21st procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on where you live, you may have the right to access, correct, port, or delete your personal information; to object to or restrict certain processing; and to withdraw consent where we rely on it. Customers in the EEA, UK, Switzerland, and California (CCPA/CPRA) have the rights described in their applicable laws. To exercise these rights, contact support@21st.dev . We will respond within the timeframe required by applicable law. You may unsubscribe from marketing emails at any time using the link in the email. Transactional and security communications are not subject to opt-out while your account is active.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include: Account data: for the life of the account plus a reasonable period after closure for legal and audit purposes. Conversation history and agent run data (21st Agents): retained on your behalf and deleted in accordance with your settings or upon request. Logs and diagnostic data: retained for up to twelve months unless required for security or legal reasons. Billing records: retained for the period required by tax and accounting law.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may receive information from authentication providers (Clerk), payment processors (Stripe), and similar partners as required to operate the Services. We do not purchase personal information from data brokers.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We rely on a small set of trusted subprocessors to deliver the Services. Each subprocessor processes information only as directed by us and under contractual confidentiality and security obligations. Major categories include: Hosting and infrastructure: Vercel, Fly.io, Cloudflare, Railway. Storage and databases: Supabase, Upstash. Authentication: Clerk. Payments and billing: Stripe, Metronome. Sandboxed code execution: E2B. AI model providers: Anthropic, OpenAI. Observability and analytics: Sentry, Langfuse, Humanloop, Braintrust. Email: Resend, Google Workspace. Internal operations: GitHub, Slack, Notion, Vanta, Certn. A current subprocessor list is available on request to enterprise customers and will be published on our security page. We will provide reasonable advance notice of material additions to the subprocessor list.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 21st Labs is based in the United States, and our subprocessors operate in multiple countries. When we transfer personal data from the EEA, UK, or Switzerland to a country that has not received an adequacy decision, we rely on Standard Contractual Clauses or another lawful transfer mechanism with the receiving subprocessor.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We use third-party subprocessors (including Vercel, Fly.io, Supabase, E2B, Anthropic, OpenAI, Cloudflare, Clerk, Stripe, and others) to deliver the Agents Platform. The current list is available in our Privacy Policy and on request. We will provide reasonable advance notice of material additions to the subprocessor list.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ • Exceed the rate limits and usage caps documented for your plan, or take actions designed to circumvent those limits. ” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Payments for paid plans and credit packs are non-refundable. Except where required by applicable law or expressly approved by 21st Labs Inc. in our sole discretion, we do not provide refunds, credits, or prorated refunds for amounts already paid, including after cancellation, non-use, accidental purchase, unused time, downgrade, or changes in Marketplace content availability.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Paid plans include a monthly 21st AI credit allowance. Unused monthly allowance expires at the applicable reset and does not roll over. Separately purchased credit-pack balances roll over until used and are consumed after the monthly allowance. Credits have no cash value, cannot be transferred, and are non-refundable except where required by applicable law.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ You may cancel your paid plan at any time through the cancellation flow in Billing settings or another cancellation flow we make available. Cancellation stops future renewals and takes effect at the end of the then-current billing period. You will continue to have paid-plan access until the end of that billing period unless your access is suspended or terminated under these Terms.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ 21st paid plans unlock plan-specific features across the Web, MCP, and CLI, including Marketplace access and a monthly 21st AI credit allowance. Available features, allowances, billing periods, and prices are shown before purchase and may differ by plan. Team plans are billed per purchased seat.” | Captured 2026-09-24Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.