Privacy policy

1. Data controller

Robert Pauker
Andromedastrasse 8
4030 Linz, Austria
Email: robert@thefocusedphotographer.com

For privacy questions, you can also contact us at support@thefocusedphotographer.com.

2. Purpose of the app

The Focused Hub is a personal workspace for photographers. Users can create photography plans and manage trips, photo spots, equipment, checklists, notes, projects, participants, project chats and floor plans. Optional entries for software, subscriptions and a personal image archive index are also available. Certain functions use AI services when you actively initiate them.

3. Data processed

The following data may be processed when you use the app:

• Email address and authentication data
• Purchaser, access, FC and credit status, as well as the timing and amounts of credit purchases, credits granted, usage, adjustments and refunds
• Saved trips, places, photo spots and map links
• Coordinates, location search terms and selected map areas when using map, location and weather functions
• Equipment, notes, checklists, projects and project status
• Optional details about software, purchase prices, subscriptions, renewals and licence information
• Optional image archive metadata such as titles, keywords, shooting periods and local folder paths
• When using the Chrome extension, the address and title of the current webpage that you deliberately capture, and a passage of text you select
• Project members, participant lists and project chat messages
• Uploaded floor plans and marked areas
• Acceptance of usage rules and technical settings data
• Browser push subscriptions, notification preferences and read or unread Hub notifications
• Moderation events when a built-in filter flags a possible rule violation in inputs, project chats or direct messages
• Technical usage data such as IP address, browser data and logs
• Data-minimising usage statistics recording which Hub tool a signed-in account opened; prompts, content, places, full page paths, IP addresses and browser data are not stored in these statistics
• On the public app landing page, anonymous page views and store clicks with platform, placement and voluntarily supplied UTM campaign parameters; neither a user account nor the IP address is stored in the campaign statistics
• Support requests with ticket number, category, message history, processing status, technical context and voluntarily uploaded screenshots or PDFs, as well as enquiries by email or WhatsApp
• Withdrawal declarations with name, contract reference, confirmation address, content, and date and time of receipt

Passwords are not stored in plain text.

The image archive index does not upload original images from your hard drive to the Hub. Full licence keys should not be stored either.

For an online withdrawal declaration, we process your details to document receipt, send you the legally required confirmation and review the relevant contract. The data is retained only as long as necessary for processing and statutory documentation and retention obligations.

4. Legal bases

Where applicable, processing is based on Article 6(1)(b) GDPR to provide account access and app functions, Article 6(1)(f) GDPR for legitimate interests such as security, error analysis and abuse prevention, and Article 6(1)(c) GDPR where legal obligations apply. Where consent is required, processing is based on Article 6(1)(a) GDPR.

5. Credit purchases, usage and accounting reports

When you purchase, receive or use Focused Credits, we store the time, number of credits, transaction type, resulting credit balance and, where necessary, a reference to the related transaction. This serves contract performance, transparent accounting, customer support, refund processing and the detection of errors and abuse.

Authorised administrators may create reports as of a specified date. These contain email addresses, purchase times and credit quantities, credits actually used by the reporting date and the calculated balance. Transfers, adjustments and refunds are treated separately and are not counted as usage. These exports are not stored permanently in the Hub and must be protected against unauthorised access.

The legal bases include Article 6(1)(b) GDPR for contract performance and accounting, Article 6(1)(c) GDPR for statutory documentation and retention obligations, and Article 6(1)(f) GDPR for support, error investigation and abuse prevention.

6. Hosting, database and service providers

The app is delivered through Vercel. Authentication, database, storage and access controls run through Supabase. Depending on the function, OpenAI, Google or Black Forest Labs may be used as technical AI providers. The image provider is shown during selection or the action. An SMTP service such as World4You may send system emails. If you voluntarily request the four-part email introduction, your email address, the time and the version of your consent are transmitted to Brevo. Brevo sends these emails and processes technical sending, delivery and unsubscribe data. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw it through the unsubscribe link in each email. Course videos are provided through Bunny.net/Bunny Stream. This may involve processing IP address, browser data, access time and technical playback data in particular. Source code is managed through GitHub.

Regular app user content is not stored in GitHub. User content is stored in Supabase and separated by access controls. Project images are held in non-public storage. Only authorised project members receive time-limited access links. Images remain stored until individually removed or the related project is deleted.

When you use API functions such as Focused Scout, Visualizer or Publisher, your inputs, generated content and uploaded files may be transmitted to the relevant service for processing. The Focused Hub does not permanently store Publisher uploads in Supabase unless expressly provided for by the function. During Publisher link analysis, The Focused Hub retrieves the public webpage you specify and transmits extracted text and a limited number of publicly visible preview images for analysis. A copy of the webpage is not stored in the Hub. In the Publisher text workshop, your drafts, personal details and instructions are transmitted for text generation. For a link used there, only the extracted text is transmitted. If you enable location research, the service additionally processes the search query and public sources accessed. Your own photograph used for the cover export of an Adobe Express report is processed exclusively locally in the browser. Only if you deliberately generate an AI cover image there are your subject description and chosen style transmitted to the AI service. Custom hero images for the modern home view are resized in the browser before upload and stored in a private area of your account. They are deleted when you return to the default images.

If you enable the optional Focused Archive, we store successful plans and generated AI images together with your inputs, the result, creation time and credits used. Image files are held in private storage and released for display only for a limited time. This helps you find and reuse earlier plans. Your own uploaded source images are not added to the archive. You can delete individual archive entries at any time.

Results from AI functions are identified as AI content in the Hub where provided for in the relevant display. AI-generated image files may also contain machine-readable provenance information or invisible provenance signals. This technical information helps trace the artificial origin. If you publish or share AI-generated or AI-edited content, you must assess and apply any visible labelling required for your particular use.

Images in the shared project image selection are not automatically transmitted to an AI service. Transmission occurs only when a user expressly starts image analysis or generation, for example in Visualizer, Publisher or a hanging recommendation. For image generation, the displayed provider, Google or Black Forest Labs, processes the prompt and, where applicable, the reference photograph. A reference photograph in Visualizer is transmitted only for the requested image generation and is not stored as a project image in the Hub. For analysis, OpenAI may process selected files and instructions. The relevant provider's privacy and retention rules apply.

Transfers to service providers outside the EEA occur only where an appropriate legal basis or appropriate safeguards exist.

Mapbox is used for map views. Loading a map may transmit IP address, browser data, map position and zoom level to Mapbox. Optional automatic location search uses Geoapify, processing the entered search term and location data required for selection. Photo-spot searches may use OpenStreetMap or Overpass map data.

Weather forecasts for coordinates are requested server-side from MET Norway and cached temporarily in the Hub. The requested coordinates are transmitted to MET Norway, but not the email address or user ID. Browser location permission is used only after your confirmation.

When you import a GPX or KML file, the Hub stores its route, GPS points, timestamps and available elevation data in your account. You choose which file to import. Deleting the related trip also deletes the imported route.

7. Sign-in with Apple or Google

When you sign in with Apple or Google, the chosen provider processes the data needed for sign-in. The Focused Hub receives, in particular, a unique account ID and the email address you share. With Apple, you may use a private relay address.

8. AI functions and external programs

The Focused Scout, The Focused Visualizer, The Focused Publisher, exhibition assistant and Light Planner are integrated directly into the Hub. When online research is expressly enabled, search queries, location and time details may be transmitted to AI and search services. For the Schmerzfrei Fotografieren course, the Hub stores your access and the module progress you mark. Protected videos load through Bunny Stream; your Focused Hub password is not transmitted.

Inputs, project chats and direct messages are not continuously monitored manually. However, an automatic filter may be used to detect possible breaches of the usage rules and record them as moderation events.

For support requests, an authorised administrator may have OpenAI process the ticket content and previous message history to prepare a draft response. The draft is not sent automatically. A person reviews it before sending and may edit or discard it.

9. Browser notifications

Browser push is set up only after you expressly enable it. A technical push endpoint, cryptographic subscription keys, browser information and your chosen categories are stored. You may disable individual categories or browser push at any time in the notification centre. Delivery uses the browser's or operating system's push services.

10. Local storage and cookies

The Focused Hub uses technically necessary cookies for sign-in, session management and account security. Protected app functions cannot be provided without them. Their retention period depends on the session and the sign-in duration you choose.

The cookie focused_cookie_consent stores for 180 days whether you have allowed only necessary cookies or also affiliate attribution. It contains no randomly assigned user identifier. This storage is necessary to respect your choice.

If you open a partner link and choose “Accept all”, the cookies focused_affiliate_code and focused_affiliate_visitor store the relevant partner and a random visitor identifier. This allows a later purchase to be attributed to the partner for commission accounting. Depending on the partner programme, retention ranges from 1 to 365 days, usually 90 days. The legal basis is your consent. Without consent, these cookies are not set and the app remains fully usable.

The Hub also uses local browser storage where necessary for a function or setting you choose. Examples include theme selection, dashboard layout, project views, onboarding status and working data held offline. This information remains in your browser until you delete it or the browser removes it.

You may change your selection at any time through “Cookie settings”. Switching to “Essential only” deletes existing affiliate cookies.

Optional affiliate attribution is disabled in the iOS app. There, the Hub uses only technically necessary cookies and local storage for sign-in, security and your settings. The iOS app does not track you across other companies' apps or websites.

10a. Chrome extension

The Chrome extension captures the title and address of the current webpage only when you click the extension. It captures selected text after you choose the context-menu command or through the Publisher sidebar. It does not record a complete browsing history.

When you enable Publisher for a post, the open sidebar detects text changes locally. Voice, writing instructions and personal details are stored locally in Chrome for each post and can be deleted there. The document address and latest result are retained for the browser session. Only when you start a review are the selected text and your details processed through an expressly connected Hub tab. Your access tokens stay in the Hub. No automatic paid AI requests are started.

The captured information is transmitted to the Focused Hub in encrypted form and used there only for the photo spot or note you choose. It is not used for advertising, sold or passed to data brokers.

Information from Chrome interfaces is used in accordance with the Chrome Web Store's Limited Use requirements. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

10b. Data-minimising usage statistics

To identify usability problems and develop the Hub usefully, we count which Hub tools signed-in accounts open. A use is recorded at most once per account, tool and 15-minute period. Administrator accounts are excluded.

The statistics contain the internal account ID, tool name, general event type and time. They do not store prompts, images, notes, places, entered content, full page paths, IP addresses or browser data. The admin area displays only aggregated counts per tool. Personal raw events are automatically deleted after 90 days.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is data-minimising error analysis and improvement of the Hub functions actually used. These statistics set no additional analytics cookies and create no advertising or interest profiles.

11. Retention and deletion

Your saved workspace data remains stored until you delete it or request deletion of your access. In Settings, you can delete workspace data or remove your access completely. Project data may be managed separately to prevent the accidental removal of project content when an individual workspace is deleted.

Statutory retention obligations, purchase records, security logs or moderation events may require longer retention.

Credit transactions and the resulting accounting data are retained in personally identifiable form only as long as necessary for contract administration, support, the defence of legal claims or statutory retention obligations. Downloaded reports should be securely deleted when their purpose no longer applies.

12. Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability and objection. You may contact us by email to exercise your rights.

You also have the right to lodge a complaint with a data protection authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

13. Security

We use technical and organisational measures to protect your data. These include encrypted connections, protected user accounts and database-level access restrictions.

14. Changes

This privacy policy may be updated when functions, service providers or legal requirements change. We inform you of significant changes in the Hub. Where renewed acknowledgement or consent is required, it is requested when you next open the Hub and recorded with its version and time.