Privacy Policy
Last Updated: January 4, 2026
1. Introduction
Figure, Inc. (“Figure,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, store, share, and protect information when you use our mobile application (the “App”) and related services (collectively, the “Services”).
Company Information:
Figure, Inc.
333 Sylvan Ave, Suite 305
Englewood Cliffs, NJ 07632
Email: privacy@figure.dev
Support: legal@figure.dev
By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Services.
2. Information We Collect
We collect information in three ways: directly from you, automatically through your use of the Services, and from third-party sources.
2.1 Information You Provide Directly
Account Information: When you register for an account, we collect:
Full name
Email address
Phone number
Password (stored as an encrypted hash)
Date of birth (for age verification)
Profile photo (optional)
Transaction Data: When you make a purchase:
Shipping and billing addresses
Order details (items purchased, quantities, prices)
Payment method type (e.g., Visa ending in 1234)
Note: We do not store complete credit card numbers. Payment processing is handled securely by our respective payment partners including Elavon Inc., Global Payments Inc., Fiserv, Inc., Seamless Payments, Inc., and is subject to their respective privacy policies.
Customer Support Data: When you contact us for assistance:
Support ticket content and correspondence
Chat logs and email communications
Screenshots or files you provide
User-Generated Content:
Product reviews and ratings
Photos you upload
Comments and feedback
Profile customizations
Survey and Research Data: Information you provide when participating in surveys, focus groups, or user research activities.
2.2 Information Collected Automatically
Device Information:
Device model and manufacturer
Operating system and version (iOS/Android)
Unique device identifiers (IDFA for iOS, Android Advertising ID)
IP address
Browser type and version
Screen resolution
Device language settings
Usage Data:
Pages and features accessed
Time spent on each screen
Button clicks and navigation paths
Search queries within the App
Session duration and frequency
App crashes and error logs
Performance metrics (load times, response times)
Location Data: With your explicit permission, we collect:
GPS coordinates (latitude/longitude)
Purpose: To calculate accurate shipping costs, show nearby retail locations, and provide location-based product recommendations
You can enable or disable location access at any time through your device settings
Network Information:
Mobile carrier
Connection type (WiFi, cellular)
Network performance data
2.3 Cookies and Tracking Technologies
We use the following technologies:
Cookies: Small text files stored on your device to:
Keep you logged in
Remember your preferences (language, currency)
Analyze App performance
Software Development Kits (SDKs): We integrate third-party SDKs including:
Google Firebase Analytics: App usage analytics and crash reporting
Mixpanel: User behavior analysis and feature usage tracking
Segment: Data integration and routing to analytics platforms
Analytics Tools: We use analytics services to understand how users interact with our Services and improve user experience.
Advertising Identifiers: We may collect mobile advertising IDs (IDFA/Android Advertising ID) to:
Measure ad campaign effectiveness
Provide personalized advertising (with your consent)
You can reset or opt-out of personalized ads in your device settings
2.4 Information From Third Parties
Social Media: If you connect your account via social media (Facebook, Google):
Basic profile information (name, email, profile picture)
Friend lists (if you grant permission)
Marketing Partners: We may receive demographic information and interests from third-party data providers to better understand our user base.
Fraud Prevention Services: We receive information from fraud detection services to protect against unauthorized transactions.
3. How We Use Your Information
We process your personal data for the following specific purposes, based on applicable legal grounds:
3.1 Service Delivery and Performance (Contractual Necessity)
Create and manage your account
Process orders and transactions
Deliver products to you
Provide customer support
Authenticate your identity
Enable App features and functionality
3.2 Service Improvement (Legitimate Interest)
Analyze usage patterns and trends
Identify and fix technical issues
Develop new features and products
Conduct A/B testing to improve user experience
Optimize App performance and reliability
3.3 Communication (Contractual Necessity / Consent)
Transactional Communications (no consent required):
Order confirmations and shipping notifications
Password reset emails
Account security alerts
Important policy updates
Responses to your inquiries
Promotional emails about new products and sales
Push notifications about offers and recommendations
In-app messages about features
You can opt-out at any time using the “Unsubscribe” link or adjusting notification settings
3.4 Personalization (Consent / Legitimate Interest)
Customize content and product recommendations
Remember your preferences and settings
Provide personalized search results
Tailor the user interface based on your behavior
3.5 Marketing and Advertising (Consent)
Send promotional materials (with your opt-in consent)
Display targeted advertisements
Measure advertising campaign effectiveness
Conduct market research
3.6 Security and Fraud Prevention (Legitimate Interest / Legal Obligation)
Detect and prevent fraud, abuse, and unauthorized access
Investigate suspicious activity
Enforce our Terms of Service
Protect the rights and safety of our users
Maintain the security and integrity of our Services
3.7 Legal Compliance (Legal Obligation)
Comply with applicable laws and regulations
Respond to legal requests and court orders
Conduct audits and maintain records
Exercise or defend legal claims
3.8 Research and Analytics (Legitimate Interest)
Understand market trends
Conduct internal research and development
Generate aggregated, anonymized statistics
Our Legitimate Interests Explained: Where we process data based on legitimate interests, we have determined that our business interests do not override your fundamental rights and freedoms. Our legitimate interests include operating and improving our Services, preventing fraud, ensuring security, and conducting analytics to enhance user experience. You have the right to object to processing based on legitimate interests.
4. How We Share Your Information
We do not sell your personal information to third parties for monetary consideration. We share data only in the following limited circumstances:
4.1 Service Providers and Business Partners
We share data with trusted third-party companies that provide services on our behalf:
Cloud Infrastructure:
Amazon Web Services (AWS) - Data hosting and storage
Purpose: Store user data, host the App backend
Location: United States
Analytics, Logging and Performance:
Google LLC (Google Analytics)
Datadog, Inc.
Purpose: App analytics, crash reporting, user behavior analysis
Data shared: Device information, usage data, anonymized user identifiers
Customer Support:
Freshworks, Inc. - Support ticketing system
Purpose: Manage customer inquiries and support tickets
Data shared: Contact information, support correspondence
Email and Communication:
Amazon Web Services (AWS) - Email and SMS delivery service
Purpose: Send transactional and marketing emails
Data shared: Email address, name, message content
Payment Processing:
Elavon Inc., Global Payments Inc., Fiserv, Inc., Seamless Payments, Inc.
Purpose: Process payment transactions securely
Data shared: Payment method information, transaction amounts, billing information
Note: We do not store complete credit card numbers; processors handle this data directly
Shipping and Fulfillment:
FedEx, UPS, and USPS - Order fulfillment
Purpose: Deliver products to customers
Data shared: Name, shipping address, order details
Data Processing Agreements: All service providers are contractually obligated to protect your data, use it only for specified purposes, and comply with applicable privacy laws including GDPR Standard Contractual Clauses where applicable.
4.2 Business Transfers
If Figure, Inc. is involved in a merger, acquisition, asset sale, bankruptcy, or similar transaction, your personal information may be transferred to the successor entity. We will notify you via email and/or prominent notice in the App at least 30 days before your information becomes subject to a different privacy policy.
4.3 Legal Requirements and Protection
We may disclose your information when we believe in good faith that disclosure is necessary to:
Comply with applicable laws, regulations, or legal processes
Respond to subpoenas, court orders, or government requests
Enforce our Terms of Service or other agreements
Protect the rights, property, or safety of Figure, our users, or the public
Detect, prevent, or address fraud, security, or technical issues
Investigate violations of our policies
4.4 Aggregated and Anonymized Data
We may share aggregated, anonymized data that cannot identify you with:
Business partners for market research
Advertisers for campaign analytics
Researchers for industry studies
4.5 With Your Consent
We may share your information with third parties when you explicitly consent to such sharing, such as when you:
Connect your account to social media platforms
Participate in co-branded promotions
Opt-in to data sharing with specific partners
5. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal obligations.
Account Data:
Retained while your account is active
After account deletion: Deleted within 90 days, except where retention is required by law
Transaction and Order Data:
Retained for 7 years after the transaction date for tax, accounting, and legal compliance purposes
May be retained longer if required by law or to resolve disputes
Marketing Data:
Retained until you opt-out or unsubscribe
After opt-out: Removed from active marketing lists within 10 business days
Email address may be retained on a suppression list to honor your opt-out preference
Customer Support Data:
Retained for 3 years after the last interaction to provide continued support and improve service quality
Usage and Analytics Data:
Retained for 24 months in identifiable form
May be converted to aggregated, anonymized form and retained indefinitely for statistical analysis
Legal Hold:
Data may be retained longer if subject to legal hold, litigation, investigation, or regulatory request
Deletion Process: When retention periods expire, we securely delete or anonymize your data using industry-standard methods.
6. Your Rights and Choices
Depending on your location, you may have the following rights regarding your personal data:
6.1 Access and Data Portability
Right to Access: Request a copy of the personal data we hold about you.
Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
How to Exercise:
Email legal@figure.dev with the subject line “Data Access Request”
We will respond within 30 days (45 days in some jurisdictions)
We may verify your identity before fulfilling your request
6.2 Correction and Updates
Right to Correction: Request correction of inaccurate or incomplete data.
How to Exercise:
Update your information directly in the App: Settings > Account > Edit Profile
Email legal@figure.dev
We will respond within 30 days
6.3 Deletion
Right to Deletion (Right to be Forgotten): Request deletion of your account and personal data.
How to Exercise:
In the App: Settings > Account > Delete Account
Email support@figure.dev with the subject line “Account Deletion Request”
We will delete your data within 90 days
Limitations: We may retain certain data when:
Required by law (e.g., transaction records for tax purposes)
Necessary to complete a transaction you requested
Needed to detect and prevent fraud or security incidents
Necessary to exercise or defend legal claims
6.4 Opt-Out of Marketing
Email Marketing:
Click “Unsubscribe” at the bottom of any marketing email
Adjust preferences in Settings > Notifications > Email Preferences
Push Notifications:
Disable in the App: Settings > Notifications > Push Notifications
Or in your device settings: Settings > Notifications > Figure App
SMS/Text Messages:
Reply “STOP” to any marketing text message
Or adjust preferences in Settings > Notifications > SMS Preferences
Targeted Advertising:
Opt-out of personalized ads:
iOS: Settings > Privacy > Advertising > Limit Ad Tracking
Android: Settings > Google > Ads > Opt out of Ads Personalization
NAI Opt-Out: http://optout.networkadvertising.org/
DAA Opt-Out: http://optout.aboutads.info/
6.5 Object to Processing
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
How to Exercise: Email legal@figure.dev with details about the processing you object to. We will cease processing unless we have compelling legitimate grounds that override your interests.
6.6 Restrict Processing
Right to Restrict: Request that we limit how we use your data in certain circumstances (e.g., while we verify accuracy of disputed data).
How to Exercise: Email legal@figure.dev with your request.
6.7 Withdraw Consent
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
How to Exercise:
Adjust settings in the App (e.g., location permissions, marketing preferences)
Email legal@figure.dev
Note: Withdrawal does not affect the lawfulness of processing before withdrawal
6.8 Lodge a Complaint
Right to Complain: If you believe we have violated your privacy rights, you may lodge a complaint with a supervisory authority.
EU/EEA Residents: Contact your local Data Protection Authority (DPA):
List of EU DPAs: https://edpb.europa.eu/about-edpb/board/members_en
UK Residents: Information Commissioner’s Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Phone: 0303 123 1113
California Residents: California Attorney General:
Website: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company
Other Jurisdictions: Contact your local privacy regulator or consumer protection agency.
7. Security Measures
We implement robust technical and organizational measures to protect your personal data:
Encryption:
Data in transit: TLS 1.3 encryption for all data transmitted between your device and our servers
Data at rest: AES-256 encryption for stored data in our databases
Access Controls:
Role-based access control (RBAC) limiting employee access to personal data
Multi-factor authentication (MFA) required for all employee accounts
Regular access reviews and audit logs
Infrastructure Security:
Firewalls and intrusion detection systems
Regular security assessments and penetration testing
Automated vulnerability scanning
DDoS protection
Application Security:
Secure coding practices and code reviews
Regular security updates and patch management
Session management and timeout controls
Employee Training:
Annual privacy and security training for all employees
Background checks for employees with data access
Confidentiality agreements
Incident Response:
24/7 security monitoring
Documented incident response procedures
Forensic analysis capabilities
Limitations: No method of transmission over the internet or electronic storage is 100% secure. While we implement industry-standard security measures, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your password and account credentials.
8. Data Breach Notification
In the event of a data breach that poses a risk to your rights and freedoms:
Notification to Users:
We will notify affected users within 72 hours of becoming aware of the breach (where feasible)
Notification will be sent via email to your registered email address
Notification will include:
Description of the breach and data affected
Likely consequences
Measures we have taken to address the breach
Recommended actions you can take to protect yourself
Notification to Authorities:
We will notify relevant supervisory authorities as required by applicable law
GDPR: Within 72 hours to the lead supervisory authority
State laws: As required by specific state breach notification laws
How to Report Suspected Breaches: If you suspect unauthorized access to your account:
Immediately change your password
Email legal@figure.dev with details
We will investigate and respond promptly
9. International Data Transfers
Figure, Inc. is based in the United States. If you access our Services from outside the US, your information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers operate.
Legal Mechanisms for Transfers:
For EU/EEA and UK Users:
We transfer data to the US under Standard Contractual Clauses (SCCs) approved by the European Commission
Copies of SCCs are available upon request at legal@figure.dev
We implement supplementary measures as recommended by the European Data Protection Board
For Swiss Users:
We comply with the Swiss Federal Data Protection Act
Transfers are conducted under SCCs recognized by the Swiss Federal Data Protection and Information Commissioner
For Other Jurisdictions:
We implement appropriate safeguards as required by applicable law
Your Consent: By using our Services, you acknowledge and consent to the transfer of your information to the United States and other countries that may have different data protection laws than your country of residence.
Adequacy: We conduct transfer impact assessments and implement technical measures (encryption, pseudonymization) to ensure adequate protection during international transfers.
10. Children’s Privacy
Our Services are not intended for individuals under the age of 13 (or 16 in the European Economic Area, or the applicable age of digital consent in your jurisdiction).
No Knowing Collection: We do not knowingly collect personal information from children under these age thresholds.
Parental Rights: If you are a parent or guardian and believe your child has provided us with personal information:
Email legal@figure.dev with the subject line “Child Privacy Concern”
Include your child’s name, email address (if known), and your relationship to the child
We will promptly investigate and delete the information within 30 days
Age Verification: We use age-gating mechanisms during account registration to prevent underage users from creating accounts.
School or Educational Use: If you are an educational institution interested in using our Services for students under 18, please contact us at education@figure.dev to discuss COPPA/FERPA-compliant arrangements.
11. Region-Specific Disclosures
11.1 California Residents (CCPA/CPRA)
This section applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
Categories of Personal Information Collected (Last 12 Months):
Category
Examples
Collected
Business Purpose
Identifiers
Name, email, phone, IP address
Yes
Account creation, service delivery
Commercial Information
Purchase history, transaction data
Yes
Order processing, analytics
Internet Activity
Browsing history, search queries
Yes
Service improvement, analytics
Geolocation Data
Precise location coordinates
Yes (with consent)
Shipping calculations, local recommendations
Sensory Data
Profile photos, product images
Yes (voluntary)
User-generated content
Inferences
User preferences, behavioral predictions
Yes
Personalization, recommendations
Sources of Personal Information:
Directly from you (account registration, purchases)
Automatically from your device (usage data, device information)
Third parties (social media, data brokers, fraud prevention services)
Disclosure for Business Purposes: In the last 12 months, we disclosed personal information to service providers for:
Cloud hosting and data storage
Payment processing
Analytics and performance monitoring
Customer support
Marketing and communications
Fraud prevention
Sale or Sharing of Personal Information:
We do not sell personal information for monetary consideration
We may share certain identifiers for targeted advertising purposes, which you can opt out of.
You have the right to opt-out: Email legal@figure.dev with subject line “Do Not Sell/Share My Personal Information”
Sensitive Personal Information: We collect date of birth for age verification. We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA.
Right to Limit Use of Sensitive Personal Information: Email legal@figure.dev to limit use of your sensitive personal information.
Your California Privacy Rights:
Right to Know: Request details about personal information collected, used, and shared (up to 2 requests per 12-month period)
Right to Delete: Request deletion of your personal information (subject to exceptions)
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt-out of sale/sharing of personal information
Right to Limit: Limit use and disclosure of sensitive personal information
Non-Discrimination: We will not discriminate against you for exercising your rights (no denial of service, different pricing, or reduced quality)
Authorized Agent: You may designate an authorized agent to make requests on your behalf. The agent must provide:
Written authorization signed by you
Proof of their identity
We may require you to verify your identity directly
Verification Process: To verify your identity, we may ask you to:
Confirm your email address
Provide account information
Answer security questions For deletion requests, we use a heightened verification standard.
Response Timeline: We will respond to verifiable requests within 45 days (extendable by an additional 45 days with notice).
Shine the Light Law (California Civil Code § 1798.83): California residents may request information about disclosure of personal information to third parties for direct marketing purposes. Email legal@figure.dev with “California Shine the Light Request.”
Contact for California Privacy Rights: Email: legal@figure.dev
Online Form: www.figure.dev/privacy
11.2 European Union (GDPR) and United Kingdom
This section applies to individuals in the European Economic Area (EEA), United Kingdom, and Switzerland.
Data Controller: Figure, Inc. is the data controller responsible for your personal data.
Legal Bases for Processing: We process your personal data under the following legal bases:
Contractual Necessity: To perform our contract with you (account creation, order fulfillment)
Consent: For marketing, cookies, location tracking, and other optional features
Legitimate Interests: For fraud prevention, security, analytics, and service improvement
Legal Obligation: To comply with laws and regulations
Your Rights Under GDPR:
Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure / “right to be forgotten” (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object (Article 21)
Right to withdraw consent (Article 7)
Right to lodge a complaint with a supervisory authority (Article 77)
Automated Decision-Making: We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.
International Transfers: We transfer data outside the EEA/UK using Standard Contractual Clauses (SCCs). Copies available upon request.
Data Protection Officer: For GDPR-related inquiries:
Email: legal@figure.dev
Postal Address: Data Protection Officer (Legal), Figure, Inc., 333 Sylvan Ave Suite 305, Englewood Cliffs, NJ 07632
Supervisory Authority: You have the right to lodge a complaint with your local Data Protection Authority. Find your DPA at: https://edpb.europa.eu/about-edpb/board/members_en
Data Retention: See Section 5 for detailed retention periods. Data is retained only as long as necessary for the purposes outlined in this policy.
11.3 Other Jurisdictions
Brazil (LGPD): Brazilian residents have rights similar to GDPR, including access, correction, deletion, and portability. Contact legal@figure.dev to exercise your rights.
Canada (PIPEDA): Canadian residents have rights to access and correct personal information. Contact legal@figure.dev for assistance.
Australia (Privacy Act): Australian residents can access and correct their personal information. Contact legal@figure.dev with requests.
Other Regions: If you are located in a jurisdiction with specific privacy laws, please contact legal@figure.dev and we will work with you to address your rights under applicable law.
12. Cookies and Tracking Technologies
12.1 Types of Cookies We Use
Essential Cookies:
Purpose: Enable core functionality (login, session management)
Duration: Session or up to 1 year
Cannot be disabled without affecting App functionality
Analytics Cookies:
Purpose: Understand how users interact with the App
Services: Google Analytics, Mixpanel
Duration: Up to 2 years
Can be disabled (see Section 12.2)
Marketing Cookies:
Purpose: Deliver personalized ads and measure campaign effectiveness
Services: Google Ads, Facebook Pixel
Duration: Up to 1 year
Can be disabled (see Section 12.2)
Preference Cookies:
Purpose: Remember your settings and preferences
Duration: Up to 1 year
Can be disabled (may affect user experience)
12.2 Managing Cookies
In-App Controls:
Settings > Privacy > Cookie Preferences
You can accept or reject non-essential cookies
Browser Controls:
Most browsers allow you to refuse or delete cookies
See your browser’s help section for instructions
Note: Disabling cookies may limit App functionality
Third-Party Opt-Out Tools:
Google Analytics Opt-Out: https://tools.google.com/dlpage/gaoptout
NAI Opt-Out: http://optout.networkadvertising.org/
DAA Opt-Out: http://optout.aboutads.info/
Do Not Track (DNT):
We do not currently respond to DNT browser signals
We honor opt-out preferences set in cookie controls
EU Cookie Consent:
EU users will see a cookie consent banner upon first visit
You can manage preferences at any time in Settings > Privacy > Cookie Preferences
13. Third-Party Links and Services
Our App may contain links to third-party websites, services, or applications not operated by Figure, Inc.
No Responsibility: We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies.
Third-Party Login: If you use social media login (Google, Facebook), your information is subject to their privacy policies:
Google Privacy Policy: https://policies.google.com/privacy
Facebook Privacy Policy: https://www.facebook.com/privacy/policy/
Embedded Content: Third-party content embedded in our App (e.g., YouTube videos, social media widgets) may collect data according to their own privacy policies.
14. Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification of Changes:
Material Changes: We will notify you at least 30 days before material changes take effect via:
Email to your registered email address
Prominent notice in the App (banner or pop-up)
Update notification on our website
Your Acceptance:
Continued use of the Services after changes take effect constitutes acceptance of the updated policy
If you do not agree to the changes, you must stop using the Services and may request account deletion
Version History: Previous versions of this policy are available upon request at legal@figure.dev.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:
General Inquiries:
Email: legal@figure.dev
Phone: 1-855-534-4873 (Monday-Friday, 9 AM - 5 PM PT)
Online Form: www.figure.dev/privacy
Data Protection Officer (GDPR/UK):
Email: legal@figure.dev
California Privacy Requests:
Email: legal@figure.dev (Subject: “California Privacy Request”)
Postal Address:
Figure, Inc.
Attn: Figure Legal
333 Sylvan Ave, Suite 305
Englewood Cliffs, NJ 07632
United States
Response Time: We strive to respond to all inquiries within 5-10 business days, and to formal rights requests within the timeframes required by applicable law (typically 30-45 days).
16. Definitions
Personal Data/Personal Information: Information that identifies, relates to, describes, or can be reasonably linked to you.
Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
Controller: The entity that determines the purposes and means of processing personal data (Figure, Inc.).
Processor: An entity that processes personal data on behalf of the controller (our service providers).
Consent: Freely given, specific, informed, and unambiguous agreement to processing of personal data.
Legitimate Interest: A lawful basis for processing when our interests do not override your fundamental rights and freedoms.
Acknowledgment: By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.
This Privacy Policy was drafted to comply with GDPR, CCPA/CPRA, COPPA, and other applicable privacy laws. It should be reviewed by legal counsel before deployment.