Legal

Privacy Policy

How Fokal collects, uses, stores, discloses, and protects your personal information across our website and the Fokal service.

Effective: 25 May 2026 · Version: 2.0

1. About this Policy

1.1 Who we are

1.2 What this Policy covers

This Policy applies to all personal information Fokal collects through:

This Policy does NOT cover the privacy practices of the third-party services you connect through Fokal. When you authorise Fokal to read data from, for example, Google Analytics or your Wix site, the data you access remains subject to the third party's own privacy policy. We act on your instructions but we are not the controller of that third party's underlying systems.

1.3 Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email to account holders at least 30 days before they take effect, and the updated Policy will be posted at fokal.com/privacy with a new effective date. Continued use of the Service after the effective date constitutes acceptance.

We retain prior versions of this Policy and will provide them on request.

2. Information we collect

2.1 Information you give us directly

Account information. When you sign up:

Profile and onboarding information. When you complete onboarding or use the chat features:

Payment information. When you subscribe:

Communications. When you contact us:

2.2 Information from connected third-party accounts (OAuth)

When you authorise Fokal to connect to a third-party service via OAuth, we collect information from that service on your instructions and within the scope you grant. We collect only what is necessary to deliver the Fokal feature you are using.

Google Search Console (read-only access):

Google Analytics (read-only access):

Wix (per Wix App OAuth):

Webflow (per Webflow App OAuth):

Shopify (per Shopify App OAuth):

For every OAuth integration, we store:

We do not request scopes beyond what we tell you on the consent screen.

2.3 Information automatically collected

Usage data. When you use the Service:

Cookies and similar technologies. See Section 9 below. Strictly-necessary cookies include session and security cookies.

Application logs. We log internal events (action created, draft generated, integration call) for debugging, security, and product analytics. Logs are retained per Section 8.

2.4 Information we generate about you

2.5 Information about third parties (editors, journalists, public contacts)

To support the Service's outreach features, Fokal collects publicly-available business contact information for editors, journalists, and publication staff at media outlets and websites. This includes:

This data is collected from public sources (publication mastheads, author bylines, public contact pages, professional directories) and is used solely to support outreach you authorise as a Fokal customer.

Legal basis (GDPR): Where data subjects are in the EU/UK/EEA, Fokal relies on the legitimate interest basis under Article 6(1)(f) — the legitimate interest being to facilitate authorised business-to-business communications between brands and editorial contacts. We have conducted a Legitimate Interest Assessment available on request to hello@fokal.com.

Legal basis (Australia): Collection of publicly-available business contact information for the primary purpose of editorial outreach is consistent with APP 3 and APP 5.

Rights of editorial contacts:

We do not sell, share, or rent editorial contact data to anyone else.

2.6 Information published on the Fokal Directory

Where you have a workspace on Fokal, we host a public brand profile for you at fokal.com/directory/[your-slug] (the "Directory Profile"). The Directory Profile contains information you provide (or that Fokal generates from public sources about your brand) and is published publicly to make your brand discoverable by search engines and AI engines (ChatGPT, Perplexity, Google AI, etc.).

You can request removal of your Directory Profile at any time. See Terms of Service §5.5.

3. How we use your information

We use personal information only for purposes you would reasonably expect. The table below maps each purpose to its legal basis under Australian and EU law.

PurposePersonal information usedLegal basis (AU APP 6)Legal basis (GDPR Art. 6)
Create and manage your accountAccount info, contact infoPrimary purpose of collectionPerformance of contract (Art. 6(1)(b))
Deliver subscribed Service features (generate drafts, audit your site, run integrations)Account info, OAuth tokens, usage dataPrimary purpose of collectionPerformance of contract (Art. 6(1)(b))
Read data from connected third-party accounts (Google Search Console, Google Analytics, Wix, Webflow, Shopify)OAuth tokens, scopesPrimary purpose of collectionPerformance of contract (Art. 6(1)(b))
Process payments and prevent fraudPayment data, billing address, IP addressPrimary purpose / related secondaryPerformance of contract; legitimate interest (Art. 6(1)(b), 6(1)(f))
Send transactional emails (welcome, billing receipts, breach notifications, security alerts)Contact infoPrimary purposePerformance of contract; legal obligation (Art. 6(1)(b), 6(1)(c))
Send marketing emails (product updates, tips, offers)Contact info, usage dataRelated secondary purpose with opt-outConsent or legitimate interest with opt-out (Art. 6(1)(a) or 6(1)(f))
Provide customer supportAccount info, communications, usage dataPrimary purposePerformance of contract; legitimate interest (Art. 6(1)(b), 6(1)(f))
Improve the Service (debugging, performance, analytics)Usage data, application logsRelated secondary purposeLegitimate interest (Art. 6(1)(f))
Detect, prevent, and investigate fraud, abuse, or security incidentsAll categories as neededPermitted under APP 6.2(e)Legitimate interest; legal obligation (Art. 6(1)(f), 6(1)(c))
Comply with legal obligations (tax records, lawful requests, enforce our terms)All categories as neededPermitted by lawLegal obligation (Art. 6(1)(c))
Defend or pursue legal claimsAll categories as neededPermitted by lawLegitimate interest (Art. 6(1)(f))

3.1 Automated decision-making

Fokal uses AI to generate content recommendations, prioritise actions, and surface findings. These outputs are suggestions, not binding decisions, and a human (you) decides whether to accept them. Fokal does not make automated decisions that produce legal or similarly significant effects as defined in GDPR Article 22 or in the Privacy and Other Legislation Amendment Act 2024 (Cth) transparency reforms.

We will update this Policy if our use of AI evolves in a way that does engage Article 22 or the equivalent Australian provisions when they come into force in late 2026.

4. Connected third-party accounts

This Section explains specifically what happens when you connect a third-party account to Fokal.

4.1 Google APIs — Limited Use disclosure

Fokal's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

  1. We only use Google user data to provide and improve the user-facing features described in Section 4.2 and 4.3 below. These features are visible and prominent in the Fokal application.
  2. We do not transfer Google user data to others except as necessary to provide or improve those features, with user consent, for security, to comply with applicable law, or as part of a merger / acquisition / sale of assets (with notice).
  3. We do not allow humans to read Google user data, except: (a) with your explicit consent for specific items; (b) in aggregated or anonymised form for internal operations; (c) for security purposes; or (d) where required by law.
  4. We do not use or transfer Google user data for advertising, retargeting, selling to data brokers, credit / lending assessment, or to develop, improve, or train generalised AI or machine learning models.

For details of what we do with each Google scope, see also our dedicated Google API Disclosure.

4.2 Google Search Console

When you connect Google Search Console, Fokal accesses your Search Console data on a read-only basis to:

Data accessed under this scope is stored only as needed to render Fokal's user-facing analytics. Cached aggregates are retained per Section 8.

4.3 Google Analytics

When you connect Google Analytics, Fokal accesses your GA4 data on a read-only basis to:

Data accessed under this scope is fetched on-demand at your request and not bulk-exported.

4.4 Wix, Webflow, Shopify

When you connect Wix, Webflow, or Shopify, Fokal accesses the minimum endpoints needed to:

Fokal does not read your customer data, customer orders, payment details, or any commerce data from these platforms.

4.5 Revoking access

You can revoke any OAuth connection at any time:

When you revoke, Fokal deletes the stored refresh token within 24 hours and stops fetching new data from that integration. Cached data and previously generated drafts remain in your workspace unless you also delete them.

5. AI processing and training

5.1 Which AI providers we use

Fokal generates drafts, audits, and recommendations using third-party large-language-model APIs. As at the effective date of this Policy, these are:

A current list is maintained on our Subprocessors page. When we add or change a material AI subprocessor, we update that page and notify account holders at least 30 days in advance.

5.2 What is sent to AI providers

To generate a draft or run an audit, we send the relevant context — which may include your prompt, your workspace's brand information, scraped content from the web, and the output of previous Fokal tools — to the AI provider's API. Each API call is made over an encrypted (TLS) connection.

5.3 No training on your data

Fokal does not use customer data — including your prompts, your generated content, your OAuth-fetched data (Google Search Console, Google Analytics, Wix, Webflow, Shopify), or any other personal information — to train, fine-tune, or otherwise improve generalised AI or machine-learning models.

We use Anthropic, OpenAI, and Google Gemini under their API-tier zero-retention or commercial terms, which contractually prohibit those providers from using your data to train their models. We commit to maintaining only such terms with AI subprocessors and to update this Policy if that ever changes.

Aggregated, de-identified product analytics (e.g. "what percentage of users use feature X") may be used to improve the Service. These analytics cannot be linked back to you.

5.4 AI visibility checks

To track whether your brand appears in AI-search engines (a core Fokal feature), we send non-personal queries (e.g. "What are the best [your category] tools?", "Compare [your brand] vs [competitor]") to third-party AI engines — currently ChatGPT (OpenAI), Perplexity, Google AI (Gemini, AI Overviews), Claude (Anthropic), and others as we add them. We log the responses to detect mentions of your brand.

The queries contain your brand name and category. We do not send personal information about you (e.g. your account email, billing data) to these engines as part of visibility checks.

5.4 AI output is not professional advice

Fokal's AI-generated content (articles, schema, recommendations, audits) is a draft assistance tool. It can be wrong, incomplete, or out of date. You are responsible for reviewing AI output before publishing it on your site or relying on it for any decision. AI output is not legal, medical, financial, or other professional advice.

6. Who we share your information with

We share personal information only as described in this Section. We do not sell personal information, and we have not sold personal information in the 12 months preceding the effective date of this Policy.

6.1 Subprocessors

We use a small number of trusted third-party services ("subprocessors") to operate Fokal. Each subprocessor processes personal information only on our documented instructions, under contract, and consistent with this Policy and applicable law. Our current list, with purpose and country of processing, is published at:

https://fokal.com/subprocessors

When we add or replace a material subprocessor, we update that page and notify account holders at least 30 days in advance so you can object before the change takes effect.

6.2 Other disclosures

We may also disclose personal information:

6.3 Aggregated / de-identified data

We may share aggregated or de-identified information (e.g. industry benchmarks, blog posts about trends in AI search) that cannot reasonably be used to identify you. This data does not constitute personal information under the Privacy Act 1988 (Cth) or the GDPR.

7. International data transfers

Fokal is based in Australia. Some of our subprocessors and infrastructure are located outside Australia.

7.1 Where your data is processed

RegionWhat is processed there
Australia (Sydney)Primary database and application hosting — your account data, drafts, action queue, OAuth tokens, and similar core records are stored here
United StatesAI inference (Anthropic, OpenAI, Google Gemini), payment processing (Stripe), keyword and search-engine data providers, transactional email, observability and product analytics
Global edgeCDN delivery and DDoS protection for static assets

A specific vendor-level breakdown by categories of subprocessor is published at fokal.com/subprocessors. A vendor-level list is available to customers under NDA on request.

7.2 Cross-border safeguards

Australia → overseas (APP 8). We take reasonable steps to ensure overseas recipients handle your information consistent with the Australian Privacy Principles, including by contracting on terms equivalent to a Data Processing Agreement and choosing reputable providers. Where overseas law does not provide protections substantially similar to the APPs, we remain accountable for the recipient's conduct in handling your data.

EU → outside the EU/EEA (GDPR Chapter V). Where personal information of EU/UK/EEA residents is transferred outside the EU/EEA/UK to a country that has not received an adequacy decision from the European Commission or UK ICO, we rely on:

A copy of the relevant clauses or framework certificate is available on request to hello@fokal.com.

8. Retention and deletion

8.1 How long we keep things

Data typeRetention periodReason
Account informationFor the life of your account + 90 days after deletionAccount lifecycle and a short grace period for restoration
Workspace data (drafts, actions, trackers)For the life of the workspace + 30 days after deletionService delivery
OAuth refresh tokensUntil the connection is revoked; deleted within 24 hours of revocationService delivery
Cached third-party data (GSC queries, GA4 metrics)Up to 12 months; rollingAnalytics views and historical comparisons
Payment records7 yearsIncome Tax Assessment Act 1936 (Cth) and equivalent obligations
Communications and support tickets3 yearsDispute resolution and customer service
Application logs and observability data90 days (raw), 24 months (aggregated)Debugging, security investigation, product analytics
Marketing list (after opt-out)90 days (suppression list to avoid re-contact)Compliance with Spam Act 2003 (Cth) and equivalents
BackupsUp to 35 daysDisaster recovery

8.2 Deleting your account

You can delete your Fokal account at any time from Settings → Account → Delete account, or by emailing hello@fokal.com.

When you delete your account:

  1. We mark your account for deletion immediately and revoke all OAuth tokens within 24 hours.
  2. We export any data you ask to keep (drafts, content) within 14 days on request.
  3. We delete your account data within 90 days of the deletion request, except where:
    • We must retain certain records to comply with legal obligations (e.g. tax — see above)
    • We need to retain limited data to resolve a dispute, enforce our agreements, or investigate fraud
    • Data has been irreversibly anonymised

Backups containing your data are overwritten on the rolling backup schedule (up to 35 days).

8.3 Anonymisation

After the retention period, we either delete personal information or irreversibly anonymise it. Anonymised data does not identify you and may be retained indefinitely for analytics, benchmarking, and research.

9. Cookies and similar technologies

Fokal uses cookies and similar technologies (web storage, pixels, server-side tracking) to operate the Service, remember your preferences, secure your session, and measure how the Service is used.

9.1 Categories of cookies

CategoryPurposeExamplesOpt-out
Strictly necessaryAuthentication, session, security, billingSession and security cookiesCannot be disabled — required for the Service to work
FunctionalRemember preferences, language, last-visited workspaceUI preferencesBrowser settings
AnalyticsUnderstand which features are used, debuggingFirst-party and third-party analytics cookiesCookie banner / browser DNT
MarketingMeasure ad campaign performance (if running ads)Advertising platform pixels (only on marketing pages)Cookie banner / browser settings

If you visit our site from the EU, UK, or EEA, we will show you a cookie consent banner before setting non-essential cookies, consistent with the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC) and GDPR. You can change your choices at any time via the "Cookie Preferences" link in our footer.

9.3 Do Not Track

We honour browser-level Global Privacy Control (GPC) signals where required by law. We do not separately honour the older "Do Not Track" header because it has been deprecated by major browsers.

10. Security

We take reasonable steps to protect personal information from unauthorised access, modification, disclosure, loss, or destruction, consistent with APP 11 and GDPR Article 32.

10.1 Technical measures

10.2 Organisational measures

10.3 What we don't promise

No system is 100% secure. We cannot guarantee that personal information will never be subject to unauthorised access, and we are not liable for security incidents beyond our reasonable control. You are responsible for keeping your account password confidential and for any activity that occurs under your account.

11. Data breaches

11.1 Notifiable Data Breach scheme (Australia)

Fokal complies with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If we suspect an "eligible data breach" — unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm — we will:

  1. Assess the suspected breach within 30 days (and as soon as practicable)
  2. Notify the Office of the Australian Information Commissioner (OAIC) if the assessment confirms an eligible data breach
  3. Notify affected individuals as required by the scheme, in plain language, including the kinds of information involved and recommendations on steps to take

11.2 GDPR breach notification

For breaches affecting EU/UK/EEA personal data, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where required by GDPR Article 33, and affected individuals where required by Article 34.

11.3 Customer notification

Where Fokal acts as a processor on behalf of a business customer (e.g. processing their customers' data in their workspace), we will notify the customer of any breach affecting their data without undue delay so that the customer can fulfil their own notification obligations.

12. Your rights

Your rights depend on where you live. We honour the strictest applicable standard.

12.1 If you are in Australia (Privacy Act 1988 + APPs)

Under the Australian Privacy Principles, you have the right to:

12.2 If you are in the EU, UK, or EEA (GDPR / UK GDPR)

You have the right to:

To exercise these rights, email hello@fokal.com. We respond within one month. We may need to verify your identity before fulfilling the request.

EU Representative. We are evaluating whether GDPR Article 27 requires us to appoint an EU representative. Until appointed, EU/EEA data subjects may contact hello@fokal.com directly.

12.3 If you are in California (CCPA / CPRA)

California residents have the right to:

To exercise these rights, email hello@fokal.com or write to our address above. We honour authorised agent requests and verify identity via the same email used on your Fokal account. We do not currently meet the CCPA/CPRA thresholds for required disclosures (Cal. Civ. Code § 1798.140(d)) but we honour these rights as a matter of good practice.

12.4 If you are elsewhere

If your local law gives you privacy rights similar to those above, we honour equivalent rights on a best-efforts basis. Email hello@fokal.com.

13. Complaints

If you believe we have mishandled your personal information, please contact hello@fokal.com in the first instance. We will acknowledge your complaint within 7 business days and respond substantively within 30 days.

If you are not satisfied with our response, you may escalate:

14. Children

Fokal is a business tool and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please email hello@fokal.com and we will take steps to delete it.

15. Contact

This Privacy Policy is provided in English. If translated, the English version prevails.

Your check is running.