Effective Date: January 1, 2026 Last Updated: January 1, 2026

1. Who We Are

reFOCUS Marketing LLC is a Pennsylvania limited liability company operating as a digital marketing agency. In this policy, "reFOCUS," "we," "us," and "our" refer to reFOCUS Marketing LLC. "You" refers to any person who visits our website, contacts us, submits a form, books a call, subscribes to our communications, or otherwise interacts with us.

We operate exclusively online and do not maintain a public walk-in location. All privacy requests and questions should be sent to [email protected].

2. What This Policy Covers

This policy explains how we handle personal information when we act as the business responsible for that information. That includes:

• Visitors to refocusmarketing.com and any subdomain or landing page we operate

• People who fill out our forms, book appointments, subscribe to our email or text messages, or respond to our advertising

• People who engage with our pages, ads, and lead forms on third-party platforms such as Meta, Google, LinkedIn, and YouTube

• Prospective clients we contact through business outreach

• Our clients and their authorized team members

This policy does not govern personal information we handle on behalf of a client as part of a service engagement. When we build a funnel, run advertising, manage a CRM, or handle marketing operations for a client, that client determines the purpose and means of processing and we act as their service provider or processor under a written agreement. In those cases the client's own privacy policy governs. Section 14 explains this in more detail.

This policy also does not apply to third-party websites, platforms, or tools we link to. Their privacy practices are their own.

3. Information We Collect

3.1 Information you provide directly

• Contact and identity information. Name, email address, phone number, business name, job title, and website URL.

• Business and marketing information. Details you share about your company, revenue range, current marketing activity, goals, budget, service history, and similar responses to our forms, quizzes, assessments, diagnostics, and questionnaires.

• Scheduling information. Date, time, and time zone of appointments you book, along with any notes or answers you provide during booking.

• Communications. The content of emails, text messages, chat messages, form submissions, voicemails, and support requests you send us, along with our replies.

• Recordings and transcripts. If you join a video or phone call with us and we record it, we collect the recording and any transcript or summary generated from it. We tell you before we record and you can decline.

• Client account and billing information. For clients, we collect billing contacts, service details, and payment records. Payment card details are collected and stored by our payment processors, not by us.

• Job applications. If you apply to work with us, we collect your resume, work history, and anything else you submit.

3.2 Information collected automatically

When you visit our website or open our emails, we and our service providers automatically collect:

• IP address and approximate location derived from it, meaning city and region rather than precise coordinates

• Browser type, device type, operating system, screen size, and language settings

• Pages viewed, time on page, scroll depth, clicks, referring URL, exit pages, and navigation paths

• The search terms, ad, campaign, or link that brought you to us, including UTM parameters and platform click identifiers such as Meta's fbclid and Google's gclid

• Email open and click activity, where your email client permits it

• Cookie identifiers, device identifiers, and similar tracking identifiers

We do not collect precise geolocation from your device.

3.3 Information from third parties

• Advertising and analytics platforms. Meta, Google, and similar platforms give us aggregated performance data and, in the case of lead forms, the contact details a person submits on the platform itself.

• Business contact data providers. We obtain business contact information such as name, business email, job title, company, and company size from commercial data providers and public professional sources in order to identify and contact potential business clients. Section 8 explains your options regarding this outreach.

• Referrals and partners. If someone refers you to us, we may receive your name and contact details from them.

• Publicly available sources. Company websites, public business registries, and public social media profiles.

3.4 Sensitive information

We do not seek out or intentionally collect sensitive personal information such as Social Security numbers, government ID numbers, precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric data, sexual orientation, or the contents of your private communications with others. Please do not send us this kind of information. If you do, we will delete it once we identify it.

4. Cookies, Pixels, and Similar Technologies

We and our partners use cookies, pixels, tags, SDKs, local storage, and server-side tracking to run our website, understand how it is used, and measure and target advertising.

4.1 Categories we use

• Strictly necessary. Required for the site, forms, and booking tools to function. These cannot be turned off through our site.

• Analytics and performance. Help us understand traffic, page performance, and which content works.

• Advertising and targeting. Let us measure ad performance, build audiences, and show you our ads on other platforms after you visit us.

• Functional. Remember your preferences and prefill information you have already given us.

4.2 Specific advertising and analytics technologies

• Meta Pixel and Meta Conversions API. We use Meta's business tools to measure ad results, build custom and lookalike audiences, and show you ads on Facebook, Instagram, and Meta's partner network. This includes sending Meta certain event data from our website and CRM, such as page views, form submissions, and appointments booked. Where we send data through the Conversions API, contact identifiers such as email address or phone number are hashed before transmission. Meta processes this data under its own terms and privacy policy and acts as an independent controller for some of it.

• Google Analytics 4. We use Google Analytics to understand site traffic and behavior, including Google Signals and demographic and interest reporting where available.

• Google Ads, Google Tag Manager, and remarketing. We use Google's advertising products to run search, display, YouTube, and Performance Max campaigns, to measure conversions, and to show ads to people who have visited our site. This may include enhanced conversions, which send hashed contact identifiers to Google for conversion matching.

• GoHighLevel. Our CRM, form, chat, calendar, email, and SMS infrastructure runs on GoHighLevel, which sets cookies and records interactions with our forms, funnels, and booking pages.

• Hosting and site platform. Our website is hosted on Framer, which processes standard server and request data in order to deliver the site.

4.3 Managing cookies and tracking

You can control cookies through your browser settings, including blocking or deleting them. Blocking strictly necessary cookies will break parts of the site.

You can also opt out at the source:

• Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

• Google Ads personalization settings: https://myadcenter.google.com

• Meta ad settings and off-Facebook activity controls: https://accounts.meta.com/adpreferences

• Network Advertising Initiative opt-out: https://optout.networkadvertising.org

• Digital Advertising Alliance opt-out: https://optout.aboutads.info

• Your Online Choices, for users in Europe: https://www.youronlinechoices.eu

Opting out stops personalized advertising. It does not stop you from seeing ads.

4.4 Global Privacy Control

We honor the Global Privacy Control signal. If your browser or extension sends a GPC signal when you visit our site, we treat it as a request to opt out of the sharing of your personal information for cross-context behavioral advertising for that browser. Because the signal is tied to a browser rather than a person, it will not cover other devices or browsers you use, and it will not by itself opt you out of email or text messages you have separately subscribed to.

We do not currently respond to browser "Do Not Track" signals, which have no agreed standard.

5. How We Use Information

We use personal information to:

• Respond to your inquiries and provide the information or quote you asked for

• Schedule, hold, and follow up on consultations, calls, and appointments

• Deliver, support, and improve our services to clients

• Send marketing emails, newsletters, and text messages to people who have opted in

• Run, measure, optimize, and attribute our advertising campaigns

• Build audiences for advertising, including custom and lookalike audiences, subject to the opt-out rights in Section 11

• Contact businesses that fit our client profile about our services

• Operate, secure, monitor, and improve our website and systems

• Detect and prevent fraud, abuse, spam, and security incidents

• Handle billing, accounting, and contract administration

• Evaluate job applicants

• Meet legal, tax, and regulatory obligations, and establish or defend legal claims

We do not use your personal information to make decisions that produce legal or similarly significant effects about you without human involvement.

6. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are:

• Consent, for marketing emails and texts, non-essential cookies, and advertising technologies. You can withdraw consent at any time.

• Performance of a contract, to deliver services you or your company have engaged us for and to handle billing.

• Legitimate interests, to operate and secure our website, understand how it is used, contact businesses about relevant services, prevent fraud, and improve our offerings. We balance these interests against your rights and you may object at any time.

• Legal obligation, to meet tax, accounting, and other legal requirements.

7. Text Messages and Phone Calls

If you provide your mobile number and opt in, we may send you text messages about appointments, service updates, and marketing.

No mobile information will be sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party for marketing purposes. Information may be shared only with subcontractors that directly support our messaging operations, such as our CRM and messaging platform, and those parties are prohibited from using it for any other purpose.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out and HELP for assistance. Consent to receive marketing texts is not a condition of purchasing anything from us.

If we record a call, we tell you at the start of the call and you may decline to be recorded.

8. Email and Business Outreach

We send marketing email only to people who have opted in or who are business contacts we have identified as a potential fit for our services. Every marketing email includes an unsubscribe link and our postal address as required by law. Unsubscribing stops marketing email. We may still send you transactional messages related to an active engagement, such as invoices or appointment confirmations.

If we contacted you as a business prospect and you would rather we did not, use the unsubscribe link or email [email protected] and we will remove you from outreach and suppress your details so you are not contacted again.

9. Artificial Intelligence and Automated Tools

We use AI and automated systems in our internal operations, including drafting and editing marketing content, summarizing calls and meetings, organizing and researching information, and running internal workflows. Where those systems touch personal information, the following applies:

• We use commercial AI providers under business or enterprise terms that prohibit the use of our data to train their general-purpose models. We do not consent to our data or our clients' data being used for model training.

• We do not sell personal information to AI developers and we do not license personal information for AI training purposes.

• We do not use AI to make final decisions about hiring, pricing, credit, or anything else that would significantly affect you without a human reviewing the outcome.

• Any AI-assisted chat or assistant on our website is a tool for answering questions and routing inquiries. Conversations may be stored and reviewed by our team. Do not enter sensitive information into it.

AI crawlers and content. Our website is publicly accessible and may be crawled, indexed, summarized, or cited by search engines, AI assistants, large language models, and similar systems that we do not control. We publish our site so that it can be found, including by these systems. We cannot control how a third-party AI system stores, reproduces, or characterizes content it retrieves from our site, and information you make public elsewhere may reach those systems independently of us. Anything you submit through a private form or a direct message to us is not published and is not made available to those systems by us.

10. How We Share Information

We share personal information in the following circumstances:

• Service providers. Companies that operate our systems on our behalf, including CRM and marketing automation, website hosting, email and SMS delivery, scheduling, analytics, cloud storage and infrastructure, AI and productivity tools, project management, payment processing, and accounting. They may use the information only to provide services to us.

• Advertising and analytics platforms. Meta, Google, and similar platforms, as described in Section 4. When we upload customer lists to build audiences, contact identifiers are hashed before upload.

• Our team and contractors. Employees and contractors who need the information to do their jobs, bound by confidentiality obligations.

• Clients. If you responded to an advertisement or campaign we run on behalf of a client, your information goes to that client, who becomes responsible for it under their own privacy policy.

• Professional advisors. Attorneys, accountants, and insurers, when needed.

• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may transfer as part of that transaction. We will require the recipient to honor this policy or give you notice of any material change.

• Legal and safety. When we believe disclosure is required by law, subpoena, or legal process, or is necessary to protect our rights, safety, property, or the rights and safety of others, or to investigate fraud or a security incident.

We do not otherwise disclose your personal information to third parties for their own independent marketing.

11. Sale and Sharing of Personal Information

We do not sell personal information for money.

However, under California law and several other state privacy laws, the terms "sale" and "sharing" are defined broadly. Our use of advertising cookies, pixels, and audience tools with Meta, Google, and similar platforms may qualify as "sharing" personal information for cross-context behavioral advertising, and in some readings as a "sale." We disclose it here on that basis rather than argue the point.

The categories of personal information that may be shared this way are identifiers, internet and other electronic network activity, approximate geolocation derived from IP address, commercial information, and inferences. The categories of recipients are advertising and analytics platforms.

To opt out, do any of the following:

• Send a Global Privacy Control signal from your browser, which we honor automatically

• Email [email protected] with the subject line "Do Not Sell or Share My Personal Information"

• Decline advertising cookies in our cookie controls where offered

• Use the platform-level opt-outs listed in Section 4.3

We do not knowingly sell or share the personal information of anyone under 16 years of age.

12. Data Retention

We keep personal information only as long as we need it for the purposes described in this policy, and then delete or anonymize it. In practice:

• Prospect and lead records: up to 3 years from the last meaningful interaction, unless you ask us to delete them sooner

• Client records: for the length of the engagement plus 7 years, to meet contract, tax, and accounting requirements

• Email and SMS subscriber records: until you unsubscribe, plus a permanent suppression entry containing only what is needed to keep you unsubscribed

• Website analytics and advertising data: typically 14 months at the platform level, subject to each platform's own retention settings

• Call recordings and transcripts: up to 12 months, unless tied to an active engagement

• Job applications: up to 12 months from the date of application

We may keep information longer where a legal hold, dispute, or regulatory obligation requires it.

13. Security

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit, access controls, multi-factor authentication on business-critical systems, limiting access to people who need it, and vetting the vendors we use.

No system is perfectly secure. We cannot guarantee the security of information transmitted over the internet, and you send it to us at your own risk. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

14. Information We Handle for Our Clients

When we provide services to a client, we often handle personal information belonging to that client's customers, leads, and contacts. In those situations:

• The client is the controller or business, and we are the processor or service provider

• We process that information only on the client's documented instructions and only to provide the agreed services

• We do not sell it, share it for our own cross-context behavioral advertising, use it to build our own marketing lists, or use it for any purpose outside the engagement

• We hold it under written agreements that include confidentiality and data protection terms, and we require the same of our subprocessors

• On termination, we return or delete it in line with the client agreement

If you are a customer or lead of one of our clients and you want to exercise privacy rights over your information, contact that business directly. If you contact us instead, we will forward your request to the client and support them in responding.

15. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights:

• Know and access. Ask what personal information we hold about you, where we got it, why we process it, and who we disclose it to, and request a copy.

• Delete. Ask us to delete personal information we hold about you.

• Correct. Ask us to fix inaccurate personal information.

• Portability. Receive your information in a portable, machine-readable format.

• Opt out of sale or sharing. See Section 11.

• Opt out of targeted advertising and profiling. See Sections 4.3 and 11.

• Limit use of sensitive personal information. We do not collect sensitive personal information for the purposes that would trigger this right, but you may still ask.

• Withdraw consent. For anything based on consent, including marketing email and texts.

• Object or restrict. For processing based on legitimate interests, if you are in the EEA or UK.

• Non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

• Appeal. If we deny your request, you may appeal by replying to our decision. We will respond to appeals within the time your state law allows, and will tell you how to contact your attorney general if you remain unsatisfied.

15.1 How to make a request

Email [email protected] and tell us what you want. Because we operate exclusively online and deal with you directly, email is our designated request method.

We will verify your identity before acting, usually by confirming that you control the email address or phone number in our records, and sometimes by asking for additional details that match what we already hold. We use verification information only for verification and then delete it.

We respond to most requests within 45 days and will tell you if we need an extension. Requests under European law are handled within one month. An authorized agent may submit a request on your behalf with written permission, and we may still ask you to confirm it directly.

15.2 California residents

California residents have the rights above under the CCPA as amended by the CPRA. Section 3 lists the categories of personal information we collect, Section 5 the purposes, Section 10 the categories of recipients, Section 11 our sale and sharing disclosures, and Section 12 our retention periods. We have collected each listed category within the preceding 12 months. We do not use or disclose sensitive personal information beyond the purposes permitted without a right to limit. California residents may also request information under the "Shine the Light" law by emailing us with that request.

15.3 Other US state residents

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws have rights along the same lines, which vary somewhat by state. Use the same email address and we will apply whatever your state provides. Pennsylvania has no comprehensive consumer privacy statute as of the effective date of this policy, and we extend the rights described above to Pennsylvania residents as a matter of practice.

Nevada residents may submit a request that we not sell covered information to the same address.

15.4 Data deletion instructions

To have your personal information deleted, email [email protected] with the subject line "Data Deletion Request" and include the email address, phone number, or account details you used with us. We will verify your identity, delete the information we hold about you, and instruct our service providers to do the same, then confirm to you in writing when it is done.

If you interacted with us through Facebook or Instagram, tell us which account you used so we can locate and delete the associated data, including any advertising audience entries tied to your contact details.

We may keep a minimal record of your deletion request and a suppression entry so that we can honor your request going forward, and we may retain information we are legally required to keep, such as transaction records. We will tell you if that applies to you.

15.5 EEA, UK, and Swiss residents

In addition to the rights above, you may lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office. We are based in the United States and do not target the European market, but we honor these rights for anyone who contacts us from those regions.

16. International Data Transfers

We are based in the United States and our service providers are primarily located there. If you access our site or contact us from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country. Where required, our providers rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum for these transfers. By using our site or contacting us, you understand that your information will be handled in the United States.

17. Children's Privacy

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18, and we do not direct our services or advertising to children. If you believe a child has given us personal information, email [email protected] and we will delete it.

18. Third-Party Websites and Platforms

Our site, ads, emails, and content link to websites and platforms we do not control, including Meta, Google, YouTube, LinkedIn, and client websites. Once you leave our site, this policy no longer applies. Read the privacy policy of whatever site you land on. We are not responsible for the practices of those sites.

19. Changes to This Policy

We may update this policy as our practices, tools, or the law change. When we do, we will change the "Last Updated" date at the top. If the change is material, such as a new category of data collection or a new purpose, we will give you notice by email or a prominent notice on our website before it takes effect. Continuing to use our site or services after an update means you accept the revised policy.

20. Contact Us

Questions, requests, and complaints about privacy go to:

reFOCUS Marketing LLC Email: [email protected]

We will respond within a reasonable time and in all cases within the deadlines set by applicable law. If you would like our mailing address for a formal legal notice, ask and we will provide it.

21. Governing Law

This policy is governed by the laws of the Commonwealth of Pennsylvania, without regard to its conflict of laws principles, except where a privacy law of another jurisdiction applies to you and grants you greater rights, in which case that law applies to the extent of its scope.