Privacy Notice

Version: 20 October 2026

This notice explains how Figro Technology Pte. Ltd., a Singapore company (UEN 202616878Z), handles personal data in connection with its website, creator discovery and outreach, client and creator accounts, collaborations and related services, including campaigns Figro manages as an agency and creator delivery through the Figro platform.

It applies to client users, creators, representatives, reviewers, website visitors and people whose creator information is obtained from other sources, including people who have not registered with Figro. For privacy questions or requests, contact our Data Protection Officer by emailing [email protected] and mark the message "Privacy". Our appointed Data Protection Officer is responsible for handling privacy enquiries through this contact.

This notice provides information about processing. Using Figro or acknowledging this notice is not blanket consent to all processing. Where consent is required, it must be obtained for the relevant purpose.

1. Our role

Figro determines how personal data is used for its own accounts, creator discovery, outreach, service analytics, security, administration and legal records. In jurisdictions using the term, Figro acts as a controller for those activities.

When Figro is the contracting campaign client, the agency and platform functions are operated by the same Figro legal entity. We also use relevant information to manage the campaign for the represented brand. Our role for any processing performed solely on that brand's instructions depends on the actual arrangement; the agency label alone does not determine it.

Clients, creators, brands and representatives may independently determine how they use information received for a campaign. They are responsible for their own processing. Where Figro processes information solely on a client's instructions, the relevant processing arrangement and applicable data-processing agreement govern that activity. Figro is not automatically a processor for every use of campaign or creator data.

2. Information and sources

The categories depend on how you interact with Figro:

Account and organization information. Names, business roles, email addresses, login identifiers, organization details and access permissions provided by users or their organizations.

Creator discovery information. Public profiles, handles, platform identifiers, profile images, content, contact information, location, follower and engagement figures, audience summaries, rates and categories obtained from creators, representatives, clients, social platforms, publicly accessible sources and creator-data providers.

Derived information. Profile summaries, matching scores, inferred interests or categories, and audience or performance estimates derived from available profile and campaign information. These may be incomplete or inaccurate.

Campaign and collaboration information. Campaign instructions, offers, accepted terms, legal names, addresses, selected accounts, submissions, scripts, drafts, files, published links, review feedback, messages and status records provided by participants.

Acceptance and evidence. Acceptance time, user and representative identity, represented creator, IP address, browser information, acknowledgement and agreement records.

Funding and payment information. Billing and invoicing details, agreed amounts, designated receiving details such as bank account, bank or SWIFT information, receiving name and address, PayPal email or PayNow identifier, payment status and transfer evidence supplied by users, finance staff or payment providers. Transfer evidence may contain information about both sender and recipient.

Outreach and support. Contact source, campaign invitations, responses, communication history, support requests and opt-out preferences.

Usage and technical information. IP address, device and browser information, identifiers, pages and actions, timestamps, error and diagnostic information, and analytics and session-replay information collected through the service and its providers.

Financial account details and other information may receive special protection under applicable law. Do not send bank passwords, payment authentication codes or unnecessary identity documents through Figro.

Where another person supplies your information, we may receive it before you interact with Figro. Public availability does not remove applicable privacy rights. Contact us about an incorrect profile, the source of information about you or an objection to its use.

3. Purposes and legal grounds

We use relevant information to:

- Operate accounts, authenticate users and manage organization or representative access.

- Help clients discover creators, evaluate campaign suitability and contact creators about relevant opportunities.

- Support proposals, agreements, collaboration communications, submissions and content review.

- Arrange and record funding and payments, support reconciliation and address disputes.

- Understand service use, diagnose problems, review user journeys and improve functionality through analytics and session replay.

- Produce profile summaries and recommendations using automated analysis and processing providers.

- Protect accounts, investigate abuse and security incidents, and meet legal and recordkeeping obligations.

- Respond to enquiries and applicable data-rights requests, and maintain outreach preferences.

We use a legal ground permitted by the law applicable to the processing. Under the Singapore PDPA this may include consent, deemed consent or an applicable exception, subject to its conditions. We do not assume that an exception applies merely because information is available online.

Where the GDPR or UK GDPR applies, the relevant grounds are: contract necessity for services to an individual contracting with Figro; legitimate interests in administering business relationships, relevant discovery/outreach, service improvement and security where those interests are not overridden by individual rights; legal obligations; and consent where required, including for relevant tracking or marketing. A contract with a company is not automatically a contract with every employee or creator whose information is processed. Where another law requires a different ground, notice or separate consent, that requirement applies.

Our matching and analytics help users make decisions; they do not themselves constitute client approval of deliverables or an award resolving a dispute. Ask us to correct inaccurate underlying information or raise concerns about a recommendation concerning you.

Planned model development

We plan to train and evaluate models for Figro's creator matching, recommendations and campaign planning using profile information, campaign results and briefs. Figro does not currently undertake this training. Running existing models to provide current services is separate from training them.

The planned scope excludes private chats, creator-submitted scripts, images, audio and videos, payment details and authentication information. Profile information is not a general authorization to train on underlying posts or media. We will minimize personal and confidential information, use anonymized or aggregated information where suitable, and require providers acting for us to stay within the instructed purpose rather than train their own general-purpose models on the supplied information.

Before starting this processing, we will assess the data sources, rights, legal basis, provider arrangements and safeguards, and provide required notices and obtain consent or other permissions where required. The limited permissions in the platform terms do not replace these requirements or authorize unrestricted reuse of historical records. Applicable objections, withdrawal and other privacy rights remain available through our DPO.

4. Outreach and communications

Figro uses relevant creator and business contact information to send collaboration opportunities and related outreach, including to people who have not opened an account. Clients may also use Figro to coordinate their own outreach. The identity and context of the sender should be apparent from the communication.

The unsubscribe link in a new invitation email stops new campaign invitation emails and follow-ups to the email address that received it, including invitations about other creators sent to an agency inbox. Your creator profile settings let you view or change this same preference for your profile contact email address, including turning invitation emails back on. Older creator-specific links stop invitations to the contact email on that profile; contact support if you need to stop a different receiving address. You can also ask Figro to stop marketing or opportunity outreach by emailing our privacy contact. We may retain limited suppression information so that a later import does not cause unwanted outreach to resume. Tell us which addresses or profiles your request concerns.

Opting out of outreach does not necessarily stop essential communications about an existing account, accepted collaboration, payment, security issue or legal obligation. A client or other organization contacting you independently is responsible for its own communications. We can help identify the relevant party where appropriate.

A public email address or this notice alone does not authorize every form of marketing. Applicable destination, recipient and channel rules govern whether consent or other conditions are required.

5. Analytics, cookies and session replay

We use analytics to understand use and troubleshoot the service. Depending on the enabled features and settings, these technologies may record pages, clicks, scrolling, device/browser details, errors and visible page content or interactions. Analytics may be linked to an account identifier, name or email; do not assume it is anonymous. Session replay reconstructs activity within the service rather than recording your entire device screen.

Essential storage and identifiers support functions such as authentication and security. Other tracking must use an applicable legal basis and, where required, prior consent. Acknowledging this notice does not replace that consent. On the Figro web apps, optional analytics and session replay start after you choose "Yes, help improve". Choose "No thanks" to continue without them, or use "Privacy settings" to change or withdraw your choice later. The choice is remembered for that browser and site when storage is available; another browser or site may ask separately. The creator mobile app does not show this choice. If analytics are enabled there, they can start without that web prompt. The session replay described here applies to the web apps. You may use available consent controls and browser or device settings; blocking essential storage may prevent some functions from working. Contact us about tracking choices if you cannot find the relevant control.

Only information necessary for the stated purposes should be collected. Banking credentials, authentication secrets and unnecessary sensitive data should not be entered into free-text fields. We treat collection minimization and masking/exclusion of sensitive areas as safeguards to be applied to analytics. Contact us immediately if you believe a recording contains information that should not have been collected.

6. Disclosures and access

Information may be made available to:

- Clients and prospective collaboration partners: creator profiles, relevant contact details and discovery/performance information for evaluation and outreach, and agreement/submission information for an actual collaboration. Discovery access may be part of a paid Figro service; it does not grant unrestricted rights to use personal data.

- Creators and their authorized representatives: information needed to manage their collaborations and accounts. Representative access depends on the role and relationship recorded for the service.

- Brands and campaign reviewers: submitted materials, relevant creator identity and contact information, review context and campaign results as necessary for the campaign, including campaigns where Figro is the agency client. Payment or unrelated private information should not be shared merely because a recipient is the represented brand. An external review link can be opened by anyone who obtains it without signing in and may be forwarded. Materials may be viewed and downloaded. A link is not an identity check or a licence for public reuse. Avoid including unrelated private information in externally shared content.

- Service providers: hosting and storage, communications, analytics/replay, automated processing, support and payment services as needed for their functions. Some financial providers and social platforms process information for their own legal or service purposes as well as carrying out a requested operation.

- Professional advisers, authorities or other parties: where necessary for legal obligations, investigations, protection of rights or dispute resolution, subject to applicable law.

- A successor business: where relevant to a proposed or completed restructuring or transfer, with safeguards appropriate to the transaction and applicable notice obligations.

Access should be limited to what is needed for the relevant role. This notice does not authorize campaign participants to use personal data for unrelated purposes or make private material public.

7. International processing

Figro is based in Singapore and serves people internationally. Information may be accessed or processed in Singapore, countries where campaign participants are located, and countries where our service providers operate. Relevant providers may use locations outside your country.

The safeguards required depend on the origin, destination and roles involved. Where applicable, transfers must meet Singapore's comparable-protection requirements, EU GDPR transfer requirements, the UK's separate transfer requirements, or China's personal-information export requirements. Contractual safeguards, adequacy arrangements, permitted exceptions or other mechanisms may be relevant; none applies automatically to every transfer.

Contact our privacy contact for information about destinations and applicable safeguards for your data, including how to obtain a copy where available. We will provide the information required by applicable law, with necessary protections for confidential information.

8. Retention

Retention depends on the purpose and type of record, rather than one period for all information:

Accounts and active collaborations. The duration needed to provide the service and resolve outstanding administration, obligations or requests.

Agreements, payment evidence and disputes. Applicable legal recordkeeping requirements and the period reasonably needed to establish, exercise or defend rights. Account closure does not automatically erase these records.

Discovery and outreach information. Continuing relevance, accuracy, the source and permitted use, engagement history and applicable objections or withdrawal. Information without a continuing justified purpose should be removed or anonymized.

Identifiable analytics and replay. The applicable configured retention for Figro's PostHog project and the relevant data type, subject to purpose limitation and applicable deletion obligations. Analytics events and replay may have different periods; saved recordings or exports require separate review. Contact our DPO for the current applicable period.

Suppression and request records. The minimum information needed to respect an opt-out, demonstrate handling of a request or meet a legal obligation.

Backups. The applicable backup lifecycle, with restrictions on ordinary use and handling of deletion requests if restoration occurs.

We must stop retaining identifiable information when its purposes are no longer served and retention is no longer necessary for a legal or business reason. Information may instead be genuinely anonymized where appropriate. Retention to resolve a specific dispute or meet a legal requirement should be limited to the relevant records. Contact us for information about the retention applicable to your records.

9. Your choices and rights

Depending on applicable law and the circumstances, you may request access, correction, deletion, restriction, portability or information about sources and disclosures; object to certain processing, including relevant direct marketing; or withdraw consent where processing relies on it. Withdrawal does not invalidate earlier lawful processing. We will explain where withdrawal affects a service that requires the information, or where another lawful ground requires retention.

Singapore PDPA rights include applicable access/correction and consent-withdrawal rights. EEA/UK rights may also include erasure, restriction, portability and objection, subject to their conditions. Other jurisdictions, including China, may provide additional rights. These rights are not all identical or unconditional.

Email [email protected] , identify the relevant account or profile and explain the request. We may need proportionate identity or authority verification. We will respond within the applicable legal timeframe and explain a refusal or extension where required. You may raise a complaint with the competent data-protection authority, including Singapore's Personal Data Protection Commission, and exercise other available remedies.

10. Security, incidents and minors

We are responsible for safeguards appropriate to the sensitivity and use of personal data, including limiting access and protecting receiving details and private records. No system can guarantee absolute security. Contact support promptly about a suspected exposure or unauthorized access. Applicable law determines when individuals, clients or authorities must be notified of an incident; this notice does not replace those obligations.

Figro accounts and contracting services are intended for adults aged 18 or over. Publicly sourced content can incidentally include information about younger people. Do not knowingly submit unnecessary information about minors. Contact us if a profile or submission raises a minor's privacy concern so we can assess restriction, removal and any consent requirements.

11. Changes and contact

We will identify material changes to this notice through an appropriate service notice or communication. Where a changed purpose requires new consent or additional notice, updating this page alone is not sufficient. Archived contract rights are not changed by a privacy-notice update.

Data Protection Officer — privacy enquiries and requests: [email protected] , with "Privacy" in the subject.

Operator: Figro Technology Pte. Ltd., Singapore, UEN 202616878Z.