Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement authorizes Cognition to use customer-submitted data, including prompts and outputs, for AI model training by default. Paid-tier subscribers may opt out of this use, which also activates Zero Data Retention with model providers; free-tier subscribers have no opt-out mechanism.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a tiered data governance structure in which the default permission for training data use applies to all customers, with an opt-out right conditioned on paid subscription status. The operational significance is that free-tier users' inputs and outputs may be incorporated into model training without an available mechanism to prevent this under these terms.
The updated terms indicate that Windsurf is now operating as the Cognition Platform under Cognition AI, Inc., replacing the prior Exafunction, Inc. structure. The revised terms state that prior terms continue to govern use for 30 days from the posting date (July 1, 2026), and that continued access after that period constitutes acceptance of the updated terms. Users who do not agree with the new terms are instructed to stop using or accessing the Services. The specific substantive changes to user rights, data collection, fees, or service functionality are not detailed in the provided change summary.
View change record →The agreement authorizes use of Customer Data for model training by default for all users. Under these terms, only paid-tier subscribers can elect to prevent this use and enable Zero Data Retention; free-tier subscribers operate without an equivalent control.
Cross-platform context
See how other platforms handle Model Training Data Use and Opt-Out and similar clauses.
Compare across platforms →Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Cognition may use Customer Data for model training purposes and to improve and enhance the Services. If you subscribe to a paid Service Tier, you may opt out of this use ("Opt-Out"). Following an Opt-Out election: (A) Customer Data will not be used for any other purpose, including training language models; and (B) Zero Data Retention will be enabled with our model providers. For the Teams Service Tier, only an administrator may exercise the Opt-Out.Excerpt from Windsurf's Terms of Service
(1) REGULATORY LANDSCAPE: Default use of customer-submitted data for model training engages GDPR principles of purpose limitation and data minimization, as well as CCPA provisions governing service provider data use restrictions. The EU AI Act may also be relevant depending on how training data use affects system classification. Enforcement authorities include EU data protection supervisory authorities and the California Attorney General. Where the opt-out is the only mechanism for restricting training use, compliance teams should assess whether this satisfies consent or legitimate interest requirements under applicable law. (2) GOVERNANCE EXPOSURE: High. The provision creates a two-tier data governance structure where the default is permissive use for training, and restriction requires an affirmative paid-tier election. For enterprise customers processing business-sensitive or confidential information, failure to identify and exercise the opt-out prior to use may result in that data being incorporated into model training. The Teams tier restriction limiting opt-out to administrators adds an internal access control dependency. (3) JURISDICTION FLAGS: EU and EEA customers are at heightened exposure given GDPR purpose limitation requirements; whether default training use constitutes a compatible purpose or requires explicit consent is a question that applicable regulatory guidance may inform. California customers should assess whether the tiered opt-out structure satisfies CCPA service provider restrictions. Customers in jurisdictions with sector-specific data laws (healthcare, legal, financial services) face additional exposure if regulated data categories are submitted. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should confirm paid-tier status and administrator opt-out activation before onboarding. The Data Processing Addendum at cognition.ai/dpa should be reviewed to determine whether training data use restrictions are addressed at the processor level. B2B contracts downstream of this platform should reflect the training data use terms and opt-out status. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should map data flows to determine whether Customer Data submitted to the platform includes personal data subject to purpose limitation obligations. Administrator-level controls for the Teams tier opt-out should be documented and verified. Ongoing monitoring of opt-out status is warranted given the agreement's modification provisions.
This provision establishes a tiered data governance structure in which the default permission for training data use applies to all customers, with an opt-out right conditioned on paid subscription status. The operational significance is that free-tier users' inputs and outputs may be incorporated into model training without an available mechanism to prevent this under these terms.
The agreement authorizes use of Customer Data for model training by default for all users. Under these terms, only paid-tier subscribers can elect to prevent this use and enable Zero Data Retention; free-tier subscribers operate without an equivalent control.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.