38 Total
10 High severity
22 Medium severity
6 Low severity

Key Facts

May Windsurf share the fact that a user has an account with the user's employer?
Windsurf may share the fact that a user has an account and certain account information with the user's employer or organisation when the account was created using an email address belonging or relating to that employer or organisation.
May Windsurf share certain account information with an organisation when the account was created using an email address belonging to that organisation?
Windsurf may share the fact that a user has an account and certain account information with the user's employer or organisation when the account was created using an email address belonging or relating to that employer or organisation.
May administrators of an enterprise account access User Content associated with a user's account?
Windsurf permits administrators of any enterprise or business account to access certain information associated with a user's account, including User Content, and to control the user's account and such information.
May administrators control the user's account and information?
Windsurf permits administrators of any enterprise or business account to access certain information associated with a user's account, including User Content, and to control the user's account and such information.
May Windsurf access user information to comply with law?
Windsurf may access, read, preserve, and disclose user information when it believes it is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental, and other legal requests, or court orders.
May Windsurf preserve user information to comply with court orders?
Windsurf may access, read, preserve, and disclose user information when it believes it is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental, and other legal requests, or court orders.
Does Windsurf sell personal information with third parties for targeted advertising purposes?
Windsurf does not sell or share personal information with third parties for targeted advertising purposes, and has not done so in the past 12 months.
Has Windsurf shared personal information for targeted advertising purposes in the past 12 months?
Windsurf does not sell or share personal information with third parties for targeted advertising purposes, and has not done so in the past 12 months.
Does Windsurf have actual knowledge that it sells personal information about individuals under 16 years old for targeted advertising purposes?
Windsurf states that it does not have actual knowledge that it sells or shares for targeted advertising purposes personal information about individuals under 16 years old.
Does Windsurf provide personal information to third-party service providers who help Windsurf provide its Services?
Windsurf provides personal information to third-party service providers who help Windsurf provide its Services.
Stay ahead of the changes
Track Windsurf and get the diff the day its terms change.
Summary

Windsurf's privacy policy explains what the company does with your information when you use its Services. If you signed up with a work email, your employer may be told you have an account, and enterprise account administrators can access and control your account content. Your content is also used to train Windsurf's AI models, and your personal information is shared with third-party service providers that help run the platform.

Analysis

This privacy policy establishes Windsurf's data collection, sharing, retention, and use practices governing users of its Services. Windsurf may share account information with an employer or organization when a corporate email address is used at registration, and administrators of enterprise or business accounts hold access and control rights over user accounts and User Content. Windsurf uses User Content to train, fine-tune, and improve the AI models powering its Services, and shares personal information with third-party service providers as well as in the event of corporate transactions such as acquisitions or mergers. Security measures are characterized as commercially reasonable and not an absolute guarantee, with residual risk expressly allocated to users.

What this means for you

If you use a work email to sign up, Windsurf may share the fact that you have an account and certain account details with your employer without asking for your consent at that moment. On enterprise or business accounts, your employer's administrators can access your User Content and control your account. Your submitted content contributes to the training and improvement of Windsurf's AI models. Windsurf does not sell or share personal information with third parties for targeted advertising. Voice audio is deleted after transcription unless Windsurf states otherwise. Windsurf instructs users under 18 to stop accessing its Services.

Institutional Analysis
Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

6 important changes detected

9 versions captured · Last updated: August 2026

What changed In an update detected on August 26, 2026, Windsurf modified a single sentence in its privacy policy header. The navigation menu changed from listing 'Contact' to listing 'Get a Demo' alongside other menu options. This is a formatting and navigation change with no material impact on privacy practices, data handling, rights, or disclosures.
Why this matters This change is a navigation menu update and has no material impact on consumer privacy rights, data handling practices, disclosures, or obligations under the policy.
View full change record →
What changed Windsurf's Privacy Policy removed a reference to 'Service Level Agreement' from its linked policy documents. Previously, the policy listed 'Service Level Agreement' among related links; the updated version removes that link. This is a formatting change that does not materially alter privacy rights, data practices, or consumer obligations.
Why this matters This change removes a link to the Service Level Agreement from Windsurf's Privacy Policy documentation. The privacy policy's substantive terms, data practices, and user rights remain unchanged. This is a formatting adjustment to the footer navigation of the privacy policy document.
View full change record →

July 24, 2026 low

Windsurf updated its privacy policy footer to add a link to a 'Service Level Agreement' document between the Data Processing Addendum and Privacy Policy. This change adds a document reference …

View change record →
June 21, 2026 low

Windsurf's privacy policy was updated on June 21, 2026 to change the company website URL from www.cognition.ai to cognition.com in the opening paragraph. This is a technical correction reflecting the …

View change record →
June 12, 2026 low

Windsurf reordered the navigation links in their privacy policy footer on June 12, 2026. The 'Privacy Policy' link moved from its original position to appear after the 'Data Processing Addendum' …

View change record →
June 2, 2026 low

Windsurf removed the 'Windsurf' navigation link from the header menu in their privacy policy document on June 2, 2026. The updated privacy policy header now omits the redundant Windsurf link …

View change record →
Featured, High severity
Featured, Medium severity

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

38 provisions
12 featured
14 clause types
10 high severity
Targeting and Audience Restrictions 2 2 high
AI / Automated Decision-Making 1 1 high
Acceptable Use Restrictions 1 1 high
Disclosure and Transparency Requirements 1 1 high
Stay ahead of the changes

Monitoring

Windsurf has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Stay ahead of the changes

Governance Intelligence

Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.

Cross-platform context

See how other platforms handle Employer Account Sharing for Corporate Email Users and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured September 11, 2026 00:59 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000486
Version ID CA-V-006786
SHA-256 4c6c5bb87f04d241adb3ca8311cdeb6fec2b0052bb73ffd284907d902b77c60c
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.

Start monitoring → Compare plans