Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document discloses that named third-party inference providers Baseten, Together AI, and Fireworks may temporarily access and store model inputs and outputs, with deletion occurring after use, when Privacy Mode is disabled.
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies specific third-party subprocessors by name and authorizes temporary storage of model inputs and outputs by those providers, with retention duration determined by the phrase 'deleted after use' rather than a defined timeframe.
Interpretive note: The phrase 'deleted after use' does not specify a defined retention period, creating uncertainty about the maximum duration of temporary storage by named providers.
The updated policy clarifies that Cursor maintains zero data retention agreements with all AI model providers and customer data will not be used for training by Cursor. However, the policy now explicitly discloses that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored for investigation and deleted according to the provider's retention policies. The policy removed the previous blanket statement that code would never be trained on by Cursor or third parties, replacing it with more specific disclosure of abuse detection practices. You can review OpenAI and Anthropic's documentation directly for details on their specific retention policies.
View change record →Under this clause, when Privacy Mode is off and users select models served through Baseten, Together AI, or Fireworks, the prompts and model outputs may be temporarily stored by those providers; the document states this data is deleted after use but does not specify a defined deletion timeline.
Cross-platform context
See how other platforms handle Third-Party Inference Provider Data Sharing (Baseten, Together AI, Fireworks) and similar clauses.
Compare across platforms →Monitoring
Cursor has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Some of our inference providers, including Baseten, Together AI, and Fireworks, may temporarily access and store model inputs and outputs to improve our inference performance; this data is deleted after use.Excerpt from Cursor's Data Use & Privacy Overview
(1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 28 requirements for data processing agreements with subprocessors, CCPA service provider contract requirements, and FTC Act standards for accurate disclosure of third-party data sharing. The absence of a defined retention period for 'deleted after use' may require evaluation under applicable data minimization standards. (2) GOVERNANCE EXPOSURE: Medium. The named subprocessors create a documented data sharing chain that enterprise compliance teams must assess for contractual alignment with their own data governance obligations. The phrase 'deleted after use' is operationally imprecise and does not establish a measurable retention limit. (3) JURISDICTION FLAGS: EU and EEA users face heightened exposure under GDPR, which requires documented processor agreements with all named subprocessors. Organizations in regulated sectors such as healthcare or financial services should assess whether model inputs routed through these providers may contain regulated data categories. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request documentation of data processing agreements between Cursor and Baseten, Together AI, and Fireworks to verify that these providers are contractually bound to the deletion and non-use terms described in this document. The provision does not assert audit rights over these subprocessors on behalf of users. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should update data processing records to include Baseten, Together AI, and Fireworks as downstream data processors; assess whether these providers' data handling practices are consistent with applicable law in relevant jurisdictions; and evaluate whether the 'deleted after use' standard constitutes a sufficient retention limit under applicable frameworks.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision identifies specific third-party subprocessors by name and authorizes temporary storage of model inputs and outputs by those providers, with retention duration determined by the phrase 'deleted after use' rather than a defined timeframe.
Under this clause, when Privacy Mode is off and users select models served through Baseten, Together AI, or Fireworks, the prompts and model outputs may be temporarily stored by those providers; the document states this data is deleted after use but does not specify a defined deletion timeline.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.