Mobile App Privacy Policy

1. Scope

This Privacy Policy describes how Figur collects, uses, shares, and protects personal data in the Figur mobile app on iOS and Android (the “App”). If you use the figur.fit website or Figur’s business-to-business services (catalog ingestion, Shopify plugin, API, dashboard), see the separate Website Privacy Policy.

2. Data We Collect

a. Account data

• Name, email address, phone number (if you sign in with OTP)
• Authentication identifier from Sign in with Apple or Google Sign-In, if used
• Profile metadata you choose to add

b. Photos and visual data (sensitive personal data)

• Photos you upload for try-on (which may include your face and body)
• Garment photos you upload
• AI-generated try-on images and edits produced from your uploads

We treat photos and visual data as sensitive personal data under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

c. Payment data

• RevenueCat subscriber identifier
• Apple App Store or Google Play transaction identifiers
• Product purchased and entitlement status

Card and bank details are handled by Apple, Google, or our payment processors directly. Figur does not store your card or bank details.

d. Device and technical data

• Device model, operating system version, App version
• Language, time zone, IP address
• Device vendor identifier (e.g., iOS identifierForVendor)
• Advertising identifier — only if you grant App Tracking Transparency permission (we do not currently request this)

e. Usage data

• Screens viewed, features used, jobs run
• Interaction events, button taps, search queries within the App

f. Diagnostic data

• Crash logs, performance traces, error stacks

3. How We Use Data

• Operate the Service — run try-on jobs, manage your account, deliver subscriptions and credits
• Process payments through Apple App Store, Google Play, and RevenueCat
• Improve our AI models on an anonymized and aggregated basis only
• Prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Send transactional communications (purchase confirmations, support replies)
• Send optional product communications, which you can opt out of at any time

4. AI Processing of Your Photos

When you upload a photo, the App sends it to Figur servers and to one or more third-party AI/ML model providers for try-on inference. Photos and generated outputs are encrypted in transit and at rest and are deleted within 30 days of upload, unless retained on an anonymized basis for a limited period for debugging and product improvement.

We do not sell or share your photos or generated images with advertisers, brokers, or external agencies.

5. SDKs and Third-Party Processors

The App uses the following third-party services to operate. Each is bound by a confidentiality and data-protection agreement.

6. App Tracking Transparency (iOS)

The App does not currently track you across other companies’ apps and websites. Accordingly, we do not show the App Tracking Transparency consent prompt and do not access your IDFA. If we change this in the future, we will request your consent through Apple’s ATT prompt and update this Policy first.

7. Push Notifications

We use push notifications to send purchase confirmations, try-on completion alerts, and optional product updates. You can disable notifications per-platform:

• iOS: Settings → Notifications → Figur
• Android: Settings → Apps → Figur → Notifications

8. Permission Prompts

The App may request the following permissions:

• Photos: to let you select images from your photo library for try-on.
• Camera: to let you take a photo for try-on directly in the App.
• Notifications: to send purchase confirmations and try-on completion alerts.

You can grant or revoke these permissions in your device settings at any time.

9. Children’s Privacy

The App is intended for users 18 years of age and older. We do not knowingly collect personal data from minors. You must not upload photos depicting any person under 18. If we become aware that we have collected personal data from a minor, we will delete it promptly.

10. Data Retention

• Photos and generated outputs: deleted within 30 days, except where retained on an anonymized basis for limited debugging and product-improvement use.
• Account data: retained for the lifetime of your account plus a 30-day deletion grace period.
• Transaction records: retained as required by Indian tax and audit law (typically up to 7 years), in minimal scope.
• Diagnostic data: retained for up to 90 days.

11. Account Deletion

You can delete your account from within the App: Account → Delete Account. On deletion, your account is immediately disabled and your data is permanently removed within 30 days, subject to retention required by applicable law. You may restore a deleted account during the 30-day window by emailing team@figur.fit from your registered address.

12. Your Rights (India — DPDP Act)

Under India’s Digital Personal Data Protection Act, 2023, you have the right to:

• Access and request copies of your personal data
• Correct or update inaccurate data
• Withdraw consent and request deletion of your data
• Nominate another individual to exercise your rights in the event of your death or incapacity
• Lodge a grievance with the Grievance Officer (see contact below)
• Lodge a complaint with the Data Protection Board of India

To exercise these rights, contact our Grievance Officer at lavees96@gmail.com or team@figur.fit.

13. India-Only Service Notice

The App is currently offered only in India. If you access the App from outside India, this Service is not directed to you and we do not actively offer it in your jurisdiction. Where mandatory local laws nonetheless apply (for example, the EU General Data Protection Regulation, the UK Data Protection Act, or the California Consumer Privacy Act), contact us at team@figur.fit and we will respond to lawful requests in good faith.

14. International Data Transfers

Your data is primarily stored and processed in India (AWS Mumbai region, ap-south-1). Some processors (notably AI/ML model providers and Firebase services) may process data in other countries, including the United States. We rely on standard contractual safeguards and processor agreements to protect data during international transfers.

15. Security

We protect personal data using industry-standard measures, including:

• HTTPS / TLS encryption in transit
• Encryption at rest in cloud storage
• Restricted access controls and environment isolation
• Regular review of security practices

No system is 100% secure. You are responsible for keeping your account credentials confidential.

16. Changes

We may update this Policy from time to time. Material changes will be notified in the App and by email where we have one on file. Your continued use of the App after a change takes effect constitutes acceptance of the updated Policy.

17. Contact

For questions, requests, or grievances, contact:
📧 team@figur.fit
📧 Grievance Officer: Lavee Singh — lavees96@gmail.com
📍 Lavee Singh d/b/a Figur, Prestige Greenwoods, CV Raman Nagar, Bangalore, India