Privacy Policy

(Focal Shift^®)

1. Data Controller

The personal data collected on the Focal Shift website is processed by:

Focal Shift — Steven De Jong, sole proprietor (entrepreneur individuel under French law)
231 rue Saint-Honoré
75001 Paris - France
SIRET: registration pending
Email: contact@focalshift.eu

2. Data Collected

Depending on how the website is used, the following data may be collected:

a) Data provided voluntarily

Email address
Last name or first name, if provided
Phone number, if provided
Messages sent via forms or through the AI Advisor

b) Data related to the use of the welcome chatbot

The website features a welcome chatbot available on all pages, designed to help visitors find the services or content best suited to their situation. This chatbot does not require a user account or identification.

Messages exchanged with the welcome chatbot are stored in encrypted form (AES-256-GCM) on our servers for a maximum period of 12 months, for the purpose of improving the service. No directly identifying data (IP address, email address) is associated with these conversations. However, the content of messages may contain sensitive information freely described by the visitor.

Exchanges are transmitted to the technical processor (OpenAI) with the non-retention option enabled: data is neither stored nor used to train models by this processor.

When the chatbot directs the visitor to book an appointment, a summary of the described situation is automatically generated and pre-filled in the message field of the booking form. This summary is encrypted, stored for a maximum of 24 hours and can only be used once. The visitor may edit or delete it before submitting the form.

Temporary storage is also maintained in the visitor's browser (sessionStorage) to ensure conversation continuity during the visit. This storage is automatically cleared when the browser tab is closed.

The anti-spam service Cloudflare Turnstile is used on the welcome chatbot to distinguish human users from bots. IP addresses are temporarily processed for rate limiting and anti-spam verification purposes.

c) Data related to the use of the AI Advisor

Content of exchanges and conversations (text)
Audio data transmitted when using voice mode (user voice recording, generated audio output)
Transcriptions resulting from voice processing
Technical identifiers required for the service to operate

Conversations are encrypted and are used only for the operation of the service and the improvement of the user experience. To ensure that the AI Advisor can operate, exchanges (text and, where applicable, audio) are transmitted securely to a technical processor (OpenAI), which processes the data only to generate responses. This processor handles data with the non-retention option enabled: data is neither stored nor used to train its models. Conversations may also be subject to automated quality analysis, transmitted to the same processor without data retention, solely for the purpose of improving the service. Audio data is not retained by Focal Shift beyond the active session; only the resulting text transcriptions are kept in the conversation history.

When the user enables conversational memory from their account area, Focal Shift may also:

produce and store a synthetic memory (longitudinal portrait) derived from completed conversations, in order to provide continuity between exchanges;
store internal state summaries per conversation, used to build this synthetic memory;
record the user's memory preferences (activation, scope per support type or across chatbots, inclusion or exclusion of prior history).

The synthetic memory is stored in encrypted form on our servers. The user may view, disable or delete it at any time from their account area (Conversational memory section). It is a synthesis: it does not reproduce the full verbatim content of each exchange.

For the AI Advisor to operate, elements of this memory may be transmitted to the technical processor (OpenAI) together with the messages of the ongoing conversation, to the extent necessary to generate responses. The synthetic memory may also be generated or checked through dedicated processing calls to this processor, without retention of data beyond the call. Automated quality checks may apply to the synthetic memory, in the same framework as conversation quality analysis.

If the user chooses to include previous conversations, conversations predating activation may be used to build or update the synthetic memory.

d) Data related to appointment booking

When a visitor submits an appointment request through the website, the following data is collected:

Name
Email address
Phone number (if provided or required depending on the chosen contact mode)
Free-text message (if provided)
Chosen contact mode (video call or phone call)
Appointment type and selected time slot

Technical data is also generated as part of processing the request: confirmation, management and cancellation tokens, request status, and, for video call appointments, a meeting link and event identifier hosted by Google (Calendar and Meet). If the appointment is cancelled by the publisher, a cancellation reason may be associated with the request.

Transactional emails are sent as part of the process: confirmation request (double opt-in), appointment confirmation with a calendar file (ICS), a reminder 24 hours before the appointment, and, where applicable, a cancellation notification.

Booking an appointment does not require a user account on the website.

e) Data related to the "Enrich your support" questionnaire

When a user fills in the questionnaire offered as part of the support process, the following data is collected:

Responses to the questionnaire (which may include information relating to the user's personal situation, experiences or feelings)
Explicit consent from the user (checkbox)

This data is transmitted securely to the Focal Shift internal processing engine, which relies on the technical processor (OpenAI) to generate a personalised perspective report. Questionnaire data is processed solely for this purpose.

f) Payment data

Payments for credits, gift cards and services are processed by Stripe.
No banking data, such as card numbers or security codes, is stored on the website or on its servers.

g) User account data

Email address, password (hashed)
Login sessions (session cookie)
Email verification token, password reset token
Two-factor authentication data (TOTP secret, where applicable)
Language preference (for registered accounts)

h) Technical and security data

Technical data, including IP addresses, may be collected temporarily for the following purposes:

security
abuse prevention
website protection

Attempts to manipulate, circumvent or misuse the AI Advisor or the welcome chatbot are automatically detected. When detected, the following data is logged: user identifier, triggering message, event type and date. This data is retained indefinitely for traceability and service protection purposes. This processing is based on the legitimate interest of the publisher (GDPR, Article 6(1)(f)).

Article page views are counted in aggregate to help improve our content. This counting does not rely on any cookie, personal identifier, or IP address.

i) Article search

The Articles page offers a free-text search field. The text entered is sent to our servers, then to the technical processor (OpenAI) for the sole purpose of computing a numerical representation (vector) used to rank articles by closeness of meaning. No answer is generated from this text.

The text entered is neither stored nor logged. Only an irreversible fingerprint (hash) of the search is kept, together with its numerical representation, so that an identical search is not recomputed. This fingerprint cannot be used to recover the original text.

This feature relies on no cookie and no personal identifier. The IP address is used only for the anti-abuse rate limiting described in point h). Legal basis: legitimate interest of the publisher (GDPR, Article 6(1)(f)) — providing relevant access to editorial content.

3. Purposes and Legal Bases

Data is used for the following purposes:

Providing the services offered (the AI Advisor in text and voice mode, support, credits) — legal basis: performance of the contract
Managing appointment requests (processing, confirmation, reminder, cancellation) — legal basis: performance of the user's request (pre-contractual measures)
Generating perspective reports from the questionnaire — legal basis: explicit consent of the user
Guiding visitors through the welcome chatbot and improving the service based on retained conversations — legal basis: legitimate interest (facilitating access to services and continuous improvement)
Responding to requests sent through the contact form — legal basis: legitimate interest (management of enquiries)
Managing user accounts and authentication — legal basis: performance of the contract
Optional conversational memory for the AI Advisor (synthesis, continuity between conversations, related preferences and controls) — legal basis: explicit consent of the user when enabling or changing memory settings
Processing payments and billing — legal basis: performance of the contract and legal obligations
Security, abuse prevention and website protection — legal basis: legitimate interest
Compliance with legal obligations — legal basis: legal obligation

No data is used for advertising purposes or sold to third parties.

4. Retention Period

AI Advisor conversations

Exchanges made through the AI Advisor are retained in order to allow the user to access their conversation history and to ensure continuity of service.

Active conversations are retained for as long as they are used by the user.
The user may delete a conversation at any time. This deletion is final and the conversation can no longer be recovered.
An inactive conversation is automatically deleted after 365 days.
Deleted data is retained on our servers for a maximum period of 180 days for legal compliance purposes, then permanently erased.
Conversational data is transmitted to the processor (OpenAI) with the non-retention option enabled: no data is stored by the processor beyond the immediate processing of each exchange.

This data is used only for the operation of the service and is never used for commercial or advertising purposes.

Welcome chatbot conversations

Conversations are stored in encrypted form for a maximum period of 12 months, then automatically deleted.
Situation summaries generated for pre-filling the booking form are encrypted, expire after 24 hours and are automatically deleted.

Conversational memory

The synthetic memory and related preferences are retained for as long as the user account is active and the user has not chosen to delete it.
The user may disable memory without deleting it, or delete stored memory from their account area. Deletion is final for the affected synthetic memory.
Deleting a conversation may lead to updating or deleting the synthetic memory if that conversation contributed to it.
If the account is deleted, conversational memory is removed under the same conditions as other account data, subject to applicable legal retention periods.
Deleted data may be retained on our servers for a maximum period of 180 days for legal compliance purposes, then permanently erased.

Appointment data

Appointment requests (whether confirmed, cancelled or expired) are retained for 24 months from the date of the appointment or the cancellation.
Technical tokens (confirmation, management, cancellation) are invalidated after use or expiry and are not reused.
Visitors without a user account may request the deletion of their appointment data by writing to contact@focalshift.eu.

Questionnaire data

Questionnaire responses and the generated report are retained for as long as the user account is active.
If the account is deleted, this data is removed under the same conditions as other account data.

Data from the contact form

Messages sent through the contact form are stored in a secure database to ensure proper follow-up and traceability of requests.

Data collected: name, email address, subject, phone number (if provided), message
No IP address is stored
Archived messages are deleted after 24 months
You may request the deletion of your messages at any time by writing to contact@focalshift.eu

User account data

Account data is retained for as long as the account is active.
Session cookies expire after 30 days or upon logout.
Email verification and password reset tokens expire after a limited period.
If the user deletes their account, associated data is removed in accordance with the conditions described in the Terms of Use and Terms of Sale, subject to applicable legal retention periods.

Security data, including logs and IP addresses

Retained for a maximum period of 90 days

Billing data

Retained in accordance with applicable legal obligations

5. Processors and Recipients

Personal data may be shared with the following processors, strictly for the purposes described above:

Infomaniak (Switzerland) — website and data hosting, sending of transactional emails (appointment confirmation, account verification, password reset, reminders). Technical email delivery logs (recipient address, timestamp, delivery status) are processed by Infomaniak as a processor, under its Data Processing Agreement (DPA), in accordance with its retention policy.
OpenAI (United States) — processing of exchanges in the AI Advisor (text and audio), generation of perspective reports, synthesis and quality checks of conversational memory when enabled, computation of the vector representations used by the article search. Data is transmitted securely in accordance with a Data Processing Addendum (DPA). Data is processed with the non-retention option enabled: it is neither stored nor used to train its models.
Stripe (United States) — payment processing. No banking data is stored by Focal Shift.
Google (United States) — creation of calendar events and video conferencing links (Google Calendar and Google Meet) for managing video call appointments. A calendar invitation email may be sent to the visitor by Google.
Cloudflare (United States) — anti-spam verification service (Cloudflare Turnstile) used on forms across the website (contact, appointment booking, registration, login, password reset) and on the welcome chatbot. This service may collect technical data (IP address, browser fingerprint, interaction data) in order to distinguish human users from bots.

No data is sold, rented or shared with third parties for commercial or advertising purposes.

6. Users' Rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

Right of access to your personal data
Right to rectification
Right to erasure
Right to restriction of processing
Right to object
Right to data portability

You may exercise these rights by writing to:
contact@focalshift.eu

For conversational memory, you may in particular view the synthetic memory, change your preferences, disable it or delete it from your account area (Conversational memory section), without prejudice to your other rights.

If you booked an appointment without having a user account on the website, you may exercise your rights (access, rectification, erasure) by sending your request to contact@focalshift.eu, indicating the email address used when booking the appointment.

If you experience any difficulty in exercising your rights, you also have the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr.

7. Cookies and Trackers

The website uses only:

Technical cookies necessary for its operation (session cookie for authentication of logged-in users)
A language preference cookie (site_locale) to remember the language chosen by the visitor. For logged-in users, this preference is also stored in the account profile.

No audience measurement or advertising cookies are used.

The welcome chatbot uses temporary browser storage (sessionStorage) to maintain the ongoing conversation. This storage is cleared when the browser tab is closed and does not constitute a cookie.

The anti-spam service Cloudflare Turnstile, used on certain forms on the website, may collect technical data (see section 5) but does not set any advertising or tracking cookies.

8. Hosting and Security

Data is hosted on servers located in Europe, in particular by Infomaniak (Switzerland). Processors located in the United States (OpenAI, Stripe, Google, Cloudflare) process data in accordance with appropriate safeguards and their respective data processing agreements.

Appropriate technical and organizational measures are implemented to ensure data security:

restricted access
encryption
security and monitoring tools

9. Service Limitations

The services offered on Focal Shift do not constitute a medical act, therapy, or legal or financial advice.
No automated decision-making producing legal effects is carried out on the basis of the data processed.

10. Changes to This Policy

This Privacy Policy may be amended at any time in order to remain compliant with legal or technical developments.
The version in force is the one published on the website.

Last updated: 15 September 2026