This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The prohibition shifts all risk of processing such data to the customer and establishes a usage boundary that, if violated, could trigger customer indemnification or termination obligations.
Interpretive note: The clause uses 'such as', indicating the listed data types are examples rather than an exhaustive list; the full scope of prohibited sensitive personal data may be broader than what is enumerated.
The updated terms indicate that Windsurf is now operating as the Cognition Platform under Cognition AI, Inc., replacing the prior Exafunction, Inc. structure. The revised terms state that prior terms continue to govern use for 30 days from the posting date (July 1, 2026), and that continued access after that period constitutes acceptance of the updated terms. Users who do not agree with the new terms are instructed to stop using or accessing the Services. The specific substantive changes to user rights, data collection, fees, or service functionality are not detailed in the provided change summary.
View change record →You are prohibited from inputting or processing medical information or sensitive personal data of the types listed when using Windsurf's Services.
How other platforms handle this
ZipRecruiter does not require any Sensitive Personal Data about you in order for you to utilize the ZipRecruiter Website...please carefully consider the information that is contained within your resume and ensure that you are not providing any sensitive or other information that is not necessary.
The custom audiences you create must comply with Section 1(h).
Therefore, we do not "sell" or "share" data (as defined by applicable law) belonging to minors.
"You agree not to process any medical information or sensitive personal data such as social security numbers, birth dates, passport information, bank account, and credit card numbers in using the Services.Excerpt from Windsurf's Terms of Service
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The prohibition shifts all risk of processing such data to the customer and establishes a usage boundary that, if violated, could trigger customer indemnification or termination obligations.
You are prohibited from inputting or processing medical information or sensitive personal data of the types listed when using Windsurf's Services.
ConductAtlas has identified this type of provision across 245 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.