Privacy

This page is a translation; in the event of any discrepancy, the French version prevails.

Last updated: November 1, 2026. This page explains what we do with your photo and your data, who has access to them, how long we keep them, and how you take back control of them. It is written to be read, not skimmed.

Who processes your data

FIGU, data controller within the meaning of Regulation (EU) 2016/679, known as the GDPR. Its identity and contact details are given in the legal notice.

For any question about this page or to exercise your rights: contact@figushop.com.

What we process, and why

We don’t collect anything “just in case.” Each piece of data below serves a specific step in making your figurine.

Your account: email address, password (which we never see: it is hashed by our authentication provider) or Google identifier if you sign in with Google, account creation and sign-in dates. Without an account, we could neither find your creation nor let you delete your photo.
Your photo: the image you submit, its cropped version, its dimensions, the file name, as well as the version of the rights notice displayed when you submitted it, and the date.
Your configuration: style, pose, size, number of people and pets, and the generated previews.
Your order, once you place one: name, delivery address, email address, phone number (for the carrier), amount, and shipment tracking.
Your review, if you leave one: your rating, your text, the name you choose to display, the photo you attach, and your consent to its publication, linked to your order. We ask you for it by email after delivery, once and then one reminder; each of these emails lets you stop the requests.
Your address, if you ask for your preview by email: the address, the language and country of your visit, the creation concerned, and the date of each email sent, so that we never write to you more than once a day.
Technical logs kept by our hosting providers: IP address, date and nature of the request, which are essential to keep the service running and to detect abuse.
Your visit: traffic statistics, with no measurement cookie and without your IP address, described below, which you can opt out of.
If you agree: visit statistics through Google Analytics and, separately, the measurement of our ads through Google’s tools. Without your consent, none of this is loaded.
If you accept advertising: measurement of our ads on Facebook and Instagram by the Meta pixel and, for an order placed after that consent, sending the purchase to Meta (order number, amount, currency) with your email address, phone number and country in encrypted (hashed) form, to know which ad led to it. Without your consent, nothing is loaded or sent.
If you accept advertising: measurement of our ads on Pinterest by its tag (pages viewed, the preview, adding to cart and the purchase, with its order number, amount and currency), to know which ad led to it. Without your consent, nothing is loaded or sent.

The legal basis is the performance of the contract between us (Article 6.1.b of the GDPR) for everything used to create, make, and deliver your figurine. It is a legal obligation (Article 6.1.c) for the accounting records linked to an order, and our legitimate interest (Article 6.1.f) for the security of the service and the measurement of its traffic. Google Analytics statistics and ad measurement rely on your consent (Article 6.1.a), which you can withdraw at any time. If you start a creation without ordering it, we may email you your preview, three times at most, on the basis of our legitimate interest: you can refuse this when you create your account (“No thanks”) and at any time through the unsubscribe link in each email. If you give us your address to receive your preview, or accept our emails when you create your account, you also receive a few reminders and our offers, one email a day at most, on the basis of your consent, which you can withdraw in one click in each of them. We send no other marketing messages without your consent.

Your photo, handled separately

It is the most sensitive data you entrust to us, and we treat it as such.

It is stored in a private storage space. No public address leads to it. When necessary, our servers issue short-lived signed links, and nothing else can open it.
We perform no facial recognition and make no attempt to identify the people in your photos. No biometric template is calculated or stored.
Your photo is never used to train a model, whether ours or anyone else’s, and it is not sold, rented, or transferred to anyone other than the providers named below.
It is never published. If we ever wished to show a creation, we would ask you separately, and saying no would have no effect on your order.
If you tap “Show someone” on your preview, a private link is created: it shows the preview of your FIGU, never your original photo, to whoever receives it, who can view it and order it as it is. It cannot be guessed, and it stops working when the creation is deleted.

Who else has access

We use providers who act on our instructions and solely for our purposes. Here they are, with what they see and where they operate.

Supabase: accounts, database, and photo storage. Data hosted in the European Union.
Vercel: website hosting. Company based in the United States.
OpenAI: generating your figurine’s preview from your photo, counting the people and animals it shows to prefill your choice, and automatically checking that it can serve as a model: a visible person or animal, with no nudity or shocking content. A rejected photo is not used for any preview. It also answers the questions you type to the site’s assistant; these questions and its answers are kept by FIGU for one year at most, to improve the assistant; photos you attach are not kept. Company based in the United States. Processing is done through its application programming interface (API), whose terms for business customers exclude the use of submitted content to train its models.
Resend: sending the emails for your orders (confirmation, shipping, delivery) and for your custom quote requests: your name, your contact details, the order details or your message. The emails about your order, sent to you alone, also carry a small image of each item’s preview; the photo of your creation is only sent for a quote. Company based in the United States.
The production workshop, located in China: it receives your photo, the preview you approved, and the figurine’s specifications, since an artisan shapes the figurine from them. It receives neither your email address nor your bank details.
Stripe: online payment. You enter your card details with Stripe: we never see or store them. Stripe receives your email address, the delivery name, address, and phone number you give it, the amount, the names of the items ordered and, to show them on its payment page, a small image of each item’s preview, available only while you pay; never your photo. Company based in Ireland (Stripe Payments Europe); some of the data may be processed in the United States.
17TRACK: tracking your package once it has shipped, so we know when it is delivered. It receives the tracking number and an order reference, nothing else: no name, no address, no email. Company based in China.
Google (Google Tag Manager, Google Analytics, and its advertising tools), only if you agree: the pages viewed, technical information about your browser, and the identifiers of its cookies. Company established in the United States.
Meta (Facebook, Instagram), only if you accept advertising: pages viewed, technical information about your browser, its cookie identifiers and, for a purchase, the encrypted data described above. Company established in Ireland and the United States.
Pinterest, only if you accept advertising: pages viewed, technical information about your browser, its cookie identifiers and the steps described above. Company established in Ireland and the United States.

Apart from these providers, your data is not disclosed to anyone, except upon a request from a judicial authority that we would be legally bound to answer.

Transfers outside the European Union

Several of these providers process data outside the European Union, and we would rather say so plainly than bury it in boilerplate.

The United States, for website hosting, preview generation, sending emails, and part of the payment processing, as well as, if you agree, for Google’s measurements; Google adheres to the EU-U.S. Data Privacy Framework.
Meta, if you accept advertising, which also adheres to the EU-US Data Privacy Framework.
Pinterest, if you accept advertising, which also adheres to the EU-US Data Privacy Framework.
China, for production. This country is not covered by any adequacy decision of the European Commission: the transfer therefore relies on the standard contractual clauses adopted by the Commission, within the meaning of Article 46 of the GDPR, supplemented by the necessary measures.

You can ask us for a copy of the safeguards governing these transfers, at the address given above.

How long we keep them

A creation started without an account: you can upload your photo, see your first five previews and even order without creating an account; an account is only required for a second adjustment or a sixth preview. Without an order or an account, the photo and the creation are deleted after 7 days. If you order, the rule for an ordered creation applies; if you create an account, they are added to it.
A creation without an order: the photo and its previews are deleted after 90 days without activity on the creation.
An ordered creation: the photo is deleted 90 days after delivery. This period covers a complaint, breakage in transit, or a remake; after that, it is of no further use to us and we have no reason to keep it.
A review: published for 5 years, then deleted along with its photo. A rejected review is deleted after 1 year. You can have yours removed at any time by writing to us.
An address given to receive a preview: 3 years after your last visit, or until you unsubscribe; after that, we keep only what we need to never write to you again.
Your account: for as long as it exists. You can delete it at any time, which erases your creations and your photos.
Accounting records of an order (invoice, amount, date): 10 years, as required by article L123-22 of the French Commercial Code. They do not contain your photo.
Technical logs: 12 months at most.
Traffic statistics: 13 months at most.
Google Analytics cookies: 13 months at most. Your cookie choice: 6 months, after which we ask you again.
Meta cookies: 90 days.
Pinterest cookies: one year.

Photos showing other people

Under French law, a person’s image belongs to them (article 9 of the French Civil Code). When you submit a photo, a notice reminds you that by continuing, you confirm you have the right to use it and the consent of the people in it, or of their legal representatives in the case of a minor. We keep the version of this notice along with the date.

If you appear in a photo submitted by someone else, write to us: we will delete the image and everything derived from it, without asking you to justify your request beyond what allows us to recognize you in it.

Your rights

You have the right of access, rectification, erasure, restriction, objection, and portability (Articles 15 to 22 of the GDPR).

Erasure requires no request: you delete your account yourself from your profile, at the bottom of the “Your data” section. Your photos, your creations, and their previews are then removed from our files and our database, immediately and irreversibly. Only the accounting records of your past orders remain, without your photo, for the legal period stated above. If an order is in production, erasing the photo prevents it from being completed: we tell you so before acting, not after.

For your other rights, write to us at contact@figushop.com: we respond within one month, and sooner when possible.

If you are not satisfied with our response, you can contact the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

Audience measurement

To know how many people visit the site, where they come from, and at which step they stop, we measure its traffic ourselves, with no outside tool. These statistics are used to improve the site and for nothing else: no advertising, no profiling, no resale.

What is counted: the pages viewed and how long the visit lasts; the steps of a creation (creation started, photo sent, preview received, added to cart, payment, purchase); the choices made on the preview (size, head, pose, size guide, adjustment, offers); the code of an error shown when sending a photo or on the preview, never the photo itself; whether the account request was shown; the number of items in the cart and its value; the country and the city, inferred from your connection by our hosting provider (never more precise than the city); the language; the type of device (phone, tablet, or computer, based on the screen size); the site or campaign that brought you here; and whether you are signed in.
How a visit is recognized: by an identifier drawn at random and kept in your browser’s local storage (figu.visiteur), and another one for the current visit (figu.visite), forgotten when the tab is closed. They contain nothing that identifies you. When a visit leads to an order, the purchase is counted in it, but not the order itself: the measurement never says who bought.
What is not: no measurement cookie, no fingerprint of your device, no third-party tool in this measurement (Google Analytics, described below, only loads with your consent). Your IP address is not recorded: for the duration of a request, it is only used to slow down bots. The statistics stay with us and are neither sold nor shared.
For how long: the visitor identifier is renewed after 13 months, without ever being extended, and measurements older than 13 months are deleted.

You can choose not to be counted, at any time, with no consequence for your browsing or your orders. The choice applies to this browser; it is kept in its local storage (figu.mesure) and in a cookie (figu-mesure), which lets it survive signing out. If your browser sends the Global Privacy Control signal, it counts as an opt-out, with nothing to set here.

Don’t count me

Cookies and local storage

The site sets no audience measurement, advertising or social media cookies without your consent. On your first visit, a banner lets you accept or decline, one as easily as the other, and choose purpose by purpose; you can change your mind at any time with the “Manage cookies” link at the bottom of every page. Until you choose, nothing from Google or Meta is loaded. Cookies needed for the site to work do not require consent:

the session cookies of our authentication provider, which keep you signed in and cannot be accessed by the page’s scripts;
figu-connecte, a simple marker that tells the interface you are signed in. It grants no access by itself. Its value, drawn at random at each sign-in, contains nothing that identifies you.
figu-invite and figu-invite-jeton, set when you start a creation without an account: the first tells the interface to offer you an account before the preview; the second, inaccessible to scripts, makes it possible to link your creation to the account you will create. They disappear when you sign in, and after 7 days at most.
figu-sortie, set when you sign out or delete your account: it asks the next page to erase what this browser kept from the account (cart, creations), then disappears, after 30 days at most. It says nothing about you.
figu-reprise, set when you open the link in an email that resumes a payment: it keeps the reference of that payment for the order pages only, and cannot be accessed by scripts (2 hours).
figu-pays, your country, which sets the currency and the units of measurement: kept for one year if you chose it in the selector, one day if it comes from the link you arrived by (an ad, a page in another language).
figu-langue, the language of the site: kept for one year if you chose it in the selector, one day if it comes from the link you arrived by.
figu-pub, set when you arrive through some of our ads: it keeps only the name of the ad (for example animaux), so that the site keeps showing you the same examples during your visit (one day).
figu-mesure, set only if you opt out of audience measurement: it remembers that choice, and nothing else.
figu-equipe, set only on our team’s devices, so that our own visits and test orders are not counted (13 months).
figu-client, set when an order is paid from this browser: it tells the site not to show you the welcome offer again, which is for a first purchase only (2 years). It says nothing else about you.
__stripe_mid and __stripe_sid, set by Stripe, our payment provider, on the payment page only, to detect fraud (one year for the first, 30 minutes for the second).

Version tests (A/B): to find out which version of a page helps most, we sometimes show two, each to one half of visitors, drawn at random. A cookie remembers the version drawn, so that you see the same one again: it contains only its name (for example avec or sans), nothing that identifies you. The version seen is recorded in the audience measurement described above, which compares the two halves. If you opt out of being counted, or if your browser sends the Global Privacy Control signal, no test is drawn for you: you see the usual version, without any of these cookies. Each of these cookies lasts 30 days, and a finished test no longer sets its own:

figu-essai-bandeau: two layouts of the cookie window.
figu-essai-notification: with or without the badge showing how many previews were created in the last 24 hours.
figu-essai-prix: with or without the starting price under the button on the home page.
figu-essai-chemin: two sequences of screens between choosing the photo and the preview.
figu-essai-panier: two layouts of the cart.
figu-essai-arrivee: coming from an ad, arriving on the home page or directly on the photo screen.
figu-essai-style: for a figurine of two people or more, the Big Head or the Classic selected by default.
figu-essai-appli: in the Facebook or Instagram app, payment opened in the app, or in Safari or Chrome.
figu-essai-cookies-photo: when arriving on the photo screen, the cookie window right away, or once the photo is sent.
figu-essai-prix-style: on the style screen, the starting price on each card, or only on the preview.

Only with your consent: _ga and _ga_…, set by Google Analytics if you accept visit statistics, to tell visitors apart (13 months at most); Google’s advertising cookies (_gcl_…), if you accept advertising. Withdrawing your consent deletes them.

Only with your consent to advertising: _fbp and _fbc, set by the Meta pixel to link a visit to a Facebook or Instagram ad (90 days). Withdrawing your consent deletes them.

Only with your consent to advertising: _pin_unauth, _epik and _derived_epik, set by the Pinterest tag to link a visit to a Pinterest ad (one year). Withdrawing your consent deletes them.

Your choice is kept in this browser’s local storage (figu.consentement), with nothing that identifies you. It stays after you sign out, since it applies to this browser, and we ask you again after six months.

Your browser also keeps, in its local storage, the creation in progress, the cart, and its options (figu.configurations.v1, figu.cart.v1, figu.cart.options.v1), the time a creation was last brought back to your attention on this device, so as not to remind you too often (figu.rappel.v1), and the identifiers of the audience measurement described above (figu.visiteur, figu.visite, figu.mesure). This data stays on your device, is erased when you sign out, and disappears if you clear the site’s data.

Your browser also keeps there, with nothing that identifies you:

figu.cart.promo.v1, the promo code you entered, to show the discount in the cart (payment checks it again).
figu.commandes.envoi.v1, the items sent to payment with each order, so that only they are removed from the cart once the order is paid (10 orders at most).
figu.commandes.panier-vide.v1, the numbers of the orders whose cart has already been emptied, so as not to empty a cart filled since (20 orders at most).
figu.reprise-oubli.v1, after a request for a new password, the page where you can pick up your creation (one hour).
figu.compte.v1, a hash of the signed-in account, never your email address or your identifier: if another account signs in on this browser, the first account’s data is erased first.
figu.offre-apero.v1, the creations for which the matching accessory has already been offered to you, so as not to offer it twice (100 at most).
figu.zoom.vu, the fact that you have already zoomed in on a preview, so the hint is no longer shown.
figu.citations.vues, the sentences already read while a preview was being prepared, to show you new ones (300 at most).
figu.meta.achats and figu.pinterest.achats, only with your consent to advertising: the numbers of the latest orders already reported to Meta or Pinterest, so that they are never reported twice (20 at most).
figu.contact, the fact that you have already asked for your preview by email on this device, so that it is no longer offered to you.

And, in the tab’s storage, erased when the tab is closed:

figu.suite-invite.v1, the change you asked for on the preview just before creating your account, so you find it again afterwards (one hour).
figu.rappel.accord, your choice to receive your preview by email or not, while you create your account.
figu.rattrapage.v1, the creations for which you have already been offered a chance to correct the preview.
figu.recadrer, a request to recrop the photo, valid for ten seconds.
figu.notification, the time the previews badge appeared, so that it is not shown too often.
figu.garder.depart, the “Keep your FIGU” window already shown during this visit, so that it is not shown twice.

The site’s fonts are downloaded at build time and served from our own domain: your browser does not contact any external font server.

Security

Photos are kept in a private storage space that no public address leads to. Uploads go from the browser to this space through a single-use, short-lived signed link, issued by our server after checking your session. Session cookies are marked httpOnly, so a script injected into the page cannot read them. Access to the database goes through our server, never through your browser.

Changes

If this page changes, the update date at the top changes with it. Any change affecting what we do with your photo would be brought to your attention, not slipped quietly into a revision.