TL;DR
- Ownership changes can shift who controls data and which policies apply.
- Treat all current terms as unverified until a stable controller is confirmed.
- Use this page as a checklist, not a legal source.
Scope
This page maps the key term areas you must verify for Windsurf. It is a snapshot checklist, not legal advice.
How to use this page
- Start here to understand the ownership context.
- Pick your plan page (Free or Enterprise) and verify each checklist item.
- Re-check monthly or after any ownership or policy update.
What changed recently
See /posts/windsurf-acquisition-collapse-2025/ for the ownership timeline.
Plan map (quick routing)
- Windsurf Free: /verify/windsurf-free-terms/
- Windsurf Enterprise: /verify/windsurf-enterprise-terms/
Terms matrix (auto)
| Plan | Data controller | Retention | Training use | Subprocessors | Model providers | Enterprise DPA |
|---|---|---|---|---|---|---|
| Windsurf Free | Unconfirmed; verify current legal controller in updated terms. (unknown) | Unconfirmed; verify retention window. (unknown) | Unconfirmed; verify whether data is used for training. (unknown) | Unconfirmed; request current subprocessor list. (unknown) | Unconfirmed; verify current model providers. (unknown) | Unconfirmed; ask sales/support about DPA availability. (unknown) |
| Windsurf Enterprise | Unconfirmed; verify controller and entity in enterprise addendum. (unknown) | Unconfirmed; verify retention window in enterprise terms. (unknown) | Unconfirmed; verify training use or opt-out terms. (unknown) | Unconfirmed; request current subprocessor list. (unknown) | Unconfirmed; verify model providers and data routing. (unknown) | Unconfirmed; request DPA or addendum. (unknown) |
Terms snapshot checklist
- Data controller: confirm the legal entity and controller.
- Retention: confirm retention window.
- Training use: confirm whether data is used for model training.
- Subprocessors: request the current list.
- Model providers: confirm which models receive data.
- Enterprise DPA: confirm availability if required.
Evidence / signals
- Current terms/privacy policy showing the controller or owner.
- Subprocessor list or DPA for enterprise accounts.
- Public statements on ownership or model provider routing.
How to verify
- Read the latest terms and privacy policy for the current owner.
- Request a subprocessor list and enterprise addendum if needed.
- Confirm model provider routing and storage regions.
If you already shared data
- Re-evaluate approvals after any ownership change.
- Request updated terms from the current controller.
What would invalidate this
A stable owner publishes updated terms with a recent effective date and a current subprocessor list.