Privacy Policy

This Privacy Policy explains how Figurly collects, uses, shares and protects personal data when you visit the site, upload photos, design a figurine, create an account, place an order or contact us.

The controller of that data (the "business" under California law) is RM ECOM (SASU), 18 rue Goubet, 75019 Paris, France, 883 393 944 RCS Paris, which operates Figurly. For any question or request about your data, write to hello@figurly.co. We have not appointed a data protection officer, which the law does not require of us; the address above reaches the people responsible for your data.

Your photos are used to design and make your figurine, and for nothing else. We never use them to recognise or identify anyone, we never create a face template from them, we never sell them and we never use them, or let our providers use them, to train AI models.

Optional cookies (support chat, audience measurement, advertising) are only set with your consent if you are in Europe or California. Elsewhere they are on by default and you can switch them off at any time. Everyone can change their choice from the "Cookie settings" link at the bottom of every page.

You can ask us at any time for a copy of your data, to correct it or to delete it, by writing to hello@figurly.co.

What you give us: your email address, your name, your delivery and billing address and, if you give it, your phone number; the photos you upload; the details you add to a design (names, texts, notes such as height, build, hair, clothing or pets, and the style and options you choose); your messages to our support team; your reviews; and, for a group quote, the details of the request.

What we collect when you use the site: your IP address and the country and region derived from it; your browser, device and operating system; a random identifier stored in a cookie on your device that keeps your designs attached to it and counts your free previews; and, only with your consent where it is required, the pages you view and the actions you take on the site (see "Advertising and audience measurement").

What others give us: our payment provider tells us whether a payment succeeded and gives us fraud signals (we never receive your full card number), and carriers tell us where your parcel is.

Your photos are used to make the preview images you see, the 3D model of your figurine and the figurine itself, and to handle any after-sales request. They are processed by AI image and 3D tools run by our service providers, and they may be reviewed by members of our team to check quality and prepare production. The 3D model is a stylised figurine made to be printed and painted; it is not used, and cannot be used by us, to recognise or identify anyone. We do not extract or store face geometry, face prints or any biometric identifier.

Only upload photos of people who have agreed to it. For a photo of a child, you must be the child's parent or legal guardian, or act with their consent. We ask you to confirm that you hold the rights to the photos before they are sent.

How long they are kept. Photos uploaded without an account are deleted 30 days after upload, and previews that nobody ordered 60 days after they were made; with an account, both are kept for one year so you can come back to your designs. The photos, previews and 3D model of an order are kept for as long as needed to produce and deliver it and handle after-sales requests, and no longer than 24 months after delivery. You can ask us at any time to delete them sooner; once deleted, we can no longer remake or replace the figurine.

To spare you uploading them again, your browser also keeps a copy of your photos and previews on your own device (in its local database), until your order is complete or you clear your browser data. That copy never leaves your device unless you send it to us.

To provide the design tools and previews, make and deliver your order, manage your account, answer your messages and handle after-sales: this is necessary to perform our contract with you, or to take steps at your request before entering into it (GDPR Article 6(1)(b)).

To keep the site secure, limit free previews per visitor, prevent fraud and abuse, improve our products and service from aggregate figures that need no consent, send you a reminder about a design or cart you left (only if you gave us your email address in that process, and with a one-click way to stop), and establish or defend our legal rights: our legitimate interests (Article 6(1)(f)), which we have balanced against your rights. You can object to any of these at any time.

To keep accounting and tax records and answer lawful requests from authorities: our legal obligations (Article 6(1)(c)).

To set optional cookies (support chat, audience measurement, advertising) and to send you marketing emails about new products when you have not bought from us: your consent (Article 6(1)(a)), which you can withdraw at any time, as easily as you gave it, without affecting what was done before.

Our previews are made by AI tools, but we make no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The limits on free previews are an anti-abuse measure; if you believe one was applied in error, write to us and a person will review it. Payment fraud checks are run by our payment provider, and a declined payment can be reviewed by us at your request.

We share personal data with service providers that process it on our behalf and under our instructions, bound by contract to protect it and not to use it for their own purposes: website hosting, content delivery, file storage and email sending (Cloudflare, United States); our database (Neon, United States); payment processing and fraud prevention (Stripe); AI image and 3D tools, which receive your photos and design options to make the previews and the 3D model (OpenAI, Kie.ai, Meshy and Tripo); our order-management platform (Klay); customer chat (Crisp, France); and the manufacturing partners and carriers that make and deliver your figurine, which receive the 3D model, the design images, your name and your delivery address.

With your consent where it is required, Google (Google Analytics, audience measurement) and Meta (the Meta pixel, advertising measurement) also receive data about your use of the site. For the Meta pixel, Meta acts as a joint controller with us for the collection and transmission of that data, and as an independent controller for what it does with it afterwards, under its own privacy policy (facebook.com/privacy/policy).

We may also disclose data to our professional advisers, to authorities when the law requires it, to establish, exercise or defend a legal claim, and to a buyer or successor if our business is transferred, who will be bound by this Policy.

Google Analytics measures visits and purchases in aggregate. It runs only with your audience-measurement consent where it is required, its cookies last at most 13 months, Google Signals and ad personalisation stay off unless you also allow advertising, and Google does not store IP addresses in Google Analytics 4.

The Meta pixel tells Meta when a visitor who came from one of our ads views a page, adds to cart, starts a checkout or buys (with the order value, never the content of your design or your photos). It lets us measure our ads and lets Meta show them to people likely to be interested. It runs only with your advertising consent in Europe and California, and is switched off by a Global Privacy Control signal everywhere.

Our own statistics (Klay analytics) count visits, carts and purchases in aggregate for our dashboards. They run with the same audience-measurement choice as Google Analytics.

Some of our providers and partners process data outside the European Economic Area, the United Kingdom and Switzerland, in particular in the United States, and our manufacturing partners may be located outside those areas. When we transfer personal data outside them, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, the UK extension and the Swiss-US framework for certified providers) or on the European Commission's Standard Contractual Clauses, with the UK addendum where needed, and on additional safeguards where appropriate. You can ask us for a copy of the safeguards at hello@figurly.co.

Photos, previews and 3D models: as described in "Your photos and your figurine". Orders, invoices and payment records: 10 years, the period French accounting law requires. Account data: until you close your account, or after 3 years without any activity. Support conversations: 3 years after the last message. Marketing contacts: 3 years after your last purchase or contact, or until you unsubscribe. Security and anti-abuse records: up to 12 months. Records of your cookie choices: 3 years, to prove the choice. Cookies themselves: see the Cookie Policy.

When a period ends, we delete or anonymise the data, unless we must keep it longer by law or to establish, exercise or defend a legal claim.

Data is encrypted in transit, payment card data is handled only by our payment provider, access to personal data is limited to the people and providers who need it, and photos are kept in private storage that is not publicly reachable. No system is perfectly secure; if a breach affecting your data occurs, we will notify the supervisory authority within 72 hours and you without undue delay when the law requires it.

You have the right to access your data and receive a copy, to have it corrected, to have it deleted, to restrict its processing, to object to it (including, at any time and without giving a reason, to direct marketing and to processing based on our legitimate interests), to receive the data you gave us in a portable format, and to withdraw your consent at any time. In France, you can also give instructions about what happens to your data after your death.

To exercise a right, write to hello@figurly.co. It is free. We answer within one month, which may be extended by two further months for complex or numerous requests (we tell you if so), and we may ask for information to confirm your identity, usually a code sent to the email address we hold.

You also have the right to lodge a complaint with a data protection authority, in particular in the country where you live or work, or where an alleged infringement took place. Our lead authority is the CNIL (3 place de Fontenoy, 75007 Paris, www.cnil.fr). In the United Kingdom, it is the ICO (ico.org.uk); in Switzerland, the FDPIC (edoeb.admin.ch).

This section is our notice at collection and privacy notice under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and similar laws of other US states. In the past 12 months, we collected the following categories of personal information, from you, from your device and from the providers named above, for the purposes described in "Why we use your data": identifiers (name, email, postal address, IP address, online identifiers); customer records (phone number, payment status, never full card numbers); commercial information (orders, designs, quotes); internet or other electronic network activity (browsing and actions on our site); approximate geolocation (country and region derived from IP); audio, electronic or visual information (the photos you upload, support messages); and inferences limited to the preferences shown by your designs. We keep each category for the periods in "How long we keep it". We do not collect biometric information, and we do not use or disclose sensitive personal information for any purpose that would give you a right to limit it.

We disclose these categories for business purposes to the service providers and contractors listed in "Who we share it with". We do not sell personal information for money. When advertising cookies are on, the Meta pixel discloses identifiers and internet activity to Meta for cross-context behavioural advertising, which California law calls "sharing" and other states call targeted advertising; Google Analytics may do the same if you allow advertising. In California this happens only after you opt in. In other states it is on by default and you can opt out at any time. We do not knowingly sell or share the personal information of consumers under 16, and we offer no financial incentive in exchange for personal information.

Depending on your state, you have the right to know what personal information we collect, use and disclose; to access it and receive a portable copy; to correct it; to delete it; to opt out of the sale or sharing of personal information, of targeted advertising and of profiling with legal or similarly significant effects; and not to be discriminated against for exercising these rights. To opt out, use the "Your Privacy Choices" link at the bottom of every page, or send a Global Privacy Control signal from your browser: we honour it as a valid opt-out request, and we show you that we have.

To make any other request, write to hello@figurly.co. We verify your identity by matching information you give us with what we hold, usually by a code sent to your email address. You may use an authorised agent, who must provide your signed permission; we may still ask you to verify your identity directly. We confirm receipt within 10 business days and answer within 45 days, which may be extended once by 45 days. If we decline your request, you may appeal by replying to our answer; we answer an appeal within the time your state's law requires, and if you disagree you may contact your state Attorney General.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes. Nevada: we do not sell covered information.

The site is not directed at children and we do not knowingly collect personal data from children under 16 (under 13 in the United States), except photos uploaded by a parent or guardian to design a figurine. If you believe a child has given us personal data, write to hello@figurly.co and we will delete it.

We send you the emails needed for your account and your orders (sign-in codes, order confirmation, production and shipping updates). Marketing emails are sent only if you agreed to them or, where the law allows it, about similar products after a purchase. Every marketing email and every reminder has a link to stop them in one click.

What the site stores on your device, why, for how long, and how to accept or refuse it is explained in our Cookie Policy. You can change your choice at any time from the "Cookie settings" link at the bottom of every page.

We may update this Policy. The version number and date at the top of this page tell you when it last changed. We announce material changes on the site or by email before they apply, and we ask for your consent again where the law requires it.