Privacy

Kept secure, and encrypted

• Everything Fig stores is encrypted — your calls, transcripts, recordings and account — both on the way to us and while it is stored.
• Your provider key gets an extra layer of encryption, with the keys held separately, and it is never shown back to you.
• Only the right people get in. Access is by role, a client sees only their own calls, and every open of a recording or transcript is written down.

What Fig holds

• Your calls — the recording, the transcript, when it happened, how long it ran, how it went. These come from the voice-agent account you connect.
• Your account — your email address, your name, and which agency or business you belong to.
• Your provider key — encrypted, used to fetch your calls, never shown back to you or sent to your phone.
• How Fig is used — which screens, how long, what was slow, what errored. Used to decide what to fix, what to build and what to take out. Never the content of a call.

The people on the other end of those calls

A recording has somebody else in it. Fig holds whatever your agent captured — usually a phone number and whatever the person said — because that is what the recording is. We do not enrich it, look them up anywhere, or use it for anything except showing you your own call.

Telling those people they are being recorded is your responsibility, not ours. The rules differ by state and by country. Fig is the place the recording lands; it is not the thing that made it.

Where it is

• Calls, transcripts and recordings: Australia. They do not leave.
• Your email address: the United States, held by the service that signs you in. That is the only personal thing that sits outside Australia.
• Recordings are encrypted at rest, and a link to one is short-lived — it cannot be copied out and used later.

Who can see your calls

• People in your agency or business, according to the role you gave them.
• A client you have given portal access to sees only their own calls. That boundary is enforced by the database itself, not by a screen remembering to filter.
• Every time anybody opens a recording or a transcript, Fig writes down who and when. You can ask us for that record.
• Us, only when you ask us to look at something, or where the law forces us.
• Anyone you send a shared link to — see below. This is the one way a call leaves the boundaries above, and it only ever happens because somebody chose it.

Sharing a call with someone outside Fig

You can create a link to one call. Anyone holding that link can open it without signing in and without an account — that is the point of it, and it is also the risk, so the link is the key. Treat it like one.

• You choose what travels. The recording always; the transcript only if you say so. The page shows that one call and nothing else from your account.
• You can add a passcode, and you can set it to expire. Both optional.
• You can revoke it at any moment, and it stops working immediately.
• We count the opens and the last time it was opened, and show you both. We cannot tell you who opened it — nobody signs in, so there is nothing to know.
• Whoever opens it can ask you to send it again if it has stopped working, or tell us they believe they are the person on the recording. Either way it reaches you inside Fig.

What we never do

• We never sell your data, or anybody’s. There is no advertising in Fig and no arrangement with anyone who wants your calls.
• We never train AI models on your calls or transcripts.
• We never read your calls out of curiosity.

Deleting your account, or getting a copy

Delete your account from inside Fig — Settings, then Delete account. Nothing to email, nobody to ask, no reason required.

We keep it for 30 days in case you change your mind. Sign in during that time and you can bring it back, exactly as it was. Nothing syncs while it is waiting, and nobody can open it.

After 30 days it is gone: your calls, your recordings, your transcripts, your account and your provider key. Backups take a few hours longer. Our database keeps a short recovery history — currently six hours — so a copy can linger that long and no longer. We will not pretend we can reach inside a backup and pull one person out of it. Nobody can.

Deleting Fig does not delete the calls in your voice-agent account. We only ever held a copy. Yours stay where they are.

Want everything we hold before you go, or something corrected? Email support@ironlab.ai from the address on your account.

How long we keep it

Your calls stay while your account is open, because a call you cannot go back to is not worth storing. Delete the account and they go on the schedule above. Access records are kept for two years while your account exists, because the whole point of them is answering a question somebody asks later — delete your account and they go with everything else.

If something goes wrong

If data of yours is exposed and it could cause you harm, we will tell you and the Australian Information Commissioner. We will tell you what happened, what was involved, and what to do — not a notice that says as little as possible.

Children

Fig is a tool for businesses and is not for anyone under 16. We do not knowingly hold an account for one.

Changes

If this changes, we will say what changed, in one line, before it applies. The version date at the top is the honest one.

If you are not happy

Tell us — support@ironlab.ai. A person reads it, and we will tell you what we are doing about it rather than that your feedback is important to us.

And if you would rather just go, go. Delete your account from Settings and everything of yours goes with it, on the schedule above. You do not have to argue with us first, and you do not have to explain.

You can also raise a privacy concern with the Office of the Australian Information Commissioner, oaic.gov.au. We would rather you came to us first — but it is your right and you should know it exists.