Webflow Premium and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No for AI features: Webflow and its subcontractors may not use AI Inputs and Outputs (prompts, content you give the AI and what it returns) to train, improve or fine-tune models without your prior consent. Training on other site content is not addressed.

Vendor's wording: “Webflow will use Inputs and Outputs solely to provide the AI Offerings to Customer. Webflow will not (and will not permit its subcontractors to) use them to train, improve, or fine-tune the AI Offerings or any underlying models without Customer’s”

Source: webflow.com2.1 Input and Output; No TrainingSecond source: webflow.comChecked on 19 October 2026

DPA on request.

Yes: a Data Processing Addendum is published and applies where data protection laws apply; a pre-signed DocuSign version is available to sign.

Vendor's wording: “If you would like to execute a DocuSigned version of this Data Processing Addendum, please review and sign our pre-signed DPA here. ## 1. Definitions Capitalized terms that are used”

Source: webflow.comIntroChecked on 19 October 2026

Published.

Yes: https://webflow.com/legal/subprocessors (updated 9 Jul 2026), 37 entries. AI providers: Anthropic and OpenAI.

Vendor's wording: “This Subprocessor list includes any of our service providers who may have access to your or your end users’ personal information when Webflow acts as your processor. The type of”

Source: webflow.comSubprocessors tableChecked on 19 October 2026

On the list.

Active (Webflow; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Webflow'Checked on 19 October 2026

Personal information processed for you is kept during the agreement and deleted after termination unless law requires keeping it. Retention of AI prompts is not stated.

Vendor's wording: “Upon the termination of the Agreement, Webflow will delete all Personal Information processed on behalf of Customer unless local laws, regulations, or other requirements”

Source: webflow.comAnnex I, period of retentionChecked on 19 October 2026

6 named: ISO 27001, ISO 27017, ISO 27018, ISO 42001, SOC 2 and PCI-DSS.

Vendor's wording: “Webflow maintains third-party certifications that validate how we handle data, access, and operational controls across our”

Source: webflow.comCompliance at a glanceChecked on 19 October 2026

Partly: the AI Terms say the customer may manage and disable applicable AI settings in its account settings; the steps are not given in the terms.

Vendor's wording: “Customer may manage and disable applicable settings at any time in its account settings as described here. Webflow shall identify”

Source: webflow.com2.2 Customer Controls and IdentificationChecked on 19 October 2026