Privacy notice
Last updated 18 Oct 2026.
Who we are
Figbox, based in Singapore, is responsible for your data. Data Protection Officer: Figbox data contact, hello@figbox.app.
What we collect
What you type into the order form (name, email, your figure brief and the websites you'll embed on), the payment record from our payment provider, and, for embed licences, the licence holder's name and domains. We never see or store your card details.
Your account
When you buy, we make you an account under the email you paid with. It holds that email, your name, your licences (figures, the websites you list, dates), your subscription status, and your custom orders (brief, progress, previews and revision requests). You log in with a one-time link we email you, so we hold no password. A log-in link works once and expires after 15 minutes; a log-in lasts 30 days. If you run a centre licence you can add teachers by email. We store those emails, tell each teacher that you added them, and they can leave at any time. Please add only colleagues who teach at your centre. From your account you can download your data or delete the account.
When someone plays an embedded figure
When an embedded figure loads, it is fetched from our server, which checks the licence using the embedding page's address. Cloudflare keeps short-term logs (such as IP address and page address) for security. After that, the figure runs in the viewer's browser and sends nothing further to us.
Photos and sketches you upload
We use them only to understand your order (which apparatus, which layout). We never trace or copy them. We keep them until 30 days after delivery, then delete them, and we never use them in marketing without your written OK. Please only upload images you have the right to share, with no students or other people in them.
Why, and our legal basis
To make and deliver your figure, send receipts and answer you. Under the GDPR our basis is performing our contract with you, keeping tax records (a legal obligation), and our legitimate interest in keeping briefs and messages for 2 years so we can handle revisions and repeat orders. Under Singapore's PDPA we use your data only for these purposes, which you consent to when you order. We don't sell your data or use it for advertising.
Who processes it for us
Stripe (payments), Cloudflare (hosting), our email provider (Cloudflare Email Routing (forwarding only; we do not send marketing email), which sends log-in links and notices and sees the recipient's email address) and Anthropic (AI processing of your brief and any photos). Some of them process data outside Singapore, the UK or the EU. We rely on the EU Standard Contractual Clauses and the UK Addendum, and on comparable protection under section 26 of Singapore's PDPA.
Cookies
We set no tracking or advertising cookies. When you log in we set one strictly necessary cookie that keeps you logged in; it is removed when you log out and carries no tracking. Cloudflare and Stripe may set strictly necessary security cookies. We count page visits with Cloudflare Web Analytics, which sets no cookies and doesn't track you across sites. The figures run in your browser and send nothing back.
How long
Order records are kept for 5 years for tax purposes. Briefs and messages are kept for 2 years after your last order, unless you ask us to delete them sooner. Uploaded photos are deleted 30 days after delivery. If you start a checkout for several figures and don't pay, those briefs are deleted after 7 days. Licence records are kept while the licence is active and for 5 years after. Log-in links and log-ins expire on their own. If you delete your account, we withdraw your licences and remove your name, email, briefs and previews; we keep only the payment amount and date (without your name) for tax.
Emails
We email you about your orders. We send marketing emails only if you opt in, and you can unsubscribe any time.
Children
Our customers are teachers, tutors, centres and other adults. We don't knowingly collect personal data from children, and the figures collect none from the students who use them.
If something goes wrong
If a data breach affects you, we will tell you and the relevant authority as the law requires.
Your rights
You can ask to see, correct or delete your data, or ask us to stop using it. Once you are logged in you can download your data and delete your account yourself; otherwise email hello@figbox.app. In the UK or EU you can also complain to your data protection authority; in Singapore, to the PDPC.