Legal

Privacy Policy

Last updated: April 2026. This policy covers how Foxello collects, uses, and protects your data - and your rights under GDPR and CCPA.

1. Who We Are

Foxello ("we", "us", "our") operates an AI-powered document processing platform. For the purposes of data protection law, the Data Controller is Ana Nenada, operating as Foxello, located in Rousse, Bulgaria.

We maintain enterprise-grade security and business continuity protocols to support our high-volume operations and BPO partners.

For privacy inquiries: privacy@foxello.com

2. Data We Collect

Account data

  • Name and email address
  • Company name (optional)
  • Subscription status (we receive only confirmation of your active plan from Lemon Squeezy; we do not receive or store payment card details)
  • Account preferences and settings

Usage data

  • Log data: IP addresses, browser type, pages visited, timestamps
  • Feature usage: which workflows you use, extraction volume, token consumption
  • Error logs and performance metrics (collected for security and service reliability purposes only)

Document data

  • Documents you upload to the Service for processing
  • Extracted data fields returned by the Service
  • Validation decisions made by your team

Document data is processed solely to provide the Service to you. We do not use your documents to train AI models or share them with third parties except as described in Section 5. To ensure maximum privacy, Foxello personnel do not access or view your documents or extracted data unless you explicitly grant us permission for a specific support request. All processing is performed programmatically via secure APIs.

Cookies

We do not set or use HTTP cookies on our marketing website or in the Foxello application for tracking, analytics, or advertising. Third-party services you interact with separately (for example, Lemon Squeezy during checkout on their own pages) may use cookies under their own policies.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your personal data on the following legal bases:

  • Contract performance (Article 6(1)(b)): Processing necessary to create and manage your account, authenticate you, deliver document extraction services, and handle billing.
  • Legitimate interests (Article 6(1)(f)): Processing usage logs, IP addresses, and browser information to maintain security, prevent fraud and abuse, and improve service reliability. We have assessed that these interests are not overridden by your rights.
  • Legal obligation (Article 6(1)(c)): Processing required to comply with applicable law, respond to lawful requests, or meet financial record-keeping obligations.
  • Consent (Article 6(1)(a)): Where we rely on your consent (for example, for optional marketing communications), you may withdraw it at any time without affecting the lawfulness of prior processing.

4. How We Use Your Data

  • To provide the Service: Processing your documents, running extraction workflows, and returning structured output.
  • Account management: Authentication, billing, support, and communications about your account.
  • Service improvement: Aggregated, anonymized usage data helps us improve performance and develop new features. This never includes your document content.
  • Legal compliance: To comply with applicable laws, respond to lawful requests, and enforce our Terms.
  • Security: To detect and prevent fraud, abuse, and security incidents.

5. Data Retention

  • Documents and extracted data: Retained for the data retention period included in your plan (1 year on Starter, 2 years on Growth, 3 years on Scale), plus 30 days after account termination so you can export your data. You can delete documents at any time from your dashboard.
  • Account data: Retained for the life of your account, plus any legally required retention periods.
  • Usage logs: Retained for 90 days for security and performance purposes.

6. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the following categories of recipients, each engaged under appropriate data processing agreements:

Infrastructure and hosting

  • Amazon Web Services (AWS) - Application hosting (EC2) and file storage (S3) in European regions. Privacy policy

Database and caching

  • MongoDB Atlas - Cloud database used to store account data and extraction results, deployed in EU regions. Privacy policy
  • Upstash Redis - Serverless caching layer used for session management and performance, deployed in EU regions. Privacy policy

AI document processing

  • Microsoft Azure - Azure Document Intelligence - Used for OCR and document structure extraction, deployed in EU regions under our Azure agreement. Privacy policy
  • Microsoft Azure - Azure OpenAI - Used for AI-powered field extraction and data structuring on some models, deployed in EU regions under our Azure agreement. Data submitted to Azure OpenAI is not used by Microsoft to train models. Privacy policy
  • Amazon Web Services - Amazon Bedrock - Used for AI-powered field extraction and data structuring on other models, and for Markdown generation, deployed in EU regions under our AWS agreement. Data submitted to Bedrock is not used by AWS to train models. Privacy policy

Foxello may change which underlying model or provider handles a given extraction mode over time (including adding new models); any change stays within the EU-region processors listed here.

Payment processing

  • Lemon Squeezy - We use Lemon Squeezy as our Merchant of Record. This means Lemon Squeezy legally sells Foxello subscriptions to customers, handles all payment processing, tax compliance, and chargebacks directly. Your billing and payment data is collected and controlled by Lemon Squeezy under their own privacy policy - Foxello does not receive or store your payment card details. Privacy policy

Legal requirements

  • When required by law, court order, or to protect the rights and safety of users or the public.

7. Data Location

We process and store customer documents, extracted data, and related personal data in the European Union / European Economic Area (EU/EEA) for all core service components:

  • File storage: Documents you upload are stored in Amazon S3 in EU regions.
  • Application hosting: Our platform runs on AWS EC2 in Europe.
  • Database: Account and extraction data is stored in MongoDB Atlas in EU regions.
  • Caching: Session and transient data is handled by Upstash Redis in EU regions.
  • AI processing: Document extraction uses Azure Document Intelligence, Azure OpenAI, and Amazon Bedrock, all deployed in the EU, depending on the extraction mode and model selected.

Your data remains within the EU. All core processing - including file storage (AWS), database hosting (MongoDB, AWS), and AI-powered extraction (Azure OpenAI and Amazon Bedrock) - is performed exclusively within EEA-based infrastructure to ensure full compliance with regional data sovereignty requirements. If our approach to data location changes materially, we will update this policy and, where the law requires, put appropriate safeguards in place and notify you.

8. Your Rights Under GDPR (EU/EEA Users)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations.
  • Right to data portability: Receive your personal data in a structured, machine-readable format and transfer it to another controller.
  • Right to restrict processing: Request that we limit how we use your data in certain circumstances.
  • Right to object: Object to processing based on legitimate interests.
  • Right not to be subject to automated decision-making: We do not make solely automated decisions with significant legal effects about you.
  • Right to lodge a complaint: You have the right to lodge a complaint with your national data protection supervisory authority at any time. A list of EU supervisory authorities is available at edpb.europa.eu.

To exercise any of these rights, contact us at: privacy@foxello.com. We will respond within 30 days.

9. Your Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, and how it has been used and shared.
  • Right to delete: Request deletion of personal information we have collected, subject to certain exceptions.
  • Right to opt-out of sale: We do not sell personal information. No opt-out is necessary, but you may contact us to confirm this.
  • Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise CCPA rights, contact us at: privacy@foxello.com. We will respond within 45 days.

10. Security and Data Breach Notification

We implement appropriate technical and organizational measures to protect your data, including TLS encryption in transit, encryption at rest using industry-standard mechanisms provided by our EU-based AWS and Azure services (such as server-side encryption for object storage and encrypted database volumes), access controls, and security monitoring. See our Security & Compliance page for full details.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34.

11. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or through the Service at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions, data requests, or concerns:

Email: privacy@foxello.com
General inquiries: hello@foxello.com

14. Data Processing Agreement (DPA)

For business customers and BPO teams requiring a formal Data Processing Agreement (DPA) to meet their regulatory obligations, please contact us at privacy@foxello.com to receive our standard agreement.