Data Processing Agreement (for businesses)
Version 2026-10-12 · FoxDocs (foxdocs.ai) · [email protected]
This agreement applies when you switch on business mode in your FoxDocs account and accept it — that is, when you fill in documents for your clients. For your clients' data you are the controller and FoxDocs is your processor (GDPR Art. 28; Thailand PDPA s. 40). For your own account data, the Privacy Policy applies.
Contents
- 1. Parties and roles
- 2. Subject matter and duration
- 3. Nature and purpose
- 4. Types of data and data subjects
- 5. FoxDocs obligations
- 6. Security measures
- 7. Sub-processors
- 8. Requests from data subjects
- 9. Retention and deletion
- 10. Personal data breaches
- 11. Audits
- 12. International transfers
- 13. Precedence and acceptance
1. Parties and roles
- Controller — the business account holder ("you").
- Processor — FoxDocs (foxdocs.ai), contact [email protected].
- You confirm that you have a lawful basis to process your clients' data and to pass it to FoxDocs, and that you have informed your clients.
2. Subject matter and duration
Processing of your clients' personal data to fill in the official forms you select, for as long as business mode is on, and afterwards until the data is deleted under section 9.
3. Nature and purpose
Receiving data through the chat, the form and uploaded files; recognising document photos; AI-assisted filling and checking; producing PDF files; storing values for re-filling; deletion. The only purpose is to fill in documents for you.
4. Types of data and data subjects
- Data: identification data (name, date of birth, nationality, sex), document data (passport and ID numbers, visa details), contact data (address, phone, e-mail), travel and stay details, other information required by a form, images of documents.
- Data subjects: your clients and the people named in their forms (family members, hosts, property owners).
- Special categories are not requested. If a form contains such a field, you ensure a lawful basis for it.
5. FoxDocs obligations
- Process the data only on your documented instructions; your use of the service features is such an instruction. We will tell you if we believe an instruction breaks the law.
- Not use your clients' data for our own purposes: conversations of a business account are excluded from the analysis used to improve the service (Privacy Policy, section 5).
- Ensure that staff with access are bound by confidentiality and access data only for support, fixing errors and security.
- Apply the security measures in section 6.
- Help you respond to your clients' requests and to meet your security, breach notification and impact assessment obligations, taking into account the information available to us.
- Make available the information needed to demonstrate compliance (section 11).
6. Security measures
- Encryption of all traffic (HTTPS/TLS), the site behind Cloudflare.
- Passwords stored only as hashes; Google access tokens stored encrypted.
- Profile in Google Drive encrypted in the browser (AES-256-GCM), if Drive is connected.
- Masking of document numbers, dates of birth, e-mails and phone numbers before the model in the chat and in questions (exceptions: AI check, photo and PDF recognition, OCR).
- Form values are not written to technical logs.
- Server access only by key, firewall, automatic security updates; daily backups kept for 14 days.
7. Sub-processors
You authorise FoxDocs to use the following sub-processors. We will publish changes to this list on this page before they take effect; if you object, you can switch business mode off.
anymodel — AI model gateway
- Purpose
- passes requests to models
- Where
- international
Google (Gemini), Anthropic (Claude) — through anymodel
- Purpose
- chat replies, recognition, AI check
- Where
- USA and other countries
Namecheap
- Purpose
- server hosting, domain e-mail
- Where
- USA
Cloudflare
- Purpose
- site delivery, TLS, protection
- Where
- global network
- Purpose
- sign-in; Drive storage if you connect it
- Where
- USA and other countries
| Sub-processor | Purpose | Where |
|---|---|---|
| anymodel — AI model gateway | passes requests to models | international |
| Google (Gemini), Anthropic (Claude) — through anymodel | chat replies, recognition, AI check | USA and other countries |
| Namecheap | server hosting, domain e-mail | USA |
| Cloudflare | site delivery, TLS, protection | global network |
| sign-in; Drive storage if you connect it | USA and other countries |
8. Requests from data subjects
If one of your clients contacts FoxDocs directly, we will forward the request to you and will not answer it on the merits without your instruction. Export and deletion tools are available in your account; for anything else write to [email protected].
9. Retention and deletion
- Clients' data is deleted 90 days after the document is downloaded.
- On your request we delete it earlier.
- When business mode is switched off or the account is deleted, the data is deleted under the same rules; deleted data disappears from backups within 14 days.
10. Personal data breaches
We will notify you without undue delay after becoming aware of a breach affecting your clients' data, with the information available to us, so that you can meet your own deadlines (GDPR Art. 33 — 72 hours; PDPA s. 37(4)).
11. Audits
On request we provide the information needed to demonstrate compliance with this agreement. Audits and inspections by you or an auditor you appoint are possible with reasonable prior notice, on agreed dates, and must not disclose other customers' data.
12. International transfers
Data is processed outside the EU/EEA and Thailand (see section 7 and the Privacy Policy, section 7). On request we provide information about the safeguards applied to a specific sub-processor.
13. Precedence and acceptance
For the processing of your clients' data this agreement prevails over the Terms of Service; in everything else the Terms apply. The agreement is accepted when you switch on business mode in your account; the version and date of acceptance are stored with your account.