Last updated: 26 August 2026

This policy explains how Foxbee OÜ handles personal data, and in particular how the Foxbee agent application accesses, uses, stores and shares Google user data.

Who we are

Foxbee OÜ is a private company registered in Estonia.

• Foxbee OÜ, Sepapaja 6, Tallinn, 15551, Estonia
• Registration number 14995280
• VAT EE102266755
• Contact: contact@foxbee.com

Foxbee OÜ is the data controller for the processing described here.

What Foxbee agent is

Foxbee agent is internal tooling. It connects Foxbee's own software development agents to Google Workspace accounts that Foxbee and its operators control, so that routine work on our own documents, mail, calendars and files can be carried out programmatically instead of by hand.

Foxbee agent is not a public product. It is not offered to third parties, it has no sign-up, and it is authorised only by a small number of accounts belonging to Foxbee and to people who operate Foxbee's systems. Each of those accounts grants access deliberately, through Google's standard OAuth consent screen, and can withdraw it at any time.

Google user data we access

Foxbee agent requests access to the following categories of Google user data. It accesses this data only for the account that granted consent.

• Google Drive files — to read, create and update documents and files held in our own Drive accounts.
• Gmail messages, labels and settings — to read, compose, send and organise mail in our own mailboxes, and to maintain labels and basic settings.
• Google Calendar events — to read and manage calendars and events belonging to our own accounts.
• Google Docs and Google Sheets — to read and edit the contents of our own documents and spreadsheets.
• Google Contacts — to read and maintain contact records held in our own accounts.
• Basic profile information — name, email address and account identifier, used only to identify which account an authorisation belongs to.

How we use it

We use Google user data solely to perform the tasks the operator of the account asks the agent to carry out. Typical tasks include drafting and sending mail, updating a spreadsheet, filing a document, or scheduling an event.

We do not use Google user data for advertising, profiling, credit assessment or any form of marketing. We do not sell it. We do not use it to build products or datasets.

Our legal basis

Under the General Data Protection Regulation we rely on the following bases for the processing described above.

• Consent (Article 6(1)(a)) for access to Google user data. That access exists only because the holder of the account granted it through Google's consent screen, and it lasts only as long as the grant does. Consent may be withdrawn at any time, without giving a reason, and withdrawing it does not affect the lawfulness of processing carried out beforehand.
• Legitimate interests (Article 6(1)(f)) for keeping task history and operational logs, and for the security of our systems. Our interest is in being able to audit what our agents did on our own accounts and to investigate faults and abuse. We have weighed this against the interests of the people concerned, who are the operators of the accounts themselves.
• Legal obligation (Article 6(1)(c)) where we are required to retain or disclose information by law.

Automated processing

Foxbee agent acts on its own, driven by language models, and takes actions on the accounts that authorised it — sending mail, editing documents, changing calendar entries. Those actions are automated in the ordinary sense of the word.

They are not decisions producing legal effects concerning an individual, or similarly significantly affecting one, within the meaning of Article 22. The agent operates on accounts belonging to Foxbee and its operators, at their instruction, and it does not profile anyone, score anyone, or decide anything about a person. Anyone operating the agent remains responsible for supervising it and can stop it at any point.

Limited Use

Foxbee's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Artificial intelligence and language models

Foxbee agent works by passing the content it retrieves to large language models, which decide what action to take and generate the text that the agent writes back. This means Google user data relevant to a given task is transmitted to the language model provider that serves that request, for the sole purpose of completing that task.

We use these providers under their commercial API terms, which do not permit the provider to train models on the content submitted through them.

We do not retain Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models, whether our own or anyone else's. We do not transfer Google user data to any party for that purpose.

Storage and security

Access tokens issued by Google are stored encrypted at rest, in a separate store for each authorised account, readable only by the system account that runs the agent. They are used only to make requests on behalf of the account that issued them.

Google user data retrieved by the agent is recorded in the task history described below. That history is held on infrastructure under Foxbee's control, and access to it is restricted to Foxbee operators authenticating with cryptographic keys.

Retention and deletion

• Task history — the record of what the agent was asked to do and what it read and wrote in the course of doing it. Because the agent works on mail, documents, calendars and files, this history can contain the contents of those items. It is retained for up to twelve months, then deleted.
• Access and refresh tokens — retained until the account revokes access, or until the account has been inactive for twelve months, whichever comes first.
• Operational logs — retained for 30 days, then deleted. These record which operations ran and whether they succeeded.

We keep task history so that the agent can refer back to earlier work and so that its actions can be audited. We do not use it for any other purpose, and it is never used to train models.

Any account may revoke Foxbee agent's access at any time from the Google account permissions page. Revoking access stops all further processing. To have any remaining data deleted, write to contact@foxbee.com and we will action it within 30 days.

Who we share it with

We do not share Google user data with anyone, with two exceptions, both necessary to operate the service:

• Language model providers, as described above, strictly to carry out the task requested.
• Infrastructure providers that host the systems Foxbee agent runs on, which store data on our behalf under contract and may not use it for their own purposes.

We do not sell personal data, and we do not transfer it to advertising platforms, data brokers or information resellers.

We may disclose data where we are legally required to do so, or where it is necessary to investigate abuse or protect the security of our systems.

International transfers

Foxbee operates in the European Union. Some of our providers process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's standard contractual clauses or an equivalent safeguard.

Your rights

Under the General Data Protection Regulation you have the following rights over your personal data.

• Access — to be told whether we hold data about you and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have data deleted where we no longer have grounds to keep it.
• Restriction — to have processing paused while a dispute about accuracy or grounds is resolved.
• Objection — to object to processing we carry out on the basis of legitimate interests.
• Portability — to receive data you provided in a structured, commonly used, machine-readable form.
• Withdrawal of consent — to withdraw at any time the consent that allows us to reach a Google account, by revoking access from the Google account permissions page. Withdrawal takes effect immediately and does not affect processing already carried out.

To exercise any of these, write to contact@foxbee.com. We answer within one month. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to complain to a supervisory authority. In Estonia this is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), and you may instead complain to the authority where you live or work.

We have not appointed a data protection officer. We are not required to: we do not carry out large-scale monitoring, and we do not process special categories of data at scale.

The website

This website serves static pages. It sets no cookies, runs no analytics and does not track visitors. Our web server keeps standard request logs, including IP addresses, for 30 days, for security and diagnostics.

Children

Foxbee agent is internal business tooling and is not directed at children. We do not knowingly process the personal data of anyone under 16.

Changes

We may update this policy. Any change is published on this page with a revised date above. Where a change materially affects how we handle Google user data, we will seek fresh consent from the affected accounts.

Contact

Questions about this policy, or about data we hold: contact@foxbee.com.