Privacy Policy

Figsoul is a service of Luvarly, a company registered in the Netherlands. Luvarly is the controller of the personal data in this policy: we decide why and how it is processed.

• Company: Luvarly, Verdronkenoord 104-C, 1811 BH Alkmaar, The Netherlands
• Chamber of Commerce (KVK): 97726702
• VAT number: NL868203956B01
• Privacy questions and support: support@figsoul.com

We have not appointed a data protection officer. Privacy questions go to the address above and reach the people responsible. More company details are on our legal information page.

We collect what you give us, what you render and a small amount of technical data. You need an email address to create an account; without it we cannot provide Figsoul. Everything else depends on how you use it.

• Account data: your email address, the name you give us, when you created your account and when you finished the welcome step. If you sign in with Google, Google gives us your name and email address.
• Sign-in data: the sessions that keep you signed in, and the links and codes we email you. We store these only as hashes, with their expiry times.
• Souls: what makes up each soul you create, such as its name, handle, home, niche, style, traits and bio, and its portrait and reference views.
• Photos and clips you upload: photos to create a soul from, garment photos for outfits, and reference videos for motion. Photos of people are personal data of the people in them.
• Renders: your prompts and settings, the images and clips that come back, and when each was made.
• Credits and purchases: your credit balance and every change to it. Payments go through Stripe: we receive a reference, what you bought and whether the payment succeeded, never your card number.
• Affiliate data: your invite code, which account invited you if any, and the commissions your invites earn: the size of each purchase and when it was made. Referrers never see who their invitees are.
• Technical data: your IP address and standard request details, such as your browser type, in short-lived logs.
• Messages to us: what you write when you email support.

We do not use photos to identify people, and we do not create face templates or other biometric data from them. A photo is only sent to the model you pick, so it can draw that face in a new image.

Every render runs on fal, a US company that hosts AI models. A request contains your prompt, the soul’s portrait and reference views, and any photo or clip you added. fal runs some models itself and passes requests for others to the company that makes the model. The model you choose decides who receives the request:

• GPT Image: OpenAI.
• Nano Banana: Google.
• Kling: Kuaishou.
• Wan: Alibaba.
• Seedance: ByteDance.

Model pickers in the app show which model each render uses. When we add a model from another company, we add that company to this policy before any of your content goes to it.

• Storage: the files you upload and the renders that come back are stored by fal at long, unguessable links, so your library keeps working. Anyone who has a link can open that file, so share links with care.
• No training by us: we do not use your photos, souls or renders to train AI models. fal and the model makers handle requests under their own terms and privacy policies, linked under Who receives your data.
• Our access: people at Luvarly look at your souls and renders only when you ask us to, for example in a support request, when we must investigate a report of misuse, or when the law requires it.

We use personal data only for the purposes below, each on a legal basis from Article 6(1) of the GDPR.

Our legitimate interests are keeping Figsoul, its users and the people in their photos safe, and protecting our rights. We have weighed them against your interests and rights, and you can object to them. We do not ask for consent for any processing today; if we do later, you can withdraw it at any time. We do not use your data for advertising or to build profiles of you.

If you upload a photo of someone else, you share their personal data with us. Our Terms of Service only allow that with their explicit permission. You are responsible for having it, and for telling them how their photo is used.

If you believe someone made a soul or render of you without your consent, write to support@figsoul.com. You do not need an account. We remove it once we confirm the report, and tell the account holder why.

We use only cookies that Figsoul needs to work. We do not use analytics, advertising or tracking cookies, and no other company sets cookies on our pages. Because these cookies are strictly necessary, the law does not require your consent for them, so you will not see a cookie banner.

We do not sell your personal data and do not share it for advertising. We use a small number of services to run Figsoul.

Cloudflare, fal and Stripe process data for us under agreements that bind them to our instructions. Google, for sign-in, and Stripe, for its own fraud prevention and legal duties, decide themselves how they use the data they receive, under their own policies.

Beyond these, your data goes only to authorities when the law requires us to disclose it. What you publish yourself, on social media for example, is up to you.

Luvarly is based in the Netherlands, but several of the services above are based outside the European Economic Area (EEA) or process data there.

We transfer personal data outside the EEA only with a safeguard the GDPR recognises. Where the recipient is certified under the EU-U.S. Data Privacy Framework, we rely on the European Commission’s adequacy decision for it (Article 45 GDPR). Otherwise we rely on the European Commission’s Standard Contractual Clauses (Article 46 GDPR), in our agreements with these providers and in theirs with the companies they pass requests to.

You can ask us for a copy of the safeguard for a specific transfer at support@figsoul.com.

We keep personal data only as long as we need it for the purposes above.

• Account data: until your account is deleted.
• Souls and renders: until you delete them or your account.
• Uploads and render files at fal: deleting a render, a soul or your account removes it from Figsoul at once. To have the files removed from fal’s storage as well, email us and we arrange it within one month.
• Sign-in sessions: up to 30 days. Logging out ends a session at once.
• Sign-in links and codes: 15 minutes, and they work once.
• Affiliate data: until either account is deleted. A commission is held 14 days before it can be redeemed.
• Purchase records: seven years, as Dutch tax law requires, also after your account is deleted.
• Logs: a short period, to fix errors and investigate abuse. They are then deleted automatically.
• Rate limiting: the count of sign-in emails per address and IP address lasts about a minute.
• Emails with us: as long as we need them to handle your request.

When your account is deleted, we delete your account data, sessions, souls, renders, credit history and affiliate data, except the purchase records the law requires us to keep. Copies in our backups expire within 30 days.

• There are no passwords to leak: you sign in with a single-use link or code, or with Google.
• Sessions, sign-in links and codes are stored only as hashes, so a copy of our database would not let anyone sign in.
• The session cookie cannot be read by scripts on the page and is sent only over HTTPS.
• All traffic to Figsoul is encrypted with TLS, and Cloudflare encrypts stored data at rest.
• Sign-in emails are rate limited per address and per IP address.
• Keys for fal, Stripe and Google are kept as encrypted secrets on our servers and never reach your browser.
• Only people who need it to run Figsoul can access production data.

No system is perfectly secure. If a breach affects your personal data, we report it to the Autoriteit Persoonsgegevens and, where it puts you at high risk, tell you without undue delay, as the GDPR requires.

Under the GDPR you have these rights over your personal data:

• Access: ask what personal data we hold about you and get a copy (Article 15).
• Rectification: have incorrect or incomplete data corrected (Article 16).
• Erasure: have your account and data deleted (Article 17). We keep only what the law requires, such as purchase records.
• Restriction: have us pause processing while a complaint about it is resolved (Article 18).
• Portability: receive the data you gave us in a common, machine-readable format (Article 20).
• Objection: object to processing based on our legitimate interests (Article 21). We then stop, unless we have compelling grounds that override yours or need the data for a legal claim.
• Withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect processing that happened before.

You can change your name, download your renders and delete your account yourself, in Settings and your library.

To use any other right, email support@figsoul.com, from the address on your account if you have one. We may ask you to confirm your identity first. It is free, and we answer within one month. If a request is complex, we may take up to two more months; if so, we tell you within the first month.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

If you think we handle your data wrongly, tell us first at support@figsoul.com and we will try to put it right. You also have the right to complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens (opens in a new tab). You can also go to the authority in the EU country where you live or work, or where the problem happened.

Figsoul is for adults. You must be at least 18, or the age of majority where you live if that is higher, as our Terms of Service set out. We do not knowingly collect personal data from anyone younger. If we learn that we have, we delete the account and its data. If you believe a child is using Figsoul, or appears in a photo uploaded to it, email support@figsoul.com.

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose, to have it deleted or corrected, and to opt out of its sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising.

We collect the categories described in this policy: identifiers such as your email address and IP address; commercial information such as your purchases; internet activity in our technical logs; and the photos, prompts and renders you give us. We use and disclose them only for the purposes in this policy and keep them for the periods above.

To use your rights, email support@figsoul.com. Someone you authorize may also ask for you. We verify each request before we act on it, and we will not treat you differently for using your rights.

We update this policy when Figsoul or the law changes. The date at the top shows the last change. If a change matters to you, for example a new kind of data or a new company that receives your content, we tell you by email or in the app before it takes effect.

For questions about this policy or your data, email support@figsoul.com or write to Luvarly, Verdronkenoord 104-C, 1811 BH Alkmaar, The Netherlands.