Privacy Policy

Figura is a product operated by Pano (the "Company," "we," "us," or "our") and available at figura.so. This Privacy Policy explains how the Company collects, uses, discloses, and protects personal data when you use Figura.

This policy applies to the personal data we process when you use the Figura web application and Studio, the /fig skill, the command-line interface (CLI), and the Model Context Protocol (MCP) server. It governs the personal data of account holders, members of teams and workspaces, and visitors to our website.

To make this policy easier to follow, some key terms are used throughout:

• Figs — self-contained, device- or browser-framed HTML mockups generated by Figura from your design system.
• Brand profiles & design tokens — the inputs you upload that describe your visual system (palette, typography, components) and are used to generate on-brand figs.
• Teams / workspaces — the way accounts are organized so that members can collaborate on shared resources.
• Seats / editors — the licensed members within a workspace who can create and edit figs.
• Credit pool — the monthly allowance that meters in-app web Studio generations.

Capitalized terms that are not defined in this policy have the meaning given to them in our Terms of Service.

Depending on the type of data and the context in which we process it, Pano acts either as a data controller or as a data processor.

For account, identity, billing, and usage data — the information we need to operate your account, charge for the Service, and run our business — Pano acts as a data controller and determines the purposes and means of that processing.

For customer-uploaded content — including brand profiles, design tokens, generated figs, and comments — Pano typically acts as a data processor on behalf of the customer's team or workspace. In that case, the business customer (the workspace owner or administrator) is the controller for that content and is responsible for the lawfulness of what its members upload and generate, including ensuring it has any notices or permissions required to do so.

Our processing of customer content is governed by the customer's instructions and by any applicable data-processing agreement (DPA) between Pano and the customer. Where a DPA is in place, it supplements this policy with respect to that content.

We collect the following categories of data, each for the purposes described:

• Account identity — your name and email address, and a securely hashed password if you choose password sign-in — to authenticate you and operate your account. You can sign in with an email and password or with a passwordless magic link sent to your email.
• Connected design sources — if you choose to connect a repository through the GitHub App, we receive your GitHub handle and the contents of the repositories you grant access to, in order to ground figs in your real design system. GitHub is optional and is not required to sign in.
• Team & workspace data — to enable collaboration, manage seats, and provide access to shared resources.
• Uploaded brand profiles & design tokens — to generate on-brand figs that reflect your visual system.
• Generated figs (HTML), versions, and comments — the product output and the collaboration history attached to it.
• API tokens (which carry the fig_ prefix) — to authorize programmatic access via the CLI and MCP.
• Usage & billing metadata — for metering, the Studio credit pool, invoicing, and determining your plan entitlements.
• Optional custom domains — to publish figs at domains you choose.
• Web-push subscriptions — to deliver browser notifications, where you have opted in.

Payments are handled by Stripe, our payment processor. Card and payment-instrument data is submitted directly to Stripe and never touches Figura servers.

Figura offers two paths for generating figs, and personal data flows differently in each. We want to be explicit about that difference.

Path 1 — the /fig skill, CLI, and MCP. In these paths, Claude runs inside your own Claude subscription. The prompts and inputs are processed under your relationship with Anthropic, not ours. Figura only persists the resulting fig; we do not send those prompts or inputs to our own LLM provider.

Path 2 — the in-app web Studio. The Studio runs on Figura's own Anthropic / Claude API key. This means the prompts and inputs you submit in the Studio — including the relevant brand profiles and design tokens — are processed by Anthropic in order to generate figs on our behalf.

Anthropic does not use API inputs or outputs to train its models by default. Studio generation is metered via the monthly credit pool and is subject to Anthropic's usage policies.

Accordingly, Anthropic is a subprocessor only for the Studio path. See the Subprocessors section for details.

Where the EU or UK General Data Protection Regulation applies, we rely on the following lawful bases:

• Performance of a contract — to provide the Service, manage your account, process billing, and generate and store figs.
• Legitimate interests — for security, fraud prevention, product analytics, service improvement, and notifications. We balance these interests against your rights and freedoms, and we will not rely on this basis where those rights override our interests.
• Consent — for non-essential cookies and analytics and for web-push notifications. You may withdraw your consent at any time, without affecting processing carried out before withdrawal.
• Legal obligation — to meet our tax and accounting duties and to respond to lawful requests.

Processing of customer content is generally performed under the customer's instructions and any applicable DPA, with the customer acting as controller, as described in the Controller vs. Processor section.

We share data with a limited set of vetted subprocessors, each engaged under appropriate data-processing terms. We currently use the following:

• Anthropic (Claude) — LLM generation for the Studio path, using Figura's API key. It processes submitted prompts, brand profiles, and design tokens, and does not train on API inputs or outputs by default.
• Neon — managed PostgreSQL database holding account, team and workspace, billing and usage metadata, fig version records, comments, and API token references.
• Vercel — hosting of the Figura web application at figura.so.
• Amazon Web Services (S3) — private object storage for generated fig assets (HTML) and their versions.
• Stripe — subscription billing and payment processing for the Starter, Team, and Studio plans. Card data never touches Figura servers.
• Resend — transactional email delivery: sign-in magic links and product notification emails are sent through Resend, which processes the recipient's email address.
• GitHub — when you connect a repository as a design source through the GitHub App, we access your GitHub handle and the repositories you authorize. This is optional and is not used for sign-in.

For transparency: web-push notifications are delivered first-party via VAPID, not through a third-party push subprocessor.

We maintain a current list of subprocessors and, where material changes occur (such as adding a new subprocessor that processes personal data), we will update this policy and, where required, notify affected account holders so that they have an opportunity to object.

We retain personal data and content for as long as your account or workspace is active and as needed to provide the Service. When an account or workspace is closed, we delete or anonymize the associated personal data, subject to any legal, tax, or accounting retention requirements (for example, billing records that we are obliged to keep).

This deletion covers figs and their versions, brand profiles, comments, API tokens, and web-push subscriptions. Residual copies of data held in backups are purged on a rolling cycle in the ordinary course of backup rotation.

Our standard retention windows are:

• Account & profile data — kept for the life of your account and deleted or anonymized within 30 days of account or workspace closure.
• Figs, versions, brand profiles & comments — deleted within 30 days of account or workspace closure.
• Backups — purged on a rolling basis within 90 days.
• Billing & tax records — retained for up to 7 years to meet legal and accounting obligations.
• Web-push subscriptions — kept until you revoke them or disable notifications.
• Sign-in magic-link tokens — expire within minutes of being issued.

We apply technical and organizational measures designed to protect personal data, including:

• Encryption — data is encrypted in transit and at rest.
• Private storage — fig assets are held in a private S3 store, not publicly listable.
• Scoped API tokens — tokens (carrying the fig_ prefix) are scoped to your team and revocable at any time.
• Authentication — sign-in uses an email and a securely hashed password, or a single-use magic link sent to your email.
• Access controls — access is scoped to teams, workspaces, and seats.
• Vetted subprocessors — we rely on the SOC 2-type security postures of our subprocessors.

No method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

If you believe you have found a security vulnerability, please contact us at support@figura.so.

Our subprocessors — including Anthropic, Amazon Web Services, Vercel, Neon, Stripe, Resend, and GitHub — may process personal data in countries other than your own, including in the United States.

Where such transfers occur and a legal mechanism is required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, to protect your data.

EU and UK users who would like details of the transfer mechanisms we rely on can contact us at support@figura.so.

Depending on where you live, you may have rights over your personal data.

Under the GDPR / UK GDPR, you have the rights of access, rectification, erasure, data portability, restriction of processing, objection to processing, and withdrawal of consent.

Under the CCPA / CPRA, you have the rights to know what personal information we collect, to delete it, to correct it, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and to be free from discrimination for exercising your rights.

We do not sell personal information.

To exercise any of these rights, contact us at support@figura.so. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law. You also have the right to appeal a decision we make about your request and to lodge a complaint with your supervisory authority.

If you are a member of a workspace, some requests may need to be routed through your workspace administrator, who is the controller for content generated within that workspace.

We use strictly necessary cookies to authenticate you and maintain your session. These cookies are required for the Service to function and cannot be switched off through our consent mechanism.

We also use analytics to understand how the product is used so we can improve it. Where enabled, this may include PostHog; we will confirm and name any live analytics processor before relying on it, and it is not listed as a subprocessor above until then.

Non-essential cookies require your consent where the law requires it. EU and UK visitors can manage their preferences through our cookie banner and consent mechanism, and can change their choices at any time.

Web-push notifications are opt-in and are enabled through your browser.

Figura is a business-to-business product. It is not directed to children and is intended for users aged 16 or older (or 18 or older where required by the applicable jurisdiction).

We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@figura.so and we will take steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the Effective date shown at the top of this page.

If we make material changes, we will communicate them through an in-app notice or by email to account holders, as appropriate.

We encourage you to review this policy periodically so that you stay informed about how we handle your data.

You can reach us at the following addresses:

• Privacy — support@figura.so
• Legal / terms — support@figura.so
• General support — support@figura.so

The Service is operated by Pano. Our full registered company details and registered office address are available on request — email support@figura.so.

This Privacy Policy is governed by the laws of the State of Delaware, United States, without regard to its conflict-of-laws rules, except where mandatory local data-protection law (such as the GDPR or UK GDPR) grants you rights under the law of your place of residence.

EU and UK users have the right to lodge a complaint with their local data protection supervisory authority.

Reminder: this document is a template and must be reviewed by qualified legal counsel before launch.