Skip to main content
✦  Legal  ✦

Privacy Policy

Last updated · 15 November 2025

Who we are

Foxley Farm Operations, Ltd (“we”, “us”, “our”) trading as abm.dev. Company number 16392009, registered in England and Wales. Registered office: One Express C/O Beever and Struthers, 1 George Leigh Street, Manchester, United Kingdom, M4 5DL. Contact: [email protected].

What we do

We provide a GTM Intelligence API and related services (the “Service”) that enrich seed identifiers (e.g., email, domain) into structured company and person intelligence, and generate campaign drafts. Customers decide how they use outputs within their systems.

Personal data we process

  • Account data: name, email, organization, role, authentication identifiers.
  • Billing data: subscription details, invoices, payment method references via Stripe (we do not store full card data).
  • Service data: seed inputs (e.g., emails, domains), API requests and responses, metadata (request_id, timestamps, confidence scores, sources).
  • Telemetry: performance, errors, usage events, cost metrics (e.g., tokens, model provider, latency).
  • Website data: cookies, device, IP address, analytics events.

Sources of personal data

  • You and your organization (account setup, API calls).
  • Connected services you configure (e.g., CRM references).
  • Public and partner sources used for enrichment (e.g., websites, professional profiles).

Purposes and lawful bases (UK GDPR)

  • Provide and secure the Service (contract).
  • Billing and account management (contract, legal obligation).
  • Fraud, abuse, and rate-limit enforcement (legitimate interests).
  • Product analytics and cost monitoring (legitimate interests, with opt-out where applicable).
  • Compliance with law and requests from authorities (legal obligation).

How we use AI and third-party providers

  • Model providers (e.g., OpenAI, Anthropic) may process prompts and inputs to generate outputs. We configure providers not to train on your data where controls exist. You may bring your own keys (BYOK).
  • Metering, billing, and analytics (e.g., Stripe, PostHog) receive limited metadata needed for their function.

International transfers

We may transfer data outside the UK/EEA. Where we do, we rely on adequacy decisions or Standard Contractual Clauses with supplemental measures.

Retention

  • Account and billing records: as required by law (typically 6 years in the UK).
  • Service logs and telemetry: default 12 months unless you request a shorter window.
  • Cached enrichment data: default 30 days (configurable by customer).

Your rights (UK data subjects)

Access, rectification, erasure, restriction, portability, objection, and the right to complain to the ICO. To exercise rights: [email protected].

Children

The Service is not intended for children under 16, and we do not knowingly process such data.

Security

We operate a defense-in-depth program with access controls, encryption in transit and at rest, secret management, and audit logging. SOC 2 program in progress; DPA-ready.

Sub-processors (illustrative)

  • Stripe (billing, payments).
  • PostHog (product analytics and LLM analytics).
  • Cloud hosting, CDN, and model providers as configured.

A current list is available on request.

Controller and processor roles

We act as controller for account, billing, and website data, and as processor for Service data you submit, under our Data Processing Addendum (DPA) where applicable.

Contact

Data protection queries: [email protected]. Registered address as above.