Legal

Privacy Policy

Last updated: 13 September 2026

Who we are

Zephyr is a design critique tool that integrates with Figma, operated by Studio Sintez Ltd. ("we", "us", "our"). We are the data controller for the personal data described in this policy. We operate at zephyr.design.

Zephyr is not made by, affiliated with, or endorsed by Figma. We are solely responsible for the privacy, security, and integrity of any data we receive from Figma or from you through the service.

We do not sell, rent, or trade your personal data to third parties.

For any privacy-related questions, contact us at hello@zephyr.design.

What data we collect

Waitlist phase:

• Your email address, submitted when you join the waitlist. It is received and stored by Google on our behalf (see Sub-processors). Retained until you unsubscribe or request deletion.

Beta and beyond:

• Figma account data — your name, email address, Figma user ID and handle, obtained via Figma OAuth during setup. Retained while your team is connected and removed when you disconnect it. To have your Zephyr account itself deleted, contact us.
• Comment data — for a Figma comment that mentions @Zephyr: its text and location, the name, handle and email address of the person who wrote it and of anyone mentioned in it, and event metadata (file key, comment ID, timestamp). This is stored in our database as a record of the event (see Webhook data below).
• Thread context — the earlier comments in the same Figma comment thread, with their authors' Figma handles. Read from Figma each time you tag @Zephyr so the reply can follow the conversation, sent to our AI provider, and not stored by Zephyr.
• Workspace context — information you choose to enter in the Zephyr dashboard about your organisation, brand, design standards, users or constraints. Stored until you clear it (context for a specific team is also deleted when you disconnect that team), and sent to our AI provider with each critique.
• Design frame images — a rendered PNG image of the specific frame or component where your comment is attached, exported from Figma's API. We do not export or access your entire file. More information available in the Design Image Lifecycle section.
• Webhook event metadata — when you connect a team, Zephyr registers a webhook with Figma to listen for new comment events in your team's files. When a comment is posted, Figma sends Zephyr a notification containing the event type, file key, comment ID, team ID, and comment text. Zephyr only processes events that mention @Zephyr — all others are discarded and not stored.
• Usage analytics — basic, cookieless analytics to help us improve the service (see Cookies and analytics below).

Why we collect it

• To operate the waitlist and send your beta invite.
• To provide the Zephyr feedback service — analysing your designs and delivering critique via Figma comments.
• To maintain and troubleshoot your team's connection to Figma (webhook management, OAuth lifecycle).
• To communicate important product updates.

Lawful basis for processing (GDPR)

We process your data under the following lawful bases:

• Contract performance — connecting your Figma account via OAuth, processing your design data, managing webhooks, and delivering AI-generated feedback. This processing is necessary to provide the service you signed up for.
• Legitimate interest — operational logging, security monitoring, and service reliability. We balance these interests against your privacy rights and limit processing to what is strictly necessary.
• Consent — waitlist signup, marketing communications, and optional analytics. You may withdraw consent at any time by unsubscribing or contacting us.

How we process your design data

When you tag @Zephyr in a Figma comment, the following happens:

• Figma sends a webhook event to Zephyr. The event contains metadata about the comment (file key, comment ID, team ID) and the comment text.
• Zephyr reads the comment and identifies the frame or component it's attached to.
• A PNG image of that specific frame is exported via Figma's API. Only the relevant frame is exported — not your entire file or project.
• The frame image, your comment, the earlier comments in the thread and any workspace context you have entered are sent to our AI provider (see below) to generate design feedback.
• The AI response is posted back to Figma as a reply to your comment.

Design image lifecycle

Design images follow a strict transient-only policy:

• Trigger: An image export is only triggered when you explicitly tag @Zephyr in a Figma comment. Zephyr never proactively scans or exports your files.
• Scope: Only the specific frame or component attached to your comment is exported — nothing else.
• Processing: The image is held in server memory only for the duration of processing (typically a few seconds). It is passed directly to the AI provider as an encoded data payload.
• Storage: Images are never written to disk, stored in a database, or served via a public URL. They exist only in memory during the processing pipeline.
• After processing: The image data is discarded from memory when processing completes. No copy is retained by Zephyr.

AI provider and LLM data pipeline

Zephyr uses OpenAI to generate design feedback. When you tag @Zephyr, the following data is sent to OpenAI's API:

• Your comment text (the message you wrote in Figma) and your Figma handle.
• The earlier comments in the same thread, with their authors' Figma handles.
• A rendered PNG image of the design frame your comment is attached to.
• The name and type of that frame, and roughly where on it your comment sits.
• Any workspace context you have entered in the Zephyr dashboard.

This data is sent via OpenAI's API for the sole purpose of generating a design critique response. Key facts about how OpenAI handles this data:

• OpenAI does not use data submitted via their API to train or improve their models.
• API inputs and outputs are retained by OpenAI for up to 30 days for abuse and misuse monitoring, then deleted. Zephyr cannot request early deletion of data during this retention period.
• For full details, see OpenAI's API Data Usage Policies ↗ and their Data Processing Addendum ↗.

No other AI or LLM provider receives your data. If we change providers in the future, we will update this policy and notify you before the change takes effect.

Webhook data

When you connect a Figma team to Zephyr, we register a webhook with Figma. This webhook notifies Zephyr when new comments are posted in your team's files. Here is how webhook data is handled:

• What Figma sends: Webhook payloads include the event type, file key, comment ID, comment text, team ID, and information about the commenter and anyone mentioned in the comment, including their name, handle and email address.
• Filtering: Zephyr only processes comment events that explicitly mention @Zephyr. All other events are acknowledged, discarded and not stored.
• Sanitisation: The webhook verification passcode is removed from each event before it is stored. No other fields are removed.
• Storage: For each comment that mentions @Zephyr, the event as Figma sent it — including the comment text and the names, handles and email addresses of the commenter and of anyone mentioned — is stored in our database for operational reliability, duplicate detection and troubleshooting. We do not currently apply an automatic retention period: these records are kept until your account is deleted or you ask us to delete them.
• Deletion: When you disconnect a team, the webhook is deleted from Figma, and your OAuth tokens and that team's workspace context are deleted. Stored event records are not removed automatically when you disconnect; email us and we will delete them.

Third-party services

Platform you connect to:

• Figma (San Francisco, US) — the design platform you already use. Zephyr accesses Figma's API using the OAuth token you grant and Zephyr's own Figma bot account to read comments, export frame images, and post replies. Your relationship with Figma is governed by Figma's own terms and privacy policy. Figma is not a sub-processor of Zephyr.
  Figma privacy policy ↗.

Sub-processors (services that process data on our behalf):

• OpenAI (San Francisco, US) — AI provider. Receives comment text, earlier comments in the thread with authors' handles, workspace context, and design frame images to generate feedback. Data retained up to 30 days for abuse monitoring.
  Data usage policy ↗.
• Render (San Francisco, US) — Cloud hosting and managed database. Hosts the Zephyr API, database, and automation services.
  Privacy policy ↗.
• Google Apps Script / Google Workspace (Google, US) — Waitlist sign-ups. Receives and stores the email address you submit to the waitlist form.
  Privacy policy ↗.
• Firebase Authentication (Google Cloud, US) — User authentication. Handles sign-in and session tokens.
  Privacy policy ↗.
• PostHog (EU-hosted) — Cookieless product analytics. Collects anonymous usage data to help us improve the service. No personal identifiers are sent.
  Privacy policy ↗.

Data storage and security

Your Figma OAuth credentials (access and refresh tokens) are encrypted at rest using AES-256-GCM with unique initialisation vectors. Webhook verification secrets are also encrypted at rest using the same scheme.

Your design files are not copied or stored by Zephyr. Frame images are processed entirely in memory and never written to disk or permanent storage. We do not build a database of your design work.

We limit access to personal data to only what is necessary to operate the service. All connections to external APIs (Figma, OpenAI) use TLS encryption in transit.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, in accordance with GDPR Articles 33–34.

International data transfers

Zephyr is operated from the EU. However, some of the services we use (OpenAI, Figma, Render, Firebase and Google Apps Script) are based in the United States. Personal data transferred to the US is protected by:

• The EU-US Data Privacy Framework (adequacy decision adopted by the European Commission on 10 July 2023), where the provider is certified.
• Standard Contractual Clauses (SCCs) as approved by the European Commission (June 2021), incorporated into Data Processing Agreements with our sub-processors.

We verify the transfer mechanisms of our sub-processors and will update this policy if they change. If you have questions about specific transfer safeguards, contact us at hello@zephyr.design.

Your rights (GDPR)

If you are in the European Economic Area (EEA), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten").
• Portability — request a machine-readable copy of your data.
• Restriction — request that we limit processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, by disconnecting your team or contacting us.
• Lodge a complaint — with your local data protection supervisory authority.

To exercise any of these rights, email hello@zephyr.design. We will respond within 30 days.

Automated decision-making

Zephyr uses AI (via OpenAI) to generate design feedback in response to your comments. This processing is automated but advisory only — it does not produce legal effects or similarly significant decisions concerning you. You are free to disregard the feedback at any time.

Cookies

The waitlist landing page does not use cookies. The beta application uses strictly necessary cookies to maintain your login session. We do not use tracking or advertising cookies. Our analytics provider (PostHog) operates in cookieless mode.

Changes to this policy

We may update this policy from time to time. If we make significant changes — particularly to how we process your design data or which AI providers we use — we will notify you by email or with a prominent notice on the website before the changes take effect. Where changes affect processing based on consent, we will seek fresh consent before applying them.

Children and age restriction

Zephyr is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us at hello@zephyr.design and we will delete it promptly.

Contact

Questions about this policy? Reach us at hello@zephyr.design.