Windsurf Privacy Policy

This is Windsurf's (Exafunction, Inc.) privacy policy explaining how the company collects and uses your personal data when you use their AI-powered coding assistant, including the IDE extension and website. Most importantly, if you use Windsurf through your employer's enterprise account, your employer's administrators can access your AI prompts and outputs — including the code and questions you type into the tool. If you are an enterprise user, you should assume your employer can see everything you type into Windsurf and act accordingly.

This Privacy Policy, published by Exafunction, Inc. (operating as Windsurf), governs the collection, use, and disclosure of Personal Information for users of the windsurf.com website, downloadable IDE extension, APIs, and related developer services, with legal bases for EU/EEA/UK processing grounded in GDPR Article 6 (consent, contractual necessity, legal obligation, and legitimate interests). The document creates significant obligations including collecting and using Prompts and Outputs (user-submitted code and AI responses) for AI/ML model training, sharing user data with employers or enterprise administrators who may access Prompts and Output Information, and transferring data internationally to the US via Standard Contractual Clauses. Notably, enterprise account administrators are explicitly granted access to individual users' Prompts and Output Information — a provision with material workplace privacy implications that deviates from typical consumer-facing privacy policies — and voice audio is processed and discarded while text transcriptions are retained as Log and Usage Information. The document engages GDPR (Articles 6, 13, 28, 44-46), CCPA/CPRA (California Civil Code §1798.100 et seq.), and state comprehensive privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA); compliance teams should note that the dual role as both data controller and processor — depending on whether enterprise customers are involved — creates layered obligations requiring distinct consent mechanisms and DPA agreements.