Privacy Policy

Scope and contact

This policy covers FigEditor at https://figeditor.com. Contact support@figeditor.com for privacy questions or requests. This notice describes our service's data handling; it is not a request for additional Google permissions.

What we process

• Account: your Google identifier, email, display name and profile image, together with FigEditor sessions and account settings. We do not receive your Google password. Signing in does not grant us access to your Gmail messages or Google Drive files.
• Creative work: prompts, uploaded files, generated images, edits and project records needed for the features you use. Some editing state and preferences are also kept in your browser.
• Billing: customer and subscription identifiers, purchase amounts, currency, status and credit transactions. Stripe handles card entry; we do not receive or store your full card number or CVC.
• Support and operation: messages you send us, along with technical request information such as IP addresses, browser details and error logs needed to operate and protect the service.

Why we use it

We use these records to sign you in, save and process your work, deliver purchases, maintain credit balances, answer support requests, diagnose failures, prevent fraud and meet legal obligations. Depending on applicable law, the basis is fulfilling our agreement with you, legitimate interests in operating a secure service, legal obligations, or consent where required. You may withdraw consent for optional processing without affecting earlier lawful processing.

Providers and AI processing

Google provides sign-in, Cloudflare supplies hosting and storage infrastructure, and Stripe processes payments. When you request AI generation or editing, the necessary prompts and files are transmitted to the model service or API gateway configured for that feature. These providers may process data outside your country and under their own contractual retention and processing terms. A model name in the interface does not establish the identity or data policy of every intermediary.

Do not upload patient identifiers, sensitive personal information or confidential research unless you have authority to share it through those services. We do not promise that every external provider has a zero-retention or no-training policy. We use your work to deliver the requested service; we do not sell it to advertisers. We may also disclose records when legally required or necessary to investigate abuse. Any international transfer must use safeguards required by the law that applies to it.

Browser storage and retention

Session cookies enable login. Cookies and local storage also remember language, preferences and editing state. Clearing them may sign you out or remove locally saved work. Additional nonessential tracking, if introduced, must be disclosed and obtain consent where required.

Saved account and project records remain while needed to provide the service. You can delete supported projects and request account deletion. Billing, fraud-prevention and legally required records may need to remain longer; backups and external processors may not be erased immediately. We do not claim a fixed deletion deadline that our systems cannot verify.

Your choices and security

Contact us from your account email to request access, correction, export, deletion or other privacy rights available where you live. We may verify identity before acting. You can also revoke Google authorization in your Google account; this alone does not cancel a paid subscription. Cancel the subscription in Billing separately.

We use access controls and encrypted web connections, but cannot guarantee absolute security. We handle reportable incidents as required by law. You may complain to your local data protection authority. The service is not directed at children; contact us if a child has supplied personal data without appropriate authorization.

Updates

We update the date above when this policy changes and provide appropriate notice of material changes.