The policy states that personal information is retained for the duration of service use or as necessary for enumerated business and legal purposes, with deletion or anonymization upon cessation of legitimate need, though data in backup archives may be retained in isolated storage until deletion is practicable; deletion requests require account deletion.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that exercising a deletion right requires deleting the user's Figma account, creating an operational dependency between privacy rights exercise and platform access, and that data in backup archives may persist in isolated storage beyond the user's active account period.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, personal information is retained as long as the user maintains an account or as required for legal and business purposes; a deletion request requires the user to delete their Figma account, as the policy states account maintenance requires retention of personal information. Data stored in backup archives may continue to be retained in isolated storage until deletion is technically feasible.
How other platforms handle this
Affirm will retain your information in accordance with our Privacy Policy and any applicable state or federal law, rule or regulation.
We collect and keep personal data only as needed or allowed for the purposes set out in this Statement, based on the reason we collected the personal data in the first instance and what is permitted under the laws that apply to the processing.
Mistral AI shall retain the Customer Exportable Data and Assets for a period of thirty (30) days from the earlier between (a) the expiration of the Transitional Period or (b) Customer's notification under Section 2.2.2 (b) of these Additional Terms.
"We store the personal information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and/or comply with applicable laws. The specific retention periods depend on the nature of the information and why it is collected and processed and the nature of the legal requirement. When we have no ongoing legitimate business need or legal reason to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. You may request deletion of your personal information at any time as noted in "Your Privacy Rights", above, but that will require you to delete your account with us, as we need your personal information to maintain your account.Excerpt from Figma's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that exercising a deletion right requires deleting the user's Figma account, creating an operational dependency between privacy rights exercise and platform access, and that data in backup archives may persist in isolated storage beyond the user's active account period.
Under this clause, personal information is retained as long as the user maintains an account or as required for legal and business purposes; a deletion request requires the user to delete their Figma account, as the policy states account maintenance requires retention of personal information. Data stored in backup archives may continue to be retained in isolated storage until deletion …
ConductAtlas has identified this type of provision across 275 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.