1. Who processes your data
The data controller is FIGUE, a French simplified joint-stock company registered with the Mulhouse trade and companies register under number 911 453 835, with registered office at 57 rue Victor Schoelcher, 68200 Mulhouse, France.
Contact: hello@figue.io.
2. Our two capacities
Figue acts in two distinct capacities:
- Controller : for data needed to manage accounts, the commercial relationship, billing, security and audience measurement.
- Processor : for content the Client uploads to its Organisation and for data Figue accesses through the Client's systems. Such processing is carried out on the Client's instructions, solely in order to perform the service.
3. Data processed
- Identity and account : name, email address, profile picture, organisation and role.
- Sign-in and security : IP address, user agent, city and country inferred from the connection, date and time, log of sensitive actions.
- Production content : requests, comments, documents and project context, attachments, voice notes.
- Meetings : video conference recording, transcript, notes and automatically generated summary.
- Billing : company name, billing address, intra-community VAT number, number of Slots subscribed, discounted rates and promotional codes applied, invoice history. Payment data is processed by Stripe and never stored by Figue.
- Access to the Client's systems : environment addresses, sign-in credentials — encrypted — and a log of their consultation.
- Audience measurement : pages viewed, referral source, navigation events.
Figue does not collect a telephone number when an account is created and does not offer social sign-in.
4. Purposes and legal bases
- Providing the service and performing the contract : performance of the contract.
- Invoicing and collection : performance of the contract and legal obligation.
- Ensuring security, preventing fraud and logging access : legitimate interest.
- Improving the service and measuring audience : legitimate interest, and consent for trackers that require it.
- Prospecting and communicating : legitimate interest, and consent where required.
- Retaining accounting records : legal obligation.
5. Processing assisted by artificial intelligence
Figue uses artificial intelligence systems to analyse and estimate Requests, transcribe recordings and assist production — writing and reviewing code, testing, documentation. Request content — description, comments, project context, attachments, transcripts — together with all or part of the product's code is transmitted to model providers for these purposes.
Automated processing of code runs in isolated, ephemeral environments, destroyed at the end of the run, with restricted network egress.
Figue does not retrain any model on its clients' content and selects providers whose terms exclude the use of transmitted content for model training.
Uploaded files are automatically converted so that a model can read them: transcription of audio and video files, text extraction from office documents, key-frame extraction from videos.
Where the Client requires its own tools or services, data passing through them is processed under the Client's responsibility and under its own providers' terms.
6. Recorded and transcribed meetings
Follow-up meetings may be recorded. The recording is copied into private storage, transcribed and then summarised automatically. All of it is kept in the Client's workspace.
Participants are informed at the start of the meeting and may object to recording. The Client informs the people it invites.
7. Recipients and sub-processors
Figue does not sell any data.
Data is accessible to authorised Figue staff and to its technical sub-processors, listed on the Sub-processors page, which is kept up to date.
It may be disclosed to an authority where the law so requires, and to Figue's advisers in the event of a dispute.
8. Transfers outside the European Union
Some sub-processors are established outside the European Union, notably in the United States: hosting, model providers, monitoring, email, video conferencing and audience measurement.
Such transfers are framed by the European Commission's standard contractual clauses and, where applicable, by appropriate supplementary measures. Details appear on the Sub-processors page.
9. Retention periods
Data is kept for the duration of the contractual relationship, then for the applicable limitation periods — five years under Article 2224 of the French Civil Code — for evidentiary purposes and project continuity.
- Accounting records and invoices: ten years, in accordance with Article L123-22 of the French Commercial Code.
- Prospecting data: three years from the last contact.
- Sign-in and security logs: twelve months.
- Inactive requests: automatically archived after sixty days without activity.
- Access to the Client's systems: revoked at the end of the subscription; the corresponding secrets are deleted within thirty days.
A user account is deleted on request, which also removes its sessions, its notifications and its sign-in identity. The Organisation's production history and deliverables are kept or anonymised, subject to legal obligations and evidentiary needs.
The Client may request the deletion or anonymisation of its Organisation's content. Such a request is granted within the limits of statutory retention obligations.
10. Security
Figue implements measures appropriate to the risk:
- encryption of communications and of stored secrets;
- data partitioning by organisation;
- access control and named authorisations;
- logging of sensitive access and of secret consultations;
- isolation of automated processing in ephemeral environments with restricted network egress.
In the event of a data breach likely to create a risk, Figue notifies the competent authority and, where the regulations so require, the individuals concerned.
11. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what becomes of your data after your death.
These rights are exercised at hello@figue.io. Proof of identity may be requested in the event of reasonable doubt.
Where Figue acts as a processor, the request is passed to the client acting as controller, who responds to it.
12. Cookies and trackers
The website and the Platform set the following trackers:
- Necessary : authentication, language preference, security and load balancing. They do not require consent.
- Audience measurement : website traffic statistics and Platform usage statistics.
- Advertising and conversion : Meta Pixel and Google Tag Manager, used to measure the effectiveness of the public website's campaigns.
Advertising and conversion trackers are not necessary for the service to work. You can block them from your browser settings or with a dedicated extension.
13. Contact and complaints
For any question about this policy: hello@figue.io.
You may lodge a complaint with the French data protection authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.