Focal

GDPR overview

The privacy policy, last updated 29 January 2025, carries a dedicated section on user rights under the GDPR: withdrawal of consent, objection, access and copy, rectification, restriction, erasure, portability and the right to lodge a complaint with a supervisory authority. Legal bases are enumerated, requests are free and answered within one month, and objection to direct marketing is unconditional. Fluorescent Labs is named as data controller, reachable at machines@focalml.com. Beyond that the implementation is thin: no Article 27 EU representative is designated, no data protection officer is named, no DPA is published, no transfer mechanism such as standard contractual clauses is cited, and the subprocessor list is not published — it is only available on request. The company states it is US-based and that data may travel to jurisdictions offering weaker protection.

Who owns the data?

Focal's terms state plainly that the company claims no ownership of your inputs or your outputs, and that any rights it might acquire in your outputs are assigned back to you. In exchange you grant Fluorescent Labs a worldwide, royalty-free, transferable and sublicensable licence — irrevocable for as long as your content is stored with them — to host, reproduce, distribute, display and process that content in order to operate, improve and promote the service, including sharing it with third parties under contract. Commercial exploitation of your outputs is permitted only on a paid plan; the free plan is for personal use only.

Reuse rights

On a paid plan, whatever you generate is yours to reuse, publish or sell without asking permission, and the terms expressly assign back any rights the company might otherwise hold in your outputs. Two limits bound that freedom. On the free plan, outputs are for personal use only and may not be monetised. And because generative models are involved, Focal warns that your outputs may not be unique: other users can produce identical or substantially similar results, and you waive any claim arising from that overlap. Separately, the company retains its own broad licence over everything you upload or generate, including the right to use inputs, outputs and interactions to train and improve its machine-learning models, with no opt-out documented. You remain responsible for holding the rights to whatever you feed in.

Data retention & training

Hosting summary

Focal publishes no hosting information in the usual sense: no provider is named, no region can be chosen and no data-residency option is offered. What the privacy policy does say is that Fluorescent Labs is based in the United States, that processing takes place at the company's operating offices and wherever the parties involved happen to be, and that it may use service providers operating in other countries. Personal data may therefore be transferred to the United States or to other jurisdictions whose data protection laws offer weaker safeguards than the user's own. No transfer mechanism is cited — standard contractual clauses are not mentioned — and the subprocessor list is not published, only available on request. The practical reading is that data sits under United States jurisdiction, with San Francisco as the company's stated base. The site itself is served through Cloudflare's anycast network, but that is content delivery infrastructure and says nothing about where projects, prompts or generated videos are actually stored.