Developer / Coding · cursor.shCursor
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless: (1) they are flagged for security review (in which case we may analyze them to improve our ability to detect and enforce our Terms of Service ), (2) you explicitly report them to us (for example, as Feedback), or (3) you’ve explicitly agreed to…”
Watch: audit rights dpa residency
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
EEA and UK users face cross-border data transfers to the US and 'other countries,' which may have lower data protection standards. The policy does not specify which transfer mechanisms are used (e.g., Standard Contractual Clauses), limiting user ability to assess adequacy of protection. No data residency options are offered.
The scope of data capture triggered by Feedback is broader than users might expect — it captures 'the entire exchange,' which could include sensitive code, personal data, or confidential business information shared during a session.
Compelled arbitration removes access to jury trials and class actions. The short opt-out window and requirement to affirmatively opt out place burden on user. Governed by Federal Arbitration Act.
Scores derived from 31 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Cursor's terms explicitly protect your inputs from training use — the policy is affirmatively favorable on this point.
- Your outputs and prompts are explicitly yours — Cursor's terms include affirmatively protective IP language.
- Data handling is conditional — 4 privacy or retention clauses warrant review before using Cursor at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Cursor's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 148 verified, verbatim-cited findings below — read the citations.
Based on 179 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Terms of ServiceVerified - read in full - 83 citationsstaticLast captured 2026-08-14
- Privacy PolicyVerified - read in full - 60 citationsstaticLast captured 2026-07-08
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment discloses that payment information is collected when users access paid products and services, identifying a specific category of personal data collected and the condition triggering its collection.
" Payment Information: We collect your payment information if you seek to access any paid Anysphere products and services."
Permits Anysphere to collect, analyze, and use Usage Data for internal business purposes including security and analytics, and permits disclosure to third parties only in aggregated or de-identified form; defines 'Usage Data' as excluding Content.
" 5.4. Usage Data. Anysphere may: (i) collect, analyze, and otherwise process Usage Data internally for its business purposes, including for security and analytics, to enhance the Service, and for other development and corrective purposes; a..."
Termination-for-any-reason clause gives platform wide discretion over paying customers. The no-refund carve-out on violation termination incentivizes broad enforcement interpretations.
"If you have a Subscription Service, we may terminate the Subscription Service at any time for any other reason. If we exercise this right, we will refund you on a pro rata basis the fees you paid for the remaining portion of your Subscripti..."
Specifies that certain features require fee payment, that fees are non-refundable except as required by law, and that Order Form pricing terms take precedence, establishing financial obligations for paid service tiers.
" 4.1. Paid Services. Certain features of the Service may require you to pay fees. Before you pay any fees, you will have an opportunity to review and accept the fees that you will be charged. Unless otherwise specifically provided for in th..."
This segment imposes an obligation on users to comply with all applicable trade laws, sanctions, and export control laws, and restricts use of the Service in embargoed countries or for prohibited end uses, creating compliance duties and use restrictions with legal consequences.
" 17.6. Export and Trade Controls. You must comply with all applicable trade laws, including sanctions and export control laws. The Service may not be used in or for the benefit of, or exported or re-exported to (a) any U.S. embargoed countr..."
Reserves Anysphere's right to modify or discontinue the Service without notice or liability, and advises users to retain their own copies of Content in case access is lost, disclaiming responsibility for content loss.
" 10. Modification of the Service. Anysphere may modify or discontinue all or any portion of the Service at any time (including by limiting or discontinuing certain features of the Service), temporarily or permanently, without notice to you...."
Imposes an obligation on the user to comply with all applicable trade laws including sanctions and export control laws, restricts use of the Service in embargoed countries or territories or for prohibited individuals or entities, and prohibits use of the Service for end uses or Inputs that are restricted or require government license under applicable trade laws.
" 17.5. Export and Trade Controls. You must comply with all applicable trade laws, including sanctions and export control laws. The Service may not be used in or for the benefit of, or exported or re-exported to (a) any U.S. embargoed countr..."
Establishes Anysphere's obligation to retain personal data only as long as necessary for service operation and legitimate business needs, and identifies factors that determine the appropriate retention period, including purpose, sensitivity, risk, and legal requirements.
" Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The app..."
Clause A requires sending a formal 'Notice of Dispute' by certified mail as the first step before arbitration, while Clause B requires sending a 'Dispute Notice' to initiate an informal meeting as the first step for any dispute, presenting conflicting initial actions.
" 16.3. Pre-Arbitration Dispute Resolution. Anysphere is always interested in resolving disputes amicably and efficiently, and most customer concerns can be resolved quickly and to the customer’s satisfaction by emailing legal@cursor.com . If such efforts prove unsuccessful, a party who intends to seek arbitration must first send to the other, by certified mail, a written Notice of Dispute (“ Notice ”) to Anysphere, Inc., 2261 Market Street STE 86466, San Francisco, CA 94114, with an electronic copy additionally sent to legal@cursor.com . The Notice must (i) describe the nature and basis of the claim or dispute and (ii) set forth the specific relief sought. If Anysphere and you do not resolve the claim within sixty (60) calendar days after the Notice is received, you or Anysphere may commence an arbitration proceeding. During the arbitration, the amount of any settlement offer made by Anysphere or you will not be disclosed to the arbitrator until after the arbitrator determines the amount, if any, to which you or Anysphere is entitled."
" 16.3. Dispute Resolution. Anysphere is always interested in resolving disputes amicably and efficiently, and most customer concerns can be resolved quickly and to the customer’s satisfaction by emailing legal@cursor.com . In the event of a dispute, claim or controversy relating to this Agreement (“ Dispute ”), the Parties will first attempt in good faith to informally resolve the matter. The Party raising the Dispute must notify the other party (“ Dispute Notice ”), who will have thirty (30) days from the date of delivery of the Dispute Notice to propose a time for the Parties to meet to attempt to resolve the Dispute. If the Parties have not resolved the dispute within forty-five (45) days of delivery of the Dispute Notice, either Party may seek to resolve the dispute through litigation as stated in Section 16.1."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date at the top of this page, unless another type of notice is legally required. Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change."
Implied acceptance through continued use following a posted update may not constitute valid consent under GDPR for changes to processing purposes or legal bases. Under GDPR Art. 13/14, material changes to processing require fresh notice and potentially fresh consent. The absence of a required notice period before changes take effect heightens risk for users.
AI-generated interpretation, not legal advice.
"Feedback: While using the Service, you may provide feedback, including ideas and suggestions for improvement or rating a Suggestion in response to an Input (" Feedback "). If you provide Feedback on the Service, we may store the entire exchange as part of your Feedback."
The scope of data capture triggered by Feedback is broader than users might expect — it captures 'the entire exchange,' which could include sensitive code, personal data, or confidential business information shared during a session.
AI-generated interpretation, not legal advice.
" Location Information. For security and performance reasons, for example to detect unusual login activity or provide more useful Suggestions, we may determine the geographic location from which your device accesses our Service using information such as your IP address."
This segment permits Anysphere to determine users' geographic location from IP address for security and performance purposes (e.g., detecting unusual login activity, improving Suggestions), granting a conditional right to process location data.
AI-generated interpretation, not legal advice.
" 1.4. Limitations for Suggestions. You acknowledge that Suggestions are generated automatically by machine learning technology and may be similar to or the same as Suggestions provided to other customers, and no rights to any Suggestions generated, provided, or returned by the Service for or to other customers are granted to you under these Terms. Further, you acknowledge that there are numerous limitations that apply with respect to Suggestions provided by large language and other AI models (each an “AI Model” ), including that (i) Suggestions may contain errors or misleading information, (ii) AI Models are based on predefined rules and algorithms that lack the ability to think creatively and come up with new ideas and can result in repetitive or formulaic content, (iii) AI Models can struggle with understanding the nuances of language, including slang, idioms, and cultural references, (iv) AI Models can struggle with complex tasks that require reasoning, judgment and decision-making, and (v) data used to train AI models may be of poor quality or biased. You agree that you are responsible for evaluating, and bearing all risks associated with, the use of any Suggestions, including any reliance on the accuracy, completeness, or usefulness of Suggestions."
This segment disclaims that users have rights to Suggestions generated for other customers, acknowledges that Suggestions may be non-unique, and warns of inherent limitations of AI-generated outputs including potential errors and misleading information, limiting user rights and Anysphere's implied warranties regarding Suggestions.
AI-generated interpretation, not legal advice.
"Inputs and Suggestions: The Service allows you to submit content (" Inputs "), which generate responses (" Suggestions ") based on your Inputs. If you include personal data or reference external content in your Inputs, we will collect that information and it may be reproduced in the Suggestions we provide."
This clause clarifies that prompt content (including any personal data of third parties) is collected and processed. This raises potential issues under GDPR regarding users acting as data controllers when inputting third-party personal data, and the platform's role as processor of such data.
AI-generated interpretation, not legal advice.
"We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless: (1) they are flagged for security review (in which case we may analyze them to improve our ability to detect and enforce our Terms of Service ), (2) you explicitly report them to us (for example, as Feedback), or (3) you’ve explicitly agreed to their use for such training purposes. You can find instructions in the Service on how to manage your preferences regarding the use of Inputs and Suggestions for training."
Default position is no training use of Inputs/Suggestions, which is user-favorable. However, two automatic exceptions exist (security flagging and explicit user reporting) that could result in content being analyzed without affirmative opt-in. The third exception requires explicit agreement. Users should review and manage training preferences in-Service.
AI-generated interpretation, not legal advice.
"We may use personal data for the following purposes: To provide and maintain the Service, including optional features that enhance functionality and user experience. To create, manage, and administer your account, including facilitating payments and responding to inquiries. To improve and develop the Service and conduct research, including debugging and identifying or repairing issues that impair functionality. To communicate with you, including sending updates, information about the Service, and events. To prevent, detect, and investigate fraud, abuse, security incidents, and violations of our Terms of Service . To comply with legal obligations and protect the rights, safety, privacy, and property of users, Anysphere, or third parties. To investigate and resolve disputes or security issues. To enforce our Terms of Service and other applicable agreements."
The listed purposes are wide-ranging. 'Improve and develop the Service and conduct research' is a commonly broad catch-all that may permit substantial secondary processing. Users should weigh this against jurisdiction-specific rights (e.g., GDPR purpose limitation principle).
AI-generated interpretation, not legal advice.
"We implement commercially reasonable technical and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, please remember that no method of transmission over the Internet or method of electronic storage is completely secure. You should use caution when deciding what information to share with the Service. We are not responsible for any circumvention of privacy settings or security features on the Service or on third-party websites linked through the Service."
'Commercially reasonable' is a weaker security commitment than ISO 27001, SOC 2, or other certifiable standards. The disclaimer of responsibility for circumvention of security features could limit the platform's liability in the event of a breach caused by inadequate controls, which may conflict with GDPR Art. 32 obligations requiring 'appropriate' technical and organisational measures.
AI-generated interpretation, not legal advice.
"If you have a Subscription Service, we may terminate the Subscription Service at any time for any other reason. If we exercise this right, we will refund you on a pro rata basis the fees you paid for the remaining portion of your Subscription Service after termination, provided that if we terminate your access to the Service due to a violation of these Terms, you will not be entitled to any refund."
Termination-for-any-reason clause gives platform wide discretion over paying customers. The no-refund carve-out on violation termination incentivizes broad enforcement interpretations.
AI-generated interpretation, not legal advice.
"To the fullest extent permitted by law, you are responsible for your use of the Service, and you will defend and indemnify Anysphere, its affiliates and each of their respective shareholders, directors, managers, members, officers, employees, consultants, and agents (together, the “ Anysphere Entities ”) from and against any and all liabilities, claims, damages, expenses (including reasonable attorneys’ fees), and other losses arising out of or relating to: (1) your unauthorized use of, or misuse of, the Service; (2) your violation of any portion of these Terms, any representation, warranty, or agreement referenced in these Terms, or any applicable law or regulation; and (3) any claim that your Input violates any third-party intellectual property, publicity, confidentiality, privacy, or other rights. We reserve the right, at our own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you (without limiting your indemnification obligations with respect to that matter), and in that case, you agree to cooperate with our defense of those claims."
User bears full indemnification obligation for a wide range of claims including third-party IP infringement stemming from inputs. Platform's right to assume control of defense without limiting user's financial obligation is particularly one-sided.
AI-generated interpretation, not legal advice.
" 15.2. LIABILITY CAP. TO THE FULLEST EXTENT PERMITTED BY LAW, THE AGGREGATE LIABILITY OF THE ANYSPHERE ENTITIES TO YOU FOR ALL CLAIMS, DAMAGES AND LOSSES ARISING OUT OF OR RELATING TO THESE TERMS, THE SERVICE, AND CONTENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE GREATER OF: (A) THE AMOUNT YOU HAVE PAID TO ANYSPHERE FOR ACCESS TO AND USE OF THE SERVICE IN THE SIX (6) MONTHS PRIOR TO THE EVENT OR CIRCUMSTANCE GIVING RISE TO THE CLAIM OR, IF GREATER, (B) $100. THE FOREGOING LIMITATIONS ARE ESSENTIAL TO THESE TERMS, AND WE WOULD NOT OFFER THE SERVICE TO YOU UNDER THESE TERMS WITHOUT THESE LIMITATIONS. THE LIMITATIONS IN THIS SECTION WILL APPLY EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE."
Caps Anysphere's aggregate liability for all claims to the greater of fees paid in the prior six months or $100, and states this cap is essential to the agreement and a condition of offering the Service.
AI-generated interpretation, not legal advice.
"THE SERVICE AND SUGGESTIONS ARE PROVIDED “AS IS” AND ON AN “AS AVAILABLE” BASIS. ANYSPHERE DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, RELATING TO THE SERVICE AND SUGGESTIONS, INCLUDING: (a) ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, OR NON-INFRINGEMENT; AND (b) ANY WARRANTY ARISING OUT OF COURSE OF DEALING, USAGE, OR TRADE. ANYSPHERE DOES NOT WARRANT THAT THE SERVICE OR SUGGESTIONS WILL BE UNINTERRUPTED, SECURE, OR FREE OF ERRORS, VIRUSES, OR OTHER HARMFUL COMPONENTS, AND ANYSPHERE DOES NOT WARRANT THAT ANY OF THOSE ISSUES WILL BE CORRECTED. YOU AGREE THAT ANY USE OF SUGGESTIONS FROM OUR SERVICE IS AT YOUR SOLE RISK AND YOU WILL NOT RELY ON ANY SUGGESTION AS A SOURCE OF TRUTH."
Comprehensive warranty disclaimer eliminates any implied guarantees about service quality, security, or output reliability. Users cannot rely on outputs as factually accurate, which is significant for a code-generation AI tool.
AI-generated interpretation, not legal advice.
"TO THE FULLEST EXTENT PERMITTED BY LAW, THE AGGREGATE LIABILITY OF THE ANYSPHERE ENTITIES TO YOU FOR ALL CLAIMS, DAMAGES AND LOSSES ARISING OUT OF OR RELATING TO THESE TERMS, THE SERVICE, AND CONTENT, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE GREATER OF: (A) THE AMOUNT YOU HAVE PAID TO ANYSPHERE FOR ACCESS TO AND USE OF THE SERVICE IN THE SIX (6) MONTHS PRIOR TO THE EVENT OR CIRCUMSTANCE GIVING RISE TO THE CLAIM OR, IF GREATER, (B) $100. THE FOREGOING LIMITATIONS ARE ESSENTIAL TO THESE TERMS, AND WE WOULD NOT OFFER THE SERVICE TO YOU UNDER THESE TERMS WITHOUT THESE LIMITATIONS. THE LIMITATIONS IN THIS SECTION WILL APPLY EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL "
Extremely low liability cap limits user recovery to a minimal monetary amount regardless of actual harm. The 'fails of its essential purpose' override removes a common consumer protection backstop.
AI-generated interpretation, not legal advice.
"TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE ANYSPHERE ENTITIES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, OR ANY OTHER INTANGIBLE LOSS) ARISING OUT OF OR RELATING TO THESE TERMS, THE SERVICE, OR CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT ANY ANYSPHERE ENTITY HAS BEEN INFORMED OF THE POSSIBILITY OF DAMAGE."
Excludes the full spectrum of consequential damages across all legal theories. For business users relying on the service, this means no recovery for lost revenue or data losses caused by the platform.
AI-generated interpretation, not legal advice.
" 15.1. NO INDIRECT DAMAGES. TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE ANYSPHERE ENTITIES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, OR ANY OTHER INTANGIBLE LOSS) ARISING OUT OF OR RELATING TO THESE TERMS, THE SERVICE, OR CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT ANY ANYSPHERE ENTITY HAS BEEN INFORMED OF THE POSSIBILITY OF DAMAGE."
This segment excludes indirect, incidental, special, consequential, and punitive damages from Anysphere's liability to the fullest extent permitted by law, significantly restricting the user's available remedies for losses arising from the Terms or Service.
AI-generated interpretation, not legal advice.
"Legal Compliance and Protection of Rights: We may disclose personal data to government authorities or other third parties if we believe doing so is necessary to: (i) comply with applicable laws, regulations, or legal processes, (ii) respond to lawful requests or investigations, (iii) protect the safety, rights, or property of any person, (iv) prevent fraud, security incidents, or other unlawful activity, (v) enforce our Terms of Service or other legal rights, or (vi) protect Anysphere against legal liability."
The enumerated disclosure grounds are standard but the 'protect Anysphere against legal liability' basis effectively allows the company to disclose user data in its own interest in litigation or disputes. No warrant canary or transparency report commitment is mentioned.
AI-generated interpretation, not legal advice.
"Business Transfers: In the event of a merger, acquisition, restructuring, bankruptcy, or other corporate transaction, personal data may be disclosed to counterparties and advisers as part of due diligence or transferred as part of the transaction."
Standard M&A data transfer clause, but users have no control or opt-out right. Post-acquisition, the acquirer's privacy policy may differ materially.
AI-generated interpretation, not legal advice.
"Service Providers and Business Partners: We may disclose personal data to third-party vendors and service providers who support our business operations and help us deliver and improve the Service. This includes third-party hosting, cloud infrastructure, model, analytics, customer support, safety monitoring, communications, payment processing, compliance services, and IT providers. These parties process personal data only as necessary to perform services on our behalf, consistent with our and your instructions and applicable law."
The inclusion of 'model' providers as a subprocessor category is notable for an AI platform — it means user content may be sent to third-party model APIs. The constraint 'only as necessary' is contractual but not independently verifiable by users.
AI-generated interpretation, not legal advice.
Common questions about Cursor's policies
- Does Cursor train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 3 verified findings from Cursor's published policy. Informational only, not legal advice.
- Who owns the content you create with Cursor?
- You own your outputs — based on 4 verified findings from Cursor's published policy. Informational only, not legal advice.
- Can you use Cursor's output commercially?
- Commercial use allowed — based on 1 verified finding from Cursor's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Cursor's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
21 verified clausesClauses in Cursor's policies that work in your favour — commitments the platform made to you.
- Governing law & disputesarbitration & class-action waiver
“16.5. Costs of Arbitration. Payment of all filing, administration, and arbitrator fees (collectively, the “ Arbitration Fees ”) will be governed by the AAA Rules, unless otherwise provided in this Arbitration Agreement. To the extent any Arbitration Fees are n…”
This segment allocates arbitration costs between the parties, providing that unallocated fees are split equally but allowing the arbitrator to waive the user's portion if they demonstrate economic hardship, establishing…
Location: exact-text link only — source has no section structureJump to exact text → - Moderation & enforcementterms can change anytime
“4.2. Pricing. Anysphere reserves the right to determine pricing for the Service. Anysphere will make reasonable efforts to keep pricing information published on the Service up to date. We encourage you to check our pricing page periodically for current pricing…”
Reserves Anysphere's right to determine and change pricing with advance notice, and establishes that continued use after a price change constitutes acceptance of the new pricing.
- Terms changes: advance notice promised
Location: exact-text link only — source has no section structureJump to exact text → - Governing law & disputesarbitration & class-action waiver
“16.8. Future Changes to Arbitration Agreement. Notwithstanding any provision in these Terms to the contrary, Anysphere agrees that if it makes any future change to this Arbitration Agreement (other than a change to the Notice Address) while you are a user of t…”
Grants users the right to reject future changes to the Arbitration Agreement by sending written notice within 30 days, with the effect that the prior version of the Arbitration Agreement will govern any disputes between…
Location: exact-text link only — source has no section structureJump to exact text → - Privacy & data usechildren's data
“Anysphere does not knowingly collect sensitive or special category personal information, such as genetic data, biometric data for the purposes of uniquely identifying a natural person, health information, or religious information. Additionally, Anysphere does…”
This segment restricts Anysphere from knowingly collecting sensitive/special category data (genetic, biometric, health, religious) and data from children under 18, and mandates investigation and deletion of such data if…
📍 Article C (Information We Do Not Collect)Jump to exact text → - Model trainingdoes-not-train
“We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless: (1) they are flagged for security review (in which case we may analyze them to improve our ability to detect and enforce our Terms of Service ),…”
Default position is no training use of Inputs/Suggestions, which is user-favorable. However, two automatic exceptions exist (security flagging and explicit user reporting) that could result in content being analyzed with…
📍 Privacy Policy › “# 2. How we use personal data”Jump to exact text → - Privacy & data use
“Depending on where you live and the laws that apply in your country of residence, you may have certain rights in relation to your personal data. These may include the right to access, delete, correct, or transfer your personal data; to object to or restrict ho…”
Enumerates data subject rights that may apply depending on jurisdiction, including access, deletion, correction, portability, objection, restriction, consent withdrawal, and the right to lodge a complaint with a data pro…
📍 Privacy Policy › “# 6. Your rights and choices”Jump to exact text →
+ 15 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
3 verified clausesWhat Cursor requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcementconduct restrictions
“1.5. Use Restrictions. Except and solely to the extent such a restriction is impermissible under applicable law, you may not: (i) reverse engineer, disassemble, decompile, decode, or otherwise attempt to derive or gain access to the source code, object code or…”
This segment prohibits a broad range of activities including reverse engineering, creating derivative works, reselling, removing proprietary notices, and using the Service to develop competing models or engage in model e…
Location: exact-text link only — source has no section structureJump to exact text → - Moderation & enforcementconduct restrictions
“17.6. Export and Trade Controls. You must comply with all applicable trade laws, including sanctions and export control laws. The Service may not be used in or for the benefit of, or exported or re-exported to (a) any U.S. embargoed country or territory or (b)…”
This segment imposes an obligation on users to comply with all applicable trade laws, sanctions, and export control laws, and restricts use of the Service in embargoed countries or for prohibited end uses, creating compl…
Location: exact-text link only — source has no section structureJump to exact text → - Moderation & enforcement
“federal, state or foreign laws applying specific security standards; or (xi) knowingly permit any third party to do any of the foregoing. You will promptly notify Anysphere of any unauthorized use that comes to your attention and provide reasonable cooperation…”
Continues the use restrictions by prohibiting facilitation of third-party violations and imposing an obligation on users to promptly notify Anysphere of unauthorized use and cooperate in preventing it.
Location: exact-text link only — source has no section structureJump to exact text →
What the policies actually cover
15 topics- Product telemetry & usage tracking15 clauses
- Advertising & tracking2 clauses
- Sale or sharing of personal data1 protective1 clause
- Sensitive data (biometric, location, health)2 clauses
- Children's data1 protective1 clause
- Government & law-enforcement disclosure2 clauses
- Does not train on your content2 protective2 clauses
- Arbitration & class-action waiver3 protective8 clauses
- Damages & liability cap7 clauses
- Indemnity direction2 clauses
- Terms can change at any time1 protective4 clauses
- Deletion rights & post-termination survival1 protective3 clauses
- Auto-renewal & cancel window3 clauses
- Feedback ownership1 clause
- Conduct restrictions2 obligations2 clauses
88 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “# 4. Retention” addresses how long content is retained, and the Privacy Policy, Privacy Policy › “# 2. How we use personal data” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Privacy Policy, § A (Personal data you provide to us directly) describes rights the platform takes in user content, and the Privacy Policy, Privacy Policy › “# 3. How we share personal data” describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
Verified retention clauses point in different directions: the Privacy Policy, Privacy Policy › “# 4. Retention” describes broad or open-ended retention, while the Privacy Policy, Privacy Policy › “# 4. Retention” describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements. The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | governing law disputes | conditional | MEDIUM | 39 |
| All applicable tiers | indemnity liability | worsens | HIGH | 3 |
| All applicable tiers | moderation enforcement | worsens | HIGH | 1 |
| Pro / Paid | moderation enforcement | worsens | HIGH | 2 |
| Team / Business | data retention | conditional | MEDIUM | 5 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“No sale or targeted advertising: We do not “sell” or “share” personal data for cross-contextual behavioral advertising, and we do not process personal data for “targeted advertising” purposes (as those terms are defined under applicable US state privacy laws). We also do not process sensitive personal data for the purposes of inferring characteristics about a consumer.”Before citation
“5.4. Usage Data. Anysphere may: (i) collect, analyze, and otherwise process Usage Data internally for its business purposes, including for security and analytics, to enhance the Service, and for other development and corrective purposes; and (ii) disclose Usage Data to third parties only in an aggregated and/or de-identified form and in a manner that does not identify you. “Usage Data” means technical logs, data, and learnings about Customer’s use of and interactions with the Service, but excludes Content.”After citation
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“5.4. Usage Data. Anysphere may: (i) collect, analyze, and otherwise process Usage Data internally for its business purposes, including for security and analytics, to enhance the Service, and for other development and corrective purposes; and (ii) disclose Usage Data to third parties only in an aggregated and/or de-identified form and in a manner that does not identify you. “Usage Data” means technical logs, data, and learnings about Customer’s use of and interactions with the Service, but excludes Content.”Before citation
“No sale or targeted advertising: We do not “sell” or “share” personal data for cross-contextual behavioral advertising, and we do not process personal data for “targeted advertising” purposes (as those terms are defined under applicable US state privacy laws). We also do not process sensitive personal data for the purposes of inferring characteristics about a consumer.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“No sale or targeted advertising: We do not “sell” or “share” personal data for cross-contextual behavioral advertising, and we do not process personal data for “targeted advertising” purposes (as those terms are defined under applicable US state privacy laws). We also do not process sensitive personal data for the purposes of inferring characteristics about a consumer.”Before citation
“5.4. Usage Data. Anysphere may: (i) collect, analyze, and otherwise process Usage Data internally for its business purposes, including for security and analytics, to enhance the Service, and for other development and corrective purposes; and (ii) disclose Usage Data to third parties only in an aggregated and/or de-identified form and in a manner that does not identify you. “Usage Data” means technical logs, data, and learnings about Customer’s use of and interactions with the Service, but excludes Content.”After citation
Latest stance: liability limited on indemnity liability
“13. Indemnity. To the fullest extent permitted by law, you are responsible for your use of the Service, and you will defend and indemnify Anysphere, its affiliates and each of their respective shareholders, directors, managers, members, officers, employees, consultants, and agents (together, the “ Anysphere Entities ”) from and against any and all liabilities, claims, damages, expenses (including reasonable attorneys’ fees), and other losses arising out of or relating to: (1) your unauthorized use of, or misuse of, the Service; (2) your violation of any portion of these Terms, any representation, warranty, or agreement referenced in these Terms, or any applicable law or regulation; and (3) any claim that your Input violates any third-party intellectual property, publicity, confidentiality, privacy, or other rights. We reserve the right, at our own expense, to assume the exclusive defense and control of any matter otherwise subject to indemnification by you (without limiting your indemnification obligations with respect to that matter), and in that case, you agree to cooperate with our defense of those claims.”Open timeline citation
Latest stance: third party or vendor sharing on training use
“5.4. Usage Data. Anysphere may: (i) collect, analyze, and otherwise process Usage Data internally for its business purposes, including for security and analytics, to enhance the Service, and for other development and corrective purposes; and (ii) disclose Usage Data to third parties only in an aggregated and/or de-identified form and in a manner that does not identify you. “Usage Data” means technical logs, data, and learnings about Customer’s use of and interactions with the Service, but excludes Content.”Open timeline citation
Latest stance: liability limited on indemnity liability
“Please also carefully read the sections below regarding Limitation of Liability and Dispute Resolution, which affect your rights.”Open timeline citation
Latest stance: platform claims or reserves rights on moderation enforcement
“9. Termination . You may stop accessing the Services at any time. We reserve the right to modify, suspend, or discontinue the Services or your access to the Services, in whole or in part, at any time without notice to you. Although we will strive to provide you with reasonable advance notice if we stop offering a Service, there may be urgent situations, such as preventing abuse or addressing security issues or responding to legal requirements, where providing advance notice is not feasible. We will not be liable for any change to or any suspension or discontinuation of the Services or your access to them. If you have a Subscription Service, we may terminate the Subscription Service at any time for any other reason. If we exercise this right, we will refund you on a pro rata basis the fees you paid for the remaining portion of your Subscription Service after termination, provided that if we terminate your access to the Service due to a violation of these Terms, you will not be entitled to any refund. We also may terminate your account if it has been inactive for over a year and you do not have a paid account. If we do, we will provide you with advance notice. Upon termination of these Terms, a Subscription Service, or your access to the Service, we may at our option delete any Content or other data associated with your account. Sections 1.5, 4 (with respect to fees outstanding as of such expiration or termination), 5, and 13-17 will survive any expiration or termination of our Terms or a Subscription Service. If you believe we have suspended or terminated your account in error, you can file an appeal with us by contacting hi@cursor.com .”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-08-14· verified 2026-08-14
- Privacy Policy:Last captured 2026-07-08· verified 2026-07-08
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 55 fewer findings this quarter vs last (232 vs 287). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Cursor's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Cursor's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.