Privacy Policy

1. Who is the data controller?

This privacy policy applies to all services and websites of Focal Creative:

• Focal Creative, sole proprietorship of Sam De Waegenaere
• Stanislas Leclefstraat 2 bus 001, 2600 Berchem, Antwerp, Belgium
• Enterprise number BE 1032.957.255
• Small business exempt from VAT (Belgian small enterprise scheme, article 56bis VAT Code).
• Email: hello@focalcreative.be
• Website: https://www.focalcreative.be

For any questions or requests about privacy and data protection, contact Sam directly at hello@focalcreative.be.

2. What personal data do we process?

Focal Creative collects only the data needed to prepare, execute and complete creative commissions, or to secure the platform.

• Contact details and correspondence: name, email address, optional telephone number, project description and the content of your messages.
• Project and account data in the Author Portal: email address, project role, book title, project status and the email addresses of team members you invite.
• Manuscripts, images and proof files: Word documents, original artwork, annotations, correction lists and the proof PDFs we prepare.
• Technical logs: IP address, date and time, requested URL, browser type and operating system, used only for troubleshooting, performance and network security.

3. Purposes and legal bases

We process personal data only on the legal bases set out in Article 6(1) GDPR:

• Performance of a contract (Article 6.1.b GDPR): to design your book, website or print project, prepare proofs and deliver print-ready files.
• Legitimate interest (Article 6.1.f GDPR): for network security, diagnostics and answering exploratory questions before a project starts.
• Legal obligation (Article 6.1.c GDPR): for invoices, payment records and tax evidence that must be kept under Belgian accounting and tax law.
• Consent (Article 6.1.a GDPR): when you voluntarily share extra information that is not strictly required for the contract. You can withdraw that consent at any time.

Focal Creative does not use automated decision-making or profiling as defined in Article 22 GDPR.

4. Manuscript confidentiality and AI policy

Focal Creative applies a strict policy for unpublished work, copyright and artificial intelligence:

• No AI processing of manuscripts: no manuscript, text passage or proof file is entered into public or commercial AI tools such as ChatGPT or Claude.
• No AI training: author texts and images are never used to train or refine AI models or machine learning algorithms.
• No automated rewriting: editing and typesetting are done by hand by Sam in Adobe InDesign. No automatic AI rewriting or style changes are applied to your work.
• Strict project confidentiality: access to an active project is limited to Sam and the people you invite. External freelancers or third parties receive no access without your explicit prior permission.

5. Service providers and transfers outside the European Union

Focal Creative works with external technical providers to host the platform and manage files. We work with these parties as processors. They process data only on our instructions and for the purposes described in this policy.

• Google Drive (Google Workspace): storage of manuscripts, original artwork and proof PDFs. Google LLC is certified under the EU-U.S. Data Privacy Framework and applies the European Commission’s Standard Contractual Clauses.
• Supabase: project metadata, user accounts, access permissions and notifications. The primary database and authentication run in Frankfurt, Germany (eu-central-1). Transfers are covered by Standard Contractual Clauses.
• Vercel: website hosting and serverless execution. Serverless functions run in Frankfurt, Germany (fra1). Vercel Inc. is certified under the EU-U.S. Data Privacy Framework and applies Standard Contractual Clauses.
• Adobe InDesign: professional desktop software for typography and book layout. Files are processed locally and are not stored in Adobe Cloud.

External email services are not currently active in production. Invitations and notifications use secure in-app links. Personal data is never sold, rented or shared for marketing or advertising.

6. Access security and storage

Focal Creative applies appropriate technical and organisational measures to protect personal data against loss, unauthorised access or misuse:

• Passwordless sign-in: the Author Portal is invitation-only. Access uses a single-use encrypted sign-in link sent to your verified email address. No passwords are stored.
• Role-based access control: access to files and proofs is restricted per project with database-level Row Level Security in Supabase.
• Encrypted transit and storage: all web traffic uses HTTPS/TLS. Stored files use standard encryption at rest, such as AES-256.
• Isolated workspace: the internal studio environment and client folders are separated. Every request checks permissions and folder ancestry before a file can be opened or downloaded.

No digital system can guarantee absolute protection against every possible risk. We take data protection seriously and reduce risk with established standards.

7. Retention periods and deletion

We keep personal data no longer than necessary for the purposes for which it was collected:

• Active project files: manuscripts, images, proof versions and print-ready files are kept during the project and for two years after completion. After that they are deleted unless explicitly agreed otherwise.
• Deletion on request: you can ask us to delete your active project folder and files earlier at any time. After confirmation we delete the active files in Google Drive and the project references in the database.
• Backups: files in Google Drive trash are removed within 30 days. Supabase database backups are removed within 7 days.
• Accounting and tax records: invoices and administrative evidence are kept for 7 to 10 years, as required by Belgian law.
• Technical server logs: kept only for a short period, according to the hosting provider’s standard retention.

8. Cookies and local storage

Focal Creative applies a calm, privacy-friendly cookie policy:

• No marketing or advertising cookies and no third-party tracking pixels.
• No analytics tools that follow visitors across different websites.
• Only strictly necessary first-party session cookies in the Author Portal and Studio dashboard, such as sb-*-auth-token. These keep your active session secure.

Because we use only strictly necessary cookies that are exempt under Article 129 of the Belgian Electronic Communications Act, we do not show a cookie banner.

9. Your rights under the GDPR

As a data subject you have clear rights regarding your personal data:

• Right of access (Article 15 GDPR): you can ask which personal data we process and receive a copy.
• Right to rectification (Article 16 GDPR): you can ask us to correct inaccurate or incomplete data.
• Right to erasure (Article 17 GDPR): you can ask us to delete your data where no statutory retention duty applies.
• Right to restriction of processing (Article 18 GDPR): you can ask us to temporarily restrict processing in certain situations.
• Right to data portability (Article 20 GDPR): you can receive the data you provided in a structured, commonly used and machine-readable format.
• Right to object (Article 21 GDPR): you can object to processing based on our legitimate interest.
• Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you can withdraw it at any time.

Email hello@focalcreative.be to exercise your rights. To confirm that the request comes from you, we may ask you to verify your identity, for example by replying from the email address linked to your project.

We respond as soon as possible and at the latest within one month of receipt, as required by Article 12(3) GDPR. For complex or numerous requests this period may be extended by up to two months. In that case we will tell you within the first month why.

If you believe Focal Creative processes your personal data unlawfully, you can lodge a complaint with the Belgian Data Protection Authority:

• Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)
• Rue de la Presse 35, 1000 Brussels, Belgium
• Telephone: +32 (0)2 274 48 00
• Email: contact@apd-gba.be
• Website: https://www.gegevensbeschermingsautoriteit.be

10. Changes to this privacy policy

Focal Creative may update this privacy policy when our services, software providers or legal obligations change. The latest version is always available at https://www.focalcreative.be/en/privacy. If significant changes affect active projects, we inform registered authors by email.

11. Contact

Do you have a question about this privacy policy or the processing of your data? Email hello@focalcreative.be. You can also find Focal Creative’s legal details on the imprint page.