Last updated: 14 July 2026

This Privacy Policy explains how Enly AI Inc (“Figr”, “we”, “us”, “our”), a Delaware C-corporation based in the United States, collects, uses, and protects your personal data when you use the Figr try-on and fit experience embedded in a partner brand’s online store (the “Service”).

Figr provides a pre-purchase visualization and fit layer for fashion brands: you can try products on a personal avatar and get size recommendations before you buy. This policy is written for shoppers the people who create an account, upload photos, and receive try-ons and sizing through Figr. It also covers visitors to our own website at figr.so, such as brands and partners who contact us or request a demo (see Section 2).

Note on roles. When you shop on a brand’s website, that brand decides to offer Figr and is a joint or independent controller for some of your data, while Figr acts as controller for the avatar, try-on, and sizing data described below. Please also read the brand’s own privacy notice.

1. Who we are and how to contact us

• Controller: Enly AI Inc, 131 Continental Drive, Suite 305, Newark, DE 19713, United States.

• Privacy contact: privacy@figr.so

• EU representative (GDPR Art. 27): Figr Inc hello@figr.so

• UK representative: None appointed; contact hello@figr.so

If you are in the EU / EEA you may lodge a complaint with your local supervisory authority (in France, the CNIL, cnil.fr). If you are in the UK, you may complain to the Information Commissioner’s Office (ico.org.uk).

2. The data we collect

We collect only what we need to create your avatar, show you try-ons, and recommend sizes.

You provide directly:

• Account data: your email address (we use a one-time code to sign you in; we do not store a password).

• Profile / fit data: gender, age range, height, weight, and body-type descriptors (e.g. torso and abdomen build).

• Photos: the face photo and body photo you upload to generate your avatar and estimate measurements.

Generated when you use the Service:

• Avatars, portraits, and try-on images and videos created from your photos and profile.

• Estimated body measurements (e.g. chest, waist, hips, inseam) derived from your body photo and height.

• Try-on and size-recommendation history linked to your account.

Collected automatically:

• Usage and device data: product events, the store you used Figr in, SDK version, environment, and basic technical / diagnostic data via our analytics (PostHog) and error monitoring (Sentry). We configure these to avoid collecting unnecessary personal identifiers.

If you visit our website (figr.so):

Separately from the in-store try-on, you can visit our own website for example to learn about Figr, request a demo, or get in touch. There we may collect:

• Contact and demo requests: your name, work email, company, and anything you include in your message, so we can respond and follow up. Legal basis: our legitimate interest in responding to enquiries, or steps taken at your request before entering a contract.

• Marketing preferences: if you subscribe to updates, your email address. Legal basis: your consent, which you can withdraw at any time.

• Website cookies and analytics: essential cookies to run the site, and only with your consent via our cookie banner analytics cookies to understand how the site is used. Legal basis: legitimate interests (essential) and consent (analytics).

The rest of this policy, your rights, retention, international transfers, security, and how to contact us applies to this data too.

We do not ask for or process payment card details. Purchases happen in the brand’s store, not within Figr.

3. Sensitive data and your explicit consent

Your photographs and the body measurements we derive from them can reveal information about your physical appearance and body. Where this data is treated as a special category of personal data under the GDPR / UK GDPR (Article 9), we process it only with your explicit consent, which you give through an opt-in checkbox shown before you upload any photo.

We do not use your photos for facial-recognition identification. We do not use your photos or the measurements we derive from them to train our AI models unless you separately opt in to our model-improvement program (see Section 6). You can withdraw any consent at any time by deleting your data or your account (see Section 9), which stops further processing.

5. How your data is processed by AI

To create avatars and try-ons, your photos and profile data are sent to and processed by our AI systems and trusted AI infrastructure providers (see Section 7). Generation is automated, but it does not produce legal or similarly significant effects about you. It produces images and a suggested size, which you remain free to accept or ignore. Our sizing service processes your body photo in memory to estimate measurements and does not retain the photo itself.

6. Improving our AI models (optional)

We are continually working to make try-on images look more realistic and size recommendations more accurate. To do this, we may fine-tune our own AI models. Taking part is optional and is governed by the rules below.

Your images, opt-in only.

We will use your photos, avatars, and try-on images to train or fine-tune our image-generation models only if you give separate, explicit opt-in consent. This consent is:

• separate from the consent you give to use the try-on feature;

• entirely optional, Figr works exactly the same whether you opt in or not; and

• withdrawable at any time. Withdrawing stops any future use of your images for training. It cannot remove data that has already been incorporated into a model that has already been trained, but we will not include your images in any future training.

Before any image is used for training, we remove direct identifiers such as your name and email and apply additional safeguards. Removing identifiers reduces risk but does not by itself make an image anonymous, which is why we rely on your explicit consent for this use.

Sizing and measurement data de-identified.

Separately, we may use de-identified body measurements and fit data for example derived measurements, declared height and weight, and whether a recommended size was accepted to improve our sizing and measurement models. This data is decoupled from your identity and from your photos. Where it is genuinely anonymized it is no longer personal data; where any personal data remains, we rely on our legitimate interest in improving accuracy, and you may object at any time.

Scope and limits.

Model-improvement processing applies only to data collected after this policy’s effective date, under the opt-in described above. We do not retroactively use content collected before then. We do not sell your data, and we do not use your data or images to train third parties’ foundation models. Before we use any images to improve our models, we complete a data protection impact assessment (DPIA), and we can describe our safeguards on request.

7. Who we share data with (subprocessors)

We do not sell your personal data. We share it only with service providers (“subprocessors”) that help us run the Service, under contracts that require them to protect it:

• The brand / store where you used Figr, for your try-on, sizing, and shopping experience.

• Cloud & infrastructure: Cloudflare (storage, media streaming, application hosting), Fly.io and Google Cloud (AI service hosting), Supabase (authentication and database).

• AI processing: Google (Gemini models, Vertex AI) for image generation and embeddings; FAL.AI for image upscaling (configured so outputs expire within ~1 hour and inputs / outputs are not stored).

• Analytics & monitoring: PostHog (product analytics), Sentry (error monitoring).

• Commerce & messaging: Shopify (product data), Klaviyo and Resend (email).

A current list of subprocessors is available on request at privacy@figr.so. We may also disclose data where required by law or to protect our rights and users’ safety.

8. International transfers

We are based in the United States, and some of our subprocessors process data in the United States and other countries. When we process the personal data of shoppers in the EEA or UK, those transfers outside the EEA / UK rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision where one applies. You can request a copy of the relevant safeguards.

9. How long we keep your data and how to delete it

We keep your account, profile, photos, and generated content for as long as your account is active. We do not impose a fixed expiry: your data is retained until you delete it or close your account.

• Immediate deletion: when you delete specific content or your account, we erase it from our active systems immediately.

• Unauthenticated / anonymous sessions: if you use Figr without signing in, the associated data is kept for a grace period of up to 30 days and is then deleted.

• Backups: residual copies held in our encrypted backups are purged within 30 days.

You can also:

• Export your data: request a machine-readable (JSON) copy of your account, profile, and generated content.

• Delete your account: this permanently erases your authentication record, stored photos and assets, and try-on videos, and triggers deletion requests to our email provider.

We action data-rights requests within 30 days. Some limited data may be retained where required for legal, security, or fraud-prevention reasons.

10. Your rights

Under the GDPR and UK GDPR you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). Where decisions are automated, you can ask for human review. To exercise any right, email privacy@figr.so or use the in-product export / delete tools. We will not discriminate against you for exercising your rights.

11. Security

We protect your data with measures including encryption in transit, access controls and least-privilege provisioning, tenant isolation (your data is never shared across brands, and your images are never used to train models without your opt-in), monitoring, and a documented incident-management program. No system is perfectly secure, but we work to protect your data and will notify you and regulators of breaches where the law requires.

12. Children

The Service is not directed to children. You must be at least 18 years old to use Figr. We do not knowingly collect data from children; if you believe a child has used the Service, contact privacy@figr.so and we will delete the data.

13. Changes to this policy

We may update this policy as the Service evolves. We will post the new version with an updated “Last updated” date and, for material changes, provide additional notice. Where a change introduces a new use of your data that requires your consent, such as using your images to improve our models, we will ask for that consent separately rather than relying on your continued use.