Privacy Policy
1. Who We Are
CP0 operates the web application at cp0.dev and the CP0 plugin for Figma. For the account and service data described below, CP0 is the data controller. For payment transactions, Paddle acts as the merchant of record and is the data controller for payment data under Paddle's own privacy policy.
2. Information We Collect
Account data: your name, email address, and password. Service data: the Figma design data you submit, your selected frames, component and project metadata, generation settings, and the code generated for you. Usage data: basic technical logs such as IP address, browser, and timestamps, used to keep the service secure and reliable. We do not collect your payment card numbers; they are entered directly with our payment provider, Paddle.
3. How We Use Information
We use account data to run your account, authenticate you, and send transactional email such as verification and password reset messages. We use service data to generate code, run your projects, and let you review and export output. The Figma design data you submit is transmitted to our AI provider solely to analyze your design and generate your output. We use usage data to maintain security, prevent abuse, and operate the infrastructure. We do not sell your personal information and we do not use it for advertising. We do not train machine-learning models on your designs or generated code.
4. Legal Bases
We process account and service data to perform the contract you enter into when you register. We process usage data for our legitimate interests in securing and operating the service. Where the law requires consent for a type of processing, such as marketing, we only process with your consent, which you may withdraw at any time.
5. Cookies and Local Storage
We authenticate your session with httpOnly JWT cookies set on login, a short-lived pairing cookie used while you connect the Figma plugin to your account, and short-lived signed state cookies used during Google sign-in. We do not use tracking, advertising, or analytics cookies. The plugin keeps local state in Figma's client storage while it pairs with your account.
6. Data Retention
Figma design data, the JSON we analyze, is deleted from our object storage within 48 hours of upload or of your next analysis run, whichever triggers cleanup first, whether or not you generate code. Generated code and project files stay stored while your project is active and are deleted when you delete the project or ask us to close your account. Account data is kept while your account is active. Billing records are kept by Paddle for as long as the law requires. Technical logs are kept only as long as needed for security.
7. Sharing and Sub-Processors
We share data only with the service providers needed to run the service, under contractual terms that require them to protect it: Paddle (payment processing, a separate controller), Resend (transactional email), Cloudflare (CDN, edge network, and R2 object storage), DeepSeek (AI analysis — the design data you submit is sent to DeepSeek's API solely to analyze your design and generate your output), and Contabo (VPS hosting in Germany, where our self-hosted PostgreSQL database and Redis run). Each has its own privacy policy governing its processing.
8. International Transfers
Our servers are hosted in Germany. The providers listed above may store and process data in other locations under their own published policies (see DeepSeek's, Cloudflare's, and Paddle's data-handling terms). Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses or an applicable adequacy decision.
9. Your Rights
You may access, correct, or delete your data at any time. To delete a project's data, use the DELETE endpoint /api/export/{project_id}/data, or ask us at [email protected] with your account email. You may also object to processing, restrict it, or request your data in a portable format, and you may withdraw any consent you gave. If you are in the EEA or the UK, you may lodge a complaint with your data protection authority. California residents may request to know, correct, or delete their personal information under the California Consumer Privacy Act; we do not sell personal information.
10. Children
The service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.
11. Security
Design data is encrypted at rest with AES-256 managed by our object storage provider and protected in transit with TLS. Passwords are stored only as cryptographic hashes. Access to our systems is limited to staff who need it to operate the service.
12. Changes and Contact
We may update this Privacy Policy from time to time. Material changes will be posted here with an updated Last Updated date. For privacy questions or to exercise your rights, contact us at [email protected].
Last Updated: September 2026