Privacy
Last updated: 1 October 2026
Operator and contact
FigureKit is operated by Level09 FZE, Level 14, Boulevard Plaza Tower One, Sheikh Mohammed Bin Rashid Boulevard, Downtown Dubai, UAE, P.O. Box 334155. Trade licence 8581/2016.
For privacy, support, and legal requests, email billing@level09.com.
Data collected
- Your email address, whether you opted in to product update emails, and when you opted in.
- Sign-in link records: email address, creation time, expiry time, and used time.
- Session records: a random token stored as a hash, with a 30-day expiry.
- Your account credit balance.
- Generation records: style used, timing, status, provider request ID, provider cost, file type, and expiry.
- Purchase records: Stripe checkout session ID, pack, credits, and amount.
Stripe handles card details. They never reach FigureKit.
Briefs and images
The brief and one-line context your agent sends for a generation are passed to the image provider to create the image. They are not stored in the FigureKit database.
Generated images are stored in Cloudflare R2 and deleted automatically after 7 days, when their links expire. Save images you want to keep.
Abuse prevention and logs
Your IP address is used transiently for per-IP rate limiting and Cloudflare Turnstile bot checks. Cloudflare Workers platform logs are enabled to operate the service.
Cookies
FigureKit uses one strictly necessary session cookie named fk_session on mcp.figurekit.dev. It is HttpOnly and lasts 30 days. FigureKit uses no analytics, advertising, or tracking cookies.
Cloudflare Turnstile runs a bot check on sign-in forms.
Service providers
- Cloudflare: hosting, database, storage, email delivery, and bot checks.
- OpenRouter and Google: image generation. They receive the brief, context, and style reference images.
- Stripe: payments.
Sign-in emails are transactional. Product update emails are sent only if you opt in. You can turn them off on the account page.
Your data requests
You can ask to access, correct, export, or delete your account data by emailing billing@level09.com.
Deleting an account removes the email address and remaining credits. Payment records may be kept where required for accounting.