This Privacy Policy describes how Marketing Gewerk e.U. ("we," "us," or "our") accesses, collects, stores, uses, and shares your personal information when you use our services, including when you visit our website at figaviyo.com or use the Figaviyo Figma plugin.

Questions or concerns? If you have any questions about this Privacy Policy or our practices, please contact us at privacy@figaviyo.com.

1. What information we collect

Information you provide

When you register for an account, contact us, or interact with the Service, we may collect:

• Names
• Email addresses
• Passwords (encrypted; we never see your plaintext password)
• Contact and authentication data
• Billing addresses
• Subscription and payment information (handled by Stripe — see below)
• Email design files you choose to push to Klaviyo through the plugin
• When you connect a Klaviyo account: its account ID and name, and an encrypted access credential (see section 11)
• Usage data and analytics

Payment data

If you subscribe to a paid plan, payment data (card numbers, security codes) is collected and handled exclusively by Stripe. We never store full card details on our servers.

Information collected automatically

When you visit our website or use the plugin, we automatically collect log and usage data, device information, and IP addresses. This is used to keep the Service running, prevent abuse, and improve performance.

2. How we use your information

We process your personal information for the following purposes:

• To create and manage your account and authenticate you
• To deliver the Service (push email designs to your Klaviyo account)
• To process payments and send subscription receipts
• To provide customer support and respond to your inquiries
• To detect and prevent fraud, abuse, or security incidents
• To comply with legal obligations
• For analytics, to understand how the Service is used and improve it

3. Legal bases for processing (EU/UK)

If you are in the European Economic Area (EEA) or United Kingdom (UK), the General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on. We process your information based on:

• Consent — you have given us permission for a specific purpose, which you can withdraw at any time
• Performance of a contract — when processing is necessary to provide the Service you've subscribed to
• Legal obligations — when we need to comply with applicable laws
• Legitimate interests — for fraud prevention, service improvement, and security

4. When and with whom we share information

We may share your information in the following situations:

• With Stripe, our payment processor, to handle subscriptions
• With Klaviyo, when you push designs through the plugin (this is the action you initiate)
• With Anthropic, our AI provider, when you use section detection or alt-text generation (see section 6)
• With our hosting and infrastructure providers, Railway and Supabase, which run the Service and store its data
• With YouTube (Google), only if you click play on the video in our guide (see section 5)
• For business transfers, in the event of a merger, acquisition, or sale of assets
• To comply with law, when required by court order or governmental request

We do not sell your personal information. We do not share it with advertisers for targeted advertising. We do not use any third-party analytics service — no Google Analytics, no advertising pixels, and no data sent to analytics companies.

5. Cookies and usage measurement

Cookies

We do not use cookies for advertising or for third-party analytics. Two kinds of storage are used, both strictly for running the Service:

• Signing in. When you sign in, your browser stores a session so you stay signed in between visits. Clearing it signs you out.
• Security. Our hosting and CDN providers may set strictly necessary cookies to protect the Service against automated abuse.

Usage measurement

We measure how the Service is used on our own servers. We do not send this data to any analytics company.

• On the website, we record when a page is opened, when someone clicks a link to install the plugin and which part of the page it was clicked from, and how far into the demo video someone watches. A random identifier is stored in your browser so we can tell one visitor clicking twice from two visitors clicking once. The video is played from our own servers, so watching it does not tell any video platform who you are.
• In the plugin, we record steps such as opening the plugin, connecting a Klaviyo account, and completing an export, so we can find where setup gets stuck. A random identifier is stored by Figma on your device for the same purpose.

These identifiers are random strings. They are not linked to your name or email unless you are signed in, they are not shared with anyone, and they cannot be used to follow you across other websites. Clearing your browser storage, or removing the plugin, resets them.

YouTube video in our guide

Our guide How to export a Figma email to Klaviyo includes a video hosted on YouTube. Until you click it, the page shows only a preview image from our own servers and loads nothing from YouTube. When you click play, the video loads from youtube-nocookie.com, YouTube's privacy-enhanced mode, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. From then on YouTube receives your IP address and technical details about your browser and may store information in your browser, as described in Google's Privacy Policy. Google may process this data in the United States. The legal basis is your consent, given by clicking play (Art. 6(1)(a) GDPR). If you would rather not load YouTube on our site, use the "Watch on YouTube" link instead.

6. AI-based features

The Figaviyo plugin uses AI services (currently Anthropic) to detect email sections automatically and generate alt-text for images. When you trigger these features, the design content is sent to the AI provider for processing under data-processing agreements that prohibit using your content for model training.

7. How long we keep your information

We keep your personal information only as long as necessary to provide the Service or comply with legal obligations. Generally, this is the period during which you have an active account, plus a short retention window for backup, fraud prevention, and tax records (typically 7 years for accounting records under Austrian law).

Klaviyo connections are kept until you disconnect them in the plugin or delete your Figaviyo account.

When we no longer need your information, we delete or anonymize it.

8. How we keep your information safe

We use organizational and technical security measures to protect your personal information, including encryption in transit (HTTPS), encrypted storage, and access controls. However, no electronic transmission is 100% secure. Use the Service at your own risk and use a strong, unique password.

9. Information from minors

The Service is not directed at children under 18, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at privacy@figaviyo.com and we will promptly delete it.

10. Your privacy rights

If you are in the EEA, UK, Switzerland, or Canada, you have the right to:

• Request access to and obtain a copy of your personal information
• Request correction or deletion
• Restrict or object to processing
• Data portability
• Not be subject to automated decision-making
• Withdraw your consent at any time

To exercise any of these rights, email us at privacy@figaviyo.com. We will respond within 30 days.

If you are in the EEA or UK and believe we are processing your information unlawfully, you have the right to lodge a complaint with your Member State data protection authority.

11. How Figaviyo connects to your Klaviyo account

Connecting with "Connect Klaviyo"

When you click Connect Klaviyo, Klaviyo asks you to allow Figaviyo access to your account. Figaviyo requests only three permissions: reading the account's name and ID, uploading images, and creating templates. It cannot read your contacts, lists, campaigns or flows.

Once you allow access, Klaviyo gives us a long-lived credential for that account (a refresh token). We store it encrypted (AES-256) in our database; the encryption key is kept separately on our application server. We also store the Klaviyo account ID and name, the name and background colour you give the brand in Figaviyo, and when the connection was created and last used. We use this only to upload your sections and create templates when you export, and to keep the connection working.

• Your connected brands are available wherever you sign in to Figaviyo, including on other devices.
• Disconnecting a brand in the plugin deletes its credential from our database and revokes Figaviyo's access in Klaviyo.
• You can also remove Figaviyo at any time from the integrations in your Klaviyo account. The stored credential then stops working and we mark the connection as disconnected.
• When you delete your Figaviyo account, all of its Klaviyo connections are deleted with it.
• We use the Klaviyo account ID to stop one Klaviyo account from being used for several free plans.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR): without this access we cannot deliver your designs to Klaviyo.

Adding a brand with a private API key

If you add a brand with a Klaviyo private API key instead, the key is stored in Figma's plugin storage on your device. It is sent with each export so we can upload to Klaviyo for you, and it is not saved on our servers afterwards. We keep only a salted one-way hash of it, which cannot be turned back into the key, to stop one Klaviyo account being used for several free plans. You can revoke the key at any time in your Klaviyo settings. We are phasing out this option in favour of Connect Klaviyo.

12. Updates to this notice

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Updates will be reflected by the "Last updated" date at the top. For material changes, we will notify you in advance — via email or a prominent notice on the website.

13. How to contact us

If you have questions or concerns about this Privacy Policy, contact us by email at privacy@figaviyo.com, or by post:

Marketing Gewerk e.U.
Birkengasse 20
3034 Maria Anzbach
Lower Austria, Austria

For general (non-privacy) questions, you can also reach us at support@figaviyo.com.

This Privacy Policy was generated using Termly as a starting point and customized for Figaviyo.