Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that privacy rights including access, deletion, correction, objection, and portability are available to users where legally required by jurisdiction, and that the company retains absolute discretion to grant or deny those rights where not legally mandated.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that the availability of privacy rights outside legally mandated jurisdictions is at the company's sole discretion. Users in jurisdictions without comprehensive privacy statutes have no contractual entitlement to exercise the listed rights and may be denied requests at the company's discretion.
Under this clause, the availability of rights including data access, deletion, and objection depends on the user's jurisdiction and applicable law. Users in jurisdictions without statutory privacy rights may submit requests to privacy@cognition.ai but the policy does not guarantee a response or compliance with such requests.
Cross-platform context
See how other platforms handle Jurisdiction-Dependent Privacy Rights at Company Discretion and similar clauses.
Compare across platforms →Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Depending on where you live, you may be able to exercise certain privacy rights related to your personal information. If any of the rights listed below are not provided for under law for your jurisdiction, we have absolute discretion in providing these rights.Excerpt from Windsurf's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Articles 15 through 21 for EEA and UK residents, which establish statutory rights to access, erasure, rectification, objection, and portability. CCPA and its amendments establish parallel rights for California residents. The provision's 'absolute discretion' language applies only where no legal requirement exists, and the company's stated legal compliance obligations would govern in jurisdictions with applicable statutes. 2. GOVERNANCE EXPOSURE: Low to Medium. The discretionary rights language is a commonly observed approach in privacy policies and does not assert authority over legally mandated rights. However, the explicit use of 'absolute discretion' framing may warrant review for adequacy of disclosure under applicable consumer protection frameworks. 3. JURISDICTION FLAGS: EEA, UK, and California users have statutory rights that the policy acknowledges and does not limit. Users in US states without comprehensive privacy statutes have no contractual entitlement to the listed rights under this policy. Jurisdictions with emerging privacy legislation may create new mandatory rights that are not yet reflected in this policy. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying Windsurf for employees in jurisdictions with statutory rights should confirm that the data processing addendum addresses the obligation to assist with data subject rights requests. The 'absolute discretion' provision does not modify obligations arising from DPA commitments. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a current mapping of jurisdictions where statutory privacy rights apply and ensure that request handling procedures address those statutory obligations. The policy's discretionary language should be evaluated for adequacy under any applicable consumer protection disclosure requirements.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that the availability of privacy rights outside legally mandated jurisdictions is at the company's sole discretion. Users in jurisdictions without comprehensive privacy statutes have no contractual entitlement to exercise the listed rights and may be denied requests at the company's discretion.
Under this clause, the availability of rights including data access, deletion, and objection depends on the user's jurisdiction and applicable law. Users in jurisdictions without statutory privacy rights may submit requests to privacy@cognition.ai but the policy does not guarantee a response or compliance with such requests.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.