Privacy Policy

This Privacy Policy tells how we collect, use and protect personal data when you use FoxyLab: the site foxylab.ai, the studio, the API and the MCP server (the “Service”).

FoxyLab is operated by FOP Liubchenko Yurii Mykolaiovych, a sole proprietor (FOP) in Ukraine (“we”, “us”, “our”). We are the controller of your personal data.

Operator

FOP Liubchenko Yurii Mykolaiovych

Country

Ukraine

Email

support@foxylab.ai

Account

Your email address.

Your material

The links, screenshots, files, chat messages and notes that you give us, and the videos, scripts and voices that the studio makes from them.

Billing

Your plan, its status, your usage, your extra usage, and the IDs that the Merchant of Record of your order (Paddle or Creem) gives to you, to your orders and to your subscription. The Merchant of Record collects your payment details. We do not see your full card number.

Developer

The names of your API keys, your webhook addresses and your MCP connections. We keep only a hash of each API key.

Sharing

The email addresses of the people with whom you share projects and folders.

Technical

IP address, browser and device type, and server logs of requests and errors.

Product use

The pages that you open and the actions that you take on the site and in the studio.

Support

The emails that you send us and our answers.

Voice typing in the studio uses the speech recognition of your own browser. We receive only the text.

Your material can contain personal data of other people, for example a face in a screenshot. Give us such material only if you have the right to do so.

Each use of data has a legal basis:

Contract

To make your videos, run your account, send service emails such as sign-in links and invitations, and answer support requests.

Legal obligation

To keep payment and tax records, and to answer lawful requests of public authorities.

Legitimate interests

To protect the Service against fraud and abuse, to check requests against our Acceptable Use Policy, and to understand how people use the Service so that we can improve it. For analytics we use Amplitude and Google Analytics.

Consent

To publish your video as a showcase, and to send you news about the Service. You can withdraw consent at any time.

• We do not sell your personal data.
• We do not use your material to train AI models.
• We do not make decisions with legal effects on you by automated means only.

FoxyLab admins can review your material and your videos to stop abuse and to enforce our Terms and our Acceptable Use Policy.

• Before the studio makes a video, the automatic moderation service of Creem, our payment partner, can check the text of your request.
• We send Creem only the text of the request.
• We do this to keep the Service lawful and safe, and to stop content that our Acceptable Use Policy forbids. Our legal basis is our legitimate interest in a lawful and safe Service.
• If the check finds content that the policy forbids, the studio does not make the video. An admin can then review the request.

These companies process data for us. Each one gets only the data that it needs for its task.

Google Cloud

Hosting, the database (Cloud SQL) and file storage (Cloud Storage), in region europe-west1 (Belgium, EU).

Firebase Authentication

Sign-in with an email link. Firebase is a Google service.

Anthropic

AI processing. The AI features of the studio read your material and your chat, and write and assemble your videos.

Google Gemini API

The synthetic voice, made from the text of the script.

Resend

Service emails, such as invitations and notices.

Paddle

Payments, tax, invoices and refunds, as a Merchant of Record.

Creem

Payments, tax, invoices and refunds, as a Merchant of Record. Also the automatic moderation check of requests: Creem gets only the text of a request. Company: Armitage Labs OÜ, Estonia.

Amplitude

Product analytics. Amplitude gets your IP address to find your country.

Google Analytics

Traffic analytics: where visits come from and which pages people open. Google Analytics is a Google service.

Cloudflare

DNS for foxylab.ai.

Pexels and Pixabay

Stock footage and pictures. We send them search words only, not personal data.

Our servers also tell Amplitude about some events of your account, such as your sign-up, your payments and your finished videos. They tell Google Analytics about your payments. They name your account by its ID, never by your email. When you turn analytics off, they stop.

Our online reseller, Paddle or Creem, sells your purchase to you as the Merchant of Record. So the Merchant of Record also processes your payment data as a controller, under its own privacy policy: the Paddle Privacy Policy or the Creem Privacy Policy.

• People with whom you share a project or a folder see that project or folder.
• A showcase page is public. We publish it only with your permission. When you withdraw the permission, we take the page down.
• We disclose data when the law, a court order or a public authority requires it, or to protect our rights and the safety of others.
• If the Service is sold or merged, your data can go to the new owner. This Privacy Policy continues to apply to it.

• We store your account and your projects in the EU, in Google Cloud region europe-west1 (Belgium).
• We operate the Service from Ukraine. Some sub-processors, such as Anthropic, Amplitude and Google Analytics, process data in the United States and in other countries.
• For these transfers, we rely on safeguards that the law accepts, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Account data

While your account is open. We delete it within 30 days after the account closes.

Projects and videos

Until you delete them. When you delete a project, we delete its chats and files at once. Each video keeps its last 10 versions; older versions go as new ones come.

Backups

Copies in backups expire within 30 days.

Billing records

As long as tax and accounting law requires.

Server logs

Up to 30 days.

Sign-in addresses and devices

The IP addresses and browser identifiers that signed in to an account, so that one person gets one Free week: while the account is open, then we delete them with the account.

Product analytics

In Amplitude, as long as we need them to improve the Service. Then we delete them or make them anonymous. Google Analytics keeps them for up to 14 months after your last visit.

Support emails

As long as we need them to answer you and to keep a record of the request.

Depending on where you live, you have the right to:

• get a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data;
• limit how we process your data;
• object to processing that is based on our legitimate interests (for analytics, use the switch under Cookies);
• get your data in a portable format;
• withdraw your consent at any time, without effect on processing before that;
• complain to a data protection authority.

To use a right, write to support@foxylab.ai from your account email. We answer within 30 days. We can ask you to confirm who you are.

You can delete projects and folders yourself in the studio. To delete your whole account, write to us.

• The cookie vc_session keeps you signed in. The Service does not work without it.
• The cookie vc_device identifies your browser for 400 days, so that Free usage is one per person. It stays after you sign out.
• The studio keeps a few settings in the local storage of your browser, such as the last video size and the voice typing language.
• Firebase uses the storage of your browser during sign-in.
• Amplitude and Google Analytics start when you open the site. Amplitude keeps an identifier of your device in the storage of your browser. Google Analytics sets the cookies _ga and _ga_<ID> for 13 months. After you sign in, they also get the ID of your account. They never get your email or the text that you type. We use them to see how people use the Service and what to fix. Our legal basis is our legitimate interest. You can turn analytics off for this browser:
• When you turn analytics off, the cookie fl_analytics and the storage of your browser keep your choice. We delete what Amplitude and Google Analytics kept in your browser. Our servers also stop their events for your account: they learn your choice when you are signed in on this browser.
• We do not use advertising cookies. We do not track you across other sites.
• You can delete cookies and local storage in the settings of your browser. If you delete the session cookie, you are signed out.

• All traffic to the Service uses TLS (HTTPS).
• Google Cloud encrypts our database and our files at rest.
• We keep only a hash of each API key, not the key itself.
• Only the people who run the Service can access personal data, and only when their work needs it.
• No method of storage or transfer is fully secure. If a breach affects your data, we tell you and the authorities as the law requires.

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you think that a child gave us personal data, write to support@foxylab.ai, and we delete it.

We can change this Privacy Policy. The date at the top of this page shows when the current version took effect. Before an important change takes effect, we tell you by email or in the studio.

For questions about your data and for requests, write to support@foxylab.ai.

If you are in the EU, the EEA, the UK or Switzerland, you can also complain to the data protection authority where you live or work.