. For users in the EU/EEA/UK, we ensure appropriate safeguards for international transfers:

• Standard Contractual Clauses (SCCs): EU Commission-approved clauses with all relevant sub-processors
• Data Processing Agreements: Comprehensive DPAs with technical and organizational measures
• UK Addendum: International Data Transfer Addendum for UK transfers
• Swiss Compliance: Swiss-US Data Privacy Framework adherence

Copies of our SCCs are available upon request.

Children's Privacy

Foefox Labs services are designed for business professionals and are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such information, we will delete it promptly and completely.

Policy Changes

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will notify you via email (if you're a customer or subscriber)
• We will post a prominent notice on our website
• We will update the "Last updated" date at the top of this policy
• For significant changes, we may provide 30 days notice before they take effect

Your continued use of our services after changes become effective constitutes acceptance of the revised policy.

Contact Us

For any privacy-related questions, concerns, or to exercise your rights: