Focal Privacy Policy

Operated by First Light Holdings LLC

Last Revised: July 23, 2026

First Light Holdings LLC, a North Carolina limited liability company ("First Light Holdings," "Focal," "we," "us," or "our"), operates Focal, a done-for-you online-presence service for local and small businesses, available at focuswithfocal.com (the "Site"). This Privacy Policy explains how we collect, use, share, and safeguard information in connection with the Site and the services we provide (collectively, the "Services"). It also describes the choices and rights you have regarding your information.

We are committed to handling personal information responsibly and in accordance with applicable data protection laws, including, where applicable, the EU General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the Virginia Consumer Data Protection Act ("VCDPA"). This Privacy Policy should be read together with our Terms of Service, which governs your use of the Services, and, where we act as a processor of data on your behalf, our Data Processing Agreement ("DPA").

By using the Site or the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

1. Privacy Policy Overview

Focal helps local and small businesses establish and maintain a professional online presence. In the course of delivering that service, we necessarily handle two broad categories of information: (a) information about you, the business owner who subscribes to Focal (our "Customer" or "you"), which we generally control; and (b) information about your website visitors and customers ("end-users"), which we process on your behalf and under your instructions.

This Privacy Policy primarily addresses the information for which First Light Holdings acts as the data controller — that is, the account and business information you provide to us so that we can build, host, and run your online presence. Where we handle information about your end-users that flows through the websites and tools we operate for you, we generally act as your data processor, and that handling is governed by our Data Processing Agreement and your own privacy policy toward those end-users. Section 8 explains this distinction in more detail.

In short: we collect the information we need to deliver the Services, we use it to operate and improve those Services, we share it only with the service providers and in the circumstances described below, and we do not sell your personal information.

2. Our Services That Process Data

Focal is a done-for-you online-presence service for local and small businesses. As part of delivering the Services, we may:

• Design, build, host, and maintain a business website for you, including page content, layout, and brand presentation;
• Connect online booking and scheduling so that your end-users can request or book appointments;
• Connect the third-party payment processor you choose so that your end-users can pay you directly (see Section 7 — your payments flow directly to you, not through Focal);
• Optimize your website so it can be found through search engines and AI answer engines (SEO/AEO), and connect Google Search Console and Google Analytics where you provide access, so the people looking for your business can find it;
• Run and manage your online presence on an ongoing basis, at the service level you select (self-managed, co-managed, or fully managed).

The Services are delivered as a one-time setup fee plus a recurring monthly subscription. You own your business content, brand assets, website content, and your customer data. To provide these Services, we collect and process the categories of information described in Section 3.

3. Information We Collect

We collect information that you provide directly, information we process on your behalf about your end-users, and information collected automatically when you use the Site.

3.1 Personal Information

Account Information. When you subscribe to or set up an account with Focal, we collect information such as your name, email address, phone number, business name, business address, and business hours. We use this to create and administer your account and to deliver the Services.

Contact Information. We collect the contact details you provide when you communicate with us — for example, when you request support, send us a message, or respond to our communications — so that we can respond and maintain a record of our correspondence.

Payment Information. We use Authorize.net to process payment of Focal's own fees (your setup fee and subscription). We do not store full payment card numbers. We may retain related records such as transaction identifiers, subscription identifiers, masked card information (for example, the card type and last four digits), and your billing history, so that we can administer your subscription, issue receipts, and support your account.

Onboarding Content. During our guided onboarding process, you provide information about your business so that we can build your online presence. This may include your business description, your story, your preferred voice and tone, your target audience, and your differentiators, as well as brand assets such as your logo, brand colors, and photographs. We treat this content as yours and use it to create and maintain your website and presence.

Customer's End-Customer Data. In operating the websites and tools we build and host for you, we handle information about your end-users on your behalf — for example, contact-form submissions, booking and appointment submissions, and any customer list you provide or that is generated through your site. With respect to this data, you are the data controller and Focal acts as your data processor, processing it only to provide the Services to you and in accordance with our Data Processing Agreement. You are responsible for having an appropriate legal basis and privacy notice for the end-user data you collect through your site.

Authentication. Focal uses passwordless, magic-link authentication. When you sign in, we email you a one-time login link or token rather than asking for a password. We do not create or store passwords for your account. We process the email address and token associated with your sign-in to authenticate you securely.

IP Addresses. We collect the Internet Protocol (IP) address associated with your device when you access the Site or the Services. IP addresses may be considered personal information under some laws. We use them for security, fraud prevention, troubleshooting, and to understand general usage of the Services.

3.2 Non-Personal / Automatically Collected Information

Web Server Log Files. Like most online services, our servers automatically record certain information in log files when you access the Site or the Services. This may include your IP address, browser type, referring and exit pages, operating system, date and time stamps, and related data. We use log files to operate and secure the Services, diagnose problems, and analyze trends.

Analytics. We use Google Analytics (GA4) to understand how visitors and users interact with the Site and the Services, so that we can improve them. Google Analytics collects information such as pages viewed, session activity, approximate location, and device and browser characteristics. This information is used in aggregate to measure and improve performance.

Cookies. We use cookies and similar technologies that are limited to operating and measuring the Services:

• Essential and session cookies, which are necessary to make the Site work, keep you signed in, and maintain your session;
• Security cookies, including cross-site request forgery (CSRF) protection tokens;
• Analytics cookies associated with Google Analytics (GA4), used to measure and improve the Services.

We do not use advertising cookies, Google AdSense, or any ad-targeting or ad-network cookies, and we do not use cookies to build advertising profiles about you. Most browsers allow you to refuse or delete cookies; however, disabling essential cookies may prevent parts of the Services from functioning.

"Do Not Track." Some browsers offer a "Do Not Track" ("DNT") signal. There is currently no industry or legal standard for recognizing or honoring DNT signals. At this time, our Services do not respond to DNT signals. We describe the choices available to you regarding tracking and analytics elsewhere in this Privacy Policy.

Device Information. We may collect information about the device and browser you use to access the Services, such as device type, operating system, browser type and version, language settings, and screen characteristics, for security, compatibility, and analytics purposes.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To create, administer, and secure your account, including passwordless authentication;
• To design, build, host, maintain, and operate your website and online presence;
• To connect and support online booking, scheduling, and the third-party payment processor you choose;
• To optimize your website for search engines and AI answer engines (SEO/AEO), and to connect Google Search Console and Google Analytics where you provide access;
• To process payment of Focal's own setup and subscription fees, issue receipts, and manage billing;
• To provide customer support and respond to your inquiries and requests;
• To send you transactional and service communications, such as account notices, service alerts, security notices, and billing messages;
• To send you marketing or promotional communications where permitted, from which you may opt out at any time;
• To monitor, maintain, secure, troubleshoot, and improve the Site and the Services;
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues;
• To comply with applicable legal obligations and enforce our Terms of Service and other agreements;
• To create aggregated or anonymized data that does not identify you, for analytics and improvement of the Services.

Where required by law, we rely on an appropriate legal basis for processing, such as performance of our contract with you, your consent, our legitimate interests in operating and improving the Services, or compliance with a legal obligation.

5. Data Sharing & Disclosure

We do not sell your personal information. We share information only in the limited circumstances described below.

5.1 Third-Party Service Providers (Subprocessors)

We rely on trusted third-party providers to deliver the Services. These providers process information on our behalf and are permitted to use it only to provide services to us. Our current providers include:

• Vercel — website hosting and content delivery (CDN);
• Neon — managed PostgreSQL database hosting;
• DigitalOcean — DNS management;
• Authorize.net — processing of Focal's own setup and subscription fees;
• TaxJar — sales-tax calculation at checkout;
• Postmark — delivery of transactional email;
• Google — analytics (Google Analytics, GA4) and Google Search Console on your behalf;
• Anthropic — AI-assisted text polishing of the content you provide during the onboarding interview.

We may update this list from time to time as our providers change. Where these providers process end-user data on your behalf, they act as subprocessors under our Data Processing Agreement.

5.2 Payment Processor (Focal's Own Fees)

We use Authorize.net to process payment of Focal's own fees — your one-time setup fee and recurring subscription. Charges for Focal's fees appear on your card statement as "First Light Holdings LLC." Authorize.net handles your payment card data under its own security standards; we do not store full card numbers.

5.3 Your Own Payment Processor

Focal operates on a processor-agnostic model for your sales. You connect the payment processor you choose — for example, Stripe, PayPal, Klarna, Authorize.net, or Square — and we simply connect and configure it to your website and booking tools. When your end-users pay you, those payments go directly to you through your own payment processor. Focal does not process, hold, touch, or have access to your sales revenue, and Focal is not a party to those transactions.

Because your payment processor is a service you select and contract with directly, its handling of payment and personal data is governed by its terms and privacy policy, not this one. First Light Holdings makes no representation or warranty regarding the availability, holds, freezes, fees, or terms of any third-party payment processor you choose. We encourage you to review your chosen processor's terms and privacy practices.

5.4 Legal Compliance

We may disclose information if we believe in good faith that doing so is necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms of Service or other agreements; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of First Light Holdings, our customers, or others.

5.5 Business Transfers

If First Light Holdings is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, or in the event of insolvency, information we hold may be transferred as part of that transaction. We will take reasonable steps to ensure that any recipient continues to protect your information consistent with this Privacy Policy, and we will notify you of any material change in how your information is handled where required by law.

5.6 Aggregated / Anonymized Data

We may create and use aggregated, de-identified, or anonymized data that does not identify you or any individual. This data is not personal information, and we may use and share it for any lawful purpose, such as analytics, benchmarking, and improving the Services.

6. Data Processing Agreement

Where First Light Holdings processes personal information about your end-users on your behalf and under your instructions, we act as a data processor and you act as the data controller of that information. This processing is governed by our Data Processing Agreement, which supplements this Privacy Policy and our Terms of Service. The Data Processing Agreement describes the subject matter, duration, nature, and purpose of the processing, the types of personal data and categories of data subjects involved, our obligations as a processor, and the subprocessors we engage. If you require a copy of the Data Processing Agreement, please contact us at privacy@focuswithfocal.com.

7. Data Security

We take reasonable and appropriate technical and organizational measures designed to protect the information we hold. These measures include encryption of data in transit using SSL/TLS, access controls that limit who can access data internally, and passwordless magic-link authentication that avoids the storage of reusable passwords. We also rely on reputable infrastructure and service providers that maintain their own security programs.

No method of transmission over the Internet or method of electronic storage is 100% secure, however, and we cannot guarantee absolute security. You are responsible for safeguarding access to your email account, since our magic-link authentication relies on it, and for the security practices of any third-party services you connect. If we become aware of a security incident that affects your personal information, we will notify you as required by applicable law.

8. Your Privacy Rights & Access

Depending on where you live and the applicable law (including the GDPR, CCPA/CPRA, and VCDPA), you may have some or all of the following rights regarding your personal information:

• Access — the right to request confirmation of whether we process your personal information and to obtain a copy of it;
• Correction — the right to request that we correct inaccurate or incomplete personal information;
• Deletion — the right to request that we delete your personal information, subject to legal exceptions;
• Object / Restrict — the right to object to or request that we restrict certain processing of your personal information;
• Portability — the right to receive certain personal information you provided to us in a portable, machine-readable format, and where feasible to have it transmitted to another controller;
• Opt out of "sale" or "sharing" — the right, under the CCPA/CPRA and similar laws, to opt out of the sale or sharing of personal information (see Section 12). As noted, we do not sell your personal information;
• Withdraw consent — where we rely on your consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details in Sections 10 and 13. We will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your privacy rights. Where the request concerns end-user data that we process on your behalf as a processor, we will refer the request to you, the controller, or assist you in responding as required by the Data Processing Agreement. We may need to verify your identity before fulfilling a request, and in some cases you may designate an authorized agent to act on your behalf.

9. Information Correction & Deletion

If you would like to review, correct, update, or delete the personal information we hold about you, please contact us at privacy@focuswithfocal.com or support@focuswithfocal.com. We will take reasonable steps to fulfill your request, subject to any legal or legitimate business reason to retain certain information — for example, to comply with our legal obligations, resolve disputes, maintain security, or enforce our agreements. We may retain and use information as necessary to comply with applicable law and for standard backup and record-keeping purposes, and we may retain aggregated or anonymized data that no longer identifies you.

10. SMS Terms & Conditions

If Focal sends you text (SMS) messages, those messages are directed to you, our business-owner Customer, and relate to your account and the Services. This may include service and account alerts (such as billing notices, security notices, or important updates about your website or presence) and, only where you have provided consent, marketing or promotional messages.

• Opt-in. We send SMS messages only to numbers for which we have an appropriate basis or your consent. Consent to receive SMS is not a condition of purchasing the Services.
• Opt-out. You can opt out of SMS messages at any time by replying STOP to any message. After you opt out, we will stop sending you SMS messages, other than a confirmation that you have been unsubscribed.
• Help. For help, reply HELP to any message, or contact us at support@focuswithfocal.com.
• Frequency. Message frequency varies depending on your account activity and settings.
• Rates. Message and data rates may apply, depending on your mobile carrier and plan.
• No sharing for third-party marketing. We do not share your mobile information with third parties or affiliates for their own marketing or promotional purposes. We may share it with service providers who help us deliver messaging on our behalf, solely for that purpose.

11. CCPA / US State Privacy Laws Opt-Out ("Do Not Sell or Share")

First Light Holdings does not sell your personal information and does not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and similar US state privacy laws. We do not use advertising cookies or ad networks, and we do not disclose personal information to third parties for their own advertising purposes.

Because we do not sell or share personal information, there is no sale or share for you to opt out of. Nevertheless, if you are a California, Virginia, or other US state resident and wish to exercise any right available to you under applicable state privacy law — including a request to opt out of sale or sharing, or to limit the use of sensitive personal information — you may submit a request to privacy@focuswithfocal.com, and we will honor it consistent with applicable law. You may also designate an authorized agent to submit such a request on your behalf.

12. Data Compliance Officer

For questions, requests, or concerns regarding this Privacy Policy or our data practices, you may contact our Data Compliance Officer:

ATTN: Data Compliance Officer First Light Holdings LLC 4030 Wake Forest Rd, Ste 349 Raleigh, NC 27609, USA privacy@focuswithfocal.com

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make changes, we will revise the "Last Revised" date at the top of this policy and, where the changes are material, we will provide additional notice as required by law, such as by email or a notice on the Site. Your continued use of the Services after an updated Privacy Policy takes effect constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, requests, or concerns about this Privacy Policy or our handling of your information, please contact us:

• General and support: support@focuswithfocal.com
• Privacy and data requests: privacy@focuswithfocal.com

First Light Holdings LLC 4030 Wake Forest Rd, Ste 349 Raleigh, NC 27609, USA