Figma AI Privacy Review: Is the Figma Agent Safe for Client Work?

Short answer: Figma AI is workable for client projects, but on the Starter and Professional plans most freelancers pay for, Figma uses your file content to train its own models by default, and new Figma agent chats are visible to everyone who can open the file. Our verdict is USE WITH CAUTION for client work. Policy reviewed October 2026, three days after Figma made its design agent generally available. For a solo designer, those two defaults matter more than any feature list. Your files hold unreleased product screens, client brand systems, interview notes pasted in as context, and sometimes real customer data used to make mockups look convincing. The good news is that both defaults can be changed in under a minute, once you know where to look. Here is what Figma’s documents say, measured against how we vet privacy claims.

What Figma does with your data

Privacy at a glance

Figma’s privacy policy took effect on September 1, 2026 (per Figma’s privacy policy, retrieved 2026-10-09). It lists AI improvement as one of the purposes for which Figma processes data, and ties it to a setting called Content Training. When that setting is on, Figma may use your customer content, meaning anything you create in or upload to Figma, to improve its AI. The policy says Figma de-identifies and aggregates data before using it to train models.

The defaults are spelled out on Figma’s AI approach page and in its help center (per Figma’s AI approach page and help article on content training, retrieved 2026-10-09):

• Starter and Professional plans. Content training is switched on by default. A team admin can turn it off at any time.
• Organization and Enterprise plans. Content training is off by default, and Figma currently does not let these admins switch it on.
• Education and Government accounts. Figma says it does not use their data for training at all.
• Turning it off is not retroactive. Training began in August 2024. Switching it off covers new content and edits only.

Third-party model providers are a separate question. Figma says OpenAI and its other model vendors may not train their own models on your files, and keep data briefly or not at all. Its sub-processor list names Anthropic, OpenAI, Google, Microsoft, Amazon, and four smaller vendors as US-based AI model providers (per Figma’s sub-processor list, retrieved 2026-10-09).

The newer issue is the Figma agent. Since June 23, 2026, every new agent chat is shared by default with anyone who can access the file, including viewers, with no private-by-default option (per Figma’s help article on agent chat visibility, retrieved 2026-10-09). The agent can also take attached files, search the web, and pull context from Slack, GitHub, or Linear through MCP connectors.

Personal data is stored and processed in the United States, with Standard Contractual Clauses and a customer DPA for EU transfers. Retention has no fixed period: data is kept while you use the service or as long as business or legal needs require.

What this means for solo freelancers

Figma’s AI program is more transparent than most. The risk comes from defaults built for large companies that land on solo designers working inside client files. If you use Figma AI the way most freelancers do, here is what could go wrong.

Scenario 1: you design an unreleased product on a Professional plan. You never touched the training toggle, so the screens, copy, and flows of your client’s stealth launch become eligible training material for Figma’s own models from day one. Figma says it de-identifies content and aims for models that learn general patterns, not your ideas. Based on the policy as written, though, many client contracts and NDAs forbid sharing confidential material with any third party for its own purposes, and model training is arguably one of those purposes. Turning the toggle off later only covers new work.

Scenario 2: your client can read your agent chats. You open a shared client file and ask the agent to “make this look like the competitor deck I pasted,” or you attach a user interview transcript with names and job titles. Because new chats are shared by default, everyone with access to that file can read the full conversation, including the client’s stakeholders and anyone they forwarded the link to. A candid prompt about budget, another client, or the quality of their brand guidelines becomes part of the deliverable.

Scenario 3: you serve EU clients. Figma acts as a processor for your file content and offers a DPA, which helps. But content training means Figma also uses that content for its own product improvement, and prompts go to several US model providers. Based on the policy as written, if your client’s files contain personal data, such as real customer names in a dashboard mockup, you need to explain those flows to the client or switch training off first. Our guide to what a data processing agreement means for solo consultants covers why that matters, and our explainer on GDPR rules for EU freelancers with US clients covers the transfer side.

How to use it safely

Most of the risk disappears with a few settings and habits. Do this before the next client file opens:

1. Turn off content training on your Professional team. From the file browser, go to your team’s Admin area, then Settings, then the AI section, and switch Content training off. On a Starter team, the path is All Folders, the menu next to your team name, View settings, Settings, then Manage AI settings.
2. Repeat it for every team you own. The setting is per team. If you keep one team per client, each one needs the switch flipped, and drafts follow whichever team they sit in.
3. Make existing agent chats private. Click Agents in the left navigation, open the Chats view, click More options, and choose to make your existing chats private.
4. Make each new chat private as you start it. Figma offers no private-by-default option, so open More options in the chat header and set access to Private chat before you type anything sensitive.
5. Never attach raw client documents. Redact names, emails, and figures from interview notes or briefs before you drop them into an agent prompt, and use fake data generators for realistic mockups.
6. Be careful with MCP connectors. Connecting Slack or GitHub lets the agent pull context from those tools into prompts that reach US model providers. Connect only workspaces you own.
7. Ask for training terms in writing. If a client is on an Organization or Enterprise plan, ask them to invite you into their workspace instead of working in your own team. Training is off there by default.

For a broader walkthrough across tools, see our guide to opting out of AI training for freelance work.

Privacy-friendlier alternatives

If you want design tooling where training is never on by default, or where files never leave your machine, these options cover the same jobs. All links are direct, with no affiliate tracking.

• Penpot for interface design and prototyping. What it gives you that Figma doesn’t: it is open source and can be self-hosted on your own server, so client files never touch a vendor cloud if you choose that route. Pricing band: a free, fully featured cloud plan, paid team plans from about $7 per editor per month, and free self-hosting. Best for: freelancers who handle NDA-heavy work and are comfortable running or renting a small server.
• Sketch for Mac-based UI design. What it gives you that Figma doesn’t: documents can live as local files on your Mac, so nothing reaches a cloud workspace or an AI feature unless you choose to share it. Pricing band: per-editor subscription billed yearly, with a 30-day free trial and no free plan. Best for: solo designers on macOS who deliver files rather than live links.
• Proton Drive for handing off and storing client files. What it gives you that Figma doesn’t: end-to-end encrypted storage run from Switzerland, so exported designs, brand kits, and interview recordings are protected outside the design tool. Pricing band: free tier; paid plans roughly $5 to $13 per month. Best for: freelancers who need to share source files and research without emailing plain attachments.

Whatever you choose, protect the design account itself with a password manager such as Bitwarden or 1Password and a hardware security key like the YubiKey 5C NFC. A compromised Figma login exposes every client file in every team you belong to.

Switching tools has real costs. Your clients probably live in Figma, and its collaboration features are hard to replace. A practical split works for many solo designers: keep Figma for collaborative client work with training off and chats private, and move confidential early-stage concepts or sensitive research into Penpot or local Sketch files.

The verdict

Frequently asked questions

Does Figma train AI on my designs?

On Starter and Professional plans, yes, unless a team admin switches content training off. Figma says it de-identifies content and redacts sensitive details before training, and that it aims to teach models general design patterns rather than your specific ideas. On Organization and Enterprise plans, training is off by default. Paid Community files are never used, and Education and Government accounts are excluded entirely from model training.

Can my client see my Figma agent chats?

Yes, by default. Since June 23, 2026, new chats with the Figma agent are shared with everyone who has access to the file, including viewers. Viewers cannot continue your chat, but they can read it. You can switch any chat you created to private at any time, and bulk-convert your existing chats, but Figma currently offers no setting to make new chats private automatically.

Is Figma AI GDPR-friendly for EU client work?

Based on the policy as written, it is a partial fit. Figma offers a customer DPA with Standard Contractual Clauses and lists its AI sub-processors publicly. However, all personal data is stored in the United States, prompts reach several US model providers, and content training on smaller plans uses client material for Figma’s own purposes. Switching training off and keeping real personal data out of files narrows the gap.

Can I use Figma AI with HIPAA-covered data?

Figma’s privacy policy and AI approach page do not offer a Business Associate Agreement for AI features, and prompts are processed by multiple outside model providers. Based on the policy as written, putting protected health information into Figma AI prompts or files on a Professional plan would leave you without the agreement HIPAA expects. Use synthetic patient data in healthcare mockups and keep real records out of the tool.

Does turning off content training delete what Figma already used?

Not according to the help pages. Figma says that once an admin switches content training off, new content and edits are no longer used to train AI models. It does not say that content already used since training began in August 2024 is removed from models or datasets. If that matters to a client, you can ask Figma directly through its privacy request channels, but plan as if past use stands.

Do OpenAI and Anthropic train on my Figma files?

Figma says no. Its AI approach page states that third-party model providers, including OpenAI, are not permitted to train their own models on content you create or upload in Figma, and that they keep data temporarily or not at all. Anthropic, Google, Microsoft, and Amazon also appear on the sub-processor list as AI model providers, under the same restriction as described by Figma.

Sources

• Figma Privacy Policy, effective 2026-09-01 (retrieved 2026-10-09)
• Figma AI: our approach, including model training and data privacy (retrieved 2026-10-09)
• Figma Help: manage AI settings and content training (retrieved 2026-10-09)
• Figma Help: manage chat visibility for the Figma agent (retrieved 2026-10-09)
• Figma Help: work with the Figma agent in design files (retrieved 2026-10-09)
• Figma sub-processor list, including AI model providers (retrieved 2026-10-09)
• Figma blog: Figma agent now generally available (2026-10-06) (retrieved 2026-10-09)
• Figma pricing and AI credits (retrieved 2026-10-09)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of October 9, 2026.