Hosting and network
GDPR Webflow
In an indie stack, Webflow is used for Site creation and hosting. Entity cited: Webflow, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Webflow
Yes. Public Data Processing Addendum, incorporated into the terms, with standard contractual clauses.
Stated role
For Customer Personal Information, the customer may be controller or processor, and Webflow is processor. For Customer Relationship Data (account, billing, fraud, legal obligations), Webflow presents itself as an independent controller.
Personal data
The DPA annex cites, on the customer-relationship side, name, email, phone, and payment data. On the end-user and team side: name, emails, and other data determined by the customer, platform usage data, browser, system, and IP address.
Sub-processors of Webflow
Public list (stated last update: 4 May 2026). The named table is not copied here.
Transfers outside the EU
Hosting / location
The Privacy FAQs (stated last modification: 7 October 2024) state that Webflow stores the data of customers and of end users in the United States, where the company is established, and that it uses sub-processors based in the United States. DPA address: 398 11th St., Floor 2, San Francisco, CA 94103.
EU–United States Data Privacy Framework
Webflow, Inc. is registered. EU-U.S. Data Privacy Framework status: Active (non-HR data). United Kingdom extension and Swiss-U.S. DPF: Active.
Cookies
A Cookie Policy is published. Names of cookies set on a customer's site: not disclosed.
Typical use, written by StackLégal and not by the vendor: Site creation and hosting.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is Webflow a processor within the meaning of the GDPR?
For Customer Personal Information, the customer may be controller or processor, and Webflow is processor. For Customer Relationship Data (account, billing, fraud, legal obligations), Webflow presents itself as an independent controller.
What DPA does Webflow publish?
Yes. Public Data Processing Addendum, incorporated into the terms, with standard contractual clauses. https://webflow.com/legal/dpa
Which further sub-processors does Webflow publish?
Public list (stated last update: 4 May 2026). The named table is not copied here. https://webflow.com/legal/subprocessors
Where does Webflow state that it processes data, including outside the EU?
The Privacy FAQs (stated last modification: 7 October 2024) state that Webflow stores the data of customers and of end users in the United States, where the company is established, and that it uses sub-processors based in the United States. DPA address: 398 11th St., Floor 2, San Francisco, CA 94103.
Is Webflow registered under the EU–United States Data Privacy Framework?
Webflow, Inc. is registered. EU-U.S. Data Privacy Framework status: Active (non-HR data). United Kingdom extension and Swiss-U.S. DPF: Active. https://www.dataprivacyframework.gov/participant/6365
Which personal data does Webflow mention?
The DPA annex cites, on the customer-relationship side, name, email, phone, and payment data. On the end-user and team side: name, emails, and other data determined by the customer, platform usage data, browser, system, and IP address.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.