Privacy Policy

Last updated: 1 November 2026

This policy covers the Figma plugin “Figback”, the Figback Capture Chrome extension, this website (figback.hopin.it) and our API server.

1. Short version

• By default, conversion runs locally in Figma and in your browser, and we never receive your page or design content.
• Two things send content to our server, and only when you use them: server capture (our server opens a URL that the plugin cannot load itself) and the optional AI features (Pro, off by default, ask for your consent first). Neither is stored beyond the short times below.
• We store only what we need to run subscriptions and license checks: license key, Stripe customer id, email, subscription status, device ids and timestamps.
• If you join the waitlist on this website, we keep your email (and comment, if you write one) only to send one launch email.
• We do not run ads or sell data.

2. Who we are (controller)

HOPIN.IT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (HopIn.IT sp. z o.o.) ul. Marsz. Józefa Piłsudskiego 74/320, 50-529 Wrocław, Poland KRS 0001117479, NIP 8971940626, REGON 529197668

(“HopIn.IT”, “we”, “us”). We are the controller of the personal data described in this policy. You can reach us about privacy at [email protected]. Based on our current assessment, the law does not require us to appoint a Data Protection Officer.

3. What happens on your device, and what leaves it

Figma plugin. Pasted HTML, fetched pages, capture files and Figma frames are processed inside Figma’s plugin sandbox and your browser. They are not sent to us. Export to HTML runs entirely inside the plugin.

Network requests the plugin makes:

1. If you enter a URL, the plugin first requests that URL and its assets (images, CSS, fonts) directly from the site you named. That site sees the request like any browser request.
2. Server capture. If the site blocks this, or the page comes back empty, the plugin sends the URL, the chosen widths and options, your random device id and (on Pro) your license key to our server. Our server opens the public page in a browser, converts it and returns the design. The page and the result are kept in memory for at most 10 minutes to answer repeated requests, then discarded. They are not written to disk or to logs; logs contain only a hash of the URL. The target site sees a request from our server.
3. AI features (Pro, optional). If you turn on “Improve with AI”, the plugin sends the parts of the converted design needed for the features you chose (layer structure, names, texts, colours and, for some features, small images of page regions) to our server. The server forwards them to our AI provider, Anthropic, and returns suggestions. We do not store this content; answers may be cached on your device. Anthropic processes it under its commercial terms, which do not allow it to train models on this content.
4. License checks to our license server (section 4).
5. If you enter a library file link and a Figma personal access token, the plugin calls the Figma REST API (api.figma.com) directly to list that library’s components and styles. The token is not sent to us. It is stored on your device only if you choose “Remember token”.

Chrome extension (Figback Capture). When you click it on a tab, it reads that tab’s rendered page, can resize the window to capture other widths, and downloads a .ir.json file to your computer. It sends no data to us or anyone else. The file may contain content from the page, including content you see while logged in, so treat it like any file you save.

Local storage. The plugin keeps your license key, device id, import counter, settings, AI consent and AI answer cache (and your Figma token, only if you choose to remember it) in Figma’s client storage on your device.

4. What our license server receives and stores

We do not collect Figma file names, Figma account details or IP-based profiles. Page and design content is processed only as described for server capture and AI. Our application does not log IP addresses. The HTTPS reverse proxy in front of it keeps access logs (IP address, time, path) only as long as needed to keep the service running and secure.

Free-plan counting. The 10 imports per 30 days are counted locally in plugin storage. Server captures on the Free plan are counted on the server by hashed device id.

5. This website

figback.hopin.it is a static site. It sets no cookies and uses no advertising or tracking scripts. We measure visits with Cloudflare Web Analytics, which counts page views without cookies and without identifying you. Cloudflare delivers the site and, like any web host, processes your IP address to do so.

Waitlist. If you join the waitlist, the form sends your email address and, if you write one, your comment to our API server, which stores them with the date you signed up. We use the email only to send you one message when Figback launches, and read comments to learn what people want to import. We delete all waitlist entries at the latest 30 days after the launch email is sent (time to handle replies and bounced messages), or earlier if you ask us at [email protected].

6. Payments

Payments are processed by Stripe, which acts as merchant of record under Stripe Managed Payments. Stripe collects payment details, billing address and tax data under its own privacy policy: https://stripe.com/privacy. We never receive your card number.

7. Legal bases (GDPR Art. 6)

• Contract (6(1)(b)): license, subscription, device limit, support.
• Legal obligation (6(1)(c)): accounting and tax records.
• Legitimate interests (6(1)(f)): security, fraud and abuse prevention, license-sharing limits, service logs, cookieless website statistics.
• Consent (6(1)(a)): AI features, which you switch on yourself and can switch off at any time; the waitlist, which you join yourself and can leave at any time.

Apart from the one launch email to people who joined the waitlist, we do not send marketing emails.

8. Recipients and processors

We do not sell personal data or share it for advertising. We may disclose data where the law requires it.

9. International transfers

Where a processor handles data outside the European Economic Area, we rely on an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at [email protected].

10. Retention

• License and subscription records: while your subscription is active and for 12 months after it ends, then deleted.
• Invoices and tax records: as long as Polish law requires (generally 5 years from the end of the tax year).
• Device ids: removed 180 days after last use, or when you remove the device.
• Server capture content: in memory for at most 10 minutes. AI request content: not stored by us.
• Waitlist entries (email, optional comment, signup date): at the latest 30 days after the launch email is sent, or earlier on request.
• Server logs: the reverse proxy’s access logs only as long as needed to keep the service secure. Application logs contain no IP addresses, keys or page URLs (only hashes).
• Stripe keeps its own records under its own policy.

11. Security

Traffic is encrypted with HTTPS. Access to the server is limited to the operator. License keys and device ids are stored only as SHA-256 hashes. A new key is kept in plain text only until it is shown to you after checkout: at most 1 hour after you first view it, or 7 days if you never view it. No system is perfectly secure; please report issues to [email protected].

12. Your rights

Under the GDPR you can ask for access, correction, deletion, restriction and portability of your data, and you can object to processing based on legitimate interests. You can withdraw consent at any time, which does not affect processing before the withdrawal. Email [email protected]; we reply within one month.

You can complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl, or to the authority in your country.

We need these details to provide a paid license; without them we cannot provide Pro. The Free plan needs no account and sends nothing to us unless you use server capture (then the random device id is sent).

13. Children

The service is not directed at children under 16.

14. Changes

We will update this page and the date above. We will announce material changes in the plugin or by email.

15. Contact

HopIn.IT sp. z o.o., ul. Marsz. Józefa Piłsudskiego 74/320, 50-529 Wrocław, Poland · [email protected] · https://figback.hopin.it