Privacy Policy

This policy explains what TTM Media Ltd ("Figbase", "we") collects, how we use it, and the choices you have.

What we collect

• Account: your email address.
• Waitlist: your email, the handle you asked for (if any), and where you came from: the link's ref and utm tags, and the referring site's name (never the full address of the page you came from).
• X connection: your public X identity — user ID, username, display name, and profile picture. Never your tweets, followers, or private messages. We don't retain X access tokens.
• Store connections: read-only payout data from Shopify Payments — settlement amounts, dates, and status — plus the store's name and domain, and the name and email of the Shopify login that approved the connection. We never request order, product, or customer scopes, and we do not collect your customers' names, emails, or addresses.
• What you add: your profile picture (if you upload one), location, links, brands and brand logos, reviews, recommendations, messages you send to vendors, and logo approvals.
• Counts: daily totals of views of your profile and clicks on your links. We count visits; we don't record who made them.
• Product events: a record of steps taken on Figbase (for example, joining the waitlist, requesting a sign-in link, connecting a store) so we can see where people get stuck. No cookies and no IP addresses; when you're signed in, the record carries a one-way code derived from your account, not your email or name.
• Technical: the email and IP address of each sign-in or waitlist request, kept for about 24 hours to stop abuse, and standard logs (IP, browser type) for security and debugging.

How we use it

• To operate the service: compute verification, tiers, and growth.
• To display what you choose — your visibility setting controls what your public page shows.
• To send email: sign-in links; a confirmation email when you join the waitlist and one email when Figbase opens; messages about your account (for example, a vendor intro or a logo request); and, if you have a verified store, a weekly summary. The weekly email is on by default and every one has a link to turn it off. Marketing only with consent.
• To prevent fraud and manipulation.
• To produce aggregated, anonymized industry insights that never identify your store.

What we never do

• We never sell your data.
• We never share store-level revenue data with third parties.
• We never display a number you haven't chosen to make public.
• Stealth brands are never named. Negative growth is never displayed.

Who processes data for us

Neon (database hosting), Resend (email delivery), Netlify (web hosting), and the platforms you connect (Shopify, X) under their own policies. Each receives only what its role requires.

Some pages also load content from other services, which then see your IP address and browser: posts embedded from X (on our landing pages, with X's tracking turned off), and company logos from Google's favicon service (on vendor pages).

Retention and deletion

We keep data while your account is active. Disconnecting a store stops syncing immediately. Sign-in and waitlist request logs are deleted after about 24 hours, and product events after about 13 months. When an account is deleted, its handle, when its profile was created, and a one-way code derived from its X account are kept for 180 days, so old links can't open a stranger's profile. Request deletion at any time and we'll delete or anonymize your data within 30 days, except records we must keep for legal or security reasons.

Security

Encryption in transit and at rest, least-privilege read-only API scopes, and no storage of connection tokens we don't need. No system is perfectly secure, but minimal data held means minimal data at risk.

Cookies

No advertising or analytics cookies. We use:

• Your sign-in session, and a small cookie that remembers you're signed in (30 days).
• fb_ref, set when you open an operator's invite link, so they're credited if you join (30 days).
• fb_wl, set when you join the waitlist, so you aren't asked to join again (until 30 days after launch, and at least 30 days). It holds no email address.
• Short-lived cookies while you connect Shopify or X, and one that hides agency pages for the rest of a visit that started in your Shopify admin.

Your rights

You can access, correct, export, or delete your data. Signed in, you can download a copy of your data and delete your account from your dashboard; for anything else, or if you can't sign in, email support@figbase.com. Depending on where you live (including the EU/UK and California), you may have additional statutory rights, which we honor.

Changes

We'll announce material changes on the site or by email.