Framyy

Privacy Policy

Who we are

Framyy (“we”) is a design-system automation tool available at app.framyy.com.

What we collect, and on what legal basis

• Access requests — the e-mail address you submit via the access request form, so we can contact you about access. Legal basis: your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time.
• Account and sign-in — your account identity (e-mail, name) and a strictly necessary session cookie (hub_session), set only after you sign in; it is not used for tracking and is not shared with anyone. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — providing you the service you signed up for.
• Figma connection (OAuth) — if you connect Figma, we receive an access token from Figma via OAuth and use it solely to read the files you point the service at (the token grants read-only access). Changes to your files are made only by the Framyy plugin that you run yourself inside Figma. You can revoke the token at any time in your Figma account settings (Connected apps), and we delete stored tokens on account deletion. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Your design files — contents of the Figma files you connect (styles, variables, components), processed solely to perform the transfer you requested. Legal basis: legitimate interest / performance of a contract — we do not use your design data for anything else.

What we do NOT do

We run no analytics, no advertising pixels and no third-party trackers. We do not sell your data. We share it only with the service providers listed under “Where data lives”, and only to run the service for you. We do not send marketing e-mail.

Security

All traffic to the service is encrypted in transit (HTTPS/TLS). Access tokens are stored on our server and are not exposed to other users. Access to the server is restricted to the operator.

Where data lives

Our server is hosted in the European Union (Frankfurt) by our hosting provider, Render. Your data is stored there.

To analyse your design files, the service uses an AI model provided by Anthropic (United States). When an analysis runs, the relevant parts of the files you point the service at (such as layer names, text, structure and rendered images) are sent to Anthropic’s API for processing. We do not send your account data or access tokens to Anthropic.

Figma itself provides the sign-in (OAuth) and the file access described above.

How long we keep it

Access requests are kept until processed. Account data and tokens are kept while your account is active and deleted when the account is deleted.

Your rights (GDPR)

You have the right to: access your data; rectify inaccurate data; erase your data; restrict processing; data portability (receive your data in a machine-readable format); object to processing based on legitimate interest; withdraw consent at any time (without affecting prior processing); and lodge a complaint with a supervisory authority (Data Protection Authority) in your EU member state.

Changes

If this policy changes materially, we will notify registered users by e-mail and publish the new version on this page with a new date.