Windsurf Privacy Policy

This document is Windsurf's (Exafunction, Inc.) privacy policy, last updated October 21, 2025, governing the collection, use, and disclosure of Personal Information through the windsurf.com website, downloadable extensions, APIs, and associated software and services. The agreement states that Windsurf collects Registration Information, Communications Information, Log and Usage Information, Prompts and Outputs Information, voice command transcriptions, and information from third-party integrations; the terms authorize use of Log and Usage Information and Prompts and Outputs Information to train, develop, and improve AI and machine learning models, and permit disclosure to partners, affiliates, vendors, analytics providers, and enterprise account administrators who may access user Prompts and Outputs. The policy authorizes disclosure of any categories of Personal Information to current or future partners and affiliates for any purpose described in the policy, and enterprise account administrators are stated to have access to individual Prompts and Output Information, which is operationally distinct from policies that restrict employer access to derived or aggregated data only; the document also asserts that Standard Contractual Clauses govern EEA-to-US transfers, though the document does not specify which SCCs or the supervisory authority responsible. The policy engages GDPR and UK GDPR for EEA and UK residents, the California Consumer Privacy Act and California Privacy Rights Act for California residents (with a separate California Resident Privacy Notice referenced), and various other U.S. state comprehensive privacy laws; COPPA-adjacent age restriction provisions apply to users under 18. Compliance considerations include the use of AI training as a stated purpose for processing user Prompts and Outputs without a clear opt-out mechanism disclosed in the main policy text, enterprise data access provisions that may require evaluation under employment law and data processor agreement requirements in the EU and UK, and the absence of a specified retention schedule beyond a general necessity standard.