Windsurf can record your voice to generate text prompts, then deletes the audio but keeps the text transcript — and that transcript is used like any other usage data, including potentially for AI training.
When you use voice input in Windsurf, your speech is converted to text and that text is retained and used for AI model training and analytics, even though the original audio is deleted after processing.
Cross-platform context
See how other platforms handle Voice Data Processing and similar clauses.
Compare across platforms →Voice data is a sensitive biometric-adjacent data type; while Windsurf says it discards audio, the retained text transcripts are used for AI training and analytics purposes, which may not be what users expect when using voice input.
(1) REGULATORY FRAMEWORK: Voice processing implicates Illinois BIPA (740 ILCS 14/1 et seq.) if voice prints or voiceprints are captured (though conversion to text and discard of audio may exclude BIPA if no biometric identifier is retained). Texas CUBI (Tex. Bus. & Com. Code §503.001) and Washington My Health MY Data Act may also apply. GDPR Article 9 applies if voice data constitutes biometric data used for unique identification. CCPA/CPRA defines 'biometric information' broadly and requires specific disclosure. FTC Act Section 5 applies to inadequate voice data disclosures. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.