FOXAFFOXAF CRM

Privacy Policy

Last updated: 19 May 2026

FOXAF CRM ("FOXAF", "we", "our", or "us") is a multi-tenant customer relationship management platform operated by ITVision, headquartered in the Islamic Republic of Pakistan. This Privacy Policy explains what information we collect when you use FOXAF CRM at crm.foxaf.com (the "Service"), how we use it, who we share it with, and the choices you have.

By creating an account or otherwise using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Information we collect

We collect only the information needed to operate the Service:

  • Account information. Your name, work email address, password hash, workspace name, and (optionally) phone number and profile photo.
  • Contact data you upload or sync. Names, email addresses, phone numbers, company details, notes, tags, custom fields, and any other contact attributes you choose to add to your workspace.
  • Conversations. The content of messages you send or receive through connected channels (Email, WhatsApp, SMS, web chat widget), including attachments and delivery metadata.
  • Calendar data. When you connect Google Calendar, Microsoft 365, Zoom, or Calendly, we read event titles, times, attendees, and busy/free status so the Service can schedule bookings without conflicts. We also create or update events on your behalf when you ask us to.
  • Google Account email and OAuth tokens. When you authorize Google, we receive your Google Account email address and short-lived access / refresh tokens scoped to the calendar permissions you granted. We never receive your Google password.
  • Billing information. Payments are processed by Stripe. We store only the last four digits of your card, the Stripe customer ID, and subscription state. We do not see or store full card numbers.
  • Usage and device information. IP address, browser user-agent, timestamps, pages viewed, and feature usage events. Used for security, abuse prevention, and product analytics.

2. How we use information

We use the information above to:

  • Deliver, maintain, and improve the Service.
  • Authenticate you, secure your workspace, and prevent fraud or abuse.
  • Send transactional messages to your contacts on your behalf through the channels you have connected.
  • Sync booking, conversation, and calendar data between FOXAF CRM and the third-party services you have explicitly connected.
  • Process billing and prevent payment fraud (through Stripe).
  • Respond to support requests and notify you of material changes to the Service.

We do not sell your personal data, your contacts' data, or your conversation content to any third party. We do not use data from connected Google APIs to serve advertising. We do not use human reviewers to read your data except where required to comply with applicable law, to investigate a specific security incident with your consent, or where the data has been aggregated and anonymized.

3. Google API Services User Data Policy

FOXAF CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from Google Workspace APIs (including Google Calendar) is:

  • Used only to provide or improve user-facing features that are prominent in the FOXAF CRM user interface (calendar sync, meeting booking, availability conflict detection).
  • Not transferred to others except as necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
  • Not used to serve advertising.
  • Not read by humans unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or for the app's internal operations and only when the data has been aggregated and anonymized.

4. Sharing and sub-processors

We share data with a small set of sub-processors strictly to operate the Service:

  • Hosting and infrastructure. Our application and database run on dedicated servers operated by ITVision.
  • Email delivery. Resend (transactional + bulk email).
  • Messaging. Meta WhatsApp Cloud API for WhatsApp Business messages.
  • Calendar & meetings. Google, Microsoft, Zoom, Calendly — only when you connect them.
  • Payments. Stripe.
  • AI providers. Anthropic, OpenAI, and Google AI — used to power AI agents inside your inbox, only on conversations where you have enabled an agent.

We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of FOXAF, our users, or others.

5. Data retention

We retain workspace data for as long as your account is active. Conversation transcripts, contacts, and calendar links remain available to you until you delete them or close your workspace. When you delete a workspace, all associated personal data is purged from our production systems within 30 days, and from encrypted backups within 90 days. Authentication logs and security event records may be retained for up to 12 months for abuse-prevention purposes. You may request earlier deletion of OAuth tokens at any time by disconnecting the relevant integration in Settings → Integrations.

6. Your rights

You can, at any time:

  • Access and export your data. Contacts, conversations, and workspace configuration can be exported as CSV or JSON from inside the app, or on request.
  • Correct or update any personal information held about you.
  • Delete your account. Go to Settings → Workspace → Delete, or email us at info@itvision.com.pk. Deletion is irreversible.
  • Revoke Google access at any time from your Google Account permissions page, or from Settings → Integrations inside FOXAF CRM. Revoking access stops all future sync immediately.
  • Object to specific processing, or lodge a complaint with your local data-protection authority.

7. Security

We protect your data with TLS in transit, encryption at rest for credentials and OAuth tokens, isolated per-tenant data scoping, hashed passwords (bcrypt), and strict role-based access controls. No system is perfectly secure; if we ever become aware of a security incident affecting your data, we will notify you without undue delay.

8. Children

FOXAF CRM is a business tool. It is not directed to children under 16, and we do not knowingly collect data from them. If you believe a child has provided us information, please contact us so we can remove it.

9. International transfers

FOXAF CRM is operated from Pakistan. By using the Service, you understand that your data may be processed in Pakistan and in any country where our sub-processors operate. We rely on standard contractual safeguards with our sub-processors.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify account owners by email and update the "Last updated" date above. Continued use of the Service after a change constitutes acceptance of the revised policy.

11. Contact

Questions about this Privacy Policy, your data, or our compliance posture?

ITVision — FOXAF CRM
Email: info@itvision.com.pk