How Copycat UI processes personal information.

1. Who is responsible for your information

Copycat UI is a product of New Era Investments (Pty) Ltd, Reg. 2026/675069/07 (“New Era Investments”, “we”, “us”), which operates the service described in this notice. General, privacy, and personal-information requests can be sent to support@copycatui.com. That operator is the responsible party for account, billing, security, service-usage, and direct customer-relationship information that it decides to process.

A workspace customer may be the responsible party for personal information that it chooses to place in UI strings, translations, descriptions, tags, context links, or other workspace content. In that situation, Copycat UI may act as an operator for the customer. Ask the relevant workspace owner first if your information appears in customer content.

2. Information we process

Depending on how you use the service, we process the following categories:

• Waitlist information: first name and email address; optional last name, company or team, intended plan, and intended use; queue position, referral code, referral attribution and count; the page and language used to join; consent statement, version, method, and time; status; and confirmation-email delivery information.
• Account information: first and last name, display name, email address, Firebase user identifier, email-verification state, account dates, and workspace memberships and roles. Authentication credentials are handled by Firebase Authentication; the app does not store your plaintext password in Firestore.
• Workspace and invitation information: workspace and project names, owners, members, roles, invited email addresses, invitation status and expiry, and administrator-handoff records.
• Customer content: string keys and values, translations, descriptions, context URLs, tags, statuses, source and target locales, and imported or exported catalog content. This content may contain personal information if a customer puts it there.
• Developer access information: API-key name, prefix, one-way hash, creator, creation date, revocation information, and last-used time. The full API secret is shown when created and is not stored in readable form by Copycat UI.
• Figma integration information: the project and account that create a one-time pairing code; code creation, expiry, and use times; and a plugin-session identifier, token prefix and one-way token hash, creation, last-used, expiry, and revocation times. The plugin stores its opaque session token and project details in Figma client storage. Text layers bound by the plugin contain the Copycat project, string key and identifier, locale, and binding version. The plugin does not send the existing contents of Figma text layers, Figma file identifiers, or document names to Copycat UI.
• Subscription information: selected plan and billing interval, subscription status and renewal date, and Paystack customer, subscription, plan, authorization, transaction, and receipt identifiers. Paystack receives the account email and service identifiers and processes payment-method and transaction information; Copycat UI does not store full card details.
• Legal acceptance information: account identifier and email, the exact Terms, Privacy Notice, and billing-statement versions presented, the statement accepted, registration or billing context, selected subscription details, server timestamp, IP address, browser user-agent, and linked Paystack transaction or subscription identifiers where applicable.
• Communications: recipient email, display name, waitlist position and referral link, invitation details, authentication or handoff links, message identifiers, and email-delivery information processed through Resend and Firebase.
• Security and technical information: IP address used for rate limiting and acceptance evidence, hashed rate-limit keys, request counts and times, application-integrity tokens and risk signals from Firebase App Check and reCAPTCHA Enterprise, browser user-agent recorded with legal acceptance, and service logs generated by Firebase and Google Cloud. The public waitlist rate limit stores a one-way hash derived from the request IP rather than the raw address.
• Usage and device information: only when you allow Google Analytics, it may collect browser and device information, approximate location, pseudonymous identifiers, page or app activity, and session statistics. Analytics is disabled by default. See the Cookie Notice.

3. Where information comes from

• Directly from you when you join the waitlist, register, choose a plan, create or edit content, create an API key, request an email, or contact us.
• From another waitlist participant when you use their referral link; this records the referral relationship and may move that participant up the queue.
• From workspace owners or administrators when they invite you, assign a role, transfer a workspace, or manage membership.
• Automatically from your browser, device, API requests, and use of the service.
• From the Copycat UI Figma plugin when you connect it, search the project catalog, apply a string, or refresh a bound text layer.
• From Firebase/Google, Paystack, and Resend when they return authentication, billing, security, or email-delivery information needed to operate the service.

4. Why we process information

We process information only for purposes connected to the service, including:

• creating and authenticating accounts, verifying email addresses, resetting passwords, and providing requested workspace features;
• maintaining the beta-access queue, preventing duplicate positions, attributing referrals, sending a confirmation, evaluating interest, providing consented beta and product updates, and announcing production availability;
• managing workspaces, projects, roles, invitations, catalogs, translations, imports, exports, and read-only API access;
• pairing the Figma plugin with a selected project, returning requested source or approved translated strings, maintaining revocable plugin sessions, and resolving bindings when you ask the plugin to refresh layers;
• starting and managing subscriptions, confirming payment status, applying plan limits, presenting payment history, and handling cancellation or plan changes;
• recording and demonstrating account-term acceptance and recurring-subscription authorization, resolving disputes, and enforcing the agreement;
• sending transactional messages that you request or that are necessary for waitlist confirmation, account, invitation, security, and administrator-handoff workflows;
• protecting accounts and infrastructure, enforcing access rules, preventing abuse, rate limiting, troubleshooting, and maintaining service integrity;
• measuring product usage and improving the service where Analytics is enabled; and
• meeting legal, accounting, regulatory, dispute, and enforcement obligations that apply to the operator.

The intended lawful justifications include steps requested before contracting, performance of the service agreement, compliance with legal duties, protection of legitimate interests that do not unjustifiably override your rights, and consent where consent is required.

5. Required and optional information

To join the waitlist, your first name, email address, and affirmative consent to the stated beta, product-update, and launch emails are required. Without them, we cannot reserve a place or provide those updates. Last name, company or team, intended plan, and intended use are optional.

Name, email address, password submission to Firebase, a plan selection, and affirmative acceptance of the Terms are required to create or continue using an account. A separate recurring-charge authorization is required for a paid subscription. Without them, we cannot create the requested account or subscription. Workspace, project, string, locale, translation, API-key, and Figma-integration information is optional, but the related feature cannot work without the information it asks for.

Do not place passwords, private credentials, payment-card data, government identifiers, health information, or other special or highly sensitive information in customer-content fields unless the operator has expressly agreed to that use and appropriate safeguards are in place.

6. Sharing and operators

We disclose information only as needed for the purposes above.

We may share personal information with service providers that help us provide Copycat UI, including Firebase and Google Cloud for waitlist storage and server-side processing, Resend for confirmation and consented product emails, and providers of authentication, payment processing, error monitoring and customer support. These providers may process personal information only for the services they provide to us and subject to appropriate contractual and security safeguards.

When you run the Figma plugin, Copycat UI returns the selected project name, locale configuration, string keys, source values, and approved translated values to the plugin inside Figma. Figma operates the editor and its plugin environment under Figma’s own terms and privacy practices. Copycat UI does not receive the surrounding Figma document or existing layer text through this integration.

7. International processing

Copycat UI is operated from South Africa, and its primary workspace database is hosted in South Africa. Some supporting activities involve international processing. Depending on the feature you use, account authentication, server-side application operations, transactional communications, payment administration, security monitoring, service logs, and related support information may be processed in the United States. Optional usage analytics and resilient infrastructure may also involve processing through distributed facilities in other countries.

International processing is limited to what is reasonably necessary for the relevant service or an optional feature you choose. Where personal information is transferred outside South Africa, we rely on applicable contractual and organisational safeguards, a transfer necessary to provide the service you requested, your consent where required, or another ground permitted by section 72 of POPIA. Service providers may use approved subprocessors in other countries under corresponding data-protection obligations.

International locations and safeguards may change as infrastructure and service arrangements develop. We review material changes and will update this notice when they significantly affect how or where personal information is processed.

8. Retention and deletion

We intend to keep personal information only while it is needed for the stated purpose and any defensible legal, accounting, security, backup, or dispute period. Vendor-controlled copies may follow the relevant vendor retention rules.

Waitlist records are kept while beta access and launch communications remain relevant and for a reasonable period afterwards to handle consent, referral, delivery, objection, and dispute records. If you withdraw consent, we will stop the covered updates and may retain only the minimum information needed to honour the objection, demonstrate consent history, prevent an unwanted re-subscription, or meet legal obligations.

When an owner chooses “Delete everything”, the current backend stops renewal of active and scheduled Paystack subscriptions, deletes owned workspaces and their projects, strings, translations, and API keys, removes that person from other workspaces, and deletes their Copycat UI profile, billing record, and Firebase Authentication account. Paystack retains transaction and related records under its own legal and contractual duties. Transferring to an existing administrator preserves workspace content but deletes the outgoing owner’s service account. Inviting a new administrator leaves the outgoing account active until the invited person registers and verifies their email.

Removing a non-owner member from a workspace removes only that person’s access to the selected workspace. It does not delete their Copycat UI account or affect their memberships in any other workspace.

Unused Figma pairing codes expire after ten minutes. A connected plugin session expires after 90 days and can be revoked earlier in Integrations or by disconnecting the plugin. Account deletion removes pairing and session records belonging to the account, and deleting an owned workspace removes the related project pairing and session records. Copycat binding metadata and text already written into a Figma file remain in that file until someone unlinks or changes the layer, deletes the file, or Figma removes it under the applicable Figma account and retention arrangements.

9. Security

The service uses role-based Firestore rules, verified-email checks, server-side functions for sensitive actions, hashed API secrets, Figma plugin tokens and invitation tokens, expiring one-time Figma pairing codes, rate limiting, Paystack-hosted payment pages, signed payment webhooks, and App Check/reCAPTCHA when configured. Vendors provide additional infrastructure safeguards. No online service is completely secure, and this notice does not promise that incidents cannot occur.

If a personal-information security compromise occurs, the operator must investigate, mitigate, and make notifications required by POPIA, including through the Information Regulator’s current eServices process where applicable.

10. Your choices and rights

Subject to POPIA, PAIA, and lawful limits, you may ask the responsible party to:

• confirm whether it holds your personal information and request access to it;
• correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
• object to processing in circumstances allowed by law or withdraw consent where consent is the basis;
• stop direct marketing and other processing that the law permits you to opt out of;
• explain a significant solely automated decision if one is introduced; and
• provide information about applicable complaint or review processes.

Send requests to support@copycatui.com. We may need to verify identity and may refuse or limit a request only where the law permits. Workspace-content requests may need to be directed to the workspace customer that controls that content.

11. Analytics, cookies, and communications

Google Ads measurement is optional and requires a separate choice in cookie preferences. If enabled and allowed, Google receives the amount in ZAR and unique checkout reference after a live Paystack payment is verified by our server, together with browser, network, and advertising attribution signals. Google may use advertising cookies and click identifiers to measure advertising effectiveness. We do not send names, email addresses, or card details in the conversion payload; enhanced conversions and ad personalization are disabled in this implementation. You can withdraw permission without affecting billing or other core features. A browser-local transaction marker prevents repeat submissions until site data is cleared.

Google Analytics is disabled by default and is not loaded unless you select “Allow Analytics” in the cookie-preferences control. Rejecting or later withdrawing that choice does not affect the service’s core features. Your choice is stored in the current browser, can be changed at any time, and resets to Analytics off if the stored preference is missing. When allowed, Analytics may set first-party identifiers and collect device, browser, approximate-location, and activity information. See the Cookie Notice for details.

Verification, password reset, workspace invitation, administrator handoff, and the immediate waitlist confirmation are service messages. If you join the waitlist using the unchecked consent control, we will also use the supplied email address for occasional Copycat UI beta and product updates and to announce production availability. You can withdraw that consent at any time by emailing support@copycatui.com; future product-update messages must identify Copycat UI and provide a practical route to stop further messages. We do not sell waitlist details or use them for third-party advertising.

12. Children, sensitive information, and automated decisions

The service is not designed to collect children’s information or special personal information, and it should not be used for those categories without prior written approval and additional safeguards.

The repository does not show profiling or a solely automated decision that has a legal or similarly significant effect. App Check and reCAPTCHA use automated risk signals to protect requests and access; users may be blocked when an integrity token cannot be verified.

13. Questions and complaints

Contact support@copycatui.com first so the concern can be investigated.

You may also lodge a POPIA complaint with the Information Regulator (South Africa) through its eServices portal or at POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za or 010 023 5200. Current details are available at inforegulator.org.za. Consumer complaints may also fall within the National Consumer Commission’s jurisdiction.

14. Changes to this notice

We will show a new effective date when this notice changes. Material changes should be brought to account holders’ attention through an appropriate in-product or email notice before they take effect where required.