Privacy Policy

1. Who we are (Data Controller)

ProdSignal is operated by Focusly Ltd (company number 16772121), registered in England and Wales, with its registered office at Flat 1, Broadwalk, 40 Granville Street, Birmingham, West Midlands, B1 2LJ. Focusly Ltd is the data controller responsible for the personal data described in this policy.

For any privacy question, request, or complaint, contact our data protection contact at hello@focuslyhq.com.

2. What personal data we collect

• Account data — your email address and authentication credentials (passwords are stored only as salted hashes by our authentication provider, Supabase Auth).
• Content you submit — customer interview transcripts, feedback, idea descriptions, product context, and analysis titles you upload or paste into the Service.
• Generated outputs — the problem statements, system designs, specifications, and validations ProdSignal produces from your content.
• Subscription & billing data — your Stripe customer ID, plan, subscription status, and cancellation state. Card details are collected and stored by Stripe; we never see or store full card numbers.
• Support data — the content of emails you send us (for example to hello@focuslyhq.com).

Please do not include more personal data in transcripts than you need — and where transcripts identify other people (for example interview participants), make sure you have a lawful basis for sharing it with us.

3. Why we process your data & our legal bases

We process personal data only where we have a lawful basis under UK GDPR:

• Performance of a contract (Art. 6(1)(b)) — to create and manage your account, deliver the core AI analysis service you signed up for, store your analyses and history, and process subscriptions and cancellations.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure (authentication, abuse and fraud prevention), to diagnose faults and maintain system reliability, and to understand aggregate usage so we can optimise the Service. We weigh these interests against your rights, and you may object at any time (see section 7).
• Consent (Art. 6(1)(a)) — for any non-essential cookies or similar technologies, if and when we use them (see our Cookie Policy). You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to keep billing and accounting records where UK law requires it.

4. AI processing & model training

To generate analyses, the content you submit is sent to the Anthropic Claude API through secure server-side endpoints. Your uploads are never used to train public LLM models, by us or by Anthropic. Generated outputs are stored securely in Supabase alongside your account, encrypted at rest and in transit, and are visible only to you.

5. Sub-processors & international transfers

We work with the following third-party processors to operate the Service:

• Vercel Inc.— hosting & infrastructure (serving the application).
• Supabase — secure database storage and authentication.
• Stripe — payment processing and subscription management.
• Anthropic PBC — Claude API for analysis generation (data is not retained for training).

Where any of these providers transfers personal data outside the UK, we rely on the UK’s adequacy regulations or the International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses, together with technical safeguards such as encryption in transit.

6. Data retention & security

We keep your account, content, and outputs for as long as your account is active so the Service can work for you. When you delete your account, we delete your profile, transcripts, and generated analyses. We may retain minimal billing records for as long as UK law requires us to. We may also keep backups for a short grace period, after which deletion is permanent.

All data is stored securely in Supabase with encryption in transit and at rest, row-level security so analyses are private to your account, and access limited to what is needed to run the Service.

7. Your rights under UK GDPR

You have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (you can edit your email and account details in Dashboard → Settings).
• Erasure (“right to be forgotten”) — delete your data at any time via the in-app deletion flow in Dashboard → Settings → Data & Privacy, which removes your profile, transcripts, and all generated analyses. You can also ask us to do this for you by email.
• Portability — receive your data in a structured, commonly used, machine-readable format (your analyses can be exported as Markdown or PDF from the app).
• Objection & restriction — object to processing based on legitimate interests, or ask us to restrict processing while a question is resolved.
• Withdraw consent — where we rely on consent (for example for cookies), you can withdraw it at any time.

To exercise any right, use the in-app controls or email hello@focuslyhq.com. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk), though we’d appreciate the chance to fix any issue first.

8. Cookies & similar technologies

We use only essential session cookies needed to keep you signed in (set by Supabase authentication). We do not use advertising or third-party analytics cookies. Full details, including how to change your cookie choice, are in our Cookie Policy.

9. Changes to this policy

We may update this policy from time to time. The current version is always published on this page with its “last updated” date. If a change materially affects your rights, we will take reasonable steps to notify you.

10. Contact

Focusly Ltd (Data Controller) — hello@focuslyhq.com · Flat 1, Broadwalk, 40 Granville Street, Birmingham, West Midlands, B1 2LJ, United Kingdom.