Privacy Policy
Last updated: October 20, 2026
Who is responsible for your information
Figalt is operated by MIND BLOWING LTD, a company registered in England and Wales under number 16664623, with its registered office at Office 15753 Initial Business Centre, Unit 7 Wilson Business Park, Manchester, United Kingdom, M40 8WN. We are the controller of personal information used for our own account administration, billing, support and service operations. Contact us at [email protected] or write to our registered office. Where we process personal information in team documents on a business customer’s instructions, that customer may be the controller and we act as its processor; contact the team administrator about that content, or contact us for assistance.
Scope
This policy explains how Figalt handles information when you use our website and vector editor.
Information we process
We process a guest or registered account identifier, authentication information, and the email address you provide when signing in. We store documents, layers, uploaded images, document ownership and team membership information to provide editing and sharing. Feedback includes the message, any contact email you provide, and the associated user identifier. Requests to our infrastructure also expose technical information such as IP address, browser information and request metadata.
Browser storage and cloud synchronization
The service uses browser storage for authentication, preferences and cached application data. Documents are stored and synchronized through InstantDB; using a guest account does not mean your work stays only on your device. Clearing browser data or losing a guest session may prevent you from accessing your work. Export important work and use a registered account when you need continued access.
Legal bases for processing
Under UK data protection law, we rely on performance of our contract with you for account access, document storage, collaboration and delivery of purchases; legitimate interests for proportionate service security, fault investigation and responding to enquiries; and legal obligations for records and disclosures required by law. Our legitimate interests are operating and protecting the service and supporting users, balanced against their rights. Where consent is required for optional tracking or another activity, we rely on that consent and you can withdraw it. If required account or payment information is not provided, we may be unable to deliver the relevant feature or purchase. We do not use personal information to make solely automated decisions producing legal or similarly significant effects.
How we use information
We use information to authenticate users, save and synchronize designs, manage access, provide sharing, respond to feedback, maintain the service and investigate abuse or technical failures.
Sharing and service providers
InstantDB processes authentication, database and file storage data on behalf of the service. The website is configured for Cloudflare Pages hosting; Cloudflare processes network requests needed to deliver and protect the website. Team documents are accessible to authorized team members. Documents you make public, including their layers and linked images, can be read by others. Recipients can copy public content; making it private later cannot remove copies already made. We may disclose information when required by law or necessary to protect the service and its users.
Information sources and optional permissions
We receive information from you, your browser, authentication and storage providers, and collaborators who add you to a team or share content with you. If you enable local font access, your browser may ask permission to list and read installed fonts for text rendering and outlining. You may refuse or revoke that permission in browser settings. If you include externally hosted images, loading or exporting them may send requests to the image host, exposing technical request data under that host’s policies.
Browser controls and external links
Browser settings let you clear or block cookies and local storage, though doing so may sign you out, remove preferences or cached work, and interrupt guest access. The Ask AI links open third-party services with a prepared product question in the URL; those services apply their own policies. The links do not by themselves upload your design documents. Other external links, including voluntary support links, are governed by the destination’s policies.
AI, advertising and payments
The pricing page offers an ad-supported Free plan. When you choose an AI feature, its operation may require sending your prompt and the content selected for that request to the provider identified in that feature. Do not include confidential or personal information you are not authorized to send. An AI feature or advertising integration that adds providers, tracking or new uses of information must disclose those practices and obtain any consent required before processing. This notice does not authorize undisclosed tracking, advertising profiling or training on private documents. At purchase, the checkout identifies the payment processor and collects payment information under its notice. We process the billing contact details, plan and transaction records needed to fulfil the purchase; do not send card details through Feedback or email.
Your choices and retention
You can export your designs, delete documents where permitted, and change their sharing settings. We retain information needed to operate the service and meet security or legal obligations; deletion from active use may not immediately remove provider backups. For access, correction, account deletion or other privacy requests, open the Feedback option in the document library and include a contact email. We may need to verify ownership before acting on a request.
Privacy rights and requests
Depending on the law that applies to you, you may request access to or a copy of your personal information, correction, erasure, restriction of processing, or portability. You may object to processing where the law provides that right and withdraw consent for processing based on consent without affecting earlier lawful processing. You may also complain to the data protection authority responsible for your location. These rights can have legal exceptions. Describe your request and the account or document involved; do not send passwords or login codes. We may request proportionate evidence of ownership and will respond within the period required by applicable law. An authorized representative may submit a request where permitted, subject to verification of authority.
Retention criteria and deletion limits
Retention depends on whether an account or document is still in use, whether information is needed to resolve a support request or security incident, and any applicable legal obligations. Browser caches are separate from cloud records: clearing one does not necessarily delete the other. Deleted records may remain in backups until those backups expire under the relevant provider’s retention processes. Copies made by collaborators or recipients are outside our direct control. Account deletion requires a request; the editor does not currently provide a self-service account deletion control.
Security and international processing
No online service or storage system can guarantee absolute security. Our service providers may process information outside the United Kingdom or your country, where privacy protections may differ. Restricted transfers must be covered by applicable adequacy regulations, appropriate contractual safeguards such as the UK IDTA or UK Addendum, or another legally permitted mechanism. Contact us to request information about the safeguards applicable to your data; security-sensitive or third-party confidential details may be redacted. Avoid uploading information you are not authorized to share.
Children and legal capacity
If you cannot lawfully use the service or provide personal information without a parent or guardian’s authorization in your country, obtain that authorization before using it. A parent or guardian who believes a child has provided information unlawfully can request review and deletion through our contact channel.
Complaints and contact
Email [email protected] for access, correction, deletion, objection, portability or other privacy requests, including if you cannot access your account. You may also use Feedback in the document library or write to our registered office. For UK data protection complaints, you may contact the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or write to ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to contact us before exercising your right to complain. Where applicable, you may also contact your local supervisory authority.
Changes to this policy
We will post changes here with a revised date and provide additional notice of material changes where required. If a new purpose requires consent, we will seek it before relying on that purpose.