Website Builders
Duda
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Duda, Inc. · www.duda.co
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Duda at a glance
- Vendor
- Duda, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Duda 3.5/5, the mean of 6 judges. Duda is a website builder sold mainly to agencies and SaaS platforms building sites for small businesses. how scores are made
- As of
- Vendor pages captured 28 Oct 2026 to 1 Nov 2026; evaluated by the panel 29 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Duda is a website builder sold mainly to agencies and SaaS platforms building sites for small businesses. The product side is strong: editor and design scores 8-9 on per-device control, CSS Grid and Flexbox sections, a developer mode and per-feature permissions; SEO and marketing sits at 8 for technical SEO — bulk CSV redirects, canonical and hreflang tags, schema, server-side rendering — plus an AI Visibility add-on. Hosting, portability and forms and business rest at 7, on named AWS hosting with a Europe-only Frankfurt option and calendar-synced bookings. Legal compliance is the weak spot at 4-6, the widest spread, as the practice owner scored 4 over terms that strictly prohibit uploading health information. Sovereignty scores 4-5 — the contract runs with Duda, Inc., a US company, and processing is named across the United States, Israel, the EEA, the UK and Canada — and pricing transparency lands at 6-7: plans are public from Basic $19 /mo to White Label $149 /mo, each billed annually, while we found no public information on monthly rates or the domain renewal price after the free first year.
Speaks for it
- Editor and design scores 8-9 on per-element desktop, tablet and mobile control, CSS Grid and Flexbox sections, and a developer mode for HTML and CSS
- SEO and marketing sits at 8 on bulk CSV redirects, automatic canonical and hreflang tags, schema, server-side rendering and an in-editor SEO audit dashboard
- Hosting is named as AWS with a Europe-only Frankfurt option, a stated 99.9% uptime, free one-click SSL and automatic multi-zone backups restorable through the API
- Forms and business holds at 7 on multi-step forms with conditional logic, unlimited submissions and bookings that sync Google Calendar, Outlook and Zoom
- Plans are public — Basic $19 /mo, Team $29 /mo, Agency $52 /mo and White Label $149 /mo, each billed annually — with a 14-day trial without credit card
Held against it
- Legal compliance spreads from 4 to 6, with the lowest score tied to terms that strictly prohibit uploading health information
- We found no public information on whether the cookie notice blocks scripts until consent, on imprint or legal-text help, or on accessibility beyond a listed use case and alt-text generation
- Sovereignty sits at 4-5 with the contract at Duda, Inc., a US company, and we found no public information on subprocessors or their locations
- Export is listed only as "code access" and "code export" on the pricing page, and the terms make the customer responsible for archiving their own content
- We found no public information on monthly-billing rates, on the domain renewal price after the free first year, or on the cost of the eCommerce and Bookings subscriptions the pricing page says may require additional purchases
Best for
- You are an agency or freelancer building many client sites a year and need per-device design control with permissions tunable down to individual features per client
- Your growth depends on technical and AI-search visibility, from redirects and schema to the paid AI Visibility add-on
- You run an appointment-driven business and want bookings that sync directly to Google Calendar, Outlook or Zoom
Avoid if
- Your forms would collect health or other sensitive data, since the terms strictly prohibit uploading Personal Health Information and similar restricted data
- You need a guaranteed exit path, since account transfers sit at Duda's sole discretion with written approval and unpublished sites may be deleted after six months
- Your procurement requires a European contracting entity, since the contract runs with Duda, Inc., a US company subject to FTC enforcement under the Data Privacy Framework
- You must know your full cost before signing, since annual plans are charged upfront and the pricing page states eCommerce and Bookings subscriptions may require additional purchases
The scores
| Criterion | Panel median |
|---|---|
| Editor, templates & design control | 4 of 5 |
| Hosting, domains & portability | 3.5 of 5 |
| SEO, analytics & visibility | 4 of 5 |
| Forms, bookings & business features | 3.5 of 5 |
| Imprint, privacy & cookie compliance | 2.5 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 3 of 5 |
Editor, templates & design control
Show reasoningHide reasoning
How this is scored
How a site gets built and how far the owner can shape it: the editor (drag and drop, sections, AI drafts), the template range, responsive and mobile editing, fonts and brand styles, multilingual pages, custom code, and roles for collaborators or clients.
0 — Not a website editor; the product hosts files or code that are built elsewhere.
3 — An editor with a small set of templates and fixed layouts, where colours and texts change but structure, mobile view and languages are not described.
5 — A visual editor with a template gallery for several industries, layouts that adapt to mobile, brand colours and fonts, a blog, and the option to add pages in a second language or custom code snippets.
8 — Fine design control documented: free layout or section editing, separate mobile and breakpoint editing, reusable components or global styles, built-in multilingual sites with translated URLs, user roles for collaborators or clients, and site versions or history that can be restored.
10 — Design work at a professional level without leaving the tool: a design system with variables and components, interactions and animations, a CMS with custom collections, staging or branching before publishing, client handover with restricted editing, and the editor documented in depth.
The Small-Business Owner
A drag-and-drop editor you can tune per device, more than a hundred font styles, template categories for services and portfolio trades, custom code and a developer mode with HTML and CSS access, reusable custom templates, multilingual pages, and role-based permissions down to individual features for team and clients — a craftsman can make this look like a workshop and not a start-up. We found no public information on design variables, staging before publishing or translated URLs for the language versions. 1 2 8 7
The Freelance Web Designer
This is the strongest part for my twenty-sites-a-year practice: drag-and-drop with per-element control over desktop, tablet and mobile, DudaFlex sections built on CSS Grid and Flexbox, blank templates plus custom templates I can save in my dashboard and reuse, and permissions I can tune down to the individual feature so a client cannot break the design — with a simplified editor for handover and a one-click upgrade path to the full editor. Custom sections are capped by plan (five on the lower tiers) and code export sits behind plan gates. We found no public information on design variables or staging and branching before publishing. 1 2 3 7 8 9
The Marketing Lead
A proper visual editor: drag-and-drop plus CSS Grid and Flexbox sections, per-device editing for desktop, tablet and mobile, and developer mode for HTML and CSS. Templates span named industries plus a blank option and reusable custom templates, multilingual pages are built in, role-based permissions reach down to individual features for clients and teammates, and site backups can be restored. Staging or branching before publishing and a variables-based design system are the pieces I found no public information on. 1 2 3 7 8 10
The Practice Owner
The captured pages show section editing with CSS Grid and Flexbox, customisation of every element separately for desktop, tablet and mobile, site-wide theme settings, over a hundred fonts, a template gallery across many industries plus a blank canvas, custom templates saved for reuse, built-in multilingual pages, role-based permissions for team and clients, and backups that can be restored. That is genuine fine design control, not recolouring a fixed layout; we found no public information on staging before publishing or a design system with variables. 1 2 7 8 10
The Data Protection Officer
Section-based free layout with CSS Grid and Flexbox, per-device editing of every element on desktop, tablet and mobile, developer mode with HTML and CSS access, site-wide theme settings, reusable custom templates and granular role-based permissions down to the individual feature are all documented, with API endpoints to create, restore and delete site backups. Templates span many industries plus a blank option and built-in multilingual with translation integrations. We found no public information on staging or branching before publishing. 1 2 7 8 10
The Skeptic
The captured pages show a serious builder: drag-and-drop with DudaFlex sections, CSS Grid and a developer mode for HTML/CSS, element-level control per desktop, tablet and mobile, industry template categories, built-in multilingual pages, custom templates, CMS collections fed by Airtable or Google Sheets, granular role-based permissions for teammates and clients, and backups with restore through the API. We found no public information on staging or branching before publishing, or on translated URLs for the multilingual sites. 1 2 7 8 10
Hosting, domains & portability
Show reasoningHide reasoning
How this is scored
What runs the site once it is built: included hosting, custom domains and domain registration, SSL, email mailboxes, speed (CDN, image optimisation), backups and restore, availability commitments — and whether pages, content and media can be exported when the owner moves on.
0 — No hosting; the product produces a design or files and the owner finds a host.
3 — Hosting on a subdomain with a custom domain on paid plans, but SSL, backups, storage limits and export are not described.
5 — Hosting included with a custom domain (or one included for a first year), free SSL, stated storage or bandwidth, a CDN or speed optimisation, automatic backups or a restore function, and an export of at least blog posts or content.
8 — Hosting described in depth: data-centre locations named, a stated uptime commitment, versioned backups with self-service restore, email mailboxes on the own domain, performance figures or Core Web Vitals addressed, and a documented export of pages, content and media.
10 — Hosting the owner can rely on and leave: an uptime SLA with credits, the hosting region selectable, DDoS and security measures named, a complete site export (code or standard formats) documented step by step, and domains transferable without fees or lock-in.
The Small-Business Owner
Websites run on AWS with an optional Europe-only Frankfurt location, free one-click SSL, a global CDN, unlimited storage and bandwidth on every plan, automatic multi-zone backups with a documented restore, a stated 99.9% uptime, and domain connection automated through the provider login. We found no public information on mailboxes at the own domain or a documented export of pages and media; a code export is listed on the pricing page, and unpublished sites may be deleted after six months. 3 7 10 11 12
The Freelance Web Designer
Hosting runs on AWS with a Europe-only option in Frankfurt, unlimited storage and bandwidth, free SSL with one-click install, a global CDN, automatic multi-zone backups with documented backup, restore and delete endpoints, and a stated 99.9 percent uptime with Core Web Vitals work. We found no public information on mailboxes on the client's own domain, and export appears only as a "code export" line on the pricing page rather than a documented export of pages, content and media. The terms also allow Duda to delete a site unpublished or unedited for six months and make account transfers subject to Duda's sole discretion and written approval — real caveats when a dormant client project needs to move. 3 6 7 10 11 12
The Marketing Lead
AWS hosting with a Europe-only Frankfurt option, free one-click SSL, a global CDN, 99.9% uptime and automatic multi-zone backups I can restore myself through the API, plus unlimited storage and bandwidth and a free first-year domain with automatic connection. Export is only a code-export line in the pricing table, we found no public information on mailboxes on our own domain, and the terms put content backup on the user and make account transfers discretionary. 3 6 7 10 11 12
The Practice Owner
The whole platform runs on AWS with an option for Europe-only hosting in Frankfurt, free one-click SSL, a global CDN, a stated 99.9% uptime, automatic multi-zone backups with a documented restore, and unlimited storage and bandwidth. Mailboxes on my own domain and a step-by-step export of pages and content are not documented — the pricing page lists only a code export — and the terms make me responsible for backing up my own content, which for a practice site is a real gap. 3 6 7 10 12
The Data Protection Officer
The host is named rather than implied — the platform runs on AWS with an Europe-only option in Frankfurt — alongside a stated 99.9% uptime, free SSL with one-click install, a global CDN, Core Web Vitals work, multi-zone automatic backups restorable through the API, and a free domain for 1 year. We found no public information on mailboxes at the own domain, export appears only as a code export line on the pricing page, and account transfers sit at Duda's sole discretion. 3 6 7 10 12
The Skeptic
Named AWS infrastructure with an Europe-only Frankfurt option, free SSL, a free domain for one year, a global CDN, a stated 99.9% uptime, unlimited storage and bandwidth, and multi-zone backups that can be listed, created, restored and deleted via the API. The exit is where it thins out: the terms put account transfers at Duda's sole discretion with written approval, tell the customer they are responsible for archiving their own content, and allow deletion of an unpublished site after six months; export is listed as "code access" and "code export" on the pricing page, and we found no public information on email mailboxes or a step-by-step export of pages, content and media. 3 6 7 10 12
SEO, analytics & visibility
Show reasoningHide reasoning
How this is scored
How the site is found and measured: page titles and descriptions, clean URLs and redirects, sitemaps and indexing, structured data, local SEO, page speed for search, built-in or connectable analytics, newsletter or social sharing, and guidance for the owner who is not an SEO.
0 — No search settings at all; pages cannot be given titles or descriptions.
3 — Page titles and descriptions can be edited, but sitemaps, redirects, analytics and indexing control are not described.
5 — Editable titles, descriptions and URLs, an automatic sitemap, 301 redirects, social sharing previews, built-in visitor statistics or a documented connection to an analytics tool, and SEO guidance or a checklist inside the product.
8 — SEO documented in depth: structured data, canonical and noindex control, robots.txt editing, image alt texts and compression, local business listings or a Google Business connection, multilingual SEO with hreflang, and privacy-friendly analytics without third-party cookies.
10 — Visibility as a strength: full technical SEO control including server-side rendering and speed figures, AI search or answer-engine readiness addressed, search data shown inside the editor, marketing tools (newsletter, campaigns, A/B tests) built in, and every setting explained in the help centre.
The Small-Business Owner
Per-page titles, keywords and descriptions, custom URLs, an automatic sitemap, automatic canonical and hreflang tags, robots.txt, 301/302 redirects with bulk CSV upload, schema for business info and FAQs, Open Graph previews, full server-side rendering and Core Web Vitals across LCP, INP and CLS, plus a built-in SEO audit dashboard and a paid AI Visibility add-on. We found no public information on local business listings, a Google Business connection or built-in visitor statistics — as a carpenter who wants to be found by neighbours, that is the gap I would check first. 12 4 3 1
The Freelance Web Designer
The technical layer is unusually well documented: per-page titles, metas and URLs, an automatic sitemap, automatic canonical tags, hreflang for multilingual, schema for FAQs, products and business info, full server-side rendering, IndexNow, bulk 301 redirects via CSV, and an in-editor SEO audit dashboard with a broken-link checker. Answer-engine readiness is treated as a product strength, with AI Visibility as a paid add-on from $19 to $195 a month. We found no public information on built-in visitor statistics or a documented analytics connection, local business listings or a Google Business connection, or noindex control beyond an automatically included robots.txt. 1 3 4 12
The Marketing Lead
The strongest area for me: per-page titles and descriptions, customizable URLs, 301 and 302 redirects even in bulk CSV, automatic sitemaps, canonical tags, robots.txt, hreflang, schema for FAQ and business info, Open Graph, fully server-side rendered content and Core Web Vitals work, with an audit dashboard that fixes metatags, alt text and schema in a click. Answer-engine readiness is genuinely ahead of the field, with AI Visibility tiers monitoring how the AI platforms talk about our brand. What I miss is my own visitor numbers: we found no public information on built-in statistics or newsletter and campaign tools, and marketing automation is shown as coming soon. 1 3 4 12
The Practice Owner
Per-page titles, descriptions and URLs, an automatic sitemap, bulk CSV redirects, automatic canonical tags, schema for business info and FAQs, automatic hreflang for language versions, AI-generated alt text, and search performance shown inside the editor through an SEO audit dashboard and AI-search monitoring with competitor tracking. This goes well past the basics; we found no public information on built-in visitor statistics, a documented analytics connection, or local listings such as a Google Business link. 1 4 12
The Data Protection Officer
Per-page titles, keywords and descriptions, custom URLs, an automatic sitemap, 301/302 redirects with bulk CSV upload, automatic canonical tags, robots.txt, schema markup, automatic hreflang, full server-side rendering and bulk AI-generated alt text are all documented, with an SEO Audit dashboard and a paid AI Visibility add-on covering ChatGPT, Gemini and Perplexity. We found no public information on built-in visitor statistics or a documented connection to an analytics tool, which is the privacy-friendly analytics piece I look for. 3 4 12
The Skeptic
Technical SEO is documented in depth: per-page titles, keywords and descriptions, customizable URLs, an automatic sitemap, 301/302 redirects with bulk CSV upload, automatic canonical and hreflang tags, robots.txt, schema for FAQs, products and more, AI-generated alt text site-wide, full server-side rendering, IndexNow, Core Web Vitals claims, an SEO Audit dashboard with a broken-link checker, and a priced answer-engine visibility suite. We found no public information on built-in visitor statistics, local listings or a Google Business connection, or on editing robots.txt beyond the automatic default. 1 4 12
Forms, bookings & business features
Show reasoningHide reasoning
How this is scored
What the site does for the business beyond showing pages: contact and custom forms with spam protection and notifications, where form entries are stored, appointment bookings, member areas, events, integrations with CRM or calendar, payments and a small shop as an add-on — judged as features of a website, not as a shop system.
0 — No forms and no interactive features; the site shows pages only.
3 — A contact form that sends an email, with spam protection, storage of entries and further business features not described.
5 — Custom forms with several field types, spam protection and email notifications, entries stored or exportable, and at least one further business feature (bookings, member area, events or a small shop) described.
8 — Business features documented in depth: forms with conditional fields, file uploads and confirmation emails, appointment booking with calendar sync, member areas or gated pages, payments, integrations with named CRM, newsletter or automation tools, and an app or extension marketplace.
10 — The site runs a small business: forms, bookings, payments, invoices or memberships work together with consent and data retention settings per form, an API or webhooks for form data, and a documented integration ecosystem — while the shop stays one feature among several.
The Small-Business Owner
Multi-step forms with conditional logic and unlimited submissions, bookings that connect to Google Calendar, Outlook and Zoom, membership, eCommerce, a Duda app store and a Zapier integration cover most of what a workshop site must do. We found no public information on where form entries are stored, email notifications of a new enquiry, or spam protection — the first thing I would want is my enquiry form landing in the inbox. 1 3 5 6
The Freelance Web Designer
Multi-step forms with conditional logic and unlimited submissions on every plan, bookings that sync to Google Calendar, Microsoft Outlook and Zoom, membership, eCommerce, an app store, a Zapier integration and a full REST API cover most of what a restaurant or practice site needs. The captured pages do not describe form spam protection, email notifications, where entries are stored or exported, or file uploads — the day-to-day details I check before quoting a job. Note also that the terms strictly prohibit uploading health information to the platform, which a doctor client's booking flow has to respect. 1 3 5 6
The Marketing Lead
Multi-step forms with conditional logic and unlimited submissions, bookings that sync Google Calendar, Outlook and Zoom, membership, eCommerce, an app store, Zapier on higher plans and REST APIs on custom ones — enough to run an enquiry funnel. But we found no public information on spam protection, file uploads, confirmation emails, or where form entries are stored and exported to, which matters when they must reach a CRM rather than a shared mailbox. 1 3 5 6
The Practice Owner
Multi-step forms with conditional logic and unlimited submissions, integrated bookings that sync to Google Calendar, Outlook or Zoom, membership, a shop, an app store and Zapier — the calendar-connected booking is exactly what my waiting list needs. But spam protection, where form entries are stored, and confirmation emails are not described, and the terms prohibit uploading health information to the services, which for a physiotherapy practice limits what patients could ever put in a form. 1 3 5 6
The Data Protection Officer
Advanced multi-step forms with conditional logic and unlimited submissions, bookings that sync with Google Calendar, Microsoft Outlook and Zoom, membership, eCommerce, a Zapier integration, REST APIs and an app store are all documented. We found no public information on spam protection, notifications, or where form entries are stored and for how long — I want a retention period I can file per form, and none is stated on these pages. 1 3 5 6
The Skeptic
Documented business depth: multi-step forms with conditional logic feeding the marketing automation suite, unlimited form submissions, bookings that connect Google Calendar, Outlook and Zoom and send appointment text messages, membership and eCommerce use cases, a Duda App Store, a Zapier integration and REST APIs — though the marketing automation itself is marked "coming soon". We found no public information on spam protection for forms, file uploads or confirmation emails, or on where form entries are stored. 1 3 5 6
Imprint, privacy & cookie compliance
Show reasoningHide reasoning
How this is scored
What the product does so that the owner's site is legal in Germany and the EU: an imprint page, privacy-policy and legal-text generators or partners, a cookie consent banner that blocks scripts until consent, GDPR-compliant forms, a data processing agreement for visitor data, fonts and media served without third-country transfers, and accessibility under the European Accessibility Act.
0 — Nothing for the site's legal obligations; the owner is left to add every legal page and banner from outside.
3 — Pages for an imprint and privacy policy can be added by hand, and a simple cookie notice exists, but consent blocking, a data processing agreement and form data handling are not described.
5 — A cookie consent banner, a data processing agreement offered to customers, documented GDPR handling of form entries, and help for imprint and privacy pages (templates, a generator, a named legal-text partner or a help article).
8 — Compliance worked out for EU sites: a consent banner that blocks scripts and embeds until consent and logs it, legal texts kept current by a named provider or a warranty against cease-and-desist letters, fonts and maps served without US transfer, and accessibility features or an accessibility statement.
10 — Compliance as part of the product: consent management with granular categories and records, legal texts maintained for several EU countries, every embed and script assessed for consent, accessibility to WCAG 2.1 AA documented with tooling, and the vendor's share of liability stated in its terms.
The Small-Business Owner
Every site ships with privacy pages, cookie notifications and tracking toggles, advanced cookie compliance integrations sit alongside the Europe-only Frankfurt hosting, and a data processing addendum covering the EEA is incorporated by reference into the terms. We found no public information on whether the cookie notice blocks scripts until consent, on help with a German imprint, or on legal-text generators or partners; accessibility appears only as a listed use case. 7 6 1 5
The Freelance Web Designer
Every site ships with privacy and privacy-settings pages, cookie notifications and tracking toggles, and Duda publishes a data processing agreement covering the EEA, UK and Switzerland, backed by ISO 27001 certification. We found no public information on imprint help or a legal-text partner, on consent banners that block scripts and embeds until consent and log it, or on an accessibility statement — accessibility appears only as a use case and through AI alt-text generation. 5 6 7
The Marketing Lead
Privacy and privacy-settings pages ship out of the box, cookie notifications come with consent options and preference management, a data processing agreement covering the EEA is published and incorporated by reference, and there is a Frankfurt-only hosting option alongside accessibility support through bulk alt-text generation. We found no public information on a consent banner that blocks scripts until consent and logs it, a named legal-text partner or generator, help with a German imprint, or a WCAG accessibility statement. 5 6 7
The Practice Owner
There is a published data processing agreement covering the EEA, UK and Switzerland, privacy and privacy-settings pages out of the box, cookie notifications with tracking toggles, and consent and preference-management tools. We found no public information on imprint or legal-text help, on whether the cookie banner blocks scripts until consent, or on an accessibility statement — and because health data is prohibited by the terms, I could not rely on this for GDPR handling of patient details in forms. 3 5 6 7
The Data Protection Officer
A published data processing agreement is incorporated by reference into the terms with EEA, UK and Switzerland scopes, privacy and privacy-settings pages plus cookie notifications and tracking toggles ship with every site, and Europe-only Frankfurt hosting is offered alongside cookie compliance integrations. We found no public information on a consent banner that blocks scripts and embeds until consent or that logs consent, on legal-text generators or a named legal-text partner for imprint pages, or on WCAG conformance — accessibility appears only as a use case and in alt-text generation. The privacy policy states Duda does not generally respond to Do Not Track signals, while honoring Global Privacy Control where US law requires. 1 5 6 7
The Skeptic
Every site ships with privacy pages, cookie notifications and tracking toggles, a data processing agreement is published and incorporated into the terms with EEA scope, and the privacy policy sets out handling of customer data under GDPR-style safeguards. We found no public information on whether the cookie notice blocks scripts until consent, on imprint help or a legal-text partner, or on accessibility beyond a use-case listing and alt-text generation. 1 5 6 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the sites, the form entries and the visitor data are hosted, and who the subprocessors are (hosting, CDN, email delivery, analytics, payments, AI features). Independently sourced by the sovereignty pipeline; the data subjects here are the owner's own visitors and customers, so the whole chain counts, not only the editor.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available or an EU contracting entity, a data processing agreement offered, but parts of the chain (CDN, email, analytics, AI features, support) run through non-EU providers or the subprocessors are listed without locations.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, data export and deletion documented, and certifications published with their scope rather than implied.
The Small-Business Owner
The contracting party is Duda, Inc., an American company subject to the US Federal Trade Commission under the Data Privacy Framework, and personal information may be processed in the United States, Israel, the EEA, the UK and Canada. Europe-only hosting in Frankfurt on AWS is supported, a data processing agreement is published, and ISO/IEC 27001:2022 certification is stated, but we found no public information on a subprocessor list with locations for the whole chain. 6 5 7
The Freelance Web Designer
The contracting entity is Duda, Inc., a US company subject to FTC enforcement with Data Privacy Framework self-certification; the platform runs on AWS with a Europe-only hosting option in Frankfurt, but the privacy policy states processing in the United States, Israel, the EEA, the UK and Canada. A published processing agreement and ISO 27001 certification are there; the captured pages name no individual subprocessors and show no European entity or ownership. 5 6 7
The Marketing Lead
The contracting entity is Duda, Inc., a US company, and processing is documented across the United States, Israel, the EEA, the UK and Canada, with hosting on AWS and an ISO 27001 certification published. Europe-only hosting in Frankfurt is available and a data processing agreement is published, but we found no public information on the subprocessors or their locations. 5 6 7
The Practice Owner
The contract is with Duda, Inc., a US company, but Europe-only hosting in Frankfurt on AWS is supported, a data processing agreement is published, and ISO 27001 certification is stated. The privacy policy names processing in the United States, Israel, Canada and the United Kingdom as well as the EEA, and we found no public information on subprocessors and their locations, so the full chain my patients' data would travel is not visible to me. 3 5 6 7
The Data Protection Officer
The contracting entity is Duda, Inc., a US company, and personal data may be processed in the United States, Israel, the EEA, the UK and Canada, with transfers relying on the Data Privacy Framework, adequacy decisions and the UK International Data Transfer Addendum. The hosting at least is named — AWS, with an Europe-only option in Frankfurt — and certification to ISO/IEC 27001:2022 is stated. We found no public information listing the subprocessors or their locations, so the chain behind my clients' visitor data cannot be filed. 3 5 6 7
The Skeptic
The terms name Duda, Inc. as the contracting party and the privacy policy names processing in the United States, Israel, the EEA, the United Kingdom and Canada, resting on the Data Privacy Framework and enforcement by the US Federal Trade Commission. An Europe-only hosting option in Frankfurt, a published data processing agreement and an ISO/IEC 27001:2022 certification are real; the subprocessors are not listed, and ownership and entity jurisdiction are not confirmed on the captured pages. 5 6 7
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over two or three years from public pages alone: the monthly price per plan, the introductory price and how long it lasts, the renewal price after it, setup fees, minimum term and notice, domain and mailbox renewals, transaction fees on sales, and which features (ad removal, extra languages, bookings, more storage) cost extra.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan is shown, but what the plans include, what they cost after the first term or how the cost scales is unclear.
5 — Plans are public with prices and their main inclusions, but at least one commonly needed piece (the price after an introductory offer, domain renewal, a mailbox, transaction fees, an add-on) is unpriced or hard to find.
8 — Every plan priced publicly with the introductory price, its duration and the regular price after it, setup fee, minimum term and notice period, domain and add-on prices listed, and VAT treatment stated.
10 — Complete price computability: the cost of a given site over several years derivable from public pages, with every add-on, renewal, transaction and support fee, the cancellation terms and what happens to the site and domain after cancellation published.
The Small-Business Owner
Plans are public — Basic $19/mo, Team $29/mo, Agency $52/mo and White Label $149/mo, each billed annually and charged upfront, in USD with taxes applying — with listed add-on prices for AI Visibility (Starter $19/mo up to Scale $195/mo) and extra published projects, a free domain for one year, a 14-day trial without credit card, a 30-day money-back guarantee and self-service cancellation at the end of the period. The domain price after the free first year, monthly-billing rates and transaction fees we found no public information on, so I could not compute my second-year cost down to the cent. 3 6
The Freelance Web Designer
Plans are public with real inclusions — Basic $19 /mo, Team $29 /mo, Agency $52 /mo and White Label $149 /mo, each billed annually, with unlimited form submissions, storage and bandwidth, a free domain for 1 year, a 14-day trial and a 30-day money-back guarantee — and add-ons like AI Visibility from $19/mo to $195/mo are priced. What a buyer cannot compute: the price when not billed annually, domain renewal after the free year, transaction fees, and the separately purchased eCommerce and Bookings subscriptions the pricing page itself flags. Cancellation is self-service and takes effect at the end of the current subscription period, which I appreciate. 3 6
The Marketing Lead
Four plans are priced publicly with real inclusions — team seats, pages, included projects, AI credits, unlimited storage — plus per-project overage rates, full pricing for the AI Visibility tiers, a fourteen-day trial without a card, a thirty-day money-back guarantee and self-service cancellation at period end. Holes remain: the monthly-billing price behind the 25% annual discount, the domain renewal after the free year, and the eCommerce and Bookings subscriptions that may require additional purchases are not priced publicly. 3 6
The Practice Owner
Plan prices are public ($19/mo, $29/mo, $52/mo and $149/mo, billed annually with 25% off, charged upfront) along with seats, included projects, pages, AI credits, add-on prices such as AI Visibility from $19/mo and additional published projects at $19/mo or $171/yr, self-service cancellation at period end, and published overage pricing. Still, the Bookings and eCommerce subscriptions "may require additional purchases" without prices, and the domain renewal after the free first year and the VAT treatment are not shown, so I cannot compute a two-year total for a site with online booking. 3 6
The Data Protection Officer
Plans are public with prices and a detailed inclusion grid — Basic $19 /mo, Team $29 /mo, Agency $52 /mo and White Label $149 /mo, each billed annually, plus a 25% annual discount, add-ons priced such as AI Visibility starting at $19/mo and additional Duda Vibe projects at $19/mo or $171/yr — alongside disclosed automatic renewal, upfront annual charging, self-service cancellation effective at the end of the period, and a 30-day money-back guarantee. We found no public information on the domain renewal price after the free first year, on transaction fees for sales, or on VAT treatment beyond the note that taxes may apply, and no monthly-billing price appears. 3 6
The Skeptic
Plan prices are public with their main inclusions — Basic $19 /mo, Team $29 /mo, Agency $52 /mo, White Label $149 /mo, each "Billed annually" — plus per-additional-project prices, the AI Visibility add-on from $19/mo, a 14-day trial without credit card, a 30-day money-back guarantee, automatic renewal and self-service cancellation at period end. We found no public information on the domain renewal price after the free first year, on the cost of the eCommerce and Bookings purchases the pricing note says "may require additional purchases", or on monthly-billing rates. 3 6
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Duda
Is Duda European?
No. whats-best.ai classifies Duda as Rest of world.
Where does Duda store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Duda have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Duda?
As of 4 Nov 2026, the panel rates Wix (3.5/5), WordPress.com (3.5/5) and Framer (3.5/5) highest among the other 17 Website Builders products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Framer (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Duda alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 28 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Hosting location. The EU region appears as a supported option in security/marketing copy while the underlying default hosting region is never stated, and all hosting runs on AWS.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 37 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.duda.co Checked 28 Oct 2026 Details →
- 2 Features page www.duda.co Checked 28 Oct 2026 Details →
- 3 Pricing page www.duda.co Checked 28 Oct 2026 Details →
- 4 SEO features page www.duda.co Checked 28 Oct 2026 Details →
- 5 Privacy policy www.duda.co Checked 28 Oct 2026 Details →
- 6 Terms naming the legal entity www.duda.co Checked 28 Oct 2026 Details →
- 7 Security page www.duda.co Checked 28 Oct 2026 Details →
- 8 Editor, templates & design control — found from sitemap www.duda.co Checked 28 Oct 2026 Details →
- 9 Editor, templates & design control — found from sitemap www.duda.co Checked 28 Oct 2026 Details →
- 10 Hosting, domains & portability — found from sitemap developer.duda.co Checked 28 Oct 2026 Details →
- 11 Hosting, domains & portability — found from sitemap www.duda.co Checked 28 Oct 2026 Details →
- 12 SEO, analytics & visibility — found from sitemap www.duda.co Checked 28 Oct 2026 Details →
- 13 Imprint, privacy & cookie compliance — found from sitemap www.duda.co Checked 1 Nov 2026 Details →