By platform

Terms & Conditions Generator for Webflow

Written for Webflow forms, the CMS, custom code in Site Settings and Webflow’s own consent mode.

Generate your terms and conditions Read the terms and conditions guide

Webflow sites are often the marketing front for a service business or a SaaS product, so the terms need to distinguish clearly between the website and the product behind it - two different agreements that frequently get merged into one confused document.

Webflow sites are usually built by an agency or a freelancer and handed over, which creates a specific compliance gap: the person responsible for the privacy policy is rarely the person who added the tracking. Google Tag Manager, HubSpot, Intercom, Hotjar and a marketing pixel or two typically live in Site Settings → Custom Code, added during the build and never revisited.

Webflow itself is a processor for form submissions and site data, and it publishes a data processing addendum. Its hosting sets a small number of cookies, and Webflow Ecommerce adds order and payment flows through Stripe or PayPal. The platform is comparatively light on default tracking - which means almost everything running on a Webflow site was deliberately added.

Webflow supports a privacy consent mode with data-wf-consent attributes that can gate scripts by category, plus integrations with the main consent platforms. Used properly it blocks tags until consent; unused, every script in the head loads on first paint.

What a terms and conditions for a Webflow site has to cover

Scope: whether these terms govern the website only, or the service sold through it
Ecommerce terms where Webflow Ecommerce is enabled, including delivery and cancellation
Intellectual property in site content, and permitted use of downloadable resources
Liability and warranty limits, with consumer carve-outs for the markets you sell to

How a Webflow site actually moves personal data

Form submissions stored in Webflow

Name, email and free-text message retained in the dashboard indefinitely unless you delete them, plus a copy in whichever inbox receives the notification.

Custom code in Site Settings

GTM, ad pixels, heatmaps and chat widgets pasted into the head or body tags. These load site-wide on first paint unless tagged for consent.

Webflow hosting cookies

A small set of platform cookies for hosting and, where enabled, for the Webflow-hosted forms and localisation features.

Webflow Ecommerce orders

Customer records, order history, shipping data and payment tokens handed to Stripe or PayPal.

CMS-driven member areas

Webflow user accounts hold authentication data and access levels, which is a different processing purpose from marketing forms.

Third-party embeds

Calendly, Typeform, YouTube, Vimeo and Google Maps embeds each set cookies from their own domain as soon as the embed renders.

Third parties the draft will ask you about

Webflow Inc. · Stripe · PayPal · Google Tag Manager · HubSpot · Intercom · Hotjar · Calendly · Typeform

The rules that apply

Webflow Terms of Service and DPA

Webflow acts as processor for the personal data your site collects, with a published addendum and sub-processor list.

Webflow consent mode

Script-level consent categories via data-wf-consent, which only gate scripts you have actually tagged.

Form submission storage

Submissions are retained in the Webflow dashboard and often forwarded by email or webhook, creating two copies with different retention.

Webflow Ecommerce

Order, customer and payment-token handling through Stripe or PayPal, with its own set of disclosures.

Client hand-over responsibility

Whoever operates the site is the controller. Agency-built tracking does not stay the agency’s legal problem after hand-over.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Publishing the document on Webflow

Build each document as a static page
Or as a CMS collection if you want to manage several policies with one template. Set the slug to /privacy-policy and similar.
Add the links to the footer symbol
Because it is a symbol, one edit puts the links on every page including new ones.
Audit Site Settings → Custom Code
List every script in the head and body tags. That list is your recipients and cookies disclosure.
Tag scripts for consent
Apply Webflow’s consent attributes or your consent platform’s blocking rules so nothing non-essential loads first.
Set a form retention routine
Decide how long submissions stay in the dashboard, and actually delete them on that schedule.
Set the SEO title and description on each policy page
Webflow does not do this for you, and a policy page with no metadata is a page Google renders badly.

Where this usually goes wrong

Tracking added during the build and never disclosed

The single most common Webflow failure. Site Settings → Custom Code usually holds two or three scripts nobody documented.

Consent banner installed without tagging scripts

A banner that does not carry data-wf-consent attributes or equivalent blocking rules changes nothing about load order.

Form submissions retained forever

Webflow keeps submissions until deleted. A policy promising a retention period that nobody enforces is worse than no promise.

Embeds loading before consent

YouTube, Vimeo, Maps and Calendly set third-party cookies the instant they render, regardless of the banner.

No named controller after agency hand-over

Policies that still name the agency, or name nobody, leave the actual operator undisclosed.

Frequently asked questions

Does Webflow provide a privacy policy?

No. Webflow provides hosting, a data processing addendum for its own role, and consent tooling. The document itself is entirely yours to write and publish.

How do I stop scripts loading before consent on Webflow?

Tag them with Webflow’s consent attributes or manage them through a consent platform that rewrites script types. Adding a banner without doing this leaves load order unchanged.

Who is the controller after an agency builds my site?

You are, once you operate it. The agency may be a processor for build and maintenance work, which is worth putting in a contract, but the public-facing responsibility is yours.

Do Webflow form submissions need a retention period?

Yes. Storage limitation applies to them like any other record, and they sit in the dashboard indefinitely until someone deletes them.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.