If you are located in the EU, UK, or EEA, Figma transfers your personal data to the United States using Standard Contractual Clauses (SCCs) as the legal mechanism to protect that transfer.
Your data leaves the EU/UK and is subject to US law, which provides different privacy protections than European law — this is a significant consideration for enterprise users with compliance obligations.
Reliance on SCCs for US transfers requires a valid Transfer Impact Assessment (TIA) under Schrems II (CJEU C-311/18) and the EDPB guidance. Procurement and legal teams should request documentation of these assessments and verify supplementary measures are in place.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Figma collects a broad range of personal data including usage patterns, device information, and payment details, and may use this data for AI/ML model improvement and targeted advertising. Your design content and collaboration activity may be processed and shared with third-party service providers and advertising partners. You can submit a privacy rights request (access, deletion, opt-out of data sale/sharing) through Figma's privacy request form at https://www.figma.com/privacy-request/.