Windsurf states that users in the US, EEA, Switzerland, and UK have certain data rights under applicable law, including the ability to review, update, or request deletion of their personal data by contacting the company.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy acknowledges regional data rights but exercises them through a contact-us mechanism rather than a self-service portal, meaning the process for exercising rights depends on company response to individual requests.
Interpretive note: The policy states rights exist 'in some regions' without specifying which U.S. states are covered, creating ambiguity for users in states with recently enacted privacy laws.
Users in the US, EEA, Switzerland, and UK can contact Windsurf at privacy@windsurf.com to review, update, or request deletion of their personal data; California residents are directed to a separate California Resident Privacy Notice for state-specific rights.
How other platforms handle this
Managing And Deleting Your Information. You have the right to access, correct, or delete your information in certain circumstances. We store information until it is no longer necessary to provide our Services or until your account is deleted, whichever comes first. You can delete your WhatsApp accou...
These reasons for collecting and processing Personal Data determine and limit what Personal Data we collect and how we use it (section 3. below), how long we store it (section 4. below), who has access to it (section 5. below) and what rights and other control mechanisms are available to you as a us...
You have the right to request access to, correction of, or deletion of your personal information that we hold. You may also request that we restrict processing of your personal information or object to our processing. To exercise these rights, you may contact us at privacy@eufylife.com or through th...
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"In some regions (like the U.S., the EEA, Switzerland and the UK), you have certain rights under applicable data protection laws. ... HOW CAN YOU REVIEW, UPDATE OR DELETE THE DATA WE COLLECT FROM YOU?— Excerpt from Windsurf's Windsurf Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Articles 15-22 (data subject rights including access, rectification, erasure, portability, objection, and restriction of processing), UK GDPR equivalents, CCPA and CPRA rights to know, delete, correct, and opt out, and equivalent rights under other U.S. state comprehensive privacy laws. The FTC and State AGs enforce applicable consumer privacy rights in the US. EEA and UK supervisory authorities enforce GDPR and UK GDPR rights. GOVERNANCE EXPOSURE: Medium. The policy describes rights as existing 'in some regions' without a comprehensive rights matrix, which may create ambiguity for users in states with recently enacted privacy laws. The absence of a self-service data portal means all rights requests are processed through email contact, which creates operational load and may affect timely compliance with statutory response deadlines (e.g., GDPR Article 12's one-month response requirement). JURISDICTION FLAGS: California residents are directed to a separate California Resident Privacy Notice, which is standard CCPA/CPRA practice. EEA and UK users have the right to lodge complaints with their local supervisory authority if rights requests are not fulfilled. States that have enacted comprehensive privacy laws subsequent to this policy's last update date may require evaluation of whether additional rights disclosures are needed. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers acting as data controllers should confirm with Windsurf how data subject rights requests from their employees or end users are handled when Windsurf acts as a processor, and whether rights request fulfillment processes are addressed in the DPA. COMPLIANCE CONSIDERATIONS: Legal teams should assess the company's data subject rights request handling procedures, including response timelines, identity verification processes, and the scope of data covered by deletion requests (including whether Prompts and Outputs, voice transcriptions, and AI training data are subject to erasure).
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy acknowledges regional data rights but exercises them through a contact-us mechanism rather than a self-service portal, meaning the process for exercising rights depends on company response to individual requests.
Users in the US, EEA, Switzerland, and UK can contact Windsurf at privacy@windsurf.com to review, update, or request deletion of their personal data; California residents are directed to a separate California Resident Privacy Notice for state-specific rights.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.