Framer Pro and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless AI training is switched off in the Workspace settings: on non-Enterprise plans Framer may use AI Inputs and Outputs to train its AI models. Its third-party model providers may not train on them.

Vendor's wording: “Unless AI model training is disabled in the applicable Workspace settings, Customers on a non-Enterprise plan grant Framer a worldwide, non-exclusive license to use their Inputs and Outputs to train and improve Framer's AI models. Where AI training is disabled”

Source: framer.com7.3 Customers on a non-Enterprise planChecked on 19 October 2026

You can switch the training off.

Turn off AI training in the Workspace settings; Framer then stops using that Workspace's Inputs and Outputs for training going forward. Enterprise plans are not trained on.

Vendor's wording: “Where AI training is disabled in the applicable Workspace settings, Framer will not use Inputs or Outputs from that Workspace to train Framer's AI models going forward. ## Disclaimer 8.1”

Source: framer.com7.3 Customers on a non-Enterprise planChecked on 19 October 2026

Hosted on AWS in the United States, with additional hosting infrastructure in Europe and Asia-Pacific. A default region per customer is not stated.

Vendor's wording: “All of Framer’s services are hosted in Amazon Web Services (AWS) facilities in the United States, with additional hosting infrastructure across Europe and Asia-Pacific, and global acceleration across 200+ edge”

Source: framer.comData SecurityChecked on 19 October 2026

DPA in the terms.

Yes: a DPA with Framer B.V. is incorporated into the Terms of Service.

Vendor's wording: “This Data Processing Addendum (“DPA”) is a part of, governed by, and incorporated by reference into the Terms of Service or the Master Subscription Agreement, as applicable (“Agreement”), between: Framer”

Source: framer.comOpening clauseChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Framer B.V., Amsterdam)

Vendor's wording: “This artificial intelligence (“AI”) notice (“AI Notice”) is applicable to Framer B.V., a Dutch limited liability company, and its affiliates”

Source: framer.comPurpose and scopeChecked on 19 October 2026

On written request after termination Framer irreversibly and securely deletes your Content; the DPA also deletes personal data on written request. Retention of AI inputs is not stated.

Vendor's wording: “Upon written request, Framer will irreversibly and securely delete Content (including copies) except to the extent Framer is required to”

Source: framer.com18.4 EffectsSecond source: framer.comChecked on 19 October 2026

2 named: ISO 27001 and SOC 2 Type 2 (reports for Enterprise customers on request).

Vendor's wording: “Framer has successfully completed the SOC 2 Type 2 audit.”

Source: framer.comComplianceChecked on 19 October 2026