Privacy Policy

1. Who this policy applies to

This Privacy Policy explains how FigureFolio ("FigureFolio", "we", "us") processes personal data when you visit the website, use the scientific figure designer, create an account, use cloud features, export figures, or participate in the FigureFolio Community.

FigureFolio acts as controller for the account and service data described in this policy. If you use FigureFolio on behalf of an institution, your institution may separately be responsible for the research data you choose to enter.

2. Data we process

Guest and local use

When you use the designer without signing in, figure projects, settings and interface preferences can be stored in your browser using local storage. FigureFolio does not intentionally copy guest project content to cloud project storage unless you sign in and use a cloud feature.

Account data

If you create or use an account, we may process your email address, authentication identifier, sign-in timestamps and, when supplied, your name, country, background and institution. If you choose Google sign-in, Google provides the authentication information needed to identify your account.

Project and figure data

When cloud synchronisation is available and used, we may store project names, figure data, figure settings, project metadata, saved versions and related workflow information. The content can include data that you paste, import or enter into a figure.

Community data

If you use the Community, we process content you submit such as posts, replies, votes, subscriptions, reports and any attachments you choose to add. Community content is intended to be visible to other signed-in Community members.

Contact messages

If you contact us through the website, we process the name, email address, subject and message you submit so we can answer your enquiry and, where necessary, keep a reasonable record of support or legal correspondence.

Service and security data

We may process technical data needed to operate and protect the service, such as request timestamps, session information, IP addresses in infrastructure logs, and limited product events such as app opens, project creation and figure exports. We do not currently use third-party advertising trackers in the FigureFolio application.

3. Why we process data

We use personal data to:

• create and authenticate your account;
• save, synchronise and restore your projects;
• enable protected features such as export and account-only areas;
• operate the Community;
• maintain security, prevent abuse and troubleshoot failures;
• understand basic product usage and improve FigureFolio; and
• comply with legal obligations.

Where the GDPR applies, the main legal bases are performance of our agreement with you, our legitimate interests in operating and securing FigureFolio, compliance with legal obligations, and consent where we specifically ask for it.

4. Research and sensitive data

5. Cookies, local storage and sessions

FigureFolio uses browser storage and session technologies that are necessary for functions such as local autosave, sign-in state, interface preferences and secure account sessions. These technologies are not used by FigureFolio for behavioural advertising. If you choose an external sign-in provider, that provider may use its own cookies or similar technologies under its own policy.

6. Service providers and data sharing

We do not sell your personal data. We may share data with service providers only as needed to run FigureFolio. Current technical components include Supabase for authentication and cloud database functions, the website hosting provider, Google when you choose Google authentication, and the SheetJS content-delivery network when the Excel-template importer is opened. The Excel workbook itself is parsed locally in your browser by FigureFolio and is not intentionally uploaded to SheetJS. We may also disclose information when required by law or necessary to protect users, the service or our rights.

7. International processing

Some service providers may process data outside your country or the European Economic Area. Where required, appropriate safeguards are used for international transfers, such as contractual protections recognised under applicable data-protection law.

8. Retention and deletion

We keep account and cloud project data for as long as needed to provide the service, maintain security and meet applicable legal requirements. Data linked to a deleted account is scheduled for deletion from active systems where technically and legally appropriate; limited copies can remain temporarily in backups or security logs.

Local projects stored in your browser remain on that device until you delete them, clear site data or your browser removes them.

9. Security

We use reasonable technical and organisational measures intended to protect data, including authenticated access and database access controls. No online service can guarantee absolute security, so you should also protect your account credentials and avoid entering data that FigureFolio does not need.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to receive certain data in a portable form. Where processing is based on consent, you can withdraw that consent. In the EEA you may also lodge a complaint with your local data-protection authority.

11. Children

FigureFolio is intended for researchers, students and professionals and is not directed to children under 16.

12. Changes to this policy

We may update this policy as FigureFolio develops. The date at the top shows the latest revision. Material changes will be communicated in an appropriate way when required.