Our Privacy Policy

Who We Are

WTFox.ai Pte Ltd (“WTFox.ai”, “we”) is a Singapore-registered company, UEN 202608269E, at 202A South Bridge Road, Singapore. Our majority shareholder is SalesLogs HQ Pte Ltd, a Singapore company that holds 51% of our ordinary shares. We can be reached at hey@wtfox.ai.

What This Policy Covers

This policy covers personal data collected through this website (wtfox.ai) and through the WTFox.ai connector for Anthropic’s Claude, described below. Data processed inside the WTFox product on behalf of dealership customers is governed by our customer agreements and product terms.

Data We Collect on This Website

• Contact and demo requests: name, company, email, phone or WhatsApp number, market, team size, and anything you write in your message. We use this to respond to your enquiry and to follow up about our products.

• Usage analytics: aggregated, privacy-respecting page analytics covering pages viewed, referrer, and device class. We do not build advertising profiles.

How We Use It

• To respond to enquiries and schedule demos.

• To operate, secure, and improve this website.

• To send information you have asked for. No spam, and every marketing email includes an unsubscribe link.

Claude Connector and MCP Access

WTFox.ai publishes a connector for Anthropic’s Claude at https://mcp.wtfox.ai/mcp. Connecting is optional and is started by you from inside Claude. If you never connect your WTFox account, nothing in this section applies to you.

Once connected, Claude can read the WTFox records that your role and department scope already entitle you to see. That covers:

• Leads and lead statistics

• Contacts

• Conversation history and inbox threads

• Opportunities and their timelines

• Quotations

• Appointments and calendar events

• Document metadata attached to leads

• Tasks and notes

• Document review queues

• Your dealership’s staff directory, as visible to your role

• Dashboard and sales metrics

The server also exposes write tools. Where your role permits it, Claude can create or update records on your instruction, such as logging a note or updating a lead. It is designed to inherit the same role-based access controls as the WTFox web application, whether reading or writing, so it should not widen what an account is entitled to see or change.

When you choose to connect, Anthropic becomes a recipient of the data your queries return. Data leaves WTFox only in response to a request you make in Claude, and only for the records that request matches. Anthropic’s handling of that data is governed by your own agreement with Anthropic and by Anthropic’s privacy terms. We do not push WTFox data to Claude in the background, and we do not use the connector to train models.

Authentication uses OAuth 2.0. You authorise the connection once from Claude, and you can disconnect at any time, from Claude’s connector settings or from WTFox, as described below.

Access and refresh tokens for the connector are issued by WTFox’s own authorisation server and stored in the WTFox database. Access tokens are valid for 1 hour. Refresh tokens are valid for 30 days and are rotated each time they are used. A rotated refresh token is still accepted for up to 30 seconds after rotation, to allow for network retries. If it is presented again after that window, WTFox revokes every token issued under that authorisation, and you will need to reconnect. When an access token expires, the connector obtains a new one with the refresh token, with no action needed from you. You are only asked to authorise again if the refresh token itself expires or is revoked. Removing the connection under Settings > API Keys > Connected apps in WTFox revokes both tokens immediately. Disconnecting from Claude revokes them immediately if Claude calls WTFox’s standard OAuth revocation endpoint (RFC 7009), which WTFox publishes for this purpose. If it does not, the access token lapses within 1 hour and the refresh token within 30 days.

A connector session expires after 30 minutes of inactivity. Sessions are held in memory only and are not written to disk or to a database. OAuth authentication events (consent, authorisation, token issuance and revocation) are recorded in structured logs and retained for 30 days in Azure Log Analytics. Individual connector tool calls are logged as standard HTTP requests and are retained for the same 30 days. We do not currently keep a separate, longer-term audit record of connector activity.

WTFox is hosted on Microsoft Azure in the Southeast Asia region (Singapore). When you connect the connector, Anthropic receives the data your queries return, as described above. We use the following sub-processors to operate WTFox:

OpenAI does not use API data to train its models, and keeps it for up to 30 days for abuse and safety monitoring. Clients who need stricter handling can have WTFox use Azure AI Foundry instead, where data stays within the client’s own Azure boundary and the provider retains none of it.

The connector uses the same permission model as the WTFox web application. The scopes you approve in Claude (read, write, review) map onto the same scopes WTFox already enforces for API access, and the connector only exposes the tools your role, department and scopes allow. A read-only grant exposes no write tools.

Sharing

Enquiry details may be shared within the WTFox.ai and SalesLogs group so that the right team can respond, and with service providers who help us operate, such as hosting, email delivery, AI processing and e-signature, under appropriate agreements. Our current sub-processors are listed in the connector section above. Where you have connected the Claude connector, the records your queries return are also disclosed to Anthropic, as set out above. We do not sell personal data. We do not use your data to train third-party AI models.

Retention

We keep enquiry data for as long as we need it to handle your enquiry and maintain our business relationship, then delete or anonymise it. Retention of connector session and audit records is stated in the connector section above.

Data Security

We use industry-standard measures to protect personal data against unauthorised access, disclosure, alteration, and destruction, including encryption in transit (TLS 1.2 or higher) and at rest (Azure platform encryption), an additional layer of application-level encryption with per-client keys for sensitive deal documents, and role-based access control. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your Rights

Subject to applicable law, including Singapore’s Personal Data Protection Act and, where it applies, the GDPR, you may request access to, correction of, or deletion of your personal data. Email hey@wtfox.ai and we will respond promptly.

Changes

We will update this page when our practices change, and we will update the date at the top when we do.

Contact Us

Questions about this policy, about the Claude connector, or about how we handle your personal data go to hey@wtfox.ai.