Privacy Mode and Zero Data Retention

What it is

When Privacy Mode is on, Cursor contractually requires its AI model providers not to store your code or use it to train their models. This mode is on automatically for team members and can be turned on manually by any individual user.

Why it matters (compliance & governance perspective)

The document states that without Privacy Mode, code data may be stored or used for training by model providers; enabling it triggers contractual ZDR obligations on those third-party providers.

Consumer impact (what this means for users)

This provision directly affects how code data submitted through Cursor is handled by third-party AI model providers: the document states that Privacy Mode prevents storage and training use of code data by those providers through contractual ZDR terms. Users on individual plans should verify Privacy Mode is enabled in Settings if they do not want their code processed beyond immediate inference.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 28 processor and sub-processor obligations, as ZDR contractual terms with model providers constitute a data processing control that data controllers relying on Cursor may need to reflect in their own DPAs. CCPA service provider restrictions on secondary use of personal information are also relevant where code data contains personal information. The FTC Act's prohibition on unfair or deceptive practices applies to the accuracy of the ZDR commitment as disclosed. (2) GOVERNANCE EXPOSURE: Medium. The provision asserts a contractual commitment to ZDR with model providers when Privacy Mode is active, but the document does not name those providers, specify the scope of 'code data' covered, or address what happens to data processed before Privacy Mode is enabled. The gap between the stated commitment and the absence of supporting documentation creates governance risk for enterprise customers who rely on this representation in their own compliance frameworks. (3) JURISDICTION FLAGS: EU and EEA customers processing personal data in code will face heightened scrutiny under GDPR if ZDR terms are not reflected in documented sub-processor agreements. California customers should evaluate whether code data constitutes personal information under CCPA for purposes of service provider restrictions. Enterprise customers in regulated industries (financial services, healthcare) should assess whether ZDR alone satisfies their sector-specific data handling requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should request written confirmation of ZDR terms from Cursor and ask for the identity of model providers subject to those terms. The provision asserts a contractual obligation on model providers but does not grant customers direct audit or enforcement rights against those providers. This is a standard limitation in SaaS sub-processor arrangements but may require explicit DPA language to satisfy GDPR Article 28 obligations. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should map which Cursor usage scenarios fall within Privacy Mode scope and which do not. Teams should confirm that Privacy Mode is enforced at the organizational level via admin controls rather than relying on individual user settings. The document should be reviewed against the actual DPA or terms of service for any additional representations about data use outside of Privacy Mode.

Applicable agencies

Provision details

Other risks in this policy

• China Infrastructure and Subprocessor Exclusion low
• SOC 2 Type II Attestation and Penetration Testing low
• Subprocessor Management and Vendor Risk Program low
• Account Deletion low
• Vulnerability Disclosure and Incident Communication medium
• Infrastructure Access Controls and MFA low