Post-Term Usage Data Retention and Use

What it is

The agreement authorizes Figma to collect Usage Data including technical logs, metadata, telemetry data, and usage information about Customer Content, and to retain and use that data in de-identified and aggregated form both during and after the subscription term for product maintenance and improvement. Customer Content itself is explicitly excluded from the Usage Data definition.

Why it matters (compliance & governance perspective)

This provision authorizes Figma's use of Usage Data to continue after the subscription term ends, with no stated expiration or deletion timeline for that data. The scope of Usage Data includes telemetry data and usage information about Customer Content (such as access frequency), which may require assessment under data minimization and purpose limitation requirements under applicable privacy frameworks.

Consumer impact (what this means for users)

Under this clause, Figma retains the right to use de-identified and aggregated Usage Data, including telemetry and usage information about Customer Content, after the customer's subscription ends. Customer Content itself is excluded from this post-term use authorization, but metadata and usage information about that content is not.

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR data minimization and purpose limitation principles (Articles 5 and 6) to the extent Usage Data originates from EU-based users, with EU supervisory authorities as the relevant enforcement bodies. CCPA's definitions of personal information and the concept of de-identification under CCPA may require evaluation depending on whether the aggregated Usage Data meets applicable de-identification standards. The FTC's approach to de-identification and data retention practices is also relevant. (2) GOVERNANCE EXPOSURE: Medium. The absence of a stated retention period or deletion timeline for post-term Usage Data creates a compliance touchpoint under GDPR's storage limitation principle. The characterization of usage information about Customer Content (including access frequency) as Usage Data rather than Customer Content requires careful assessment in data mapping exercises. (3) JURISDICTION FLAGS: EU and UK users face heightened exposure given GDPR and UK GDPR storage limitation and purpose limitation requirements. California users may have CCPA rights implications depending on whether the aggregated data meets California's de-identification standard. The provision applies globally as drafted. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should assess whether the post-term data use authorization conflicts with their internal data retention policies or data processing agreements. The incorporated DPA should be reviewed to confirm whether Usage Data processing is addressed separately from Customer Content processing. (5) COMPLIANCE CONSIDERATIONS: Data mapping exercises should distinguish between Customer Content (excluded from post-term use) and Usage Data categories (telemetry, metadata, access logs) subject to post-term retention. Legal teams should evaluate whether the de-identification standard described in the DPA meets applicable regulatory requirements under GDPR and CCPA. A data retention schedule for Usage Data should be requested from Figma or confirmed through the DPA review.

Applicable agencies

Provision details

Other risks in this policy

• 30-Day Arbitration Opt-Out Right for New Customers high
• Class and Representative Action Waiver high
• Customer Content Use Authorization for Services high
• Customer Indemnification of Figma for Content and Breach high
• Fees Generally Non-Refundable and Non-Decreasable high
• Figma Disclaims All Implied Warranties high