Privacy Policy

1. INTRODUCTION

Focal Deploy LLC ("Focal Deploy", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cloud deployment automation platform (the "Service").

BY USING THE SERVICE, YOU CONSENT TO THE DATA PRACTICES DESCRIBED IN THIS POLICY.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

• Account Information: Name, email address, company name, password
• Billing Information: Credit card details, billing address (processed by our payment processor Stripe)
• Cloud Credentials: AWS access keys, GCP service account keys, DigitalOcean API tokens (encrypted with AES-256-GCM)
• Deployment Configurations: Application code, environment variables, server configurations
• Support Communications: Messages, attachments, and metadata when you contact support
• Profile Information: Avatar images, preferences, settings

2.2 Information Collected Automatically

• Usage Data: Deployment logs, API calls, feature usage, session duration
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, errors, performance metrics
• Cookies and Tracking: Session cookies, authentication tokens, analytics data
• Location Data: Geographic location based on IP address

2.3 Information from Third Parties

• OAuth Providers: When you sign in with Google or GitHub, we receive your name, email, and profile picture
• Cloud Providers: Metadata about your cloud resources (instance IDs, regions, IP addresses)
• Payment Processors: Transaction confirmations and payment status from Stripe

3. HOW WE USE YOUR INFORMATION

We use your information to:

3.1 Provide and Improve the Service

• Create and manage your account
• Deploy applications to cloud providers on your behalf
• Process payments and maintain billing records
• Provide customer support and respond to inquiries
• Monitor, analyze, and improve Service performance
• Develop new features and functionality

3.2 Communication

• Send deployment notifications and status updates
• Provide technical support and service announcements
• Send marketing communications (with your consent)
• Request feedback and conduct surveys

3.3 Security and Compliance

• Detect and prevent fraud, abuse, and security incidents
• Enforce our Terms of Service and policies
• Comply with legal obligations and law enforcement requests
• Protect our rights, property, and safety

3.4 Analytics and Research

• Analyze usage patterns and trends
• Conduct research and development
• Create aggregated, de-identified statistics

4. DATA SECURITY

We implement robust security measures to protect your information:

• Encryption at Rest: Cloud credentials encrypted with AES-256-GCM
• Encryption in Transit: All data transmitted over TLS 1.3
• Access Controls: Role-based access control (RBAC) and least privilege principle
• Authentication: Password hashing with bcrypt, optional two-factor authentication (2FA)
• Infrastructure Security: Regular security audits, penetration testing, and vulnerability scanning
• Monitoring: 24/7 security monitoring and intrusion detection
• Data Isolation: Multi-tenant architecture with logical data separation

5. DATA SHARING AND DISCLOSURE

We share your information only in the following circumstances:

5.1 Service Providers

We share data with trusted third parties who assist us:

• Cloud Infrastructure: AWS, Google Cloud (hosting and storage)
• Payment Processing: Stripe (credit card processing)
• Email Services: SendGrid (transactional emails)
• Analytics: Google Analytics, Plausible (usage analytics)
• Error Tracking: Sentry (error monitoring)
• Customer Support: Zendesk or similar (support tickets)

These providers are bound by confidentiality agreements and may only use your data to perform services on our behalf.

5.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Subpoenas, court orders, or legal processes
• Requests from law enforcement or government agencies
• National security or public safety requirements
• Protection of our rights, property, or safety

5.3 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity. We will notify you of any such change in ownership.

5.4 With Your Consent

We may share your information for other purposes with your explicit consent.

6. DATA RETENTION

We retain your information for as long as necessary to:

• Provide the Service and fulfill our contractual obligations
• Comply with legal, tax, and accounting requirements (typically 7 years)
• Resolve disputes and enforce our agreements
• Maintain security and prevent fraud

Deletion: When you close your account, we delete or anonymize your personal information within 90 days, except where retention is required by law. Backup copies may persist for up to 30 additional days.

7. YOUR RIGHTS AND CHOICES

Depending on your location, you may have the following rights:

7.1 Access and Portability

• Request a copy of your personal information
• Export your deployment configurations and data
• Receive your data in a portable format

7.2 Correction and Deletion

• Update or correct your account information
• Request deletion of your personal information
• Close your account

7.3 Opt-Out and Restrictions

• Unsubscribe from marketing emails (via link in emails)
• Disable cookies (though some features may not work)
• Restrict processing of your data
• Object to automated decision-making

7.4 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@focuswithfocal.com. We will respond within 30 days.

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to:

8.1 Types of Cookies

• Essential Cookies: Required for authentication and security (cannot be disabled)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Track usage and performance (Google Analytics, Plausible)
• Session Cookies: Temporary cookies deleted when you close your browser

8.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may limit Service functionality. Visit www.allaboutcookies.org for instructions.

9. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

EU/EEA Users: We rely on Standard Contractual Clauses approved by the European Commission for transfers outside the EU/EEA.

10. CHILDREN'S PRIVACY

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, contact us immediately at privacy@focuswithfocal.com.

11. CALIFORNIA PRIVACY RIGHTS (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and share
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your information)
• Right to non-discrimination for exercising your rights

To exercise these rights, email privacy@focuswithfocal.com with "California Privacy Rights" in the subject line.

12. EUROPEAN PRIVACY RIGHTS (GDPR)

If you are in the EU/EEA, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

Legal Basis for Processing: We process your data based on:

• Performance of a contract (providing the Service)
• Legitimate interests (improving the Service, security)
• Compliance with legal obligations
• Your consent (marketing communications)

13. DO NOT TRACK SIGNALS

Some browsers support "Do Not Track" (DNT) signals. Because there is no industry standard for DNT, we do not currently respond to DNT signals. We will update this policy if standards are established.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service. The "Last Updated" date at the top indicates when the policy was last revised.

Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. CONTACT US

For questions, concerns, or to exercise your privacy rights, contact us at: