What we collect and why.

• Your account. Your name, email address and a hash of your password. We never store the password itself.
• Your sign-ins. Each signed-in session stores the IP address and browser (user agent) it came from, so a stolen session is easier to spot. A session lasts 30 days.
• Your businesses. Each business name and website, the competitors and social handles you add, your notification address and Slack webhook, and the name, logo and colour you set for client reports.
• What you ask Figo. Your Ask Figo questions and the answers, so you can come back to a conversation.
• Billing. Your plan, your subscription status and the id our payment provider gives you. Card details are handled by Stripe and never touch our servers.
• Fair-use counts. When you do something that costs us real money, such as adding a competitor or sending an Ask Figo message, we record that it happened, because plans have limits.
• Abuse limits. To stop floods of sign-ups, contact messages and page views, we count requests per IP address. The address is stored only as a salted hash, never as the address itself, and the counts are cleared after a few days.
• Messages to us. What you send through the contact form is emailed to our inbox with your name, email and company. It is not stored in the app.

Our own code, not a third-party script, records each page you open on tryfigo.com. With each page view we store the page address, the tracking tags in the link (such as utm_source), and, on the first page of a visit, the address of the page on another site that sent you. If you are signed in, the view is linked to your account; if not, it is linked to the random id in our figo_anon cookie. That includes client report pages, so opening a report link is recorded like any other page.

We also record a few product steps: starting a trial, saving competitors, starting checkout and a subscription starting.

Our emails contain a small image that tells us when an email is opened, and links to our own site pass through a short redirect that records the click. Both store which email it was, the time, and the user agent of the mail program. Links to other sites are not tracked. Our emails also load their fonts from Google Fonts, so a mail program that shows images asks Google for them.

Your browser also loads a few images straight from other sites. In the app and on client report pages, competitor icons come from Google’s favicon service, which sees the competitor’s website address. Our site footer shows three directory badges from twelve.tools, startupfa.me and findly.tools. Those sites see your IP address and browser, as any image host does.

We do not use advertising pixels, advertising cookies or third-party analytics.

• better-auth.session_token keeps you signed in, for up to 30 days.
• better-auth.session_data is a short-lived copy of your session, kept for 5 minutes so pages load faster.
• figo_ws remembers which of your businesses you last opened, for a year.
• figo_anon is a random id, set on your first visit and kept for a year, so we can see which of our pages people arrive on and whether they sign up. It is ours alone and never shared.

On a secure connection the first two carry a __Secure- prefix. None of them is used for advertising.

Public information only: pages on their websites, ads in public ad libraries, public social posts, public reviews and search rankings. Nothing behind a login, and nothing personal about their customers.

These providers run parts of Figo. Each gets only what it needs for its job, and we do not sell or rent your data to anyone.

• Vercel hosts the website and the app, so it handles every request, including your IP address.
• Neon hosts our database, where everything above is stored.
• Trigger.dev runs the scheduled checks, AI runs and emails. It processes the data those jobs work on: competitor data, the questions and prompts sent to the providers below, and the email addresses briefings go to.
• Stripe takes payments and holds your card, name, email and invoices.
• Resend sends our emails, so it sees your email address and what we send you.
• Anthropic (Claude) writes the briefings and insights, answers Ask Figo, reads websites (yours and your competitors’) to suggest competitors and questions and to summarise page and pricing changes, and decides which Reddit threads are relevant. It sees the competitor data involved and, for Ask Figo, your messages.
• DataForSEO supplies rankings, traffic estimates, business listings and reviews. It sees the websites being checked.
• ScrapeCreators supplies ads and social posts from the public ad libraries and profiles. It sees the competitor websites and handles being checked.
• Google supplies the small site icons shown next to each competitor. Your browser asks Google for them directly, so Google sees your IP address and the competitor’s website address.
• Slack, only if you add a Slack webhook, receives your briefings and alerts.

For as long as your account exists. If your trial ends or you cancel, the checks stop but your data is kept, so everything is still there if you come back. It stays until you delete your account or ask us to delete it.

Deleting your account in Settings deletes your businesses, competitors, gathered data, chats and account straight away. Page-view and email-open records are kept for our counts, but no longer linked to your name or account. A copy can survive in our database provider’s short-term backups until they roll over. Stripe keeps invoices for as long as tax law requires.

You can download a copy of your data from Settings, and delete your account there too. You can also ask us for a copy, ask us to fix something, or ask us to delete it, at any time. Email privacy@tryfigo.com or use the contact page. We reply within one working day.