Provision record
Windsurf · Security at Cognition · View original document ↗

Default use of customer data for model training

High severity High confidence Common · 273 of 352 platforms

Key Facts · in the document’s own words

May Windsurf use customer data for model training purposes?
“By default, we may use your data for model training purposes to improve and enhance the Services.”
Version CA-V-007341, captured Oct. 4, 2026 · live source ↗
Our reading, not the document’s words
Windsurf may, by default, use customer data for model training purposes to improve and enhance the Services.
Stay ahead of the changes
Track Windsurf and get the diff the day its terms change.
Share 𝕏 Share in Share 🔒 PDF
ⓘ

This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

This clause establishes that model training on customer data is an active default practice, meaning customers who do not take affirmative steps to opt out are subject to this use of their data.

Recent Activity

This document changed recently

High Jul 6, 2026

The updated terms establish a default permission for Windsurf to use customer data for model training to improve services. Previously, the company required explicit opt-in before any training use. Paid plan users can now opt out at any time through the Data Controls settings page, after which their data will not be used for training and Zero Data Retention will be enabled with model providers. Enterprise customers must provide express prior written consent before any training use occurs. Teams plan users cannot opt out individually; only administrators can exercise this right.

View change record →

Consumer impact (what this means for users)

Readers' data may be used for model training unless they take steps to change the default setting.

How other platforms handle this

TaskRabbit Medium

To enforce the relevant Terms of Service.

Uber Medium

Facilitating insurance, vehicle, invoicing or financing solutions.

Grubhub Medium

These trusted partners may use this information to support and market partnership benefits (including by communicating with you), as well as for their internal business purposes such as analytics and product improvement.

See all platforms with this clause type →
▸ View Original Clause Language DOCUMENT RECORD
"
By default, we may use your data for model training purposes to improve and enhance the Services.

Excerpt from Windsurf's Security at Cognition

Applicable regulations

EU AI Act
European Union
CCPA/CPRA
California, USA
Colorado AI Act
US-CO
ePrivacy Directive
European Union
EU AI Act - High Risk Provisions
EU
FTC Act Section 5
United States Federal
GDPR
European Union

Provision details

Document information
Document
Security at Cognition
Entity
Windsurf
Tracking information
First captured by ConductAtlas
May 11, 2026
Text quoted from version
CA-V-007341, captured Oct. 4, 2026
Record ID
CA-P-061031
Document ID
CA-D-000783
Evidence Provenance
Source URL
Wayback Machine
Archived bytes SHA-256 (version CA-V-007341)
05edda171cc1c200c61b6089b90d27db45537319bc10f5fd8fdfa1a5caaa27fe
Analysis generated
July 9, 2026 07:22 UTC
Methodology
Evidence
✓ Excerpt found in version CA-V-007341, captured Oct. 4, 2026 (checked Oct. 5, 2026)
Citation Record
Entity: Windsurf
Document: Security at Cognition
Record ID: CA-P-061031
Version: CA-V-007341
Captured: 2026-10-04 00:59:06 UTC
SHA-256: 05edda171cc1c200…
URL: https://conductatlas.com/platform/windsurf/security-at-cognition/provision/CA-P-061031/default-use-of-customer-data-for-model-training/
Accessed: Oct. 13, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
High
Categories

Other risks in this policy

Related Analysis

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

Frequently Asked Questions

What does Windsurf's Default use of customer data for model training clause do?

This clause establishes that model training on customer data is an active default practice, meaning customers who do not take affirmative steps to opt out are subject to this use of their data.

How does this clause affect you?

Readers' data may be used for model training unless they take steps to change the default setting.

How many platforms have this type of clause?

ConductAtlas has identified this type of provision across 273 platforms. See the full comparison.

Is ConductAtlas affiliated with Windsurf?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.