Figma Weave
Figma Weave
Assessment labels are editorial guidance, not GDPR certifications. Validate the exact plan, lawful basis, DPA, subprocessors, retention, residency and feature settings. EU storage and no-training terms alone do not establish GDPR compliance. ¹ No training applies under the reviewed plan’s terms.
Pricing / Contract Route
Starter USD24 monthly/USD228 annually; Professional USD45 monthly/USD432 annually; Team USD60/user monthly/USD576 annually; Enterprise custom
Enterprise Features
Enterprise model management, Verified Model controls, imported-model approvals and Figma DPA coverage except for Unverified Models
Last Updated
September 10, 2026
Reviewed: 10 September 2026 - prepared by WAIMAKERS B.V.
1 Purpose
Deployment-specific review. Figma Weave can support governed creative workflows when model status, the DPA, retention and transfers are reviewed. It should not be labelled provider-wide “no training”: Verified Models, Unverified Models and non-identifying Use Data have different contractual treatment.
Figma acquired Weavy in October 2025 and now operates it as Figma Weave. Standalone Weave uses separate plans and credits. A curated set of Weave tools is also available inside Figma Design; confirm which product terms govern the exact route.
2 Comparison of Figma Weave Options (EU focus)
The allowances and prices below come from Figma Weave's current pricing page.
| Plan | Public allowance | Public price at review date |
|---|---|---|
| Free | 150 monthly credits; 5 workflows | Free |
| Starter | 1,500 monthly credits; unlimited workflows | $24/month, or $228/year |
| Professional | 4,000 monthly credits; 3-month rollover | $45/month, or $432/year |
| Team | 4,500 monthly credits/user; shared pool and administration | $60/user/month, or $576/user/year |
| Enterprise | Custom credits, support, training and model governance | Custom |
Credits are model-dependent and Figma can change the model catalogue and usage rates. Figma and standalone Weave credits are separate.
3 Is Figma Weave GDPR-Compliant?
Training and model governance
- ✅ Weave's product page says Figma does not use images or prompts to train the Weave platform.
- ⚠️ The July 2026 standalone Terms allow Figma to collect, analyse and train on Use Data to operate and improve Weave and create products, provided that Use Data does not identify a user or other individual.
- ✅ A Verified Model has a Figma-provider contract under which content is used only to deliver the service and is not used for model training or improvement through Weave.
- ⚠️ An Unverified Model is governed by the provider's own terms and may give that provider additional rights, including training rights. Figma's DPA expressly does not apply to Unverified Models.
- ✅ Enterprise admins can approve or restrict models. Imports from Fal or Replicate are disabled by default and, if enabled, require admin approval.
The correct summary is therefore plan- and model-dependent, even though Weave itself promises not to train its platform on images or prompts.
DPA, retention, residency and assurance
The live standalone Terms state that Figma's DPA applies when Figma processes personal data in Customer Content to provide Weave, except for Unverified Models. Figma's DPA includes SCC-based transfer terms and says covered Customer Personal Data is deleted within 30 days after termination, subject to law. The Weave Terms separately provide a 30-day retrieval period after termination and then allow stored Content to be deleted.
No public Weave source reviewed here confirms EU-only inference, processing or storage. Figma's Trust Center says Weave is a standalone offering still being integrated and that Weave security documentation is in progress. Figma's broader SOC 2/ISO and EU Cloud Code materials must not automatically be presented as covering every Weave component; obtain scope in writing.
Figma's main AI Terms explicitly exclude standalone Weave. The July Weave Terms govern the standalone service and say other Figma product agreements do not apply, except where the Weave Terms specifically incorporate the Figma DPA. For tools used inside Figma Design, confirm the integrated-product contract route.
4 EU Rollout Checklist (Practical)
- Prefer Enterprise for personal, confidential or client material so model access can be centrally controlled.
- Allow only Verified Models unless legal/privacy review approves an Unverified Model's own terms.
- Keep Fal/Replicate imports disabled; if enabled, require documented per-model approval.
- Confirm DPA incorporation, SCCs, current subprocessors, processing locations and security-report scope for the actual route.
- Define retention and deletion for prompts, source assets, outputs, workflow history, Use Data and backups; test the 30-day export path.
- Restrict input categories and train users that an approved workspace does not make every model or dataset approved.
- Assess GDPR and AI Act transparency duties for identifiable people, synthetic media and public dissemination.
5 Notes & Caveats
Open procurement questions
- Where are Weave content, workflow metadata, backups and each model's inference processed and stored?
- Which security certifications and audit reports explicitly include standalone and integrated Weave?
- What falls within Use Data, how is it made non-identifying and how long is it retained?
- Which Verified Models are currently approved and what contractual indemnity applies to each?
- Which terms govern a Weave tool launched from inside Figma Design?
6 References
- Figma Weave pricing
- Figma Weave Terms
- Figma Weave Trust Center
- Verified and Unverified Models
- Enterprise Model Management
- Enterprise Model Import Controls
- Figma DPA
- Figma AI Terms
- Figma Trust Center
- GDPR, official text
7 Disclaimer
This page is a practical procurement and data-risk overview, not legal advice. Suitability depends on the product route, signed terms, model status, inputs, retention, locations and the customer's GDPR and AI Act assessment.