Privacy Policy

1. Introduction

Company Makhzoun Al Khaleej Commercial ("we", "us", "our"), operating as FoxDesk AI, respects your privacy and is committed to protecting personal data. This policy explains how we collect, use, disclose, retain, and protect information when you use our website, products, services, and integrations.

2. Information We Collect

We collect account, billing, usage, device, support, and integration data needed to operate FoxDesk. When a merchant connects Shopify, this may include:

FoxDesk account names, email addresses, user IDs, login details, and workspace information
Support conversations across email, SMS or MMS, and other messaging channels, including optional photos, videos, voice recordings, audio files, and documents that users attach
Device and app identifiers, push-notification tokens, device model and platform details, and app version information
Crash logs, diagnostics, performance measurements, and screenshots attached automatically to error reports
Customer names, email addresses, phone numbers, default addresses, customer and order identifiers
Customer tags, merchant notes, marketing status, account age, order count, and lifetime spend
Order numbers, line items, totals, discounts, payment and fulfillment status, tracking details, cancellations, returns, and refunds
Store domain, authorization metadata, and audit events showing who accessed Shopify data and when
Feedback, feature-usage data, and browser information

3. How We Use Information

We use information only to:

Provide, maintain, secure, and improve FoxDesk
Authenticate users, manage workspaces, deliver support messages and attachments, and send push notifications
Investigate crashes, diagnose technical problems, and measure app reliability and performance
Match a support contact or exact guest-order lookup to the correct Shopify customer or order
Show customer and order context to users authorized to access the active support conversation
Prepare merchant-reviewed order or tracking replies and minimal private order annotations
Process transactions, provide support, fulfill privacy requests, prevent improper disclosure, and record access history

4. Shopify Merchant Data Processing

For Shopify customer data, the merchant is the controller or business and FoxDesk is the processor or service provider. We process this data only on the merchant's documented instructions to provide the customer-support integration. We request only read_customers, read_orders, and read_returns. We do not request raw payment transactions or fraud data, sell Shopify customer data, use it for targeted advertising, or make automated decisions with legal or similarly significant effects.

5. Retention and Deletion

We keep information only as long as needed for the service, security, legal duties, and privacy requests:

Shopify customer and order responses are authoritative in Shopify and are cached in encrypted form for no more than five minutes
OAuth attempts expire after one minute, pending installations after 30 minutes, and downloadable customer-data exports after one hour
Shopify access events and completed compliance-request records are deleted after 12 months
Customer links and cached Shopify data are removed on disconnect, uninstall, customer redaction, shop redaction, or account deletion
Support messages and merchant-authored private notes remain for the life of the FoxDesk account unless deleted earlier; account deletion has a seven-day cancellation period before permanent deletion
Local database backups are retained for 14 days and encrypted offsite database backups for 35 days by default
Crash, diagnostic, performance, and error-screenshot records are kept only as long as needed to investigate and resolve reliability issues, then removed under the configured monitoring-provider retention settings

6. Data Storage and Security

We use HTTPS for data in transit, AES-256-GCM for short-lived Shopify cache values, application encryption for stored Shopify credentials, and encryption for database backups. Production is separated from staging and development by independent servers, data stores, buckets, encryption keys, and credentials. Access is limited through network controls, individual credentials, SSH keys, multi-factor authentication, and server-side audit events.

We do not sell personal data. We use infrastructure, storage, monitoring, email-delivery, and approved AI service providers under confidentiality and data-protection obligations. This includes Sentry for error and performance monitoring and Firebase Cloud Messaging for push-notification delivery. OpenAI processes data for Captain features only when a workspace administrator enables those features. A FoxDesk-controlled AI processor may receive Shopify-derived private annotations only when required deletion, zero-retention, or no-training protections are recorded. Merchants may separately configure bots, webhooks, Slack, Linear, or similar recipients under their own control. We may disclose information when required by law or to protect rights and safety.

FoxDesk does not use Shopify customer data for consent-based marketing or analytics, does not sell that data, and does not use it to make decisions that have legal or similarly significant effects on customers.

9. Your Rights and Shopify Privacy Requests

Depending on your location, you may have rights to access, correct, delete, export, object to, or restrict processing of your personal data. Shopify customers should normally contact the merchant they purchased from. FoxDesk accepts Shopify's verified customer data-request, customer-redaction, and shop-redaction requests and helps merchants fulfill them. You may contact privacy@foxdeskai.com for assistance.

10. Cookies

We use essential cookies to make our services work and analytics cookies to understand usage patterns. You can manage cookie preferences through your browser settings.

11. Contact Us

For privacy questions, contact privacy@foxdeskai.com. For security reports, contact security@foxdeskai.com. FoxDesk AI is operated by Company Makhzoun Al Khaleej Commercial.