Privacy Policy. What we collect and why.

Draft, pending legal review.Effective date: Legal review: dateLast updated: [date of merge]

This policy explains what personal data FoxCue collects, why, who we share it with, how long we keep it and what choices you have. It covers the foxcue.com marketing website and the FoxCue app at app.foxcue.com, where you sign up for and use your FoxCue account.

"FoxCue", "we", "us" and "our" mean Legal review: legal entity name, registered address and jurisdiction (likely Ontario, Canada; confirm).

1. Summary

• We collect what you give us when you sign up or contact us, what you connect (your website, help docs, Google Search Console and YouTube), and what you record or upload in the studio.
• We use it to run your account and the features you use: video ideas, cited scripts, videos, edits and reports.
• Some processing uses AI model providers. We send them only what a task needs, and we don't use your content to train our own general-purpose models. Legal review: confirm with each provider's API data terms
• We don't sell personal data.
• You can ask us to access, correct, export or delete your data at any time (see §10).

2. Our role

• Website visitors, account holders and people who contact us: we decide how this data is used (we are the "controller").
• Customer content (your site, docs, Search Console and YouTube data, recordings, brand assets and the people who appear in them): we process it on your behalf to deliver the service (we are a "processor" or "service provider"). Legal review: confirm roles; offer a Data Processing Agreement (DPA) for business customers

3. Data we collect

You give us directly

• Account details: when you sign up at app.foxcue.com, your name, email, workspace name and the team members you invite. Legal review: match to the fields the signup flow actually collects
• Support and contact messages: your email address and anything you write in the message.
• Billing details (if you choose a paid plan or buy credits): billing contact and invoices. Card data is handled by our payment processor, not stored by us. Legal review: no payment processor chosen yet

Content you connect or upload

• Website and help-center pages at URLs you give us. We crawl only public pages, follow robots.txt, and store page text, titles and links so scripts can cite exact passages.
• Files and brand assets you upload: logos, colours, fonts, slides, screen recordings, documents.
• Google Search Console data, if you grant access: search queries, pages, clicks, impressions, average position and similar report data for the properties you choose.
• YouTube data: public channel and video information (titles, descriptions, statistics) through the YouTube Data API. If you authorize your account, also analytics reports for your channel. Legal review: list exact OAuth scopes once Google verification is done
• Recordings: when you record in the FoxCue studio, camera, microphone and screen capture you choose to start. Recording happens in your browser and is uploaded to our storage so it can be edited. Legal review: biometric/voice considerations if voice cloning is ever added — not offered today
• Generated outputs: video ideas, briefs, scripts, slides, articles, audio narration, edited videos, captions and share links.

Collected automatically

• Server logs: IP address, browser type, pages requested, timestamps, errors. Kept for security and troubleshooting.
• Cookies: foxcue.com currently sets only cookies strictly needed for the site to work.

4. How we use data

• Provide the FoxCue app: crawl and index your sources, find video opportunities, draft cited scripts, render and edit videos, produce reports.
• Communicate with you about your account and your support requests.
• Keep the service secure, prevent abuse and fix problems.
• Improve FoxCue, using aggregated or de-identified usage information. Legal review: confirm whether any customer content is used for product improvement; default answer: no
• Meet legal obligations.
• Send product news only if you opt in; every email has an unsubscribe link. Legal review: CASL/CAN-SPAM consent wording

Legal review: legal bases under GDPR/UK GDPR for each purpose (contract, legitimate interests, consent, legal obligation)

5. AI processing

• To draft scripts, summarize sources, find citations, generate narration and suggest edits, we send the relevant parts of your content to AI model providers through their business APIs.
• Each script claim is linked to the source passage it came from. AI output can still be wrong, so you review every script before you record it.
• No training on your content: we do not use your content to train FoxCue's own general-purpose models. Our providers' API terms say they don't train on API data by default. Legal review: confirm current terms and retention windows for each provider; consider zero-data-retention options
• Transcription of recordings (used for silence and retake cuts and captions) uses an open-source speech model run on infrastructure we control. Legal review: confirm in the production setup
• We don't make decisions with legal or similarly significant effects about individuals based solely on automated processing.

6. Google API data (Search Console and YouTube)

• FoxCue's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• We use Search Console and YouTube data only to provide and improve the features you asked for (finding video opportunities and reporting on your videos). We don't use it for advertising, don't sell it, and don't use it to train generalized AI models.
• FoxCue uses YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service; see the Google Privacy Policy.
• You can revoke FoxCue's access at any time at Google security settings. When you do, or when you ask us, we delete stored Google API data within Legal review: 30 days. YouTube API data is refreshed or deleted at least every 30 days as YouTube's policies require. Legal review: confirm implementation

7. Who we share data with

We share personal data only with:

• Subprocessors that help us run the service, under contracts that limit their use of it:

  Subprocessor	Purpose	Location
  [not selected]	Application hosting, storage, backups	[TBD]
  OpenAI	AI drafting, embeddings for search across your sources, optional text-to-speech	USA
  Anthropic	AI drafting	USA
  ElevenLabs	Optional AI narration (text-to-speech)	Legal review: USA/EU
  Google (Search Console, YouTube Data APIs)	Data you choose to connect	USA
  [not selected]	Transactional and support email	[TBD]
  [not selected]	Billing	[TBD]

Legal review: keep this list current; publish changes [30] days in advance for customers with a DPA

• Professional advisers (lawyers, accountants), under confidentiality.
• Authorities, when the law requires it.
• A buyer or successor, if FoxCue is involved in a merger, acquisition or asset sale, with this policy continuing to apply.
• Anyone you choose: for example, people you send a video share link to. Share links are long random tokens, can be revoked, and are hidden from search engines.

We do not sell or rent personal data, and we don't share it for cross-context behavioural advertising.

8. How long we keep data

Legal review: confirm every period

• Customer content and outputs: for as long as you're a customer, then deleted within [30] days after account closure, unless you ask us to export it first.
• Backups: overwritten within [35] days.
• Server logs: [90] days.
• Billing records: as long as tax law requires (typically [6–7] years).

9. Security

We use access controls, workspace isolation between customers, encrypted connections (HTTPS), revocable share links and least-privilege access to provider keys. Legal review: confirm encryption at rest and other controls once hosting is chosen No method of transmission or storage is perfectly secure. If a breach affects your personal data, we'll notify you and regulators as the law requires.

10. Your rights

Depending on where you live (for example the EU/EEA, UK, Canada, or California and other US states), you may have the right to:

• access the personal data we hold about you and get a copy;
• correct it;
• delete it;
• export it in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time, where we rely on consent;
• complain to your data-protection authority.

To use any of these rights, contact us (see §14). We'll respond within Legal review: 30 days. If we process your data on behalf of a customer (for example you appear in a customer's video), we'll forward your request to that customer.

Legal review: PIPEDA/Quebec Law 25, GDPR/UK GDPR, CCPA/CPRA-specific disclosures; privacy officer designation

11. International transfers

We and our subprocessors may process data outside your country, including in the United States and Canada. Where required, we use safeguards such as Standard Contractual Clauses. Legal review

12. Children

FoxCue is a business service, not intended for anyone under [16]. We don't knowingly collect children's personal data.

13. Changes

We'll post updates here and change the "Last updated" date. For material changes, we'll notify customers by email before they take effect.

14. Contact

Postal address: Legal review: entity address · Privacy officer: Legal review: name, e.g. Jeel Patel