Privacy Policy

Last updated October 20, 2026

This policy explains what information FigyConsulting ("we", "us") collects through figyconsulting.com and our customer account area, how we use it, and who we share it with. It covers this website and our own business records. Websites and apps we build for customers have their own privacy policies, which our customers are responsible for.

1. Information we collect

When you request a consultation: your name, email address, phone number, company name (optional), the service you're interested in, what you'd like built, and the best time to reach you. We also record that you accepted our Terms of Service and when. To confirm your email address (and, when text verification is turned on, your phone number), we send a one-time code; we store only a scrambled (hashed) version of each code.

When you have an account: your username, name and email address, and a password, which is stored only in hashed form so we can't read it. For your business we keep a customer record: company name, billing email, phone, the terms version you accepted, and setup details you give us, such as your domain registrar, domain name and GitHub repository.

While we work together: your requests, estimates and your decisions on them, approvals and feedback, emails we send you from our system, our internal notes, the services assigned to your account, bills, discounts and payment records.

Automatically: like most websites, our web server records basic request information (IP address, browser type, the page requested and the time) in server logs. Our public pages also use Google Analytics (see Cookies & Analytics). We don't sell this information or use it to build advertising profiles.

2. Payment information

Online payments by card or US bank account (ACH) are handled by Stripe. You enter your card or bank details on Stripe's own pages, so full card numbers and bank account numbers never reach our servers. Stripe tells us the outcome of each payment, and we keep a payment record with the amount, date and method, plus the card brand and last four digits or the bank name and last four digits. To set up online payments we share your company name, billing email and phone with Stripe. If you pay by check, we record the check number with the payment.

3. How we use your information

  • To answer your consultation request, prepare estimates and contact you about your project.
  • To create and run your account, build and host the services you order, and send you service emails such as verification codes, estimates, project updates, bills and password resets.
  • To bill you, take payments, keep accounting and tax records, and produce your yearly billing summary.
  • To keep the site secure: stopping automated spam on the consultation form and limiting repeated login attempts.
  • To understand, in aggregate, how visitors use our public pages, so we can improve them.

Occasional emails to account holders. If you have an account with us, we may occasionally email you news and updates about our services. We don't send these to people who only requested a consultation and don't have an account. Every one of these emails includes an unsubscribe link; once you unsubscribe we keep your email address on an opt-out list so we don't email you again. Unsubscribing doesn't stop service emails about your account, projects and bills.

4. Cookies & analytics

We use a small number of cookies:

  • Essential cookies from our site: a session cookie that keeps you logged in (it expires after two weeks, or when you log out) and a security cookie that protects forms against forgery. The site doesn't work properly without them.
  • Google Analytics on our public pages (such as the home, services, consultation form, terms and this page). Google Analytics uses cookies and collects information such as the pages you view, how you arrived, your general location, and your device and browser, which Google processes on our behalf. It is not used on the login page, your account pages, bills or our staff pages. You can opt out by installing Google's opt-out browser add-on, by blocking cookies in your browser, or with a content blocker. See how Google uses information from sites that use its services.

5. Who we share information with

We share information only with service providers that help us run the business, and only as needed for the purposes above:

  • Amazon Web Services: hosts this website and its database, sends our emails (Amazon SES), stores encrypted database backups (Amazon S3), receives email sent to @figyconsulting.com addresses, and, when text verification is turned on, sends text messages (Amazon SNS).
  • Stripe: processes online payments and lets you manage your saved payment method.
  • Cloudflare Turnstile: checks that consultation requests come from a person, not a bot. Cloudflare receives your IP address and browser information when you use the consultation form.
  • Google: Google Analytics (see above). Email sent to our addresses is also delivered to an inbox hosted by Google (Gmail).
  • jsDelivr: a content delivery network that serves the page styling and icon files our pages use, so your browser contacts it when pages load.
  • Anthropic: provides the AI setup assistant in your account. When you ask it a question, your message, the earlier messages in that chat, and the setup details for that step (such as your business name, domain and choices) are sent to Anthropic to write the answer. We remove anything that looks like a password, key or card number first. We keep the chat so our team can help you. Under Anthropic's commercial terms, it doesn't train its models on these chats.
  • GitHub and domain registrars: when we set up your project, we work with accounts you own, such as your GitHub repository and your domain registration, under your own name.

We may also disclose information when required by law, to protect our rights or the safety of others, or as part of selling or transferring our business. We don't sell your personal information.

6. How long we keep it

  • Consultation requests, accounts and project records: for as long as you're a customer or prospect, and afterwards for as long as reasonably needed for our records. You can ask us to delete them (see Your Choices).
  • Bills and payment records: as long as we need them for tax and accounting purposes, typically several years.
  • Database backups: copies are kept on our server for 14 days and in Amazon S3 for 90 days, then deleted automatically. Copies of incoming email are deleted from Amazon S3 after 30 days.
  • Web server logs: kept for a limited period for security and troubleshooting, then deleted.

7. Your choices

  • Logged-in customers can update their name and company details on the Account page.
  • You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing privacy@figyconsulting.com. We'll confirm your request comes from you, and we may keep information we're required to keep (such as billing records) or need to resolve disputes.
  • You can opt out of Google Analytics as described in Cookies & Analytics.

8. Children's privacy

Our services are for businesses and are not directed to children under 13. We don't knowingly collect personal information from children under 13; if you believe a child has given us information, contact us and we'll delete it.

9. Security

The site is served only over encrypted HTTPS. Passwords and verification codes are stored in hashed form, login attempts are limited, staff pages are restricted to our team, and backups are encrypted and stored privately. No method of storing or sending information is completely secure, so we can't guarantee absolute security.

10. Changes to this policy

We'll update this page when our practices change and change the "Last updated" date above. If the changes are significant, we'll let customers know by email or in their account.

11. Contact us

Questions or requests about your information: privacy@figyconsulting.com.