Skip to main content
Platform Review
PricingSign in
← All platforms
Developer / Coding · codeium.com

Codeium (Windsurf)

Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.

Overall riskMEDReviewed 2026-07-20
Creator: low · GRC: medium · Counsel: medium
enterprise band
Severe
creator · pending
Dealbreaker · Training without opt-out
Exhibit A · Privacy Policy · verbatim

To customize your experience with our Services and otherwise improve our Services including, depending on the terms that apply to your use of the Services, using User Content to train, fine tune and improve the models that power our Services.

highest-risk verified finding on training use — tap for the citation
29 verified findings8 policy surfaces1/2 core docs verified

Partially verified: Privacy Policy assessed · Terms of Service pending. Everything below comes only from what was read in full.

Risk triage

Watch: Data retention

Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.

0
high
16
medium
7
low
1/2
docs
Trains on your data?
Training possible — conditions or opt-outs apply
from 2 cited findings
Who owns outputs?
Not yet assessed
no verified finding covers this surface yet
Commercial use?
Not yet assessed
no verified finding covers this surface yet
Every rating:verbatim-citedsnapshot-datedchange-loggedHow we keep ratings honest →
Risk by role
Select a role to tailor the summary and reorder the findings below.

Scores derived from 13 enriched findings — same verbatim citations as below. AI-generated, not legal advice.

What this means for you
  • Codeium (Windsurf)'s training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
  • Data handling is conditional — 4 privacy or retention clauses warrant review before using Codeium (Windsurf) at scale.

Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.

How to read this page: Overall risk rates what Codeium (Windsurf)'s own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.

Creator lens
NOT YET ASSESSED

IP/output assessment pending — terms of service not yet verified This lens receives a band only once its source document has been captured and read in full.

Know where this document lives? Point us to the URL or PDF and the pipeline will verify it.

Enterprise lens
Data use, retention, subprocessors, audit
SEVERE
Dealbreaker — Training without opt-out. Your inputs/outputs are used to train models and the policy provides no way to decline. see the clause

Based on 36 verified, verbatim-cited findings below — read the citations.

Automated assessment against a published rubric — not legal advice.

Partially verifiedDeveloper / Coding

Partially verified — Privacy Policy — Verified (read in full, 29 findings); Terms of Service — Capture pending. Findings below are from fully-read, verified documents only; remaining core documents are pending capture.

Why partial?

Capture blocked

A known core policy document could not be publicly captured after the available capture strategies were tried.

Blocked core document: Terms of Service

Document status
  • Privacy Policy
    Verified - read in full - 29 citationsstaticLast captured 2026-07-20
  • Terms of Service
    Capture blocked - document not publicly capturable
Tier conditions

Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.

plan language
Privacy & data use

Introductory clause that defines the scope of the Privacy Policy, identifies the data controller ('Cognition AI, Inc'), and specifies the covered services and websites to which the policy applies, establishing the definitional framework for all downstream obligations.

" This Privacy Policy explains how Cognition AI, Inc (“ we ”, “ our ” or “ us ”) collect, use, disclose, and safeguard your information when you use visit our website (cognition.com), our software-as-a-service offerings that we make availabl..."
📍 Privacy Policy › “Close”Jump to exact text →
plan language
Privacy & data use

Introductory clause defining the scope and parties of the Privacy Policy, identifying Cognition AI, Inc. as the data controller and specifying the covered Services (website, SaaS products like Devin and Windsurf, associated apps), thereby establishing the legal framework for all downstream data processing obligations and rights.

" This Privacy Policy explains how Cognition AI, Inc (“ we ”, “ our ” or “ us ”) collect, use, disclose, and safeguard your information when you use visit our website (www.cognition.ai), our software-as-a-service offerings that we make avail..."
📍 Privacy Policy › “Close”Jump to exact text →
plan language
Subprocessors & data sharing

Standard M&A transfer clause but broad in scope. Data could pass to entities with materially different privacy practices. No requirement that the successor honor this privacy policy is stated.

"Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are ac..."
📍 § 3 (How and why we share your information)Jump to exact text →
plan language
Subprocessors & data sharing

Restricts the company from selling or sharing personal information with third parties for targeted advertising purposes, including for users under 16, and discloses that service providers receive personal data as necessary to provide Services, incorporating by reference the data categories enumerated in Section 1.

" We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes..."
📍 § 3 (How and why we share your information)Jump to exact text →

Evidence appendix

Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.

High - 0
Medium - 16
Tier-specific - 0
Total citations - 29
Severity
Surface
Document
Tier
Training on your content
CautionHigh
"To customize your experience with our Services and otherwise improve our Services including, depending on the terms that apply to your use of the Services, using User Content to train, fine tune and improve the models that power our Services."
§ 2 (How we use your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Broad grant to use User Content for training and fine-tuning AI models. Relies on 'Legitimate Interests' legal basis rather than consent, which is a weaker basis and can be contested in EEA/UK. The conditional phrase 'depending on the terms' introduces ambiguity about which tiers or plans are subject to this practice.

AI-generated interpretation, not legal advice.

Data retention
CautionHigh
"We retain your personal information as needed to provide our Service to you, comply with legal obligations, or protect ours or others interests. How long we retain personal information includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, or information preservation requirements. We also keep certain information where necessary to protect the safety, security, and integrity of our Services or users. In line with these considerations, we delete information that is no longer needed for the above purposes or when you request deletion of your information."
§ 5 (Retention)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

The absence of defined retention periods makes it impossible for users to predict how long their data (including User Content) will be held. The broad exception for 'protecting interests' could justify extended retention beyond what users would expect.

AI-generated interpretation, not legal advice.

Training on your content
CautionHigh
"Legitimate Interests — specifically, our interest in ensuring you have the best use of the Services To promote safety, security, and integrity of our Services Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Legitimate Interests — specifically, our interest in ensuring and maintain the effective operations and delivery of the Services To comply with legal and regulatory obligations. We may access, read, preserve, and disclose information when we believe it is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental, and other legal requests, court orders, or for disclosure to tax authorities Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us To comply with our legal obligations. Legitimate Interests — specifically, our interest in complying with legal obligations, requests and our corporate responsibilities where we operate To customize your experience with our Services and otherwise improve our Services including, depending on the terms that apply to your use of the Services, using User Content to train, fine tune and improve the models that power our Services. Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, and User Content Legitimate Interests — specifically, it is in our interest to understand how you interact with the Services in order to customize and/or improve our products and Services, and the models that power our Services, and enable accurate and reliable reporting Where not otherwise required by law, and depending on the"
§ 2 (How we use your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Specifies legitimate interests as the legal basis for processing data to ensure service quality, safety, security, and integrity, and to comply with legal and regulatory obligations, including conditions under which the company may access, read, preserve, and disclose user information.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" Contact Information First name, last name, email address, phone number, and company name (if any). User Content Any personal information collected when you use our Services, including personal information that may be provided in the input, file uploads, feedback or output. Additional information and communications you submit to us Any communications that we exchange, including communications with interfaces such as our chatbots, survey responses, or feedback. Account Information Email address, password, GitHub/GitLab or other git provider username. Voice input If you use voice features, we process the audio to generate transcriptions or commands. Audio is deleted after transcription unless otherwise stated. "
Privacy Policy › “Information you provide to us Description”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Enumerates specific categories of personal data collected—contact information, user content (including prompt inputs and outputs), communications, account credentials, and voice input—defining the scope of data subject to the policy's downstream processing and retention obligations.

AI-generated interpretation, not legal advice.

Privacy & data use
CautionHigh
" Depending on where you live, you may be able to exercise certain privacy rights related to your personal information. If any of the rights listed below are not provided for under law for your jurisdiction, we have absolute discretion in providing these rights. Right to access/know and portability : You may have the right to request that we provide you a copy of your personal information held by us, or for details relating to the ways in which we use and disclose your personal information, and how we have used or disclosed your personal information in the past. You may also have the right to request that we provide certain personal information in a structured, commonly used, machine-readable format and make this available to you or a designated third party. Right to deletion/erasure : You may have the right to request to erase your personal information. If you end your Services, we will retain or delete information associated with your account as described in Section 5. Right to rectification/correction : You may have the right to request us to rectify or update any of your personal information that is incomplete or inaccurate. Right to object or restrict processing : You may have the right to restrict or object to us using or transferring your personal information based on our legitimate interests, in the public interest or for direct marketing. We may continue to process your personal information where permitted or required by applicable law. "
§ 8 (Your privacy rights and choices)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Establishes the user's right to withdraw consent to processing, the right to appeal denied privacy requests, and the right to lodge complaints with data protection authorities, while clarifying that withdrawal of consent does not affect the lawfulness of prior processing.

AI-generated interpretation, not legal advice.

Moderation & enforcement
CautionHigh
" We are constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time as well. We post any changes we make to our Privacy Policy on this page and, where appropriate, we will provide you with reasonable notice of any material changes or as otherwise required by law. The date the Privacy Policy was last updated is identified at the top of this page."
Privacy Policy › “Changes to this Privacy Policy”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Establishes the procedure for notifying users of material changes to the Privacy Policy, including posting updates on the website and providing reasonable advance notice where required by law, creating an obligation for timely disclosure of policy amendments.

AI-generated interpretation, not legal advice.

Indemnity & liability
CautionHigh
" We implement commercially reasonable technical, administrative, and organizational measures intended to protect personal information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, these measures are not a guarantee of absolute security and you acknowledge and accept that your use of our Services is ultimately at your own risk."
§ 4 (Security)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Describes commercially reasonable security measures implemented to protect personal information but disclaims any guarantee of absolute security, shifting residual risk of data incidents to the user through an acknowledgment clause.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
"Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be transferred in connection with that transaction."
§ 3 (How and why we share your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Standard M&A transfer clause but broad in scope. Data could pass to entities with materially different privacy practices. No requirement that the successor honor this privacy policy is stated.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
"Third Party Service Providers — We provide personal information to third party service providers who help us provide our Services."
§ 3 (How and why we share your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Broad disclosure to third-party subprocessors without naming them or specifying contractual safeguards imposed on those parties. Users cannot assess the risk posed by specific subprocessors.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
"To our affiliates or others within our corporate group , as a matter of our legitimate interests to efficiently provide the Services."
§ 3 (How and why we share your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Data sharing with affiliates on a Legitimate Interests basis is a weaker legal foundation than consent and may be objected to by EEA/UK users. The breadth of 'others within our corporate group' is undefined.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
" We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old. We work with service providers and other third parties to help us provide our Services, and as a result we need to provide certain information with these third parties as described below. We disclose, and in the past 12 months, we've disclosed, the categories of personal data set forth in Section 1 with the following categories of third parties: Third Party Service Providers — We provide personal information to third party service providers who help us provide our Services. Other Third Parties — Certain features allow you to display or share information with other users or third parties. For example, you may share Devin AI conversations with other users via shared links. Be sure you trust any user or third party with whom you share information. Professional Advisors, authorities, and regulators — We share your information with our advisors, regulators, tax authorities, law enforcement, and government agencies to: Respond pursuant to applicable law or regulations, court orders, legal process or government requests; Comply with our reporting and information sharing obligations and regulatory authorities; Detect, investigate, prevent, or address fraud and other illegal activity or security and technical issues; and Protect the rights, property, safety of us, our users, or others, including to prevent death or imminent bodily harm."
§ 3 (How and why we share your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Restricts the company from selling or sharing personal information with third parties for targeted advertising purposes, including for users under 16, and discloses that service providers receive personal data as necessary to provide Services, incorporating by reference the data categories enumerated in Section 1.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
" We use your personal information to deliver, personalize, operate, improve, create, and develop our Services, to provide you with a secure, smooth, efficient and customized experience as you use our Services, and for legal compliance, and loss prevention. We only use your account password to create and maintain your account and to provide you with the Services. Learn more about how we use your personal information and our legal basis for each such use case below. Why and how we use your information Information categories used Legal basis of processing (where applicable) To create and maintain your account Basic Information and Account Information Necessary to perform our contract with you To provide you with Services Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Necessary to perform our contract with you To provide customer support Basic Information, Account Information, Communications, Services usage data (including location information), App, browser, and device information We rely on our legitimate interests or those of third parties (like other users and in some cases, the general public) where they are not outweighed by your rights and freedoms. In the EEA and UK, you have the right to object to, and seek restrictions of this processing (“Legitimate Interests”) — specifically, our interest in being responsive to your requests and ensuring you have the best use of the Services To send Service communications Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Necessary to perform our contract with you. "
§ 2 (How we use your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Establishes the lawful bases and specific purposes for which personal information is processed (service delivery, personalization, security, legal compliance, loss prevention), creating an obligation to process data only within these stated purposes and introducing the legitimate interests basis for processing.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
"We collect and use your information in order to provide and improve our Services and your experience, protect the security and integrity of our platform, and meet our legal obligations."
Privacy Policy › “Close”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Introductory statement of collection and use purposes. Relatively benign on its own but must be read with the full Section 2 table for operative scope.

AI-generated interpretation, not legal advice.

Privacy & data use
High
" This Privacy Policy explains how Cognition AI, Inc (“ we ”, “ our ” or “ us ”) collect, use, disclose, and safeguard your information when you use visit our website (cognition.com), our software-as-a-service offerings that we make available to individuals and enterprise customers (e.g., Devin and Windsurf), along with any associated software, apps and websites (collectively, the “ Services ”). It is important that you understand how we use your information. You should read this page in full, but below are key highlights and some helpful links: Our goal is to simplify your experience. If you do not wish for your personal information to be collected, used, or disclosed as described in this Privacy Policy, or you are under 18 years of age, you should stop accessing our Services. We collect and use your information in order to provide and improve our Services and your experience, protect the security and integrity of our platform, and meet our legal obligations. To learn more, explore Section 1. Information We Collect and Section 2. How We Use Your Information . We share your information with trusted third parties and service providers in order to offer our Services, fulfill legal requirements and for the purposes set out more fully below. If you have any questions, or to exercise any available rights, please contact us at privacy@cognition.ai ."
Privacy Policy › “Close”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-07-20- View source
Permalink to this finding →
Automated analysis

Introductory clause that defines the scope of the Privacy Policy, identifies the data controller ('Cognition AI, Inc'), and specifies the covered services and websites to which the policy applies, establishing the definitional framework for all downstream obligations.

AI-generated interpretation, not legal advice.

Privacy & data use
High
" circumstances, we may preserve and share your information: in response to requests from third parties, law enforcement, or other governmental authorities; to promote the safety, security, and integrity of the Services, network, our users, employees, and the public Basic Information, Account Information, Communications, App, browser, and device information, Services usage data Legitimate Interests — specifically, it is in our interest and the interest of the general public to prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other harmful or illegal activity; to protect ourselves (including our personnel and property or the Service) our users or others, to defend our legal rights and resolve disputes, to secure our platform and network, to verify accounts and activity, to combat harmful conduct, to prevent and address fraud, abuse and other bad experiences, to prevent death or imminent bodily harm To research and innovate Basic Information, Account Information, Communications, Service Usage Data Legitimate Interests — specifically, it is in our interest and our users interest to improve and iterate our Services through information obtained from users, surveys, reviews, and feedback "
§ 2 (How we use your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-07-20- View source
Permalink to this finding →
Automated analysis

Describes circumstances under which the controller may preserve and share personal information — including in response to third-party, law enforcement, or governmental requests, and to maintain safety and security — specifying the data categories involved and invoking legitimate interests as the legal basis.

AI-generated interpretation, not legal advice.

Subprocessors & data sharing
High
" circumstances, we may preserve and share your information: in response to requests from third parties, law enforcement, or other governmental authorities; to promote the safety, security, and integrity of the Services, network, our users, employees, and the public Basic Information, Account Information, Communications, App, browser, and device information, Services usage data Legitimate Interests — specifically, it is in our interest and the interest of the general public to prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other harmful or illegal activity; to protect ourselves (including our personnel and property or the Service) our users or others, to defend our legal rights and resolve disputes, to secure our platform and network, to verify accounts and activity, to combat harmful conduct, to prevent and address fraud, abuse and other bad experiences, to prevent death or imminent bodily harm To research and innovate Basic Information, Account Information, Communications, Service Usage Data Legitimate Interests — specifically, it is in our interest and our users interest to improve and iterate our Services through information obtained from users, surveys, reviews, and feedback "
§ 2 (How we use your information)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Grants the company permission to preserve and share user information with third parties, law enforcement, and governmental authorities under specified circumstances (fraud prevention, safety, legal compliance), identifying the categories of data that may be shared and the legitimate interests justification.

AI-generated interpretation, not legal advice.

Data retention
FavorableHigh
" Personal information does not include information that has been de-identified, anonymized or aggregated. When data is de-identified or anonymized, we maintain it in that form and do not attempt to re-identify the information."
Privacy Policy › “Information you provide to us Description”Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

Excludes de-identified, anonymized, and aggregated data from the definition of personal information and creates an obligation not to re-identify such data, thereby limiting the scope of data subject to the privacy protections in the policy.

AI-generated interpretation, not legal advice.

Privacy & data use
NeutralHigh
" We collect, and in the past 12 months have collected, the following personal information about you:"
§ 1 (Information we collect)Jump to exact text →
Source: Privacy Policy- Snapshot 2026-06-07- View source
Permalink to this finding →
Automated analysis

States that the company collects, and has collected in the past 12 months, specific personal information, establishing a factual and compliance-oriented disclosure obligation regarding data collection practices.

AI-generated interpretation, not legal advice.

Common questions about Codeium (Windsurf)'s policies

Does Codeium (Windsurf) train its AI models on your data?
Training possible — conditions or opt-outs apply — based on 2 verified findings from Codeium (Windsurf)'s published policy. Informational only, not legal advice.

Clause detail — protections, your obligations, and coverage

Every clause below is a verbatim quote from Codeium (Windsurf)'s own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.

✅ Protections found

3 verified clauses

Clauses in Codeium (Windsurf)'s policies that work in your favour — commitments the platform made to you.

  • Privacy & data use
    Right to withdraw your consent : To the extent processing of your personal information is based on your consent, you may withdraw your consent at any time. The lawfulness of our processing before you withdraw your consent will not be affected by such withdrawa…

    Provides the contact mechanism (privacy@cognition.ai) for submitting privacy rights requests and establishes the procedure for contacting the company with privacy questions or complaints, directing users to lodge regulat…

    • Designated security contact: privacy@cognition.ai
    📍 § 8 (Your privacy rights and choices)Jump to exact text →
  • Moderation & enforcementterms can change anytime
    We are constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time as well. We post any changes we make to our Privacy Policy on this page and, where appropriate, we will provide you with reasonable notice of any m…

    Establishes the procedure for notifying users of material changes to the Privacy Policy, including posting updates on the website and providing reasonable advance notice where required by law, creating an obligation for…

    • Terms changes: advance notice promised
    📍 Privacy Policy › “Changes to this Privacy Policy”Jump to exact text →
  • Data retention
    Personal information does not include information that has been de-identified, anonymized or aggregated. When data is de-identified or anonymized, we maintain it in that form and do not attempt to re-identify the information.

    Excludes de-identified, anonymized, and aggregated data from the definition of personal information and creates an obligation not to re-identify such data, thereby limiting the scope of data subject to the privacy protec…

    📍 Privacy Policy › “Information you provide to us Description”Jump to exact text →

📋 Rules you must follow

0 verified clauses

What Codeium (Windsurf) requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.

No user-conduct rule has been verified in Codeium (Windsurf)'s published policies yet.

What the policies actually cover

6 topics
  • Product telemetry & usage tracking3 clauses
  • Sale or sharing of personal data1 clause
  • Government & law-enforcement disclosure1 clause
  • Trains by default, opt-out available2 clauses
  • Terms can change at any time1 protective1 clause
  • Deletion rights & post-termination survival1 clause

20 further verified clauses are cited on this page but not yet assigned a topic.

Cross-clause notes

Cross-reference

Two verified clauses intersect on the same subject matter: the Privacy Policy, § 5 (Retention) addresses how long content is retained, and the Privacy Policy, § 2 (How we use your information) addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.

Automated cross-reference against the published rubric — not legal advice.

Clause intelligence

Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.

55
clauses
21
patterns
21
stances
privacy sharing · 21
privacy sharingHIGH§ 3 (How and why we share your information)

The clause permits sale of personal data or information.

Your employer or related organisation — If you create an account using an email address belonging or relating to your employer or another organisation, we may share the fact that you have an account and certain account information (such as your email address) with your employer or organisation to, for example, enable you to be added to their business or enterprise account. In addition, administrators of any enterp...
Open source citation
privacy sharingHIGH§ 3 (How and why we share your information)

The clause permits sale of personal data or information.

We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old. We work with service providers and other third parties to help us provide our Services, and as a result we need to pro...
Open source citation
privacy sharingHIGH§ 3 (How and why we share your information)

The clause permits sale of personal data or information.

Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be trans...
Open source citation
privacy sharingHIGH§ 3 (How and why we share your information)

The clause permits sale of personal data or information.

We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old. We work with service providers and other third parties to help us provide our Services, and as a result we need to pro...
Open source citation
privacy sharingHIGH§ 3 (How and why we share your information)

The clause permits sale of personal data or information.

Your employer or related organisation — If you create an account using an email address belonging or relating to your employer or another organisation, we may share the fact that you have an account and certain account information (such as your email address) with your employer or organisation to, for example, enable you to be added to their business or enterprise account. In addition, administrators of any enterp...
Open source citation

Tier matrix

Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.

TierSurfaceVerdictRiskCitations
All applicable tiersprivacy data useconditionalMEDIUM2
All applicable tierssubprocessors data sharingconditionalMEDIUM3
Basicprivacy data useconditionalMEDIUM3
Basicsubprocessors data sharingconditionalMEDIUM1
Enterpriseprivacy data useconditionalMEDIUM2
Pro / Paidsubprocessors data sharingworsensHIGH4
Standardaudit rights dpa residencyconditionalMEDIUM2
Standardprivacy data useconditionalMEDIUM1
Team / Businesssubprocessors data sharingworsensHIGH3

Policy evolution

Open full timeline

Before/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.

Jul 20, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on subprocessors data sharing

The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.
Open timeline citation
Jul 20, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on privacy data use

We use your personal information to deliver, personalize, operate, improve, create, and develop our Services, to provide you with a secure, smooth, efficient and customized experience as you use our Services, and for legal compliance, and loss prevention. We only use your account password to create and maintain your account and to provide you with the Services. Learn more about how we use your personal information and our legal basis for each such use case below. Why and how we use your information Information categories used Legal basis of processing (where applicable) To create and maintain your account Basic Information and Account Information Necessary to perform our contract with you To provide you with Services Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Necessary to perform our contract with you To provide customer support Basic Information, Account Information, Communications, Services usage data (including location information), App, browser, and device information We rely on our legitimate interests or those of third parties (like other users and in some cases, the general public) where they are not outweighed by your rights and freedoms. In the EEA and UK, you have the right to object to, and seek restrictions of this processing (“Legitimate Interests”) — specifically, our interest in being responsive to your requests and ensuring you have the best use of the Services To send Service communications Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Necessary to perform our contract with you.
Open timeline citation
Jul 20, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on privacy data use

This Privacy Policy explains how Cognition AI, Inc (“ we ”, “ our ” or “ us ”) collect, use, disclose, and safeguard your information when you use visit our website (cognition.com), our software-as-a-service offerings that we make available to individuals and enterprise customers (e.g., Devin and Windsurf), along with any associated software, apps and websites (collectively, the “ Services ”). It is important that you understand how we use your information. You should read this page in full, but below are key highlights and some helpful links: Our goal is to simplify your experience. If you do not wish for your personal information to be collected, used, or disclosed as described in this Privacy Policy, or you are under 18 years of age, you should stop accessing our Services. We collect and use your information in order to provide and improve our Services and your experience, protect the security and integrity of our platform, and meet our legal obligations. To learn more, explore Section 1. Information We Collect and Section 2. How We Use Your Information . We share your information with trusted third parties and service providers in order to offer our Services, fulfill legal requirements and for the purposes set out more fully below. If you have any questions, or to exercise any available rights, please contact us at privacy@cognition.ai .
Open timeline citation
Jul 20, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on privacy data use

circumstances, we may preserve and share your information: in response to requests from third parties, law enforcement, or other governmental authorities; to promote the safety, security, and integrity of the Services, network, our users, employees, and the public Basic Information, Account Information, Communications, App, browser, and device information, Services usage data Legitimate Interests — specifically, it is in our interest and the interest of the general public to prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other harmful or illegal activity; to protect ourselves (including our personnel and property or the Service) our users or others, to defend our legal rights and resolve disputes, to secure our platform and network, to verify accounts and activity, to combat harmful conduct, to prevent and address fraud, abuse and other bad experiences, to prevent death or imminent bodily harm To research and innovate Basic Information, Account Information, Communications, Service Usage Data Legitimate Interests — specifically, it is in our interest and our users interest to improve and iterate our Services through information obtained from users, surveys, reviews, and feedback
Open timeline citation
Jul 20, 2026data sharingHIGH

Latest stance: sale or sell on subprocessors data sharing

We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old. We work with service providers and other third parties to help us provide our Services, and as a result we need to provide certain information with these third parties as described below. We disclose, and in the past 12 months, we've disclosed, the categories of personal data set forth in Section 1 with the following categories of third parties: Third Party Service Providers — We provide personal information to third party service providers who help us provide our Services. Other Third Parties — Certain features allow you to display or share information with other users or third parties. For example, you may share Devin AI conversations with other users via shared links. Be sure you trust any user or third party with whom you share information. Professional Advisors, authorities, and regulators — We share your information with our advisors, regulators, tax authorities, law enforcement, and government agencies to: Respond pursuant to applicable law or regulations, court orders, legal process or government requests; Comply with our reporting and information sharing obligations and regulatory authorities; Detect, investigate, prevent, or address fraud and other illegal activity or security and technical issues; and Protect the rights, property, safety of us, our users, or others, including to prevent death or imminent bodily harm.
Open timeline citation
Jul 20, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on subprocessors data sharing

We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old. We work with service providers and other third parties to help us provide our Services, and as a result we need to provide certain information with these third parties as described below. We disclose, and in the past 12 months, we've disclosed, the categories of personal data set forth in Section 1 with the following categories of third parties: Third Party Service Providers — We provide personal information to third party service providers who help us provide our Services. Other Third Parties — Certain features allow you to display or share information with other users or third parties. For example, you may share Devin AI conversations with other users via shared links. Be sure you trust any user or third party with whom you share information. Professional Advisors, authorities, and regulators — We share your information with our advisors, regulators, tax authorities, law enforcement, and government agencies to: Respond pursuant to applicable law or regulations, court orders, legal process or government requests; Comply with our reporting and information sharing obligations and regulatory authorities; Detect, investigate, prevent, or address fraud and other illegal activity or security and technical issues; and Protect the rights, property, safety of us, our users, or others, including to prevent death or imminent bodily harm.
Open timeline citation
Jul 20, 2026data sharingHIGH

Latest stance: sale or sell on subprocessors data sharing

Your employer or related organisation — If you create an account using an email address belonging or relating to your employer or another organisation, we may share the fact that you have an account and certain account information (such as your email address) with your employer or organisation to, for example, enable you to be added to their business or enterprise account. In addition, administrators of any enterprise or business account may be able to access certain information associated with your account, including your User Content, and be able to control your account and such information. To our affiliates or others within our corporate group , as a matter of our legitimate interests to efficiently provide the Services. Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be transferred in connection with that transaction. When you request or direct us to disclose information , with your consent or to perform our contract with you. Our Services may contain links to other websites not operated or controlled by Cognition AI, Inc, including social media services (“Third-Party Sites”).
Open timeline citation
Jul 20, 2026data sharingMEDIUM

Latest stance: third party or vendor sharing on audit rights dpa residency

To facilitate our operations, Cognition, our third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including the EU, UK and the US. If you reside in the EEA, Switzerland, or the United Kingdom, we rely upon certain legal mechanisms to facilitate these transfers of your personal information, including in some cases the European Commission's Standard Contractual Clauses and relevant local clauses (e.g., the UK's International Data Transfer Addendum) to facilitate the international and onward transfer of European personal data to third countries. You can contact us at the address below to view a copy or request more information about these mechanisms.
Open timeline citation

Capture recency

  • Privacy Policy:Last captured 2026-07-20· verified 2026-07-20
  • Terms of Service:Last captured 2026-06-07

Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.

↓ 19 fewer findings this quarter vs last (18 vs 37). First scan: June 2026.

Claim this profile

Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Codeium (Windsurf)'s policies — no human edits the data.

Need this for procurement or legal diligence?

Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.

Know where the missing document lives?

We haven't yet verified Codeium (Windsurf)'s Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.

Every finding above is a verbatim quote from Codeium (Windsurf)'s own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.

📢 POLICY UPDATES ALERT

AIRIN Brief

Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.