Insta2Figma - Privacy Policy

Last updated: June 20, 2026

1. Introduction

This Privacy Policy explains how MAINNET TECNOLOGIA collects, uses, stores, shares, and protects personal data when you use Insta2Figma — the Figma plugin, Framer plugin, our website, and our backend API (together, the “Service”).

Data controller

MAINNET TECNOLOGIA
CNPJ: 62.169.789/0001-66
Estrada dos Menezes, 850, Sala 1307
São Gonçalo, Rio de Janeiro, Brazil

Email: marcus@mainnet.design
Website: https://mainnet.design

We process personal data under the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018). Where applicable, we also respect GDPR (EEA/UK) and disclose relevant US practices below.

2. Summary

3. Who This Policy Applies To

• Service users — Figma/Framer plugin users (guest or signed-in)

• Website visitors — mainnet.design

• Customers — paid subscribers

• Support / feedback contacts

This policy also covers public Instagram usernames and URLs you choose to preview or import. Those may relate to third parties (Instagram account holders), not just you.

4. Data We Collect

4.1 Your account data (Service users)

We do not receive your personal email from Figma or Framer unless you sign in.

Optional platform display name may be sent during guest auth and passed to Polar at checkout only.

4.2 Import & usage data

4.3 Public Instagram data (on your request)

When you search or import, we process publicly available Instagram content:

We do not ask for or store your Instagram password.

Data source: our own scraper (with server-side session infrastructure) and, when that fails, Apify actors configured in our backend. Apify processes the public URLs/usernames we send — under Apify’s terms and privacy policy.

4.4 Operational & pseudonymized telemetry

We log scrape/preview operations for reliability (table scrape_telemetry). These logs are pseudonymized:

On account deletion, we remove telemetry rows matching your hashed pseudonymous ID using the same algorithm (ScrapeTelemetryService.pseudonymizeUserId).

4.5 Temporary authentication data

4.6 Feedback & support

If you submit feedback: name, email, message, platform, optional linked user ID — stored in our database and may be emailed to our team.

4.7 Website

The mainnet.design site may use Framer hosting cookies per Framer’s settings. See Cookies Policy.

We do not use third-party session-recording or analytics tools in the plugins.

4.8 Data on your device only

Clearing plugin data removes this from your device; it does not delete server-side account data.

5. How We Use Data

1. Provide previews and imports

2. Enforce plans and quotas

3. Process subscriptions (via Polar)

4. Send magic links and respond to support/feedback

5. Maintain reliability (pseudonymized scrape telemetry)

6. Protect against abuse and secure the Service

7. Comply with legal obligations

We do not sell personal data or use it for third-party advertising.

6. Legal Bases (LGPD & GDPR)

For public Instagram data you request, we rely on contract (delivering the feature) and legitimate interest (operating a design import tool). You must ensure your use respects third-party rights and Instagram’s terms.

7. Subprocessors & International Transfers

We use service providers who process data on our behalf. We select providers with appropriate security and, where required, data processing agreements (DPAs) or equivalent contractual safeguards for international transfers.

Confirmation for your records: Mainnet relies on each provider’s published privacy terms and DPA/SCC programs (Polar, Google Cloud, Apify, etc.). We do not transfer data to subprocessors for their independent marketing. Contact us if you need the name of a specific DPA instrument for a provider.

Data may be transferred outside Brazil (including the USA). We use mechanisms recognized under the LGPD and GDPR (standard contractual clauses or equivalent) where applicable.

8. Retention

9. Security

• TLS/HTTPS in transit

• Access-controlled database and cloud infrastructure

• JWT authentication

• No payment card storage (Polar)

• Pseudonymous guest accounts

Report vulnerabilities: https://mainnet.design/resources/security or marcus@mainnet.design

10. Your Rights & Data Deletion

10.1 LGPD rights (Brazil)

You may request: confirmation, access, correction, anonymization, portability, deletion, information on sharing, and revocation of consent.

Email: marcus@mainnet.design

Response time: within 15 days (LGPD), extendable where permitted.

ANPD: https://www.gov.br/anpd

PROCON: available for consumer matters under the CDC.

10.2 Account deletion

To delete your account and personal data, email marcus@mainnet.design from your registered email, or provide enough information to verify identity (including guest/platform context).

We will delete or anonymize:

• User account (email, platform IDs, Polar linkage on our systems)

• Jobs and usage counters tied to your account

• Feedback you submitted

• Scrape telemetry rows matching your HMAC pseudonymous ID (same hash algorithm used at write time)

We may retain:

• Billing/tax records via Polar (contact Polar for payment data deletion)

• Anonymized/aggregated statistics that cannot identify you

• Data required by law or to resolve disputes

Clearing plugin local storage alone does not delete server-side account data.

10.3 GDPR (EEA/UK)

If GDPR applies, you also have rights to erasure, restriction, objection, and to lodge a complaint with your supervisory authority.

10.4 United States

We do not sell personal information as defined by CCPA/CPRA. California residents may request access, deletion, and correction by contacting us.

11. Third-Party Instagram Data

Insta2Figma processes public Instagram content because you request it. We are not Instagram/Meta. Content may be subject to copyright and privacy rights of creators and account holders.

You are responsible for lawful use. See Terms & Conditions.

Third-party account holders with data concerns may contact marcus@mainnet.design.

12. Children

The Service is not directed at children under 16 without parental consent where required. We do not knowingly collect data from children under 13 (USA).

Contact us to request removal if you believe a child provided personal data.

13. Automated Decisions

We do not make legally significant decisions based solely on automated processing. Quotas follow fixed plan rules.

14. Changes

We may update this policy. The “Last updated” date reflects the current version. Material changes will be communicated via the Service or website.

A Portuguese (PT-BR) version may be published separately; where required for consumers in Brazil, it prevails over English in case of material inconsistency.

15. Governing Law

Laws of Brazil.

Consumers (CDC): courts of your domicile (Art. 101).

Other disputes: courts of São Gonçalo, Rio de Janeiro, Brazil, unless mandatory law requires otherwise.

16. Contact

MAINNET TECNOLOGIA
CNPJ: 62.169.789/0001-66
Estrada dos Menezes, 850, Sala 1307
São Gonçalo, Rio de Janeiro, Brazil

Privacy & deletion: marcus@mainnet.design
Support: marcus@mainnet.design

Appendix — Compliance notes (internal / operator reference)

This appendix summarizes alignment with common requirements. It is not legal advice.