Privacy Policy
Effective Date: 9/3/26 Last Updated: 9/30/26
This Privacy Policy describes how Focal ("we," "us," or "our") collects, uses, and protects information when you use our customer relationship management platform (the "Service").
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Name, email address, and password (or passkey credential) used for authentication
- Organization/business details if you register a company
- Profile information you choose to provide
1.2 Client and Business Data
As a CRM, Focal stores data you input or upload about your own clients and business operations, including:
- Client contact details, communication history, and notes
- Job/event details, calendars, and scheduling information
- Invoices, quotes, and line-item billing data
- Historical records imported from other systems
You are the data controller for this information; we process it on your behalf as a service provider.
1.3 Payment Information
Payments are processed through Stripe Connect. We do not store full payment card numbers on our servers. Stripe's own privacy policy governs how payment data is handled on their end.
1.4 Authentication Data
If you use passkeys, the private key never leaves your device; we store only the public key credential needed to verify sign-ins. If you use password + two-factor authentication, we store a hashed password and 2FA enrollment status (not the underlying authenticator secret in plain text).
1.5 Usage Data
We automatically collect limited technical data such as IP address, browser type, device information, and log data (e.g., login timestamps, feature usage) to maintain and improve the Service.
1.6 AI-Assisted Features
Certain features (e.g., relationship-health suggestions) send relevant account data to a third-party AI provider (Anthropic) to generate suggestions. This data is used solely to generate the requested output and is not used to train third-party models unless otherwise disclosed.
2. How We Use Information
We use collected information to:
- Provide, operate, and maintain the Service
- Process payments and payouts via Stripe Connect
- Authenticate accounts and secure access (passkeys, passwords, 2FA)
- Generate AI-assisted insights and suggestions within the product
- Communicate with you about your account, updates, or support requests
- Monitor for fraud, abuse, and security incidents
- Comply with legal obligations
3. How We Share Information
We do not sell personal information. We share data only with:
- Service providers who help operate the platform, including:
- Supabase (database and backend infrastructure)
- Stripe (payment processing and payouts)
- Anthropic (AI-generated suggestions, where applicable)
- Google Analytics (website usage analytics)
- Other members of your organization, if you belong to a multi-user account, subject to their assigned permissions
- Legal authorities, when required by law, subpoena, or to protect the rights, property, or safety of Focal, our users, or others
4. Data Security
We implement technical and organizational measures to protect your data, including:
- Encryption of data in transit and at rest
- Passkey and/or two-factor authentication options for account access
- Current-password confirmation required for password changes
- Session invalidation on credential changes
- Role-based access controls for multi-organization accounts
No system is completely secure, and we cannot guarantee absolute security of information you transmit to us.
5. Data Retention
We retain account and client data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data, subject to legal or contractual retention requirements (e.g., financial records related to processed payments).
6. Your Rights and Choices
Depending on your location, you may have rights to:
- Access, correct, or delete your personal information
- Export your data
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
To exercise these rights, contact us at bryan@focalworkflow.com.
7. Cookies and Tracking
We use cookies and similar technologies (such as browser local storage) to keep you signed in and remember your preferences.
We also use Google Analytics to understand how visitors use the Service, such as which pages are viewed, how long visits last, and general device, browser, and approximate location information. Google Analytics sets its own cookies and collects this data on our behalf. We do not use it for advertising, and we do not send it your client records or other account content. You can learn more in how Google uses information from sites that use its services, and you can opt out with the Google Analytics opt-out browser add-on.
You can control cookies through your browser settings; disabling them may affect functionality.
8. Children's Privacy
The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.
9. International Data Transfers
If you access the Service from outside the United States, your information may be transferred to and processed in the United States or other countries where our service providers operate.
10. Google and Google Workspace API Limited Use Compliance
If you choose to connect a Google Workspace or Google account (for example, to send email through Gmail or sync calendars through Google Calendar), Focal accesses only the data necessary to provide those features.
The use of raw or derived user data received from Google Workspace APIs and Google Photos APIs adheres to the Google User Data Policy, including the Limited Use requirements. Specifically:
- We do not use, transfer, or sell Google user data — including raw, aggregated, or derived data — to create, train, or improve any foundational or generalized machine learning or artificial intelligence models.
- We do not use Google user data for advertising, retargeting, or building unrelated user profiles.
- We do not transfer Google user data to third parties unless required by law or with your explicit consent.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last Updated" date, and, where required, by additional notice.
12. Contact Us
If you have questions about this Privacy Policy or how your data is handled, contact us at: