Legal

Privacy Policy

Effective 22 October 2026. DevSmooth Software Inc., Surrey, British Columbia, Canada.

1. Who this covers

This policy explains how DevSmooth Software Inc. (Surrey, British Columbia, Canada) handles personal information across www.moorfox.com, the dashboard at app.moorfox.com, and the Moorfox agents. It is written to satisfy PIPEDA, British Columbia's PIPA, and, where it applies, the EU and UK GDPR.

2. Two roles, two kinds of data

For account holders, the people who sign up, sign in and use the dashboard, we decide how the data is handled and are the controller.

For managed devices and the people who use them, the organisation that enrolled the device decides why and how data is processed; we act on its instructions as a processor under the Data Processing Addendum. If Moorfox manages your work computer, questions about what is collected there go first to whoever runs your IT.

3. What we collect

Account data. Email address, organisation name, and a salted hash of your password (never the password itself). If you request an invitation, the email address you submit.

Device data, collected by the agent. Hostname, hardware and operating system details, installed software and patch status, security posture (for example disk encryption and update settings), logged-in user account names, and the device's network addresses. The agent collects what the dashboard shows; it does not log keystrokes and it does not scan the contents of personal files.

Session data. Remote desktop and quick support screens are streamed to the connected technician, not recorded or stored by us. What we do keep: session metadata (who connected to what, when, for how long), chat messages exchanged during sessions, file transfer records (names and sizes, not a copy of the file beyond the transfer itself), and the results of commands and flows your organisation runs.

Activity and server logs. Sign-ins, administrative actions and API calls, with IP addresses and timestamps, kept for security and audit.

Abuse screening. For their first 30 days, new organisations are checked for misuse of remote access, such as scams that talk a stranger into installing the agent. We compare the countries and networks your people sign in and work from with those of the computers that open install links and enrol, and notice when a sign-in comes from a country your people have not used before. To recognise someone whose account we closed when they sign up again under another name, we note which browser and which computers an account uses: the dashboard keeps a random browser identifier in a cookie, works out a fingerprint of your browser and computer from how it draws text and graphics, its graphics card, screen size, time zone and installed fonts (only a hash of these leaves your browser), and we derive an identifier from each enrolled computer's serial number. All of these are hashed before use. During those 30 days, each computer a new organisation enrols or connects to is also reviewed: the system receives a hashed reference to it, the network its address belongs to, its kind of operating system (for example a home or business edition of Windows, or a server), whether it is a virtual machine, how many other remote-access tools it has, and whether someone was signed in at it when a remote session began, but no names, files or software lists. If you add a card to verify your account, we keep the identifier the payment processor gives that card, so the same card on another account is recognised; if an account is closed for abuse, that identifier and the name on the card are kept on a list so they are recognised if they are used again. Emails we send you record when they are opened and from which IP address. An automated system run by Devsmooth weighs these signals together with your sign-in activity; a decision model from TypeSafe receives your organisation name, your email domain and a summary of that activity, but no email addresses, IP addresses or identifiers. A language model that Devsmooth runs on its own servers also reads your organisation's details, the details you send for verification and this activity, and checks them against public sources: web searches made through a search service we run, your website, domain registration records, public company and charity registers, and what a phone number itself says about where it belongs. No outside AI provider receives them. The system can pause remote access for a new organisation until a person at Moorfox has reviewed it.

Account verification. A new organisation has a few limits until it verifies, by adding a card or by sending business details. A card added for this is never charged and does not put you on a paid plan; the payment processor tells us its brand, last four digits, country, type (credit, debit or prepaid) and the name on it. A card in the name of your organisation or one of its users lifts the limits at once; a card in any other name is checked by our team first. Business details you send (company and registered name, registration number, address, website, phone and contact name) are read by our team to decide whether to verify you, and kept with your account. Our abuse-screening system also compares them with public sources: your website, the registration record of its domain and, where one is published free, the company register. If you give a website, you can confirm you run it by receiving a code at an address on its domain that you choose.

Support. Tickets and feature requests you send through the Support tab, and emails we exchange with you.

Help in the dashboard. What you type into Help, the assistant's answers and any replies from our team. Help's assistant is an AI model that runs on our own servers; conversations are not sent to a third-party AI provider. It can look up your own organisation's devices, alerts and activity, limited to what your account can already see.

Chat on our website. The chat on moorfox.com is AI Chat for Website (aichatforwebsite.com), a separate service that Devsmooth also builds and runs, on its own servers and with the same self-hosted AI model. It also records visits to our site, which we use to see how people find and use it: the pages you view and for how long, the page or campaign that brought you, where on a page you click and how far you scroll, your approximate country (worked out from your IP address), and your browser, device, language and screen size. It does this through a random identifier kept in your browser's local storage; it sets no cookies. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, or it cannot tell where you are, it asks you first, and records nothing and stores nothing in your browser until you agree; you can change your answer from "Privacy choices" in the chat. If your browser sends Global Privacy Control, your visit is not recorded. If you start a chat, it also keeps what you type, the assistant's answers, any replies from our team, the page you started the chat on, and any name, email address or phone number you give us.

Payment data. When paid billing is in effect, card details are handled by a dedicated payment processor and do not touch our servers; we keep the invoice records.

Ad measurement. When you create a new organisation by signing up, our server reports that one event to Meta Platforms (Facebook and Instagram) through its Conversions API, so we can tell whether our ads work. It sends your email address and an account number, both hashed (SHA-256) before they leave our server, the IP address and browser details the signup came from, the time, and, if you arrived by clicking one of our ads, the click identifier Meta added to that link. Our pages load nothing from Meta and set no Meta cookies, and we send nothing about the pages you view or what you do in the product. Meta matches the report to an ad click under its own privacy policy. If your browser sends Global Privacy Control, nothing is sent; people invited into an existing organisation are never reported.

4. What we do not do

No advertising trackers, pixels or third-party analytics, on the marketing site or in the product: the signup report above goes from our server, not your browser. No sale or rental of personal information, ever. No use of Customer Data to train machine-learning models. The only cookies and browser storage we use are the ones that keep you signed in, remember preferences like your theme, the browser identifier used for abuse screening, and the chat's identifier on our website described above.

5. Why we process it

To provide and secure the Service (performance of the contract), to stop abuse and defend the systems (legitimate interests), to send operational messages like alert emails and invoices (performance of the contract), to answer you when you write to us, and to meet legal obligations such as tax record-keeping. We report a completed signup to Meta to measure our advertising (legitimate interests; you can object, see section 10). We send marketing only with consent, and every such email has an unsubscribe link.

6. Who we share it with

The subprocessors that host and run the Service, listed with their roles and locations in Annex 3 of the DPA: at present Hetzner (infrastructure), Amazon Web Services (storage and backups), Microsoft (email delivery), Cloudflare (DNS and traffic protection) and, for organisations that enable the EDR add-on and only on the devices they enable it on, Bitdefender (endpoint detection and response, contracted through Pax8). Beyond that, only professional advisers under confidentiality, authorities when the law genuinely requires it, and a successor if the business is sold, under this same policy. Meta Platforms receives the hashed signup report described in section 3, as a separate controller for ad measurement. Other than that, we do not have third-party "partners" who receive your data.

7. Where it lives

The Service runs on infrastructure in the European Union and the United States, with backups in the United States. Wherever the data is, it is protected by this policy, the DPA, and contracts with each subprocessor; for data subject to the GDPR we rely on Standard Contractual Clauses for transfers.

8. How long we keep it

Account and device data: for the life of the account, then deleted within 30 days of closure, after the export window described in the Terms. Activity logs: up to 24 months, for security and audit. Backups: age out automatically on the backup schedule, within about 35 days. Support correspondence: up to 24 months after the ticket closes. Help and website chat conversations: 12 months after the last message. Visits to our website recorded by the chat: 6 months after the visit. Invoices and tax records: 7 years, as Canadian law requires.

9. How we protect it

All traffic is encrypted in transit with TLS, including agent-to-server and remote-session traffic. Access to production systems is restricted, key-based and logged. Passwords are stored only as salted hashes, agents authenticate with per-device credentials, and releases are code-signed. Databases are backed up hourly to separate storage. No system is perfectly secure, but if a breach affects your personal information we will notify you and the authorities as the law requires.

10. Your rights

You can ask us for a copy of your personal information, ask us to correct or delete it, object to a use of it, or withdraw consent where consent is the basis. Write to support@moorfox.com and we will answer within 30 days. If you are unsatisfied you can complain to the Office of the Privacy Commissioner of Canada or your provincial or national authority. If your request concerns a device managed by another organisation, we will refer it to that organisation, as the DPA requires.

11. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16 as a controller.

12. Changes

If we change this policy materially we will announce it by email or in the dashboard before the change takes effect, and this page always carries its effective date.

13. Contact

Privacy questions and requests: support@moorfox.com. DevSmooth Software Inc., Surrey, British Columbia, Canada.