Privacy Policy

1.1 FigsFlow ("FigsFlow", "we", "us", or "our") provides Proposal, Pricing, Engagement Letter, and Anti-Money Laundering (AML) software for accounting, bookkeeping, and tax advisory professionals. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website (the "Website"), use our software platform (the "Platform"), or otherwise interact with us, as it relates to our services to customers located in the United States.

1.2 This Privacy Policy is designed to address applicable US privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other comprehensive state privacy laws that may apply depending on where you live.

1.3 By using our Website or Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please stop using the Website and our services.

2.1 FigsFlow determines the purposes and means of processing personal information collected through the Website and Platform, except where we act on behalf of our accounting firm clients (see Section 8, "FigsFlow as a Service Provider").

2.2 If you have questions about this Privacy Policy or wish to exercise a privacy right, contact our privacy team using the details in Section 14. We aim to respond to valid requests within the timeframes required by applicable law.

3.1 Information you give us directly. When you register for an account, request a demo, contact support, or otherwise engage with FigsFlow, we may collect your name, job title, professional qualifications (for example, CPA or EA), email address, phone number, business address, account credentials, and billing details. Payment card details are handled directly by our PCI-DSS-compliant payment processor and are never stored on FigsFlow's systems.

3.2 AML module data. If your firm uses our AML module, you may submit client due diligence information, including names, addresses, dates of birth, and identity verification outcomes, on your firm's behalf (see Section 8).

3.3 Information collected automatically. We automatically collect technical information such as your IP address, browser and device type, operating system, and usage data including pages visited, features accessed, session duration, and referring URLs. Cookies and similar technologies contribute to this collection; see our Cookies Policy.

3.4 Information from third parties. We may receive information from identity verification and AML screening providers, our payment processor's fraud-prevention signals, analytics partners, and publicly available business registries.

3.5 Sensitive personal information. We do not knowingly collect sensitive personal information (such as health data, precise geolocation, or government identification beyond what AML checks require) through the Website, except where an accounting firm submits client due diligence data through the Platform for its own AML/KYC purposes.

We use personal information to:

• provide and maintain the Platform, including proposals, pricing, engagement letters, and AML checks;
• process payments and prevent fraud;
• comply with legal obligations, including recordkeeping requirements that apply to our accounting-firm customers;
• send account and transactional communications;
• with your consent or as otherwise permitted by law (including the CAN-SPAM Act's opt-out framework), send marketing communications, which you may opt out of at any time;
• respond to support requests;
• improve, secure, and analyze use of the Platform; and
• enforce our Terms and protect our legal rights.

5.1 We do not sell your personal information for money, and we never will.

5.2 Some analytics and advertising cookies may fall within the CCPA/CPRA's broad definitions of "sale" or "share" (for example, where they support cross-context behavioral advertising). You can opt out at any time — see Section 7 and our Cookies Policy.

5.3 Service providers. We share data with cloud hosting providers, payment processors, identity and AML screening providers, email delivery platforms, customer support tools, analytics providers, and CRM systems such as HubSpot. Each is bound by contract to use your data only to provide services to us and in compliance with applicable law.

5.4 Legal and safety. We may disclose information to regulators, tax authorities, law enforcement, or courts where required by law or necessary to protect our legal rights.

5.5 Business transfers. In a merger, acquisition, or asset sale, personal information may be transferred as part of the transaction, subject to appropriate protections.

FigsFlow uses strictly necessary, performance/analytics, functional, and advertising cookies to operate and improve the Website and Platform. You can manage your preferences through our cookie consent banner or your browser settings. For full details, see our Cookies Policy.

7.1 Depending on your state of residence, you may have some or all of the following rights:

• Right to know / access the personal information we hold about you;
• Right to delete your personal information;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of your personal information;
• Right to limit the use of sensitive personal information;
• Right to data portability; and
• Right to be free from discrimination for exercising any of these rights.

7.2 To exercise these rights, contact us using the details in Section 14. We will verify your identity before acting on your request. Where permitted, you may designate an authorized agent to submit a request on your behalf.

7.3 You may opt out of the sale or sharing of your personal information at any time by contacting us or, where available, using the cookie preference controls on our Website.

8.1 When accounting firms use our Platform to manage their own client relationships, build proposals, issue engagement letters, set pricing, or perform AML/KYC due diligence, FigsFlow acts as a Service Provider on their behalf — not as the party that decides why that data is processed.

8.2 If you are an individual whose personal information was entered into the Platform by an accounting firm, your primary point of contact for privacy matters is that firm, not FigsFlow. We recommend referring to that firm's own privacy notice.

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including any retention period required to support our accounting-firm customers' own AML/KYC recordkeeping obligations. At the end of the applicable retention period, personal information is securely deleted or de-identified.

We use technical and organizational measures designed to protect personal information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for Platform and internal systems, regular security testing, and ongoing staff training. If a security incident affecting your personal information occurs, we will notify affected individuals and, where required, regulators, in accordance with applicable law.

FigsFlow's Platform relies on infrastructure and service providers that may be located outside the United States. Where this occurs, we take steps designed to ensure your personal information continues to receive an appropriate level of protection consistent with this Policy.

Our Website and Platform are intended for business professionals and are not directed to children under 13. We do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided us with personal information, please contact us so we can delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be posted on this page with a revised "Last Reviewed" date. Your continued use of the Website or Platform after changes are posted constitutes your acceptance of the updated Policy.

If you have questions, concerns, or requests relating to this Privacy Policy or our data protection practices, please contact us:

Email: info@figsflow.com
Address: 809 Salisbury House, 29 Finsbury Circus, London, EC2M 7AQ, United Kingdom