Privacy policy

Last updated 25 October 2026 (teams, storage and link imports added).

Who we are

Kitform (https://kitform-green.vercel.app) turns brand guides into Figma design systems, on the website and as a connector for Claude. Questions about this policy, or about your data: support-email-not-set@example.com.

What we collect

  • Your account: your email address, the name you give (optional), and your password, stored only as a scrypt hash.
  • Your brands: when you upload a brand guide (IDML, PDF or PowerPoint), Kitform reads it and keeps what it extracts: colours, fonts, text styles, spacing, page layouts and the images used in them, and any logos you add. On the free plan the uploaded file itself is not kept. On Studio and Team (or with extra storage), Kitform also keeps the original file so you can download it again, within your plan's storage. Edits you make are saved with the brand.
  • Teams: a team's name, its members' email addresses and roles, and pending invites (the email address invited and its role). Everyone in a team can see its members' email addresses and its brands.
  • Links you import from: when you import a guide from a link (Dropbox, Google Drive, OneDrive or similar), Kitform downloads the file from that link once. The link itself isn't stored.
  • Payments: if you buy Build or Studio, Stripe handles the payment. Kitform keeps your Stripe customer id, which brands you have bought, and your Studio subscription status. Kitform never sees or stores card details.
  • Technical data: our host, Vercel, records standard request logs (such as IP address, time and page requested) to run and secure the service.

Using Kitform from Claude

When you connect Kitform to Claude, Claude calls Kitform's tools on your behalf. Kitform receives only what each tool call contains (for example a brand id, a colour value or an uploaded file) and returns the result. Kitform does not receive, read or store your conversations with Claude, your Claude memory or your chat history, and does not log tool arguments beyond saving the brand changes you ask for.

Sign-in uses OAuth: you sign in to your Kitform account and approve access, and Claude receives a token that only works for your own brands. Access tokens expire after an hour, refresh tokens after 90 days, and you can end access at any time by disconnecting Kitform in Claude.

How we use it

Only to provide Kitform: to sign you in, keep your brands, build them in Figma when you ask, take payment and give you access to what you have bought, and keep the service secure. We do not sell your data, use it for advertising, or use your brand files to train AI models.

Who we share it with

Only the service providers Kitform runs on, each for its own part:

  • Vercel hosts the website and connector and stores accounts and brands (Vercel Blob).
  • Stripe takes payments and stores billing details.
  • Google Fonts serves the web fonts used on these pages, so your browser contacts Google when a page loads.
  • Figma receives a brand's design system when you build it in a Figma file you choose, through Figma's own connector or plugin.

We share data with others only if the law requires it.

Cookies

One cookie, kf_session, keeps you signed in for up to 30 days. There are no analytics or advertising cookies.

How long we keep it

  • Original files are deleted with their brand. If a plan with storage ends, kept files may be deleted after 30 days.
  • Brands stay until you delete them (in the app, or by asking Claude to delete a brand). Deleting a brand removes it from storage straight away; anything already built in Figma stays in your Figma file.
  • Your account stays until you ask us to delete it. Email support-email-not-set@example.com and we will delete your account and brands within 30 days.
  • Payment records are kept by Stripe and by us for as long as tax and accounting law requires (usually six years in the UK).
  • Hosting request logs are kept by Vercel for a short period under its own retention settings.

Your rights

Under UK and EU data protection law you can ask to see, correct, export or delete your data, or object to how it is used. Email support-email-not-set@example.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

Security

Kitform is served only over HTTPS, passwords are hashed, sign-in tokens are signed and expire, and each account can reach only its own brands. Report a security issue to support-email-not-set@example.com.

Changes

If this policy changes, we will update the date at the top and, for significant changes, tell account holders by email.