Privacy Policy

Effective date: 2026-08-01
Version: v1.1.0

This Privacy Policy describes how KFOX.AI ("KFOX", "we") collects, uses, shares, and protects information in connection with our AI-powered e-commerce content generation service (the "Service"). It applies to all users worldwide, with additional rights for users in the European Economic Area, the United Kingdom, and California where indicated.

1. Who we are (controller)

KFOX is the data controller for personal data processed when you use the Service. For privacy questions, contact privacy@kfox.ai.

2. Data we collect

We collect the following categories of data:

2.1 Information you provide

• Account information: email, password (hashed), display name, language preference.
• Payment information: handled by Stripe and PayPal; we never store full card numbers. We store transaction IDs, plan, amount, billing cycle, billing country.
• Content you upload: product photos, prompts, text descriptions, reference images, digital-human uploads, masks.
• Communications: support tickets, feedback.

2.2 Automatically collected

• Device & technical: IP address, browser type, OS, device identifiers, language, timezone.
• Usage logs: features used, generations created, credits consumed, timestamps, error logs.
• Cookies & similar: see §6.

2.3 From third parties

• Referrals: when someone signs up via your referral link, we record the relationship.
• OAuth (if used): basic profile from Google/Apple/etc. when you sign in via SSO.

3. How we use your data

We process personal data for the following purposes:

Purpose	Legal basis (EU/UK)
Provide and operate the Service (account, generation, credits)	Contract
Process payments and prevent fraud	Contract; Legitimate interest
Send service emails (receipts, security alerts, policy updates)	Contract; Legal obligation
Customer support	Contract; Legitimate interest
Improve performance, debug errors, prevent abuse	Legitimate interest
Marketing emails (only with opt-in)	Consent
Comply with law and respond to lawful requests	Legal obligation

We do not sell your personal information. We do not use the content you upload or the content we generate for you to train our own AI models.

Third-party AI processing: When you use AI generation features, we send uploads and prompts to external AI providers (Google Gemini, Anthropic Claude, fal.ai, OpenAI) only after you give explicit in-app consent. See our standalone Third-Party AI Data Processing Consent for details on what is sent, who receives it, and how to withdraw consent.

4. Who we share data with

Recipient	Purpose	Region
Stripe, Inc.	Card payments, subscriptions, invoices	USA
PayPal Holdings, Inc.	Alternative payments	USA
Google LLC	AI text/vision (Gemini)	USA
OpenAI, L.L.C.	AI text/image generation (GPT, Image models)	USA
Anthropic, PBC	AI text/vision (Claude)	USA
fal.ai (Featherless AI, Inc.)	AI image/video model routing (nano-banana, Kling, Wan, Seedance, etc.)	USA
Cloud hosting providers	Application hosting, file storage	USA / region of your account
Email delivery	Transactional and account emails	USA
Analytics (if enabled)	Aggregate usage analytics	USA

Each of these recipients has its own data policy; user inputs routed to AI providers are processed under those providers' terms (e.g., OpenAI does not train on API inputs by default; Anthropic does not train on API inputs by default; fal.ai processes inputs only to deliver outputs).

We may also share data:
- With law enforcement when legally required;
- In a merger, acquisition, or asset sale (your data passes to the acquirer under this same policy);
- With your consent for any other purpose.

5. International transfers

KFOX is based in the United States. Personal data may be transferred to, stored, and processed in the United States and other countries. Where required by law (e.g., for EU/UK personal data), we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Cookies & similar technologies

We use:
- Strictly necessary cookies — authentication, security, language preference. These cannot be disabled.
- Functional cookies — remember UI preferences (sidebar state, recent templates).
- Analytics cookies (opt-in) — anonymous usage statistics. You can decline via our cookie banner.

You can manage your cookie preferences at any time from the cookie banner or your browser settings.

7. Data retention

Data type	Retention
Account data	While account is active; deleted within 90 days of account deletion
Uploaded content	While account is active or until you delete it; backups purged within 90 days
Generated content	Same as above
Payment records	7 years (tax/legal requirement)
Consent records	7 years
Server logs	90 days
Marketing preferences	Until you opt out

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing;
• Portability — receive your data in machine-readable form;
• Withdraw consent at any time for consent-based processing;
• Lodge a complaint with your data-protection authority (EU/UK).

California residents (CCPA/CPRA): you may request disclosure of data we have collected, request deletion, and request not to have your data sold or shared (we do not sell or share for cross-context behavioural advertising).

To exercise any right, email privacy@kfox.ai with your registered email address. We respond within 30 days.

8a. SMS Communications

SMS opt-in is not obtained through acceptance of this Privacy Policy or our Terms of Service. Users must separately check a dedicated SMS consent box before we send any verification code. Details — including opt-in proof, sample messages, frequency, STOP/HELP — are in our standalone SMS Terms & Consent Policy.

Key points:

• Purpose-limited. SMS messages are sent only for account verification, login authentication, password reset, and phone-number binding. We do not send marketing or promotional SMS messages.
• Message frequency. Typically 1–5 SMS per month, sent only in direct response to a user-initiated action. Rate-limited to a maximum of 1 SMS per 60 seconds, 5 per hour, and 10 per 24 hours per phone number.
• Sample message. [KFOX] Your registration code is 482915. Valid for 10 minutes. Do not share.
• Opt-out. Reply STOP to any KFOX.AI SMS message, or remove your phone number from your account via Member Center → Account → Unbind phone number, or email admin@kfox.ai with subject "SMS opt-out". Opt-out is immediate.
• Help. Reply HELP to any KFOX.AI SMS, or email admin@kfox.ai.
• No third-party sharing. We do not sell, rent, or share phone numbers with any third party for marketing purposes. Phone numbers are transmitted only to Twilio Inc., solely for the purpose of delivering the OTP message.
• Carrier disclaimer. Message and data rates may apply, depending on your mobile carrier and plan. Carriers are not liable for delayed or undelivered messages.

9. Security

We implement industry-standard administrative, technical, and physical safeguards: TLS encryption in transit, encryption at rest for sensitive fields, strict access controls, secret rotation, audit logging, regular security review. No system is 100% secure; you use the Service at your own risk.

10. Children

The Service is not intended for users under 18. We do not knowingly collect personal data from children. If we learn that a child has provided data, we will delete it.

11. Changes to this Policy

We may update this Policy. Material changes will be notified at least 7 days in advance via in-app notice or email. Historical versions are retained.

12. Contact

Privacy questions: privacy@kfox.ai
EU/UK representative: contact us at the address above; we will route to the correct representative as required.