“if your prompts or conversations trigger abuse detectors your data may be stored for investigation and deleted in accordance with their retention policies.”
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Abuse-flagged data is subject to a different retention pathway than ordinary data, meaning it may be stored longer or under different conditions before deletion.
Interpretive note: The pronoun 'their' in 'their retention policies' is ambiguous — it could refer to Cursor's policies, the model providers' policies, or both. The primary claim reflects the deletion obligation without resolving that ambiguity.
The updated terms clarify that Cursor maintains zero data retention agreements with all AI model providers and will not use customer data for training. However, the revised language now explicitly states that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored temporarily for investigation and deleted according to the providers' retention policies. The policy removed the legacy Privacy Mode option; non-ZDR models now require explicit admin opt-in. You can review the specific retention policies of OpenAI and Anthropic through their documentation.
View change record →If your data triggers an abuse detector, it may be stored for investigation rather than handled under standard data flows, and deleted only per the applicable retention policies.
How other platforms handle this
We will retain your Data for as long as necessary: (i) to achieve the purposes as set out in this Policy; (ii) as required by applicable laws and regulations, including any mandated retention periods...
If the Services are made available to you through an organization (e.g., your employer), we retain your information as long as required by the administrator of your account.
After you submit a request to delete your account, we initiate a deletion process to safely and completely remove your data from our servers or retain it only in anonymized form.
"if your prompts or conversations trigger abuse detectors your data may be stored for investigation and deleted in accordance with their retention policies.Excerpt from Cursor's Data Use & Privacy Overview
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Abuse-flagged data is subject to a different retention pathway than ordinary data, meaning it may be stored longer or under different conditions before deletion.
If your data triggers an abuse detector, it may be stored for investigation rather than handled under standard data flows, and deleted only per the applicable retention policies.
ConductAtlas has identified this type of provision across 268 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.