Figma

GDPR overview

GDPR implementation is documented and concrete. The privacy policy has been in force since 2 June 2026, the Data Processing Addendum was updated on 30 March 2026 and is published for incorporation with a Schedule 1 describing the processing, and the AI Terms took effect on 24 June 2026. Figma names an EU Article 27 representative, Figma GmbH in Berlin, a UK representative, Figma UK Ltd. in London, and a Data Protection Officer reachable at privacy@figma.com. Transfers rely on the module 2 standard contractual clauses of 4 June 2021, the UK Addendum and certification under the EU-U.S. Data Privacy Framework with its UK and Swiss extensions. Data subject rights are listed in full, Global Privacy Control signals are honored, and security incidents are notified without undue delay and where possible within 72 hours. ISO 27701, ISO 42001, C5 and the EU Cloud Code of Conduct complete the picture.

Who owns the data?

The Terms of Service (2.8) leave the customer all right, title and interest in its Customer Content, while Figma keeps its rights in the Figma Platform. The AI Terms, effective 24 June 2026, extend that rule to artificial intelligence: both the Input submitted and the Output returned are Customer Content and belong to the customer. For personal data held inside that content, the Data Processing Addendum updated on 30 March 2026 makes Figma a processor, acting only on the customer's documented instructions or to meet its own legal obligations. On Organization and Enterprise plans every file, drafts included, belongs to the organization and is recoverable at deprovisioning.

Reuse rights

Because the customer owns its Customer Content and its AI Inputs and Outputs, it may reuse, publish and commercialize them without asking Figma for permission; the usual limits are the Acceptable Use Policy and the reminder in the AI Terms (5) that outputs are not verified by Figma and that human review is the customer's responsibility. In the other direction, Figma's own use of that content for model training depends on a single switch: when the Content Training toggle is on in the administrator settings, Figma may use Customer Content to train and improve its machine learning models. Turning it off works prospectively only, excluding content and edits added after that date. AI processing relies on named subprocessors, all listed as United States entities: Anthropic, Amazon Web Services, Cerebras Systems, Fireworks.ai, Google (Vertex), Jasper AI, Microsoft (Azure), OpenAI and Recraft, with Castle Global (Hive) and OpenAI used for moderation and safety filtering, and Modal Labs providing the sandbox environments behind Figma Make. Figma also publishes a dedicated page on its AI privacy approach.

Data retention & training

Hosting summary

Section 6 of the privacy policy is explicit: all personal information processed is transferred to, processed and stored in the United States, where Figma's headquarters and main servers sit. The subprocessor table lists Figma, Inc. itself for the EEA and the United States, and localized EU hosting is offered as a feature, though it only covers key parts of Figma and FigJam files rather than everything. Subprocessors are mostly American; Figma Weave adds providers in the EU, Belgium, the Netherlands, Spain, Singapore, Indonesia, Malaysia, Israel and the United Kingdom. The same table notes that when traffic is routed through global data centers for latency, processing happens in volatile memory only and the cache is purged within two hours. Infrastructure resolves to AWS (AS16509), with a content delivery node observed in Ferno, Italy, which reflects edge distribution rather than where the data lives. Transfers out of Europe rely on the module 2 standard contractual clauses of 4 June 2021, the UK Addendum and certification under the EU-U.S. Data Privacy Framework.