Privacy policy

In short

This policy describes the data FoxPersona processes, why, for how long, and the rights available to you.

• Forwarding emails does not require a mailbox connection. The Gmail and Outlook add-ins access the conversation you open to extract contacts. Optional Gmail deep search may read up to five older messages from a selected contact.
• Forwarded emails are deleted after extraction, no later than eight hours after arrival, unless an import is waiting for credits.
• The analysis runs in Switzerland, at Infomaniak, and no content is used to train a model.
• Your data is never sold, rented or shared for commercial or advertising purposes.

Controller and roles

FoxTarget SARL, 254 rue Vendôme, 69003 Lyon, France, is the controller for processing related to your account — signup, authentication, billing, support.

For messages you forward or import from Gmail or Outlook, and the contact cards they produce, your organisation remains the controller and FoxTarget SARL acts as a processor within the meaning of Article 28 GDPR, on your instructions alone. It is your responsibility to have a legal basis for recording your contacts' details and to inform them.

Data processed

• Account: name, email address, password (hashed), language, organisation and role, sign-in logs.
• Forwarded content: the message you forward and its attachments, for the duration of the extraction.
• Gmail and Outlook add-ins: content of the conversation you open and the identity of the connected mailbox. If you enable Gmail deep search, a Google authorization is stored and up to five older messages from a selected contact may be read.
• Contact cards: name, job title, email address, phone numbers, company and related details.
• Company: public identification data (SIREN, SIRET, NAF code, address) from open sources.
• Billing: subscription identifiers, order and payment history, processed by our payment provider.
• Technical: IP address, timestamps, error and processing logs required to operate and secure the service.

Purposes and legal bases

• Providing the service and managing your account — performance of the contract.
• Billing subscriptions and credit packs — performance of the contract and accounting obligations.
• Securing the service, preventing abuse and diagnosing incidents — legitimate interest.
• Answering a message sent through the contact form — consent.

Retention periods

• Forwarded email: deleted as soon as the contacts are extracted, and no later than eight hours after it arrives. It is kept for up to thirty days only when an import is paused for lack of credits, so it can resume after a top-up.
• Gmail and Outlook conversations: message content is purged daily starting thirty days after import. Message IDs, digests, dates and information needed to track imports are retained until the organisation’s data is deleted.
• Gmail deep search connection: the authorization is retained until revoked or the organisation is deleted.
• Contact cards: kept for as long as your organisation wants them, deletable and exportable at any time.
• Account and organisation: on a deletion request, the organisation is deactivated, then permanently destroyed — database and files — after thirty days.
• Billing: ten years, as required by accounting obligations.
• Technical logs: a limited period, for security and diagnostics.

Processors and recipients

The service runs on a deliberately small set of providers, all bound by confidentiality commitments.

• Scaleway SAS (France): hosting of the application and its databases.
• Infomaniak Network SA (Switzerland): inference, to extract contact details.
• Paddle.com Market Ltd (United Kingdom): payment and invoicing, as merchant of record.
• A transactional email and SMS provider, to deliver contact cards and notifications.
• Company data is enriched from public sources — Sirene (INSEE), the Adresse API, the Recherche d'entreprises API — and logos through Logo.dev.
• Plausible Analytics: audience measurement for the public site at analytics.foxtarget.com, using anonymised statistics.

Transfers outside the European Union

Hosting is located in France. Inference takes place in Switzerland, a country recognised by the European Commission as offering an adequate level of protection.

Some ancillary providers — payment, company logos — may be established outside the European Union. Those transfers are covered by the European Commission's standard contractual clauses.

Security

Each organisation has its own database, isolated from the others. Traffic is encrypted in transit, passwords are hashed and API keys are stored as digests. The measures are detailed on the Security page.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. These rights can be exercised at help@foxpersona.com — exporting your contacts is also available at any time from the application.

If your details were recorded by a FoxPersona customer, please contact that customer first, as the controller. We forward any request we receive to them and assist them in answering it.

You may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Cookies

The public site and the application only use strictly necessary cookies for operation and sign-in, including the session cookie. No advertising cookies are used.

Public-site audience measurement uses Plausible Analytics, without cookies or persistent identifiers. Only anonymised traffic statistics are used; this setup does not require a cookie consent banner.

Contact

Any question about this policy — help@foxpersona.com, or by post to FoxTarget SARL, 254 rue Vendôme, 69003 Lyon, France.