38 Total
10 High severity
22 Medium severity
6 Low severity

Key Facts

May Windsurf share the fact that a user has an account with the user's employer?
Windsurf may share the fact that a user has an account and certain account information with the user's employer or organisation when the account was created using an email address belonging or relating to that employer or organisation.
May Windsurf share certain account information with an organisation when the account was created using an email address belonging to that organisation?
Windsurf may share the fact that a user has an account and certain account information with the user's employer or organisation when the account was created using an email address belonging or relating to that employer or organisation.
May administrators of an enterprise account access User Content associated with a user's account?
Windsurf permits administrators of any enterprise or business account to access certain information associated with a user's account, including User Content, and to control the user's account and such information.
May administrators control the user's account and information?
Windsurf permits administrators of any enterprise or business account to access certain information associated with a user's account, including User Content, and to control the user's account and such information.
May Windsurf access user information to comply with law?
Windsurf may access, read, preserve, and disclose user information when it believes it is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental, and other legal requests, or court orders.
May Windsurf preserve user information to comply with court orders?
Windsurf may access, read, preserve, and disclose user information when it believes it is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental, and other legal requests, or court orders.
Does Windsurf sell personal information with third parties for targeted advertising purposes?
Windsurf does not sell or share personal information with third parties for targeted advertising purposes, and has not done so in the past 12 months.
Has Windsurf shared personal information for targeted advertising purposes in the past 12 months?
Windsurf does not sell or share personal information with third parties for targeted advertising purposes, and has not done so in the past 12 months.
Does Windsurf have actual knowledge that it sells personal information about individuals under 16 years old for targeted advertising purposes?
Windsurf states that it does not have actual knowledge that it sells or shares for targeted advertising purposes personal information about individuals under 16 years old.
Does Windsurf provide personal information to third-party service providers who help Windsurf provide its Services?
Windsurf provides personal information to third-party service providers who help Windsurf provide its Services.
Stay ahead of the changes
Track Windsurf and get the diff the day its terms change.
Summary

Windsurf's privacy policy explains what the company does with your information when you use its Services. If you signed up with a work email, your employer may be told you have an account, and enterprise account administrators can access and control your account content. Your content is also used to train Windsurf's AI models, and your personal information is shared with third-party service providers that help run the platform.

Analysis

This privacy policy establishes Windsurf's data collection, sharing, retention, and use practices governing users of its Services. Windsurf may share account information with an employer or organization when a corporate email address is used at registration, and administrators of enterprise or business accounts hold access and control rights over user accounts and User Content. Windsurf uses User Content to train, fine-tune, and improve the AI models powering its Services, and shares personal information with third-party service providers as well as in the event of corporate transactions such as acquisitions or mergers. Security measures are characterized as commercially reasonable and not an absolute guarantee, with residual risk expressly allocated to users.

What this means for you

If you use a work email to sign up, Windsurf may share the fact that you have an account and certain account details with your employer without asking for your consent at that moment. On enterprise or business accounts, your employer's administrators can access your User Content and control your account. Your submitted content contributes to the training and improvement of Windsurf's AI models. Windsurf does not sell or share personal information with third parties for targeted advertising. Voice audio is deleted after transcription unless Windsurf states otherwise. Windsurf instructs users under 18 to stop accessing its Services.

Institutional Analysis
Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

4 important changes detected

6 versions captured · Last updated: July 2026

What changed Windsurf updated its privacy policy footer to add a link to a 'Service Level Agreement' document between the Data Processing Addendum and Privacy Policy. This change adds a document reference within the policy's navigation structure but does not modify the substantive privacy terms, data collection practices, or user rights stated in the policy itself.
Why this matters This change adds a navigational link to a Service Level Agreement in Windsurf's privacy policy documentation structure. The updated layout does not modify substantive privacy disclosures, data collection practices, or user rights. No specific action is required from users.
View full change record →
What changed Windsurf's privacy policy was updated on June 21, 2026 to change the company website URL from www.cognition.ai to cognition.com in the opening paragraph. This is a technical correction reflecting the website domain used to access the policy and does not alter the scope of data practices, user rights, or operational procedures described in the policy.
Why this matters This change updates the website URL referenced in the privacy policy opening from www.cognition.ai to cognition.com. The change does not alter what data Windsurf collects, how it processes data, user rights, or consent mechanisms described in the policy. The policy continues to explain data collection, use, disclosure, and safeguarding for Windsurf and related Cognition AI services under identical terms.
View full change record →

June 12, 2026 low

Windsurf reordered the navigation links in their privacy policy footer on June 12, 2026. The 'Privacy Policy' link moved from its original position to appear after the 'Data Processing Addendum' …

View change record →
June 2, 2026 low

Windsurf removed the 'Windsurf' navigation link from the header menu in their privacy policy document on June 2, 2026. The updated privacy policy header now omits the redundant Windsurf link …

View change record →
Featured, High severity
Featured, Medium severity

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

38 provisions
12 featured
14 clause types
10 high severity
Targeting and Audience Restrictions 2 2 high
AI / Automated Decision-Making 1 1 high
Acceptable Use Restrictions 1 1 high
Disclosure and Transparency Requirements 1 1 high
Stay ahead of the changes

Monitoring

Windsurf has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Stay ahead of the changes

Governance Intelligence

Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.

Cross-platform context

See how other platforms handle Employer Account Sharing for Corporate Email Users and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured July 24, 2026 01:02 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000486
Version ID CA-V-005241
SHA-256 84d6d21dcb0268059e3211ed2dde3f59f8f699a66a524aff6ecb8332dd7c9e3e
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.

Start monitoring → Compare plans