Windsurf uses everything you type into the AI coding assistant — your questions, code snippets, and the AI's responses — to train and improve its AI models.
Your AI prompts and the code outputs generated in response are used by Windsurf to train its AI models, meaning sensitive or proprietary code you type into the tool may be retained and used for this purpose.
Cross-platform context
See how other platforms handle AI Model Training Using Prompts and Outputs and similar clauses.
Compare across platforms →Users may not realize that the code, questions, or sensitive information they submit to the AI tool is being used to train Windsurf's AI models, which could expose proprietary or confidential information.
(1) REGULATORY FRAMEWORK: This provision implicates GDPR Article 6(1)(f) (legitimate interests as legal basis for training), Article 13 (transparency obligation to disclose training use at point of collection), and the emerging EU AI Act transparency requirements for general-purpose AI model providers. For California users, CCPA/CPRA §1798.100 and §1798.121 require disclosure of this use and may require an opt-out if deemed a 'sale' or 'sharing' for cross-context behavioral advertising. The FTC Act Section 5 is engaged if the training use is not adequately disclosed. Enforced by relevant EEA DPAs, ICO, CPPA, and FTC. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.