Windsurf changed its default data use policy for model training. Previously, the company stated it would not use customer data for model training unless users explicitly opted in. The updated policy states the company may use customer data for model training by default. Paid plan users can now opt out on the Data Controls settings page, and Enterprise customers require express written consent before any training use. Teams plan administrators control the opt-out setting for their organization.
Consumers: Windsurf can now use your data to train and improve its AI models unless you turn this off in settings.
Consumers: You no longer need to actively agree to let Windsurf use your data for training; it happens automatically.
Enterprise customers: Enterprise customers must now give explicit written permission before their data can be used for training, rather than having it prohibited by default.
The updated terms establish a default policy permitting Windsurf to use customer data for model training purposes to improve services. Previously, the company required explicit opt-in before any training use. Under the revised policy, data training occurs automatically for free and paid users unless they affirmatively opt out through the Data Controls settings page. Once disabled, the terms state your data will not be used for training and Zero Data Retention will be enabled with model providers. Enterprise customers operate under a different standard, requiring express prior written consent before any training use occurs.
→ Review your Windsurf account privacy settings within 30 days and navigate to Data Controls to decide whether to opt out of model training.
→ For Teams plan members, contact your administrator to confirm whether model training opt-out has been disabled for your organization.
→ If you require stricter data handling guarantees, evaluate whether your use case qualifies for Enterprise tier, which requires express written consent for model training.
ConductAtlas has recorded 2 material changes to this document (since June 2026). An additional minor or cosmetic changes were excluded.
Across all monitored documents, Windsurf has made 3 significant changes.
Changed from explicit opt-in requirement to automatic authorization for all users except Enterprise; shifts presumption from data protection to data use.
Establishes right to disable model training via Data Controls settings and triggers Zero Data Retention with model providers.
Requires express prior written consent for Enterprise customers before any model training, creating a distinct tier of protection.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Windsurf reversed its model training default from opt-in to opt-out for general users while maintaining a stricter consent requirement for Enterprise customers. This change may implicate GDPR Article 6 (lawful basis for processing) and Article …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-003485.
Windsurf's Terms of Service footer navigation was updated in an update detected on July 24, 2026 to add two new …
Windsurf updated its privacy policy footer to add a link to a 'Service Level Agreement' document between the Data Processing …
Windsurf's Security & Data Handling page was updated to remove one sentence from the opening paragraph. The phrase 'Copy page' …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.