Privacy policy.

Fig Technology Limited is a company registered in England & Wales, with its registered office at 11 Wandle Bank, Wimbledon, London, SW19 1DW, United Kingdom. Our privacy contact is Jay Hopkins, Managing Director, who is responsible for overseeing questions in relation to this policy. You can reach our privacy contact at enquiries@figgroup.co.uk.

• To provide and administer our services and accounts - performance of a contract.
• To take payment and keep financial records - contract and legal obligation.
• To provide support and respond to enquiries - contract and legitimate interests.
• To send relevant marketing - consent or legitimate interests, with an opt-out in every message.
• To secure our services and comply with law - legitimate interests and legal obligation.
• To understand consented website journeys, improve conversion, and prepare internal buyer-insight drafts - consent for non-essential analytics collection and our legitimate interests in improving our services and sales operations. AI output is advisory, requires human review, and cannot contact you, change your CRM record, set a price, or make an insurance decision.

We share User Personal Data only with service providers who help us run our business, each under appropriate data-protection terms, and with professional advisers or authorities where required by law. Our principal business-operations vendors are listed on our Sub-processors page (Microsoft 365, Xero, DocuSign, HubSpot, Anthropic and our payment processor). We do not sell personal data.

Card payments for our own invoices are processed by Stripe, which acts as an independent controller for the payment transaction and processes card data under its own terms and security standards. Fig does not store full card numbers.

Where personal data is transferred outside the UK or EEA, we rely on an appropriate safeguard - the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, or the EU-US / UK-US Data Privacy Framework where the recipient is certified. Details of processing locations for the Fig Platform are on the Sub-processors page.

We keep User Personal Data only for as long as needed for the purposes above and to meet legal, accounting, and reporting requirements, after which it is securely deleted or anonymised. Retention of data held within the Fig Platform on a customer's behalf is governed by the customer's agreement and our Data Retention Schedule.

Governed website-behaviour events and internal buyer-insight drafts are retained for up to 395 days, unless an earlier erasure or legal hold applies. The Anthropic API may retain model inputs and outputs for up to 30 days under its standard commercial API terms. We send only privacy-minimised cited evidence, do not use prompt caching, files, tools, or web search for this workload, and do not permit provider output to take an external action.

We may use Claude through Anthropic's commercial API to prepare a cited internal draft about an organisation's consented website journey. The system must abstain when evidence is incomplete, unsafe, or below the approved confidence threshold. Jay Hopkins reviews every draft before use, and you may ask us to inspect, correct, or delete the underlying record. We do not use this process to make a solely automated decision that produces legal or similarly significant effects.

Under UK and EU data-protection law you have rights to access, rectify, erase, restrict, and object to the processing of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any right, contact our privacy contact at enquiries@figgroup.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would welcome the chance to address your concern first.

Our website uses essential storage for security, checkout and form state, and to remember your privacy choices. We also collect first-party information for statistical purposes solely to improve the website. This channel counts aggregate page views, approved navigation actions and funnel stages. It does not send a visitor ID, session ID, customer ID, IP address, full referrer, query string or form content, and it stores aggregate counters rather than an individual browsing history. Aggregate statistics are retained for up to 400 days and are not used for advertising or joined to customer identities.

You can object to aggregate statistics immediately by selecting Use essential cookies only, or at any time through Cookie settings in the website footer. Your objection stops subsequent statistical events. Aggregate counts already created cannot identify you and therefore cannot be separated back out by visitor.

Our first-party session and journey analytics only runs after you give analytics consent. It is hosted in Microsoft Azure and helps us understand website journeys, content performance and where people encounter difficulty. It records a random, pseudonymous session identifier and controlled events covering page and route views, navigation, content engagement, form stages, chat stages, product interest and checkout stages. Raw journey event rows are retained for up to 90 days before deletion; longer-term reporting uses aggregated results.

Journey analytics does not collect form field values, chat messages, names, email addresses, phone numbers, postcodes, authentication content, card or payment content, or full URL query strings. Pre-identification activity may be linked to the resulting lead or order if you later identify yourself through a form or purchase, but only where valid analytics consent covered that activity. Any restricted identity bridge is created server-side and not sent to Google Analytics or Microsoft Clarity.

Microsoft Clarity and the Google Ads tag load in cookieless consent mode before your choice with analytics and advertising storage denied. In that mode they do not set optional analytics or advertising cookies. The Google tag can send consent-state and conversion pings without advertising identifiers so Google Ads can provide aggregate conversion modelling. Clarity cookies, full session features and Google Analytics storage remain disabled unless you select analytics. Advertising storage, advertising personalisation and enhanced conversion user data remain disabled unless you select advertising. You can change or withdraw these choices at any time through Cookie settings. Withdrawal stops future consented journey events and behavioural linkage, clears optional analytics cookies, and returns Clarity to cookieless denied-storage mode. The rights described above, including access, erasure, objection and withdrawal of consent, apply to personal data used for this analytics processing; legal retention duties may still apply to completed orders and financial records.

We may update this policy from time to time. The effective date above shows when it was last revised; material changes will be highlighted on this page.

Fig Technology Limited · 11 Wandle Bank, Wimbledon, London, SW19 1DW, United Kingdom · Privacy contact: Jay Hopkins, Managing Director.