Webflow AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “For clarity, you (the “data controller”) are directly responsible for the End User Personal Information you collect. By using the Platform, you are instructing Webflow (the “processor”) to process your End Users’ Personal Information. Webflow, as the “processor,” is not responsible for responding to End Users on your behalf. To the extent Webflow receives a request from an End User, regulator, or authority about your use of the Platform, Webflow will notify you in compliance with or as permitted by law. If applicable, Webflow shall process your End Users’ Personal Information in accordance with our Data Processing Addendum , which is hereby incorporated by reference.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ As Webflow is based in the United States, we may host, transfer, and process your Personal Information in the United States or countries other than the United States. Webflow uses a variety of safeguards, including contractual and technical measures, to protect the Personal Information and data we transfer. Webflow will ensure that any of our service providers, processors, or third parties will undergo an adequate privacy vet prior to providing them your Personal Information. Furthermore, Webflow does assume liability for onward transfer to third parties and shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles. If you are located in the United Kingdom (“UK”), European Union (“EU”), European Economic Area (“EEA”) or Switzerland, please see Webflow’s EU & Swiss Privacy Policy. Webflow complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Webflow has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Webflow has certified to the U.S. ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “TL;DR: We offer Standard Contractual Clauses for the protection of personal data that customers export to us from the UK or EEA.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/ . In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Webflow commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. Webflow provides alternative dispute resolution provider and appropriate recourse free of charge. BASICALLY... ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “For example, if End Users located in certain jurisdictions exercise their “right to be forgotten” (or “erasure”) of their Personal Information that you have collected via the Platform, you shall comply with their request as required by applicable law. For clarity, you (the “data controller”) are directly responsible for the End User Personal Information you collect. By using the Platform, you are instructing Webflow (the “processor”) to process your End Users’ Personal Information. Webflow, as the “processor,” is not responsible for responding to End Users on your behalf. To the extent Webflow receives a request from an End User, regulator, or authority about your use of the Platform, Webflow will notify you in compliance with or as permitted by law. If applicable, Webflow shall process your End Users’ Personal Information in accordance with our Data Processing Addendum , which is hereby incorporated by reference. Notice. You agree to provide and adhere to a privacy policy for your use of the Platform that: (i) complies with all applicable laws, rules, and regulations, (ii) is conspicuously displayed to all End Users, and (iii) clearly and accurately describes to End Users what information you collect (such as login information, contact form data, cookies, etc.) and how you use and share such information (including for marketing and advertising) with Webflow and other third parties. ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “As Webflow is based in the United States, we may host, transfer, and process your Personal Information in the United States or countries other than the United States. Webflow uses a variety of safeguards, including contractual and technical measures, to protect the Personal Information and data we transfer. Webflow will ensure that any of our service providers, processors, or third parties will undergo an adequate privacy vet prior to providing them your Personal Information. Furthermore, Webflow does assume liability for onward transfer to third parties and shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We keep your personal information until we no longer need it to provide you with the service. We may also keep your personal information if required by law or to keep our internal records accurate. Once you terminate your account, we’ll delete your personal information, unless we're required by law to retain it. ” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “Webflow will retain Personal Information we process on your behalf for as long as necessary to provide the Platform to you, subject to our compliance with this Policy, or as required or permitted under applicable law. We may further retain and processPersonal Information as necessary to comply with our legal obligations; maintain accurate accounting, financial, and other operational records; resolve disputes; and enforce our agreements. We have established internal policies for the deletion of Personal Information following the termination of your Account.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Webflow will retain Personal Information we process on your behalf for as long as necessary to provide the Platform to you, subject to our compliance with this Policy, or as required or permitted under applicable law. We may further retain and processPersonal Information as necessary to comply with our legal obligations; maintain accurate accounting, financial, and other operational records; resolve disputes; and enforce our agreements. We have established internal policies for the deletion of Personal Information following the termination of your Account. BASICALLY... ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In this Policy, “Personal Information” means any information relating to an identifiable natural person. Except as described in this Policy, Webflow will not give, sell, rent, or loan any Personal Information to any third party. Personal Information does not include data or information collected, derived, or otherwise generated from the use of the Platform, provided that such data has been anonymized, de-identified, and/or aggregated so as not to identify or permit the identification of any individual (“De-identified Data”), De-identified Data helps us understand trends in usage of the Platform so that we can better consider new features or otherwise tailor the Platform. In addition to collecting and using De-identified Data ourselves, we may share De-identified Data with third parties, including our customers, partners and service providers, for various purposes, including to help us better understand our customers’ needs and improve the Platform as well as for advertising and marketing purposes. BASICALLY... ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For more information about cookies, please see Webflow’s Cookie Policy. We may provide Personal Information to any member of the Webflow team, including our Affiliates, provided that any such activities are in accordance with applicable law. BASICALLY... ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may be required to disclose Personal Information to respond to subpoenas, court orders, and law enforcement or governmental requests or investigations, or to establish or exercise our legal rights or defend against legal claims. We may also share Personal Information if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations or our Terms of Service , or as otherwise required by law.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Webflow may assign or transfer this Policy, and your user account and related Personal Information, to any person or entity that acquires all or substantially all of the business, stock or assets of, or is merged with Webflow. We may also transfer or assign such information in the course of corporate divestitures, mergers, acquisitions, bankruptcies, dissolutions, or similar transactions or proceedings, provided that the recipient of such information will continue to be bound by the terms of this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “If you're a resident of California, you can ask us to send you a list of the types of personal information we share with our affiliates and third parties for marketing purposes. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “For more information about the Personal Information we collect and how we collect it, please refer to Sections 1 and 2, above. We collect your Personal Information for the business purposes described in Section 2, above. The CCPA defines a “business purpose” as the use of Personal Information for the business’s operational purposes, or other notified purposes, provided the use of Personal Information is reasonably necessary and proportionate to achieve the operational purpose for which the Personal Information was collected or another operational purpose that is compatible with the context in which the Personal Information was collected. The categories of third parties with whom we may share your Personal Information are listed in Section 2, above. BASICALLY... ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To facilitate the exchange of data between third-party SaaS applications, we may need to store certain information (“App Credentials”) that helps us access these third-party SaaS application accounts on your behalf. We store your App Credentials in an encrypted form. When we access these third-party applications on your behalf, the third-party application provides us with access to certain data. We will use, store, and disclose this data in accordance with this Policy. You should note that Webflow shall have no liability or responsibility for the privacy practices or other actions of any third-party applications for which you provide us with App Credentials.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may be required to disclose Personal Information to respond to subpoenas, court orders, and law enforcement or governmental requests or investigations, or to establish or exercise our legal rights or defend against legal claims. We may also share Personal Information if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations or our Terms of Service , or as otherwise required by law. We use or may use information collected by cookies, log files, device identifiers, and clear GIFs information to:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may now or in the future receive Personal Information about you from third parties. For example, if you access our Platform through a third-party connection or log-in or connect an application to Webflow, that third party you connected with may pass certain information about your use of its service to Webflow. This information could include, but is not limited to, the user ID associated with your account, an access token necessary to access that service, any information that you have permitted the third party to share with us, and any information you have made public in connection with that third-party service. You should always review, and if necessary, adjust your privacy settings on third-party websites and services before linking or connecting them to the Platform. Webflow may also provide Personal Information to its third-party service providers (such as its credit card processors and hosting partners) as necessary to provide the necessary hardware, software, networking, storage, and other services we use to operate the Platform. We do not permit our service providers to use Personal Information we provide to them for any purpose other than providing their services to us. We execute the legally required data processing addenda with all of our service providers.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.