Last Updated: January 4, 2026
Effective Date: January 4, 2026
Figure, Inc. ("Figure," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we collect, use, store, share, and protect information when you use our mobile application (the "App") and related services (collectively, the "Services").
Company Information:
Figure, Inc.
333 Sylvan Ave, Suite 305
Englewood
Cliffs, NJ 07632
Email: privacy@figure.dev
Support:
legal@figure.dev
By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please do not use our Services.
We collect information in three ways: directly from you, automatically through your use of the Services, and from third-party sources.
Account Information: When you register for an account, we collect:
Transaction Data: When you make a purchase:
Customer Support Data: When you contact us for assistance:
User-Generated Content:
Survey and Research Data: Information you provide when participating in surveys, focus groups, or user research activities.
Device Information:
Usage Data:
Location Data: With your explicit permission, we collect:
Network Information:
We use the following technologies:
Cookies: Small text files stored on your device to:
Software Development Kits (SDKs): We integrate third-party SDKs including:
Analytics Tools: We use analytics services to understand how users interact with our Services and improve user experience.
Advertising Identifiers: We may collect mobile advertising IDs (IDFA/Android Advertising ID) to:
Social Media: If you connect your account via social media (Facebook, Google):
Marketing Partners: We may receive demographic information and interests from third-party data providers to better understand our user base.
Fraud Prevention Services: We receive information from fraud detection services to protect against unauthorized transactions.
We process your personal data for the following specific purposes, based on applicable legal grounds:
Transactional Communications (no consent required):
Marketing Communications (consent required):
Our Legitimate Interests Explained: Where we process data based on legitimate interests, we have determined that our business interests do not override your fundamental rights and freedoms. Our legitimate interests include operating and improving our Services, preventing fraud, ensuring security, and conducting analytics to enhance user experience. You have the right to object to processing based on legitimate interests.
We do not sell your personal information to third parties for monetary consideration. We share data only in the following limited circumstances:
We share data with trusted third-party companies that provide services on our behalf:
Cloud Infrastructure:
Analytics, Logging and Performance:
Customer Support:
Email and Communication:
Payment Processing:
Shipping and Fulfillment:
Data Processing Agreements: All service providers are contractually obligated to protect your data, use it only for specified purposes, and comply with applicable privacy laws including GDPR Standard Contractual Clauses where applicable.
If Figure, Inc. is involved in a merger, acquisition, asset sale, bankruptcy, or similar transaction, your personal information may be transferred to the successor entity. We will notify you via email and/or prominent notice in the App at least 30 days before your information becomes subject to a different privacy policy.
We may disclose your information when we believe in good faith that disclosure is necessary to:
We may share aggregated, anonymized data that cannot identify you with:
We may share your information with third parties when you explicitly consent to such sharing, such as when you:
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal obligations.
Account Data:
Transaction and Order Data:
Marketing Data:
Customer Support Data:
Usage and Analytics Data:
Legal Hold:
Deletion Process: When retention periods expire, we securely delete or anonymize your data using industry-standard methods.
Depending on your location, you may have the following rights regarding your personal data:
Right to Access: Request a copy of the personal data we hold about you.
Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
How to Exercise:
Right to Correction: Request correction of inaccurate or incomplete data.
How to Exercise:
Right to Deletion (Right to be Forgotten): Request deletion of your account and personal data.
How to Exercise:
Limitations: We may retain certain data when:
Email Marketing:
Push Notifications:
SMS/Text Messages:
Targeted Advertising:
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
How to Exercise: Email legal@figure.dev with details about the processing you object to. We will cease processing unless we have compelling legitimate grounds that override your interests.
Right to Restrict: Request that we limit how we use your data in certain circumstances (e.g., while we verify accuracy of disputed data).
How to Exercise: Email legal@figure.dev with your request.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
How to Exercise:
Right to Complain: If you believe we have violated your privacy rights, you may lodge a complaint with a supervisory authority.
EU/EEA Residents: Contact your local Data Protection Authority (DPA):
UK Residents: Information Commissioner's Office (ICO):
California Residents: California Attorney General:
Other Jurisdictions: Contact your local privacy regulator or consumer protection agency.
We implement robust technical and organizational measures to protect your personal data:
Encryption:
Access Controls:
Infrastructure Security:
Application Security:
Employee Training:
Incident Response:
Limitations: No method of transmission over the internet or electronic storage is 100% secure. While we implement industry-standard security measures, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your password and account credentials.
In the event of a data breach that poses a risk to your rights and freedoms:
Notification to Users:
Notification to Authorities:
How to Report Suspected Breaches: If you suspect unauthorized access to your account:
Figure, Inc. is based in the United States. If you access our Services from outside the US, your information will be transferred to, stored, and processed in the United States and potentially other countries where our service providers operate.
Legal Mechanisms for Transfers:
For EU/EEA and UK Users:
For Swiss Users:
For Other Jurisdictions:
Your Consent: By using our Services, you acknowledge and consent to the transfer of your information to the United States and other countries that may have different data protection laws than your country of residence.
Adequacy: We conduct transfer impact assessments and implement technical measures (encryption, pseudonymization) to ensure adequate protection during international transfers.
Our Services are not intended for individuals under the age of 13 (or 16 in the European Economic Area, or the applicable age of digital consent in your jurisdiction).
No Knowing Collection: We do not knowingly collect personal information from children under these age thresholds.
Parental Rights: If you are a parent or guardian and believe your child has provided us with personal information:
Age Verification: We use age-gating mechanisms during account registration to prevent underage users from creating accounts.
School or Educational Use: If you are an educational institution interested in using our Services for students under 18, please contact us at education@figure.dev to discuss COPPA/FERPA-compliant arrangements.
This section applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
Categories of Personal Information Collected (Last 12 Months):
| Category | Examples | Collected | Business Purpose |
|---|---|---|---|
| Identifiers | Name, email, phone, IP address | Yes | Account creation, service delivery |
| Commercial Information | Purchase history, transaction data | Yes | Order processing, analytics |
| Internet Activity | Browsing history, search queries | Yes | Service improvement, analytics |
| Geolocation Data | Precise location coordinates | Yes (with consent) | Shipping calculations, local recommendations |
| Sensory Data | Profile photos, product images | Yes (voluntary) | User-generated content |
| Inferences | User preferences, behavioral predictions | Yes | Personalization, recommendations |
Sources of Personal Information:
Disclosure for Business Purposes: In the last 12 months, we disclosed personal information to service providers for:
Sale or Sharing of Personal Information:
Sensitive Personal Information: We collect date of birth for age verification. We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA.
Right to Limit Use of Sensitive Personal Information: Email legal@figure.dev to limit use of your sensitive personal information.
Your California Privacy Rights:
Authorized Agent: You may designate an authorized agent to make requests on your behalf. The agent must provide:
Verification Process: To verify your identity, we may ask you to:
Response Timeline: We will respond to verifiable requests within 45 days (extendable by an additional 45 days with notice).
Shine the Light Law (California Civil Code ยง 1798.83): California residents may request information about disclosure of personal information to third parties for direct marketing purposes. Email legal@figure.dev with "California Shine the Light Request."
Contact for California Privacy Rights:
Email:
legal@figure.dev
Online Form:
www.figure.dev/privacy
This section applies to individuals in the European Economic Area (EEA), United Kingdom, and Switzerland.
Data Controller: Figure, Inc. is the data controller responsible for your personal data.
Legal Bases for Processing: We process your personal data under the following legal bases:
Your Rights Under GDPR:
Automated Decision-Making: We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.
International Transfers: We transfer data outside the EEA/UK using Standard Contractual Clauses (SCCs). Copies available upon request.
Data Protection Officer: For GDPR-related inquiries:
Email:
legal@figure.dev
Postal Address: Data Protection Officer
(Legal), Figure, Inc., 333 Sylvan Ave Suite 305, Englewood Cliffs, NJ 07632
Supervisory Authority: You have the right to lodge a complaint with your local Data Protection Authority. Find your DPA at: https://edpb.europa.eu/about-edpb/board/members_en
Data Retention: See Section 5 for detailed retention periods. Data is retained only as long as necessary for the purposes outlined in this policy.
Brazil (LGPD): Brazilian residents have rights similar to GDPR, including access, correction, deletion, and portability. Contact legal@figure.dev to exercise your rights.
Canada (PIPEDA): Canadian residents have rights to access and correct personal information. Contact legal@figure.dev for assistance.
Australia (Privacy Act): Australian residents can access and correct their personal information. Contact legal@figure.dev with requests.
Other Regions: If you are located in a jurisdiction with specific privacy laws, please contact legal@figure.dev and we will work with you to address your rights under applicable law.
Essential Cookies:
Analytics Cookies:
Marketing Cookies:
Preference Cookies:
In-App Controls:
Browser Controls:
Third-Party Opt-Out Tools:
Do Not Track (DNT):
EU Cookie Consent:
Our App may contain links to third-party websites, services, or applications not operated by Figure, Inc.
No Responsibility: We are not responsible for the privacy practices of third parties. We encourage you to review their privacy policies.
Third-Party Login: If you use social media login (Google, Facebook), your information is subject to their privacy policies:
Embedded Content: Third-party content embedded in our App (e.g., YouTube videos, social media widgets) may collect data according to their own privacy policies.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification of Changes:
Material Changes: We will notify you at least 30 days before material changes take effect via:
Non-Material Changes: We will update the "Last Updated" date at the top of this policy
Your Acceptance:
Version History: Previous versions of this policy are available upon request at legal@figure.dev.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:
General Inquiries:
Email: legal@figure.dev
Phone: 1-855-534-4873 (Monday-Friday, 9 AM - 5 PM PT)
Online Form:
www.figure.dev/privacy
Data Protection Officer (GDPR/UK):
Email:
legal@figure.dev
California Privacy Requests:
Email:
legal@figure.dev (Subject: "California Privacy Request")
Postal Address:
Figure, Inc.
Attn: Figure Legal
333 Sylvan Ave, Suite
305
Englewood Cliffs, NJ 07632
United States
Response Time: We strive to respond to all inquiries within 5-10 business days, and to formal rights requests within the timeframes required by applicable law (typically 30-45 days).
Personal Data/Personal Information: Information that identifies, relates to, describes, or can be reasonably linked to you.
Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
Controller: The entity that determines the purposes and means of processing personal data (Figure, Inc.).
Processor: An entity that processes personal data on behalf of the controller (our service providers).
Consent: Freely given, specific, informed, and unambiguous agreement to processing of personal data.
Legitimate Interest: A lawful basis for processing when our interests do not override your fundamental rights and freedoms.
Acknowledgment: By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.
This Privacy Policy was drafted to comply with GDPR, CCPA/CPRA, COPPA, and other applicable privacy laws. It should be reviewed by legal counsel before deployment.