Trust

Last reviewed 11 November 2026

What GetFoxChat collects, what each connection can do, where the data lives, who helps us run it, how long we keep conversations and how to have them erased. Each statement is checked against our code and database. The full privacy policy is at getfoxchat.com/privacy.

GetFoxChat is not certified

We do not hold ISO 27001 or SOC 2, and we do not say we are aligned with either. Our providers publish their own certificates (links below); those belong to them. If a buyer needs a certificate, write to privacy@mentionfox.com and we will say plainly whether we can meet it.

What the chat on a website collects from a visitor

The visitor's messages and the replies, and any file they attach.
The pages they view while the chat is loaded, the page titles, how long they stayed, and the browser's user-agent text.
An email address and a name, only if the visitor types them into the chat or the website passes them because the visitor is signed in there.
A random visitor id kept in the browser's local storage on that website (not a device fingerprint). The chat sets no cookies and loads no other company's script.
The labels of the page's buttons, links and form fields, so the chat can point to the right place. Never what is typed into them: password, hidden, email, phone and file fields, and fields marked for personal data, are skipped entirely.

The business that runs the website decides to use GetFoxChat and can see its own visitors' conversations. Nobody else can: all 229 tables in our database have row-level security switched on (checked 11 November 2026).

What each connection can do

Connection	What it can do
Shopify	Read only: products, orders, customers, content and themes (`read_products`, `read_orders`, `read_customers`, `read_content`, `read_themes`). It cannot change the store. Shopify's customer and shop deletion requests are carried out automatically, and only when Shopify's signature checks out.
Slack	You save a Slack webhook address in settings; notifications are posted only there, within a cap per hour. The address is stored privately and can be written only by the site's owner. Disconnecting removes it.
FoxPlug	Optional. You can create a read-only key for one site (up to three at a time) and revoke it at any time. It lets FoxPlug read the last 30 days of what visitors ask, as groups of questions and counts, with no visitor ids, IP addresses or answers. It cannot change anything.
Your website's own pages	To teach the chat about your business we read the public pages of the site you add and keep the text as your knowledge base.

Where data lives, and who helps us run it

Accounts, conversations and knowledge bases are stored in a database run by Supabase in Tokyo, Japan (ap-northeast-1). Our providers' certificates are theirs, not ours.

Provider	What it does for us	Its own page
Supabase	Database, sign-in and server functions	supabase.com/security
Vercel	Serves the website and the chat script	vercel.com/security
Stripe	Payments; we never see or store a full card number	stripe.com/docs/security
Resend	Sends account emails and the transcripts and follow-ups a business sends	resend.com/security
DeepSeek	Writes chat replies	DeepSeek privacy policy
Anthropic	Writes a reply when DeepSeek is unavailable, and handles requests that include an image	trust.anthropic.com
OpenAI	Creates search vectors to find the right page in a knowledge base	openai.com/security-and-privacy
Groq	Walkthrough voice narration	groq.com/privacy-policy
Firecrawl	Reads a customer's public pages when a knowledge base or preview is built	firecrawl.dev/security
Google and Microsoft	An ads tag and page analytics on getfoxchat.com only, never in the chat on a customer's website, and only after Accept All	Google · Microsoft

AI. To write a reply, the visitor's message and the conversation are sent to DeepSeek. If DeepSeek is unavailable, or the request includes an image, they go to Anthropic. The visitor's question is also sent to OpenAI to create a search vector. These providers may process data outside the visitor's country.

How it is protected

In transit. The site sends a two-year Strict-Transport-Security header, so browsers keep using the secure address.
At rest. Encrypted by Supabase, as described on its security page. That is the provider's feature; we have not tested it ourselves.
Separation between accounts. Row-level security on every table, as above.
Secrets. A site's Slack address and its FoxPlug push secret are kept in private storage that the browser cannot read.
Who can reach production. Only GetFoxChat's founder, and the people he delegates to, have production access.
Backups. We make no backup or restore-time commitment on this page.

How long we keep things

Ordinary conversations. The messages of a conversation are erased automatically once it has been resolved, or has gone quiet, for about a day. A short summary stays so the chat can remember what a visitor asked before. Conversations that were escalated, flagged low-confidence, showed frustration or were taken over by a person are kept.
The home-page preview. The private preview link works for 7 days; the record of an emailed preview is deleted after 8 days.
Spam check. A one-way hash of a message marked as spam, and the random visitor id, are kept for 30 days.
Page button, link and field labels. Deleted 30 days after the chat last read that page.

Deleting and exporting

In the inbox. Deleting a conversation hides it from the inbox. It is not erased by that button.
Erasing a conversation, a visitor or a whole site. Email privacy@mentionfox.com from your account address. There is no self-serve site deletion yet. Visitors can ask the website's business, or write to us.
Shopify stores. Shopify's own deletion requests are handled automatically.
Merging contacts. A business can merge and edit its contacts in the dashboard.

If something goes wrong

Contact. privacy@mentionfox.com.
Breach notice. If we confirm a breach that affects your data, we will tell you within 72 hours of confirming it.
Reporting a problem you found. Email the same address. Please give us a reasonable time to fix it before you publish it. We read every report and reply.
Status page. There is none yet.

Download

A short sheet of answers to the questions buyers ask most: getfoxchat-security-answers.pdf.