Privacy Policy

1. Who we are

Foxlot (foxlot.ca) is operated by Foxdoo Technologies Inc. This policy explains how we collect, use and protect personal information across the merchant dashboard and public booking pages, in accordance with Canada’s PIPEDA.

2. What we collect

Merchant account data: name, email, business details, subscription status.

Guest booking data: name, phone, email, notes, booking history, and answers to merchant-defined custom form fields — provided by guests at booking time and processed on behalf of the merchant.

Technical data: a login session cookie (used only to keep you signed in, never for ad tracking).

3. How we use it

Only to provide the booking service: creating and managing bookings, sending booking-related notifications (confirmations, reminders, reschedule/cancellation notices, and review invitations when enabled by the merchant), subscription billing and support.

We do not sell personal information or use it for third-party advertising.

4. Roles for guest data

For guest booking data, the merchant is the data controller and Foxlot acts as a processor on the merchant’s behalf. Guests may exercise access, correction or deletion rights by contacting the merchant they booked with, or by emailing [email protected] — we will coordinate with the merchant.

5. Third-party processors

Information may be processed by: Stripe (billing and merchant payments), our email delivery provider (booking notifications), Twilio (SMS on the Pro plan), and Google (only when a merchant’s staff member connects Google Calendar sync). Each receives only the minimum information needed for its function.

6. Storage & security

Data is stored in managed cloud databases with TLS encryption in transit. Magic links use non-enumerable random tokens. Cards saved for bookings are held by Stripe — we never store card numbers.

7. Retention & deletion

Data is retained while the merchant account exists. Merchants or guests may email [email protected] to request export or deletion of personal information; we process requests manually within 30 days (a manual process at this stage).

8. Your rights

Under PIPEDA you may access, correct or delete your personal information and withdraw consent (some features may stop working after withdrawal). You may also lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC).

9. Changes & contact

Updates to this policy are dated on this page; material changes will be announced separately. Contact: [email protected].