Privacy Policy

1. Who We Are

Foxxed Ltd (Company No. [pending]) is the data controller for personal data processed through foxxed.ai. Contact: hello@foxxed.ai.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

2.1 Data You Provide

• Decision text: The text you type when submitting a decision for analysis.
• Feedback: Responses to "Was this helpful?" and any follow-up feedback you choose to provide.
• Survey/Discovery responses: If you complete our feedback or discovery forms.
• Email address: Only if you voluntarily provide it (e.g., via the feedback form).

2.2 Data We Generate

• Session identifier: A random UUID generated in your browser. This is NOT linked to your identity.
• Decision analysis: The AI-generated critique, risks, blind spots, and options produced by our system.
• Safeguarding flags: If our safety system detects potential vulnerability, we log the severity level and flag category — never the content that triggered it.

2.3 Data We Do NOT Collect

• We do not use cookies for tracking or advertising.
• We do not use analytics services (Google Analytics, etc.).
• We do not collect your name, address, or payment information (during beta).
• We do not require account creation or login.

3. How We Protect Your Personal Information

3.1 PII Redaction Before AI Processing

Before your decision text reaches any AI model, our system automatically detects and replaces personally identifiable information (PII) with anonymous placeholders:

• Email addresses → [EMAIL_1]
• Phone numbers → [PHONE_1]
• National Insurance / SSN numbers → [NATIONAL_ID_1]
• Credit card numbers → [CREDIT_CARD_1]
• Dates of birth → [DOB_1]
• Medical ID numbers → [MEDICAL_ID_1]
• IP addresses → [IP_1]
• Full names (2+ word names) → [NAME_1], [NAME_2], etc.
• Postal addresses → [ADDRESS_1]
• Postcodes / ZIP codes → [POSTCODE_1]

The AI model never sees your real personal details. The redaction mapping is held in memory only for the duration of your request and is never stored or logged.

3.2 What the AI Provider Receives

We use Anthropic (Claude) as our AI provider. Anthropic receives your decision text with PII replaced by placeholders. Under Anthropic's enterprise API terms, API inputs are not used for model training. We rely on this representation.

3.3 Safeguarding Privacy

Our safeguarding system detects potential crisis or vulnerability signals. We log only the severity level and flag category (e.g., "severity: critical, flags: 1"). We NEVER log the specific text that triggered the detection. This protects the privacy of vulnerable users.

4. Legal Basis for Processing

Under UK GDPR Article 6, we process your data on the following bases:

• Consent (Article 6(1)(a)): You consent to processing when you submit a decision for analysis.
• Legitimate interests (Article 6(1)(f)): We have a legitimate interest in improving our service, detecting abuse, and ensuring platform safety.

4a. Special Category Data

Some decisions you submit may involve special category data under UK GDPR Article 9, including:

• Health data: Decisions about medical treatment, mental health, or wellbeing.
• Religious or philosophical beliefs: If referenced in your decision context.
• Data concerning sex life or sexual orientation: If referenced in relationship decisions.

We process special category data on the basis of your explicit consent (Article 9(2)(a)), which you provide by submitting the decision for analysis. Our safeguarding system provides additional protection for sensitive content.

4b. Withdrawing Consent

You can withdraw your consent at any time by:

• Emailing hello@foxxed.ai with your session ID or decision ID
• Using the GDPR deletion endpoint (if you have admin access)
• Clearing your browser's localStorage (removes your session identifier)

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. We will delete your data within 30 days of receiving a withdrawal request.

4c. AI Transparency (UK AI Governance & EU AI Act)

Foxxed uses artificial intelligence to analyse your decisions. Here is how it works:

• What the AI does: Multiple AI perspectives analyse your decision text to identify risks, blind spots, supporting evidence, strategic alternatives, and economic options.
• AI provider: Anthropic (Claude models — Haiku for speed, Sonnet for depth).
• Limitations: The AI may produce inaccurate, incomplete, or biased analysis. It cannot access real-time data, verify facts, or provide professional advice.
• Human oversight: All decisions remain yours. Foxxed provides analysis to support your thinking — never to replace it.
• Right to explanation: You can request an explanation of how a specific verdict was generated by contacting hello@foxxed.ai.

5. Data Storage and Retention

• Where: Decision data is stored on Railway (US-based hosting) in an encrypted database. Frontend is served via Vercel (global CDN).
• How long: Decision data is retained for up to 7 years to support outcome tracking, calibration, and regulatory compliance. You can request deletion at any time (see Section 6). Active data is stored in our primary database; data older than 2 years may be archived to secure cold storage.
• Session data: Your session UUID is stored in your browser's localStorage. It is never sent to any third party.
• Backups: Database backups are stored securely and subject to the same retention policies.

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access (Article 15): You can request a copy of all data we hold about you.
• Right to rectification (Article 16): You can request correction of inaccurate data.
• Right to erasure (Article 17): You can request deletion of your data. Contact hello@foxxed.ai with your session ID or decision ID.
• Right to restriction (Article 18): You can request we restrict processing of your data.
• Right to data portability (Article 20): You can request your data in a machine-readable format.
• Right to object (Article 21): You can object to processing based on legitimate interests.

To exercise any of these rights, email hello@foxxed.ai. We will respond within 30 days as required by UK GDPR.

7. Children's Privacy

Foxxed includes automated age detection. When a user indicates they are under 18:

• Analysis style is automatically adjusted to be supportive and age-appropriate.
• Safeguarding referrals (e.g., Childline) are prioritised.
• We do not knowingly collect personal data from children under 13 without parental consent (UK Age Appropriate Design Code).

If you believe a child under 13 has submitted personal data, contact us immediately at hello@foxxed.ai.

8. Data Sharing

We share data with the following third parties:

• Anthropic (AI provider): Receives PII-redacted decision text for analysis. Does not receive names, emails, phone numbers, or other personal identifiers.
• Railway (hosting): Hosts our backend infrastructure. Processes data as a sub-processor.
• Vercel (frontend hosting): Serves our website. Does not process decision data.
• Cloudflare (DNS/email routing): Routes emails to hello@foxxed.ai. Does not access decision data.

We do NOT sell, rent, or share your data with advertisers, data brokers, or any other third parties.

9. International Data Transfers

Some of our service providers (Railway, Anthropic) are based in the United States. Data transfers to the US are conducted in compliance with UK GDPR requirements, relying on Anthropic's and Railway's standard contractual clauses and data processing agreements.

10. Security Measures

• HTTPS encryption for all data in transit
• PII redaction before AI processing
• Session isolation (each user can only access their own decisions)
• Rate limiting to prevent abuse
• Admin access protected by authentication tokens
• Database backups with integrity verification
• No debug endpoints or API documentation exposed in production

11. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We encourage you to contact us first at hello@foxxed.ai so we can try to resolve your concern directly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the Service constitutes acceptance of the updated policy.