Last updated 19 October 2026
Privacy policy
This policy explains how SpoorFox ("we") handles personal data: as a controller for visitors of this website and for our customers’ business contacts, and as a processor for the data our customers collect with SpoorFox.
1. This website
We measure this website with SpoorFox itself, running on our own environment in the EU. It records visits, pages, clicks, scroll depth, the campaign or referrer that brought you here and, for some visits, a session recording with form inputs masked. When you give us your email address, for example by contacting us, we can link earlier visits to it. We do this based on our legitimate interest in understanding how prospects use our site, and we use no advertising or third party analytics tags. The cookies and storage involved are listed on the cookie page. Our hosting provider processes technical data such as IP addresses to deliver the site and protect it against abuse. When you email us, we use your message and contact details to answer you.
2. Customers and prospects
We process the names, business email addresses, phone numbers and company details of customer users and prospects to provide the service, to bill, to support and to tell customers about changes to the service. The legal bases are the performance of our contract and our legitimate interest in running and improving our business. Billing records are kept for seven years as required by Dutch tax law.
3. Data our customers collect
Our customers use SpoorFox to measure their own websites, campaigns and social profiles. For that data the customer is the controller and we are the processor, acting only on the customer’s instructions under a data processing agreement. If you visited a website that uses SpoorFox and want to exercise your rights, contact that website’s owner; we will help them respond.
SpoorFox is designed to limit what is collected: session replay masks form inputs by default, a cookieless tracking mode is available, and customers can erase all data about a person on request.
4. Where data is stored
Customer environments, databases and backups are hosted in the European Union. Where a subprocessor processes data outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.
5. Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Hosting of customer environments, databases and backups | EU (West Europe) |
| Cloudflare | Network delivery, TLS and protection against attacks | Global network, EU origin |
| Stripe | Subscription billing and payments | EU and US |
| Twilio SendGrid | Transactional email such as invitations and password resets | US |
| Anthropic | AI agent answers, only when a customer uses AI features | US |
6. Security
Each customer runs on a private environment with its own database. Access requires single sign-on or a password with two factor authentication, data is encrypted in transit and at rest, and backups are made hourly. See security and hosting.
7. Retention
Customer data is kept for as long as the subscription runs and is removed after it ends, with a final backup kept for 90 days. Emails with prospects are kept for up to two years after the last contact.
8. Your rights
You can ask for access to, correction or erasure of your personal data, ask us to restrict or stop processing it, and ask for a copy in a portable format. Email privacy@spoorfox.com. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Changes
We update this policy when our processing changes. The date at the top shows the current version.