Legal

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how [PixelForge Legal Entity Name]("PixelForge", "we", "us") collects, uses, and protects personal data when you use the PixelForge Figma plugin and web application (the "Service"). It is written to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the CPRA ("CCPA").

1. Scope

This Policy applies to personal data processed through the Service. It does not apply to third-party websites or services we link to, or to the design files you keep inside Figma itself — Figma's own privacy policy governs those.

2. Data Controller

The data controller responsible for your personal data is [PixelForge Legal Entity Name], [Registered Business Address]. You can reach us at [privacy@your-domain].

3. What Data We Collect

  • Account data: your email address, and, if you sign in with Google, GitHub or Figma, the name and avatar that provider shares with us. Used to authenticate you and manage your plan and team membership.
  • Design data:when you click "Generate code" in the plugin, it sends the selected frame only: its layer tree (layout, styles, typography and text content), the images and icons exported from it, and a small preview snapshot. The plugin does not read other parts of your Figma file.
  • Generated output: the code produced for you, your chosen stack and settings, and a diagnostic summary of how closely the rendered preview matches the design.
  • Technical & usage data: generation timestamps, usage counters, error logs and basic request metadata. For abuse protection we count requests per IP address; the address is stored only as a one-way hash, and old counters are cleaned up after about a day.
  • Billing data: for paid plans, subscription status and plan. Payments are processed by our reseller Lemon Squeezy (see below); we never receive or store your card details.

4. How We Use Data

We use the data described above to: generate code from your designs and keep your projects in your account history; authenticate you and maintain your plan, usage limits and team seats; monitor, debug and improve the reliability and accuracy of generation; prevent abuse; and communicate with you about your account or material changes to the Service. We do not sell personal data, and we do not use your designs for advertising.

5. AI Processing & Sub-processors

Layout, spacing and the generated code itself are computed by our own deterministic software, not by an AI model. To suggest semantic HTML tags, component boundaries and readable class names, we send a compact outline of your layer tree — layer names, node types and short excerpts of text content — to large language models through OpenRouter, which routes the request to the model provider (currently Anthropic for semantic analysis, and free-tier models for class names). Images, the preview snapshot and the full design data are not sent to AI providers. We do not use your content to train models, and we select providers whose terms restrict training on submitted content; we do not control providers' internal retention beyond their own terms.

We rely on the following sub-processors:

  • Vercel — hosting and serverless compute for the web application and API.
  • Supabase — authentication, database and file storage (hosted in the EU, Stockholm region).
  • OpenRouter and the model providers it routes to — AI analysis described above.
  • Lemon Squeezy — merchant of record for paid plans: checkout, payment processing, tax and invoicing.

The live preview of your generated code runs in your own browser and loads open-source libraries and fonts from public CDNs (cdn.tailwindcss.com, unpkg.com and Google Fonts). Like any web request, these receive your IP address and browser details; no design data is sent to them.

We process account, design and generated-output data on the basis of contractual necessity (to provide the Service you requested), technical and usage data on the basis of our legitimate interest in operating and securing the Service, and billing data on the basis of contractual necessity and compliance with legal obligations (e.g. tax record-keeping).

7. Data Retention

  • Exported images from your designs are deleted automatically 7 days after upload.
  • Unfinished sessions — a design sent from the plugin but never generated — expire after 30 minutes and are deleted together with their images.
  • Completed projects (generated code, the layer tree, the preview snapshot and settings) stay in your account history until you delete the project or your account.
  • Account and billing records are kept while your account is active and for a reasonable period afterward to meet legal, tax and dispute-resolution obligations, then deleted or anonymized.

8. Your Rights (GDPR)

If you are located in the European Economic Area or the UK, you have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate or incomplete data;
  • Erase your data ("right to be forgotten"), including full account deletion;
  • Export your data in a portable format;
  • Restrict or object to certain processing;
  • Lodge a complaint with your local data protection authority.

You can delete individual projects yourself in Workspace. To exercise any other right, including a full account and data deletion request, contact [privacy@your-domain]. We will respond within the timeframes required by applicable law.

9. Your Rights (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information we collect, use, and disclose;
  • Request deletion of your personal information;
  • Correct inaccurate personal information;
  • Opt out of the sale or sharing of personal information — PixelForge does not sell or share personal information as defined by the CCPA;
  • Not be discriminated against for exercising any of these rights.

To submit a request, contact [privacy@your-domain]. We may need to verify your identity before processing your request.

10. Cookies

We use only strictly necessary cookies to keep you signed in, and one preference cookie that remembers the interface language you chose. See our Cookie Policy for details.

11. International Data Transfers

Some of our sub-processors (for example Vercel, OpenRouter, model providers and Lemon Squeezy) may process data outside your country of residence, including in the United States. Where that happens we rely on appropriate safeguards recognized under applicable law, such as Standard Contractual Clauses.

12. Children's Privacy

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified through the Service or by email before taking effect.

14. Contact / Data Protection Officer

For any privacy-related question or to exercise your rights, contact [privacy@your-domain] / [Data Protection Officer contact, if applicable].