Figma Privacy Policy (Superseded URL)

This document is Figma's Privacy Policy, effective June 2, 2026, governing the collection, use, and disclosure of personal information across Figma's websites, mobile applications, APIs, and design tool services globally. The policy states that Figma collects account information, payment metadata, communication data, customer content, usage data, technical data, and candidate information, and asserts legal bases for processing under contract performance, legitimate interests, consent, and legal obligation frameworks consistent with GDPR-style requirements. Notably, the policy authorizes AI training on Customer Content when a 'Content Training' toggle is enabled in administrative settings, and permits sharing of user interaction data including IP address and file activity with file administrators, which creates operational exposure for users who may not be aware their viewing activity is disclosed to file owners. The policy engages GDPR, UK GDPR, Swiss data protection law, CCPA, and multiple U.S. state comprehensive privacy laws, and discloses participation in the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF, with the FTC holding enforcement jurisdiction. Compliance teams should evaluate the administrator data access provisions, the opt-in default structure for AI content training, and the broad organizational data disclosure clause, particularly for enterprise and education account deployments.