Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that user personal information may be shared during the evaluation of and entry into asset sales, acquisitions, mergers, or other change of control events, including bankruptcy proceedings, without a requirement for separate user consent.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision asserts that personal information across all stated categories may be transferred to third parties in connection with corporate transactions, including during the due diligence evaluation phase. This applies to the full scope of user data described in the policy, including user content, account information, and usage data.
Under this clause, personal information including user content and account data may be transferred to potential or actual acquirers in connection with a merger, acquisition, asset sale, or bankruptcy proceeding. The policy does not specify a consent mechanism or advance notice requirement for such transfers.
Cross-platform context
See how other platforms handle Asset Transfer and Acquisition Data Sharing and similar clauses.
Compare across platforms →Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be transferred in connection with that transaction.Excerpt from Windsurf's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR requirements regarding the legal basis for data transfers in corporate transaction contexts, which may require assessment of whether legitimate interests or contractual necessity adequately supports pre-transaction due diligence sharing. The FTC has addressed data transfers in acquisition contexts, particularly where privacy policies represent material terms. CCPA frameworks may impose notice requirements on the categories of personal information transferred. 2. GOVERNANCE EXPOSURE: Medium. The inclusion of user content in the categories potentially transferable in corporate transactions broadens the scope of this provision relative to policies that limit transaction-related transfers to contact and account information. The policy does not specify whether the acquirer would be bound by this privacy policy or a successor policy. 3. JURISDICTION FLAGS: GDPR-covered users may have objection rights if the transfer is processed under legitimate interests. EU supervisory authorities have scrutinized data transfers in acquisition contexts, particularly in the technology sector. California users may have rights under applicable state frameworks depending on the categories of information transferred. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers with data processing agreements should confirm whether those agreements address change of control scenarios and whether the DPA obligations transfer to a successor entity. B2B contracts should include provisions addressing continuity of data protection commitments in acquisition scenarios. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the policy's disclosure of potential acquisition-related transfers is sufficient under applicable law or whether additional notice mechanisms are required. Data processing agreements should be reviewed for change of control provisions and successor obligations.
This provision asserts that personal information across all stated categories may be transferred to third parties in connection with corporate transactions, including during the due diligence evaluation phase. This applies to the full scope of user data described in the policy, including user content, account information, and usage data.
Under this clause, personal information including user content and account data may be transferred to potential or actual acquirers in connection with a merger, acquisition, asset sale, or bankruptcy proceeding. The policy does not specify a consent mechanism or advance notice requirement for such transfers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.