Privacy Policy

PageFox is operated by Palanisamy Krishnan, a sole proprietorship registered in India, trading as Kaiaan Labs. In this policy, "PageFox", "we" and "us" mean that operator. A sole proprietorship is not a separate legal person from its proprietor.

• Proprietor: Palanisamy Krishnan
• Trade name: Kaiaan Labs
• Structure: Sole proprietorship (India)
• Registered address: Kaiaan Labs, 13/47A, Pallapalayam, Irugur, Coimbatore, Tamil Nadu 641103, India
• Privacy contact and grievance officer: privacy@pagefox.co (general inbox: hello@pagefox.co)

PageFox handles personal data in two different roles, and the role decides who you ask.

• For our customers' websites, we act for the customer. When a business installs the PageFox script, it decides why its visitor data is collected. We process that data on its instructions, as its processor (GDPR), data processor (India DPDP Act) or service provider (California). If you visited a website that uses PageFox, that website's owner is your first contact, and we will help them answer you.
• For our own business, we decide. For the people who sign up for PageFox, pay us, write to us or visit pagefox.co, we are the controller (GDPR) and data fiduciary (India).

Customer accounts

• Name, work email, password (stored only as a secure hash) and team members you invite
• Organisation and website details, settings and the content of your website that you ask us to read for chat answers
• Billing identifiers from our payment processor. We do not store card numbers.
• Messages you send us and records of how you use the dashboard

Visits to our customers' websites

• Pages viewed, time of the visit, time on page, referrer and campaign tags
• Browser, device type, operating system and approximate location (country and city)
• The IP address, stored in full. We use it to estimate which organisation's network the visit came from, to filter bots and to keep the service secure.
• A random visitor ID kept in the browser, so repeat visits can be linked to each other
• Anything a visitor chooses to type into the chat or a form on that website, such as a question, a name or a work email
• With the visitor's consent, where the website owner has set it up: scroll depth, form behaviour and return-visit signals

The Cookie and tracking notice lists every cookie and browser storage item and which ones wait for consent.

Visits to pagefox.co

We run PageFox on our own website, so the list above applies to your visit here too. On our public marketing pages only, we also use Microsoft Clarity (how pages are scrolled and clicked) and Vercel Web Analytics (page views, referrers and countries). Neither runs on the signed-in product: there is no third-party analytics tag on the PageFox dashboard, admin, onboarding, login or signup pages. Neither runs if your browser sends a Global Privacy Control or Do Not Track signal, and this site shows no consent banner. We load no advertising tags and no Google Analytics or tag-manager script.

If you reach pagefox.co through a partner's link, we keep that partner's code in a first-party cookie, pf_ref, for 90 days. The first partner link you used is the one that counts. It is read once, when you create a workspace, so we can credit the partner. No third party sets or reads it.

• To show our customers which companies visit their website, where we can resolve one, and what those visits did
• To answer visitors' questions in the chat from the customer's own website content
• To score and route enquiries to our customer by email, Slack or the integrations they choose
• To run, secure, measure and improve the service, and to stop abuse
• To bill, support and write to our customers about their account
• To meet legal duties

We do not sell personal information for money, and we never give one customer another customer's visitor data.

PageFox may link a visit to the visitor's company, for example by telling our customer that someone from a given organisation read their pricing page. We work this out from network information and from business email addresses that visitors choose to share. It names organisations, not individual people.

PageFox identifies companies, not visitors: it can tell you that an organisation visited your site, it tells you who a visitor is only when that person gives you their details in a chat or a form, and no setting or paid tier reveals the identity of a visitor who has not.

If that ever changed, this policy would say so before the change went live, and every right below would apply to it in full.

On plans that include it, PageFox looks for companies that may want our customer's product and, at each one, a person in a role the customer chose. For that person we keep their name, job title, work email address and a link to their public LinkedIn profile, from public sources and business data providers. We check that an email address can receive mail before we show it.

This is research about businesses and the people in business roles there. It is not done to visitors of our customers' websites, and it never links a visit to a person. For these people PageFox decides what is collected, so under the India DPDP Act we are the data fiduciary and you can ask us, at privacy@pagefox.co, what we hold about you or to delete it. A customer's account owner can also delete a person we found for them.

A person nobody acted on is deleted after 12 months. People and their email addresses are kept per customer and never shared with another customer.

The shared company store. Facts about companies, such as name, website, industry, size, location and dated public news, are stored once and reused for every customer, so the same company is not looked up twice. The store holds company facts only, never people or email addresses.

Mailbox and calendar connections. A customer may connect a Google or Microsoft mailbox, and a calendar so visitors can book a time. PageFox queues the emails the customer approves and sends them from the customer's own mailbox, at the customer's instruction. We never send an email to a person we research without that approval, and never from a PageFox address or PageFox's own mail service. We ask only for the access these need: sending mail, for a Microsoft mailbox reading the headers of replies to match them to a lead, and the busy times on a calendar. We never read the body of a mail we did not send, and we never read the title or guests of a calendar event we did not create. The customer can disconnect at any time.

Google user data. PageFox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to send the emails the customer approves, to check calendar busy times, and to create the meetings that visitors book. We do not use it for advertising, do not sell it, and do not use it to train AI models. No person reads it unless the customer asks us to for support, it is needed for security, or the law requires it.

Phone calls. When a visitor asks for a call back, an AI assistant may call the number they gave. The call is recorded and the visitor is told so at the start. A voice call provider places and records the call for us.

We share personal data only with:

• Sub-processors that help us run PageFox: hosting and database, email delivery, payments, AI model providers for the chat and for lead decisions, business data providers that help us recognise companies and find people in business roles, email checking, mailbox and calendar providers a customer connects, and a voice call provider. Each works under a contract that limits use to our instructions. Our sub-processor list shows who they are, what they do and where.
• The customer whose website you visited, for data collected on that website
• Authorities, when the law requires it
• A buyer or successor, if the business is sold, under this same policy

• Visit records, including the IP address of each visit: 90 days
• Company matches and network records: 180 days
• Visits linked to an enquiry or a known lead: 12 months
• Chat transcripts: 12 months
• People we research for a customer: 12 months unless the customer acts on them, and deleted at once when the customer or the person asks
• Leads: while the customer's account is open
• Browser visitor ID: expires after 180 days without a visit
• Customer account data: while the account is open, then deleted or anonymised, except billing records we must keep

We keep data longer only when a law needs us to, for example tax records or security logs, and then only for that purpose.

We encrypt data in transit, limit who can read production data, separate each customer's data and keep access logs. No system is perfectly secure. If a breach affects your personal data, we will tell the customer concerned and, where the law requires it, you and the regulator.

PageFox is run from India, and our sub-processors may process data in other countries, including the United States. The sub-processor list shows the region of each one. When data leaves the country it was collected in, we rely on the safeguards the law allows, such as standard contractual clauses for data from the European Economic Area.

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, receive a copy, object to or limit its use, and withdraw consent you gave. Write to privacy@pagefox.co. We may need to confirm who you are first.

If we hold the data for a customer's website, we will pass your request to that customer and help them answer it. To stop every lookup about you and ask for deletion, use the opt-out page.

This section applies to residents of California and of other US states with similar privacy laws.

• Categories we collect: identifiers (name, email, IP address, visitor ID), internet activity (pages viewed and site interactions), approximate location, commercial information (plan and billing records), and professional information a person chooses to share (job title, company).
• No sale for money. We do not sell personal information for money, and we do not knowingly collect the personal information of anyone under 16.
• Do not sell or share. Anyone can opt out of every lookup of their personal details on our Do Not Sell or Share My Personal Information page.
• Global Privacy Control. We treat a browser's Global Privacy Control signal as a valid opt-out of sale and sharing for that browser.
• For our customers' websites, we act as a service provider: we use the data to provide PageFox to that customer, and we never give one customer another customer's visit records. What we learn about a network address itself, such as which organisation runs it, is kept once and used for every customer.
• Your rights: to know, delete, correct and opt out, and not to be treated differently for using them. An authorised agent may ask for you with your signed permission. We answer within 45 days.

This section applies under India's Digital Personal Data Protection Act, 2023 and its Rules.

• Consent. Where we rely on your consent, we ask for it clearly, for a stated purpose, and you can withdraw it as easily as you gave it, by writing to privacy@pagefox.co or using the opt-out page. Withdrawal does not affect processing done before it.
• Customers' websites. The website owner is the data fiduciary for its visitors and is responsible for notice and consent. We process that data as its data processor.
• Your rights: to a summary of the personal data we process and who we shared it with, to correction, completion, updating and erasure, to nominate another person to act for you, and to grievance redressal.
• Grievances. Write to our grievance officer at privacy@pagefox.co. We will reply within 90 days, and sooner where we can. If you are not satisfied, you may complain to the Data Protection Board of India.

PageFox is a business tool and is not meant for anyone under 18. We do not knowingly track or profile children. Our customers may not install PageFox on websites aimed at children. If you believe we hold a child's data, write to privacy@pagefox.co and we will delete it.

This policy and any dispute about it are governed by the laws of India, with exclusive jurisdiction in the courts at Coimbatore, Tamil Nadu, India. This does not remove any right you hold under the data protection law where you live.

When we change this policy, we update the date at the top. If a change matters, we tell customers by email before it takes effect.

Privacy questions, data requests and grievances: privacy@pagefox.co. Postal address: Kaiaan Labs, 13/47A, Pallapalayam, Irugur, Coimbatore, Tamil Nadu 641103, India.