Privacy Policy — September 29, 2026

Use & Processing · Context

Policy covers personal data practices for Anysphere's software, platform, APIs, Documentation and related tools

Anysphere, Inc. says this Privacy Policy explains how it collects, uses, discloses and processes your personal data when you use its software, platform, APIs, Documentation and related tools, including the cursor.com website and related software it makes available to build, deploy, host and manage software projects. The policy calls all of this the "Service".

Supporting quotations

explains how we collect, use, disclose, and process your personal data when you use Anysphere's software, platform, APIs, Documentation, and related tools

and all related software made available by Anysphere to build, deploy, host, and manage software projects

Qualifications & exceptions

• Applies when you use the Service as the policy defines it.
• The policy does not apply where Anysphere acts as a data processor for commercial customers (see the processor exclusion).

Not stated here

• The policy does not list individual Anysphere products or say which of them fall within "related tools" or "related software".

Legal Rights & Agreement Rules · Permission or license

Accessing or using the Service is treated as acknowledging and consenting to these practices

The policy states that by accessing or using the Service you acknowledge you have been informed of, and consent to, Anysphere's practices regarding your personal information and data. The statement is made as part of the introduction and is not limited to particular practices.

Supporting quotations

By accessing or using the Service, you acknowledge you have been informed of and consent to our practices with regard to your personal information and data.

Qualifications & exceptions

• Triggered by accessing or using the Service.
• The policy elsewhere says withdrawal of consent applies where the legal basis for processing is consent, so the statement is not the only basis the policy mentions.

Not stated here

• The policy does not say which legal basis Anysphere relies on for each practice, or how this statement interacts with laws that set their own consent rules.

Cross-references

• contrast (model-proposed): Right to withdraw consent where processing is based on consent; withdrawal does not affect earlier processing — The introduction treats use of the Service as consent to Anysphere's practices, while section 6 gives a right to withdraw consent where processing is based on consent. The policy does not say how the two fit.

Legal Rights & Agreement Rules · Restriction or exception

Policy does not apply where Anysphere processes data as a processor for commercial customers

The policy says it does not apply where Anysphere acts as a data processor and processes personal data on behalf of commercial customers using its commercial services. As an example it gives an employer that has provisioned a Cursor account for you to use at work. Anysphere says its use of that data is governed by its customer agreements covering access to and use of those offerings.

Supporting quotations

this Privacy Policy does not apply where Anysphere acts as a data processor and processes personal data on behalf of commercial customers using our commercial services

Our use of that data is governed by our customer agreements covering access to and use of those offerings.

Qualifications & exceptions

• Applies only where Anysphere acts as a data processor on behalf of commercial customers using commercial services.
• The employer-provisioned account is given as an example, not a complete list.

Not stated here

• The customer agreements that govern that data are not part of this document.
• The policy does not say who decides whether Anysphere is acting as a processor for a given account, or how this exclusion relates to its later statements about business account administrators.

Cross-references

• contrast (model-proposed): With an organization email or business account, details may go to the organization and admins may manage your use — Section 3 says account information may be disclosed to an employer organization and that business account administrators may manage your use, while the introduction excludes data Anysphere processes for commercial customers, such as an employer-provisioned account. The policy does not say which applies to a given account.

Legal Rights & Agreement Rules · Context

Policy shows a last-updated date of October 11, 2026

The page states "Last updated October 11, 2026". The text on the page does not describe what changed in this update.

Supporting quotations

Last updated October 11, 2026

Not stated here

• The policy does not say what changed in this update.
• Section 7 says an effective date is published at the top of the page, but the top of the page shows a last-updated date; the document does not say whether the two are the same.

Linking & Identification · Procedure

Model training information and choices are described in a separate Privacy Overview

A note at the top of the policy tells readers to see Anysphere's Privacy Overview for information about how it collects and uses training information to develop the models that power the Service, and for the choices readers have about that information. This policy points to that document rather than describing that training information itself.

Supporting quotations

For information about how we collect and use training information to develop our models that power the Service, and your choices with respect to that information, please see our Privacy Overview.

Qualifications & exceptions

• The note concerns training information used to develop the models that power the Service.

Not stated here

• The Privacy Overview is not part of this document, so what it says about training information and choices is unknown.
• The policy does not say how the Privacy Overview relates to the rule in section 2 about Inputs and Suggestions and training.

Cross-references

• refers to (model-proposed): Anysphere says it does not train models on Inputs or Suggestions, or let third parties, except in three cases — The note at the top points to a separate Privacy Overview for training information, while section 2 states the no-training rule for Inputs and Suggestions. The policy does not say how the two relate.

Data Access & Collection · Company practice

Anysphere collects data you provide when you create an account or communicate with it, and technical data from your use

Section 1 divides collected data into two groups. Data you provide directly is collected if you create an account to use the Service or communicate with Anysphere. Certain technical data is received automatically when you use the Service. The specific items in each group are described in the cards that follow.

Supporting quotations

We collect personal data if you create an account to use our Service or communicate with us.

When you use the Service, we also receive certain technical data automatically.

Qualifications & exceptions

• Directly provided data: collected if you create an account to use the Service or communicate with Anysphere.
• Technical data: received automatically when you use the Service.

Not stated here

• The word "includes" introduces each list, and the policy does not say whether the lists are exhaustive.

Data Access & Collection · Company practice

Name and email address are collected when you sign up for an account or for information

Anysphere collects identifiers, such as your name and email address, when you sign up for an Anysphere account or to receive information about the Service.

Supporting quotations

Anysphere collects identifiers, such as your name and email address, when you sign up for an Anysphere account or to receive information about our Service.

Qualifications & exceptions

• Collected when you sign up for an account or sign up to receive information about the Service.

Not stated here

• "Such as" means name and email address are examples; the policy does not list every identifier collected.

Charges & Financial Obligations · Company practice

Payment information is collected if you seek paid products or services or initiate payment

Anysphere collects your payment information if you seek to access any paid products and services, or initiate payment for products and services.

Supporting quotations

We collect your payment information if you seek to access any paid products and services, or initiate payment for products and services.

Qualifications & exceptions

• Collected if you seek to access paid products and services or initiate payment.

Not stated here

• The policy does not list what payment information is collected.
• This section does not say whether payment information is collected by Anysphere directly or through payment processors; the sharing section mentions payment processing providers.

Data Access & Collection · Company practice

Personal data you include in Inputs is collected and may be reproduced in Suggestions

The Service lets you submit content, which the policy calls Inputs, and generates responses based on them, which it calls Suggestions. If you include personal data or reference external content in your Inputs, Anysphere says it will collect that information and it may be reproduced in the Suggestions it provides. Section 2 separately limits the use of Inputs and Suggestions for model training.

Supporting quotations

If you include personal data or reference external content in your Inputs, we will collect that information and it may be reproduced in the Suggestions we provide.

We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless

Qualifications & exceptions

• Applies where you include personal data or reference external content in your Inputs.
• Collected information may be reproduced in Suggestions.
• Use of Inputs and Suggestions for training is governed by a separate statement in section 2, which allows three exceptions.

Not stated here

• The policy does not say how long Inputs and Suggestions are kept; section 4 gives only general retention factors.
• The policy does not say whether personal data in referenced external content is treated differently from personal data you type.

Cross-references

• contrast (model-proposed): Anysphere says it does not knowingly collect sensitive or special category information — Anysphere says it does not knowingly collect sensitive information, while also saying it collects personal data you include in Inputs. The policy does not say how sensitive data included in an Input is handled.

Data Access & Collection · Company practice

Your name, contact information and messages are collected when you communicate with Anysphere

If you communicate with Anysphere, it collects your name, contact information and the contents of any messages you send.

Supporting quotations

If you communicate with us, we collect your name, contact information, and the contents of any messages you send.

Qualifications & exceptions

• Applies when you communicate with Anysphere.

Data Access & Collection · Company practice

If you give Feedback, Anysphere may store the entire exchange, and reported exchanges may be used for training

Feedback can include ideas and suggestions for improvement or rating a Suggestion in response to an Input. If you provide Feedback, Anysphere says it may store the entire exchange as part of your Feedback. Section 2 lists reporting Inputs and Suggestions to Anysphere, for example as Feedback, as one of the exceptions to its statement that it does not use them for training.

Supporting quotations

If you provide Feedback on the Service, we may store the entire exchange as part of your Feedback.

(2) you explicitly report them to us (for example, as Feedback)

Qualifications & exceptions

• Applies where you provide Feedback while using the Service.
• "May store" is permissive: the policy does not say it always stores the entire exchange.
• Section 2 treats Inputs and Suggestions you explicitly report to Anysphere, for example as Feedback, as an exception to its no-training statement.

Not stated here

• The policy does not say whether rating a Suggestion counts as explicitly reporting it for the training exception.
• The policy does not say how long Feedback is kept.

Cross-references

• refers to (model-proposed): Inputs and Suggestions may be used for training if flagged for security review, reported to Anysphere, or you agree — Exception (2) in section 2 names reporting Inputs and Suggestions to Anysphere "for example, as Feedback", which is the Feedback section 1 describes storing.

Data Access & Collection · Company practice

Device, browser, IP address and error-log information are received automatically

Your device or browser automatically sends Anysphere information about when and how you install, access or use the Service, which may include device type, browser information, operating system information and mobile network or ISP. Anysphere also collects information about how the Service is performing, including your IP address, browser type and settings, error logs and other ways you interact with the Service.

Supporting quotations

Your device or browser automatically sends us information about when and how you install, access, or use our Service.

This information may depend on your settings and the type of device you use to access the Service.

We collect information about how our Service is performing, including your IP address, browser type and settings, error logs, and other ways that you interact with the Service.

Qualifications & exceptions

• Device information "may include" the listed items and may depend on your settings and the type of device you use.

Not stated here

• The policy does not say which device or browser settings affect what is sent.

Data Access & Collection · Company practice

Usage data includes access times, browsing history, searches and links clicked

Anysphere collects information about your use of the Service, such as dates and times of access, browsing history, search, information about the links you click, pages you view, and other information about how you use the Service and technology on the devices you use to access it.

Supporting quotations

We collect information about your use of the Service, such as the dates and times of access, browsing history, search, information about the links you click, pages you view, and other information about how you use the Service, and technology on the devices you use to access the Service.

Qualifications & exceptions

• Described as information about your use of the Service; the list is introduced by "such as" and is not exhaustive.

Not stated here

• The text does not say whether "browsing history" and "search" are limited to activity within the Service or can include activity elsewhere; it says only that this is information about your use of the Service.
• The policy does not say what "technology on the devices you use" covers.

Data Access & Collection · Company practice

Cookies and similar technologies are used to operate the Service, personalize it and market additional products

Anysphere and its service providers use cookies, pixels, scripts or similar technologies to operate and manage the Service and improve your experience. Anysphere says these technologies help it recognize you, customize or personalize your experience, market additional products or services to you, and analyze and optimize your use of the Service, for example to help maintain your preferences. It points to a Cookie Policy for more details.

Supporting quotations

We and our service providers utilize cookies, pixels, scripts, or similar technologies to operate and manage the Service and improve your experience.

These technologies help us to recognize you, customize or personalize your experience, market additional products or services to you, and analyze and optimize your use of the Service, for example to help maintain your preferences.

Qualifications & exceptions

• Used by Anysphere and its service providers.
• The listed purposes include marketing additional products or services to you.

Not stated here

• The Cookie Policy is linked but not part of this document, so the specific technologies, their durations and any opt-out are unknown.
• The policy does not say which service providers place these technologies.

Cross-references

• referred to by (model-proposed): Personal data may be used to communicate with you, and cookies may be used to market additional products — The marketing purpose in the communicate card comes from the cookies description in section 1.

Data Access & Collection · Company practice

Approximate location may be determined from your IP address for security and performance

For security and performance reasons, for example to detect unusual login activity or provide more useful Suggestions, Anysphere may determine the geographic location from which your device accesses the Service using information such as your IP address.

Supporting quotations

For security and performance reasons, for example to detect unusual login activity or provide more useful Suggestions, we may determine the geographic location from which your device accesses our Service using information such as your IP address.

Qualifications & exceptions

• Stated purposes are security and performance, with detecting unusual login activity and providing more useful Suggestions as examples.
• Uses information "such as" your IP address.

Not stated here

• The policy does not say how precise the determined location is or what information besides the IP address may be used.

Data Access & Collection · Company commitment

Anysphere says it does not knowingly collect sensitive or special category information

Anysphere says it does not knowingly collect sensitive or special category personal information, giving genetic data, biometric data used to uniquely identify a person, health information and religious information as examples.

Supporting quotations

Anysphere does not knowingly collect sensitive or special category personal information, such as genetic data, biometric data for the purposes of uniquely identifying a natural person, health information, or religious information.

Qualifications & exceptions

• Limited to what Anysphere "knowingly" collects.
• The examples are introduced by "such as"; the biometric example is limited to biometric data used for uniquely identifying a natural person.

Not stated here

• Section 1 also says personal data you include in Inputs is collected; the policy does not say how sensitive data included in an Input is handled.

Cross-references

• contrast (model-proposed): Personal data you include in Inputs is collected and may be reproduced in Suggestions — Anysphere says it does not knowingly collect sensitive information, while also saying it collects personal data you include in Inputs. The policy does not say how sensitive data included in an Input is handled.

Account & Service Control · Company commitment

Anysphere says it does not knowingly collect from or direct the Service to children under 18

Anysphere says it does not knowingly collect information from, or direct the Service or content to, children under 18. If it learns or has reason to suspect that a user is under 18, it says it will investigate and, if appropriate, delete the personal data and/or the account.

Supporting quotations

Additionally, Anysphere does not knowingly collect information from or direct any of our Service or content to children under the age of 18.

If we learn or have reason to suspect that a user is under the age of 18, we will investigate and, if appropriate, delete the personal data and/or the account.

Qualifications & exceptions

• Collection limit is stated as "knowingly".
• Deletion follows an investigation and applies "if appropriate".

Not stated here

• The policy does not say how age is determined or what makes deletion appropriate.

Use & Processing · Company practice

Personal data may be used to provide the Service and to administer your account, including payments

Anysphere says it may use personal data to provide and maintain the Service, including optional features that enhance functionality and user experience, and to create, manage and administer your account, including facilitating payments and responding to inquiries. The Service here means the software, platform, APIs, Documentation and related tools the policy defines in its introduction.

Supporting quotations

We may use personal data for the following purposes:

To provide and maintain the Service, including optional features that enhance functionality and user experience.

To create, manage, and administer your account, including facilitating payments and responding to inquiries.

Anysphere's software, platform, APIs, Documentation, and related tools

Qualifications & exceptions

• Stated as purposes for which Anysphere "may" use personal data, not a promise to use data only for these purposes.
• Account administration includes facilitating payments and responding to inquiries.

Not stated here

• The policy does not say which optional features are meant or which personal data each purpose uses.

Use & Processing · Company practice

Personal data may be used to improve and develop the Service and conduct research

Anysphere says it may use personal data to improve and develop the Service and to conduct research, including debugging and identifying or repairing issues that impair functionality.

Supporting quotations

To improve and develop the Service and conduct research, including debugging and identifying or repairing issues that impair functionality.

Qualifications & exceptions

• Stated as something Anysphere "may" do.
• Debugging and repairing functionality issues are given as inclusions, not limits.

Not stated here

• The policy does not say what research is meant or who conducts it, or which personal data are used.
• This purpose is separate from the model-training rule, which treats Inputs and Suggestions differently.

Use & Processing · Company practice

Personal data may be used to communicate with you, and cookies may be used to market additional products

Anysphere says it may use personal data to communicate with you, including sending updates, information about the Service and events. Separately, in the section on cookies, it says cookies and similar technologies help it market additional products or services to you. The list of purposes in this section does not itself say marketing.

Supporting quotations

To communicate with you, including sending updates, information about the Service, and events.

market additional products or services to you

Qualifications & exceptions

• Communications named: updates, information about the Service, and events.
• Marketing of additional products or services is mentioned in the cookies description in section 1, not in this list.

Not stated here

• The policy does not say whether you can opt out of these communications or of cookie-based marketing; the Cookie Policy is linked but not supplied.
• The policy does not say how the cookie-based marketing statement relates to this list of purposes.

Cross-references

• refers to (model-proposed): Cookies and similar technologies are used to operate the Service, personalize it and market additional products — The marketing purpose in the communicate card comes from the cookies description in section 1.

Security & Safeguards · Company practice

Personal data may be used to prevent fraud and security incidents and to resolve disputes

Anysphere says it may use personal data to prevent, detect and investigate fraud, abuse, security incidents and violations of its Terms of Service, and to investigate and resolve disputes or security issues.

Supporting quotations

To prevent, detect, and investigate fraud, abuse, security incidents, and violations of our Terms of Service.

To investigate and resolve disputes or security issues.

Qualifications & exceptions

• Stated as purposes for which Anysphere "may" use personal data.

Not stated here

• The Terms of Service are linked but not part of this document, so what counts as a violation is unknown.

Legal Rights & Agreement Rules · Company practice

Personal data may be used to meet legal obligations, protect rights and safety, and enforce agreements

Anysphere says it may use personal data to comply with legal obligations and to protect the rights, safety, privacy and property of users, Anysphere or third parties. It also says it may use personal data to enforce its Terms of Service and other applicable agreements.

Supporting quotations

To comply with legal obligations and protect the rights, safety, privacy, and property of users, Anysphere, or third parties.

To enforce our Terms of Service and other applicable agreements.

Qualifications & exceptions

• Stated as purposes for which Anysphere "may" use personal data.
• Protection covers users, Anysphere and third parties.

Not stated here

• "Other applicable agreements" is not defined in this document, and the Terms of Service are not supplied.

Use & Processing · Company commitment

Anysphere says it does not train models on Inputs or Suggestions, or let third parties, except in three cases

Anysphere states that it does not use Inputs or Suggestions to train its models, or permit third parties to use them for training, unless one of three listed conditions applies. The statement is limited to Inputs and Suggestions; it does not speak in this sentence to other personal data, and the note at the top of the policy refers readers to a separate Privacy Overview for training information.

Supporting quotations

We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless

Qualifications & exceptions

• Covers Inputs and Suggestions only.
• Covers use by Anysphere and use by third parties it permits.
• Subject to the three conditions in the next card.

Not stated here

• The Privacy Overview is not part of this document, so what it says about training information is unknown.
• The policy does not say whether other personal data, such as usage data, are used for training.

Cross-references

• qualifies (model-proposed): Personal data may be disclosed to service providers and business partners, including model and payment providers — The no-training statement also bars third parties from using Inputs and Suggestions for training, subject to the three conditions, which narrows what model and other providers may do with such data.
• referred to by (model-proposed): Model training information and choices are described in a separate Privacy Overview — The note at the top points to a separate Privacy Overview for training information, while section 2 states the no-training rule for Inputs and Suggestions. The policy does not say how the two relate.
• has exception (model-proposed): Inputs and Suggestions may be used for training if flagged for security review, reported to Anysphere, or you agree — The three conditions in the exceptions card are the "unless" cases of the no-training statement.

Use & Processing · Restriction or exception

Inputs and Suggestions may be used for training if flagged for security review, reported to Anysphere, or you agree

The no-training statement does not apply to Inputs and Suggestions in three cases. (1) They are flagged for security review, in which case Anysphere says it may analyze them to improve its ability to detect and enforce its Terms of Service. (2) You explicitly report them to Anysphere, for example as Feedback. (3) You have explicitly agreed to their use for such training purposes.

Supporting quotations

(1) they are flagged for security review (in which case we may analyze them to improve our ability to detect and enforce our Terms of Service)

(2) you explicitly report them to us (for example, as Feedback)

(3) you’ve explicitly agreed to their use for such training purposes.

Qualifications & exceptions

• Exception (1): flagged for security review; stated purpose is improving detection and enforcement of the Terms of Service.
• Exception (2): you explicitly report them, for example as Feedback.
• Exception (3): you have explicitly agreed to their use for such training purposes.

Not stated here

• The Terms of Service are linked but their text is not supplied here, so what the card cannot say includes what that document treats as a violation.
• The policy does not say who flags Inputs or Suggestions for security review, or what triggers a flag.
• Exception (1) says Anysphere "may analyze them to improve" its detection and enforcement ability; the text does not say whether that analysis counts as training or is limited to those stated purposes.
• The policy does not say how explicit agreement under exception (3) is given or recorded.

Cross-references

• exception to (model-proposed): Anysphere says it does not train models on Inputs or Suggestions, or let third parties, except in three cases — The three conditions in the exceptions card are the "unless" cases of the no-training statement.
• referred to by (model-proposed): If you give Feedback, Anysphere may store the entire exchange, and reported exchanges may be used for training — Exception (2) in section 2 names reporting Inputs and Suggestions to Anysphere "for example, as Feedback", which is the Feedback section 1 describes storing.

Use & Processing · User right or choice

The Service has instructions for managing your preferences on use of Inputs and Suggestions for training

Anysphere says you can find instructions in the Service on how to manage your preferences regarding the use of Inputs and Suggestions for training.

Supporting quotations

You can find instructions in the Service on how to manage your preferences regarding the use of Inputs and Suggestions for training.

Qualifications & exceptions

• The instructions are said to be inside the Service.

Not stated here

• The instructions are not part of this document, so what choices exist and whether they apply to all three exceptions is unknown.

Use & Processing · Permission or license

Personal data may be aggregated or de-identified and used for the same purposes

Anysphere says it may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above, such as analyzing how the Service is used, improving or adding features, and conducting research.

Supporting quotations

We may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above, such as analyzing how the Service is used, improving or adding features, and conducting research.

Qualifications & exceptions

• Applies to information that no longer identifies you.
• Purposes are those described above, with analysis, feature improvement and research as examples.

Not stated here

• The policy does not say how de-identification is performed or what standard it meets.

Cross-references

• referred to by (model-proposed): Data no longer needed is deleted, erased, de-identified or anonymized under procedures Anysphere and providers follow — Section 4 lists de-identification as an outcome when data is no longer needed, and section 2 says de-identified information may be used for the described purposes.

Use & Processing · Company commitment

Anysphere says it will keep de-identified information de-identified, except as required by law

Anysphere states that it will maintain de-identified information in its de-identified form and will not attempt to reidentify it, except as required by law.

Supporting quotations

We will maintain de-identified information in its de-identified form and will not attempt to reidentify it, except as required by law.

Qualifications & exceptions

• Exception: as required by law.

Not stated here

• The policy does not say whether the commitment extends to third parties that receive de-identified information.

Sharing & Disclosure · Company practice

Personal data may be disclosed to service providers and business partners, including model and payment providers

Anysphere says it may disclose personal data to third-party vendors and service providers that support its business operations and help it deliver and improve the Service. The listed types include hosting, cloud infrastructure, model, analytics, customer support, safety monitoring, communications, payment processing, compliance services and IT providers. It says these parties process personal data only as necessary to perform services on its behalf, consistent with its and your instructions and applicable law.

Supporting quotations

We may disclose personal data to third-party vendors and service providers who support our business operations and help us deliver and improve the Service.

This includes third-party hosting, cloud infrastructure, model, analytics, customer support, safety monitoring, communications, payment processing, compliance services, and IT providers.

These parties process personal data only as necessary to perform services on our behalf, consistent with our and your instructions and applicable law.

or permit third parties to use them for training

Qualifications & exceptions

• Stated as "may" disclose.
• Providers are said to process data only as necessary to perform services on Anysphere's behalf, consistent with Anysphere's and your instructions and applicable law.
• Section 2 states that Anysphere does not permit third parties to use Inputs or Suggestions for training, subject to three exceptions.

Not stated here

• No providers are named in this section, and the list of subprocessors linked in this policy is for commercial uses.
• The policy does not say which personal data, for example Inputs, are disclosed to model providers.
• The policy does not say what "your instructions" refers to.

Cross-references

• qualified by (model-proposed): Anysphere says it does not train models on Inputs or Suggestions, or let third parties, except in three cases — The no-training statement also bars third parties from using Inputs and Suggestions for training, subject to the three conditions, which narrows what model and other providers may do with such data.

Sharing & Disclosure · Company practice

Personal data may be disclosed or transferred in a merger, acquisition or similar transaction

In a merger, acquisition, restructuring, bankruptcy or other corporate transaction, the policy says personal data may be disclosed to counterparties and advisers as part of due diligence, or transferred as part of the transaction.

Supporting quotations

In the event of a merger, acquisition, restructuring, bankruptcy, or other corporate transaction, personal data may be disclosed to counterparties and advisers as part of due diligence or transferred as part of the transaction.

Qualifications & exceptions

• Triggered by a merger, acquisition, restructuring, bankruptcy or other corporate transaction.
• Disclosure to counterparties and advisers is described as part of due diligence.

Not stated here

• The policy does not say whether you would be notified or given any choice, or whether the recipient must follow this policy.

Sharing & Disclosure · Company practice

Personal data may be disclosed to authorities or others when Anysphere believes it is necessary for six listed reasons

Anysphere says it may disclose personal data to government authorities or other third parties if it believes doing so is necessary to: comply with laws, regulations or legal processes; respond to lawful requests or investigations; protect the safety, rights or property of any person; prevent fraud, security incidents or other unlawful activity; enforce its Terms of Service or other legal rights; or protect Anysphere against legal liability.

Supporting quotations

We may disclose personal data to government authorities or other third parties if we believe doing so is necessary to: (i) comply with applicable laws, regulations, or legal processes, (ii) respond to lawful requests or investigations, (iii) protect the safety, rights, or property of any person, (iv) prevent fraud, security incidents, or other unlawful activity, (v) enforce our Terms of Service or other legal rights, or (vi) protect Anysphere against legal liability.

Qualifications & exceptions

• The test is Anysphere's belief that disclosure is necessary.
• Recipients are government authorities or other third parties.
• Six listed reasons, including protecting Anysphere against legal liability.

Not stated here

• The Terms of Service are linked but their text is not supplied here, so what enforcement of them covers is unknown.
• The policy does not say whether you are notified of such disclosures or whether Anysphere requires a legal request before disclosing.

Sharing & Disclosure · Company practice

Personal data may be shared with affiliates, which may use it consistently with this policy

Anysphere says it may share personal data with affiliates, meaning entities that control, are controlled by, or are under common control with it. The policy says they may use personal data in a manner consistent with this Privacy Policy.

Supporting quotations

We may share personal data with affiliates, meaning an entity that controls, is controlled by, or is under common control with, us. They may use personal data in a manner consistent with this Privacy Policy.

Qualifications & exceptions

• Affiliate is defined as an entity that controls, is controlled by, or is under common control with Anysphere.
• Affiliates' use is described as consistent with this Privacy Policy.

Not stated here

• The policy does not name affiliates or say where they are located.

Sharing & Disclosure · Company practice

If you choose to interact with third-party integrations, your data may be disclosed to them under their own terms

The Service may include integrations with or links to third-party websites, applications or services. If you choose to interact with these third parties, the policy says your personal data may be disclosed to them directly and governed by their own terms and privacy policies. Linking or integrating with a third party does not imply endorsement or affiliation.

Supporting quotations

If you choose to interact with these third parties, your personal data may be disclosed to them directly and governed by their own terms and privacy policies.

Our linking or integrating with a third party does not imply endorsement or affiliation.

Qualifications & exceptions

• Applies if you choose to interact with the third party.
• Disclosure may be direct, and the third party's own terms and privacy policies govern.
• Linking or integrating does not imply endorsement or affiliation.

Not stated here

• The third parties' terms and privacy policies are not part of this document.

Sharing & Disclosure · Company practice

With an organization email or business account, details may go to the organization and admins may manage your use

If you create an account using an email associated with an organization, such as your employer, Anysphere says it may disclose account-related information, such as your email address and account status, to that organization. If you are part of a business or enterprise account, administrators may access and manage your use of the Service.

Supporting quotations

If you create an account using an email associated with an organization (e.g., your employer), we may disclose account-related information (such as your email address and account status) to that organization.

If you're part of a business or enterprise account, administrators may access and manage your use of the Service.

Qualifications & exceptions

• First statement applies to accounts created with an email associated with an organization.
• Second statement applies to business or enterprise accounts.
• Disclosed items are "account-related information (such as your email address and account status)".

Not stated here

• The policy does not say what "access and manage your use" covers, for example whether administrators can see Inputs or Suggestions.
• The introduction says the policy does not apply where Anysphere acts as a data processor for commercial customers, for example an employer-provisioned account; the policy does not say how that exclusion relates to this statement.

Cross-references

• contrast (model-proposed): Policy does not apply where Anysphere processes data as a processor for commercial customers — Section 3 says account information may be disclosed to an employer organization and that business account administrators may manage your use, while the introduction excludes data Anysphere processes for commercial customers, such as an employer-provisioned account. The policy does not say which applies to a given account.

Sharing & Disclosure · Context

Information you share with other users or third-party applications is subject to their terms

Certain features of the Service may let you share Inputs, Suggestions or other content with other users or third-party applications. The policy says any information you voluntarily share with those parties is subject to their respective terms and privacy policies.

Supporting quotations

Certain features of the Service may allow you to share Inputs, Suggestions, or other content with other users or third-party applications. Any information you voluntarily share with those parties is subject to their respective terms and privacy policies.

Qualifications & exceptions

• Applies to information you voluntarily share through sharing features.
• Recipients' own terms and privacy policies apply.

Not stated here

• The policy does not name the features that allow sharing or say what Anysphere keeps about such sharing.

Sharing & Disclosure · Company practice

Personal data may be disclosed when you give permission

Anysphere says it may disclose personal data when you give it permission to do so, including through features of the Service that are designed to share information.

Supporting quotations

We may disclose personal data when you give us permission to do so, including through features of the Service that are designed to share information.

Qualifications & exceptions

• Requires your permission.
• Includes features designed to share information.

Not stated here

• The policy does not describe how permission is given or withdrawn for this kind of sharing.

Sharing & Disclosure · Procedure

For commercial uses where Anysphere is a processor, a subprocessor list is available at a linked address

For commercial uses of the Service where Anysphere acts as a data processor, the policy says you can review the third parties it engages at a trust.cursor.com subprocessors page. The list itself is not part of this document.

Supporting quotations

For commercial uses of the Service where Anysphere acts as a data processor, you can review the third parties we engage on at

Qualifications & exceptions

• Applies to commercial uses where Anysphere acts as a data processor.

Not stated here

• The subprocessor list is on a linked page that is not part of this document, so the named third parties are unknown.
• The policy does not say whether a comparable list exists for uses outside the commercial processor case.

Retention & Deletion · Company practice

Personal data is kept only as long as necessary for operating the Service and legitimate business needs

Anysphere says it retains personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution and enforcement of its agreements. It says the appropriate retention period varies with the purpose for which the data was collected, its sensitivity, the potential risks of its use or exposure, and any applicable legal requirements.

Supporting quotations

Anysphere retains your personal data only for as long as necessary to operate the Service effectively and to support legitimate business needs such as legal compliance, safety, dispute resolution, and enforcement of our agreements.

The appropriate retention period varies depending on the purpose for which the personal data was collected, its sensitivity, potential risks associated with its use or exposure, and any applicable legal requirements.

Qualifications & exceptions

• Business needs named are examples ("such as").
• Period varies by purpose, sensitivity, risk and legal requirements.

Not stated here

• The policy gives no specific retention periods for any category of data, including Inputs, Suggestions, Feedback or logs.

Retention & Deletion · Company practice

Some temporary interactions may be stored briefly for safety and monitoring and not appear in your history

The policy says your settings may influence how long certain data is kept. For instance, some temporary interactions with the Service may not appear in your history and could be stored for a limited duration for purposes related to safety and system monitoring.

Supporting quotations

Your settings may also influence how long we keep certain types of data.

some temporary interactions with the Service may not appear in your history and could be stored for a limited duration for purposes related to safety and system monitoring

Qualifications & exceptions

• Given as an instance of settings influencing retention; "some" and "could be" are not definite.
• Stated purposes are safety and system monitoring.

Not stated here

• The policy does not say which interactions are temporary, which settings affect retention, or what the "limited duration" is.

Retention & Deletion · Company commitment

Data no longer needed is deleted, erased, de-identified or anonymized under procedures Anysphere and providers follow

Anysphere says that when personal data is no longer needed, it and its service providers will follow procedures to delete, erase, de-identify or anonymize it, in compliance with applicable laws. Section 2 says de-identified information may be kept and used for the purposes described there.

Supporting quotations

When personal data is no longer needed, Anysphere and its service providers will follow procedures to delete, erase, de-identify, or anonymize it in compliance with applicable laws.

We may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above

Qualifications & exceptions

• Triggered when personal data is no longer needed.
• Four outcomes are listed: delete, erase, de-identify or anonymize.
• Carried out in compliance with applicable laws.
• De-identified information may continue to be used under section 2.

Not stated here

• The procedures and timing are not described.
• The policy does not say which of the four outcomes applies to which data.

Cross-references

• refers to (model-proposed): Personal data may be aggregated or de-identified and used for the same purposes — Section 4 lists de-identification as an outcome when data is no longer needed, and section 2 says de-identified information may be used for the described purposes.

Security & Safeguards · Company commitment

Anysphere uses commercially reasonable security measures but says no method is completely secure

Anysphere says it implements commercially reasonable technical and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration or destruction. It cautions that no method of transmission over the Internet or electronic storage is completely secure and that you should use caution when deciding what information to share with the Service.

Supporting quotations

We implement commercially reasonable technical and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

However, please remember that no method of transmission over the Internet or method of electronic storage is completely secure. You should use caution when deciding what information to share with the Service.

Qualifications & exceptions

• Measures are described as "commercially reasonable" and "designed to" protect, not as guaranteeing protection.
• Anysphere cautions that no transmission or storage method is completely secure.

Not stated here

• The measures are not described.

Security & Safeguards · Restriction or exception

Anysphere says it is not responsible for circumvention of privacy settings or security features

Anysphere says it is not responsible for any circumvention of privacy settings or security features on the Service or on third-party websites linked through the Service.

Supporting quotations

We are not responsible for any circumvention of privacy settings or security features on the Service or on third-party websites linked through the Service.

Qualifications & exceptions

• Covers circumvention of privacy settings or security features, on the Service and on linked third-party websites.

Not stated here

• The policy does not say who may circumvent these features or whether the statement applies when the circumvention results from Anysphere's own conduct.

Legal Rights & Agreement Rules · User right or choice

Depending on where you live, you may have rights over your personal data

The policy says that, depending on where you live and the laws that apply in your country of residence, you may have certain rights in relation to your personal data. These may include the rights to access, delete, correct or transfer your personal data, to object to or restrict how it is processed, to withdraw consent where processing is based on consent, and to lodge a complaint with your local data protection authority. A later list says the rights available to you may include the ones described in the following cards.

Supporting quotations

Depending on where you live and the laws that apply in your country of residence, you may have certain rights in relation to your personal data.

You may also have the right to lodge a complaint with your local data protection authority.

The rights available to you may include:

Qualifications & exceptions

• Rights depend on where you live and the laws that apply.
• The language is "may" throughout; the policy does not promise every right to every user.

Not stated here

• The policy does not say which locations or laws give which rights.
• The policy does not say whether Anysphere offers these rights to users outside places where law requires them.

Legal Rights & Agreement Rules · Procedure

Rights requests go to hi@cursor.com; identity may be verified and denials can be appealed by email

To exercise any of these rights, you or your authorized agent may contact Anysphere at its privacy email address, hi@cursor.com. Anysphere may request information to verify your identity before processing your request. If it denies your request, you may appeal by emailing the same address. Anysphere says it will not discriminate against you for exercising any privacy rights available under applicable law.

Supporting quotations

To exercise any of these rights, you or your authorized agent may contact us at hi@cursor.com.

We may request information to verify your identity before processing your request.

If we deny your request, you may appeal by emailing the same address.

Anysphere will not discriminate against you for exercising any privacy rights available under applicable law.

Qualifications & exceptions

• Requests can come from you or your authorized agent.
• Anysphere may ask for information to verify your identity.
• Appeals are by email to the same address.
• Non-discrimination applies to privacy rights available under applicable law.

Not stated here

• The policy does not state response timeframes, what identity verification requires, or how an authorized agent is verified or appeal decided.

Legal Rights & Agreement Rules · User right or choice

Right to know the categories of data collected, purposes of use and types of third parties it is shared with

Among the rights that may be available to you is the right to know what categories of personal data Anysphere collects, the purposes for which it uses them, and the types of third parties with whom it shares them.

Supporting quotations

Right to know what categories of personal data we collect, the purposes for which we use it, and the types of third parties with whom we share it.

Qualifications & exceptions

• Listed as a right that "may" be available, subject to where you live and the laws that apply.

Not stated here

• The right is to categories and types; the policy does not say you can learn the specific third parties.

Legal Rights & Agreement Rules · User right or choice

Right to request a copy of your personal data and, where applicable, in a portable format

The rights that may be available include access and portability: you can request a copy of the personal data Anysphere holds about you and, where applicable, ask it to provide that data in a portable format.

Supporting quotations

Access and portability, meaning you can request a copy of the personal data we hold about you and, where applicable, ask us to provide it in a portable format.

Qualifications & exceptions

• Portable format is available "where applicable".
• Subject to where you live and the laws that apply.

Not stated here

• The policy does not say what format is used or when portability applies.

Legal Rights & Agreement Rules · User right or choice

Right to deletion of data collected from you through use of the Service, subject to certain exceptions

The rights that may be available include deletion of personal data collected from you in connection with your use of the Service, subject to certain exceptions.

Supporting quotations

Deletion of personal data collected from you in connection with your use of the Service, subject to certain exceptions.

Qualifications & exceptions

• Limited to personal data collected from you in connection with your use of the Service.
• Subject to certain exceptions.

Not stated here

• The policy does not list the exceptions to deletion, so they are unknown. Section 4 says data may be kept for legal compliance, safety, dispute resolution and enforcement of agreements, but the policy does not say these are the deletion exceptions.
• The policy does not say whether deletion also reaches data held by service providers or already de-identified.

Legal Rights & Agreement Rules · User right or choice

Right to correction of inaccurate personal data, but accuracy of Suggestions is not guaranteed

The rights that may be available include correction of inaccurate personal data Anysphere maintains about you. The policy adds that, due to the nature of its models, it makes reasonable efforts to address correction requests but cannot guarantee the accuracy of Suggestions generated by the Service.

Supporting quotations

Correction of inaccurate personal data we maintain about you.

while we’ll make reasonable efforts to address correction requests, due to the nature of our models, we cannot guarantee the accuracy of Suggestions generated by the Service

Qualifications & exceptions

• Anysphere commits to reasonable efforts on correction requests, not to a particular result.
• No guarantee of the accuracy of Suggestions, because of the nature of its models.

Not stated here

• The policy does not say whether a correction request can change a Suggestion that has already been generated.

Legal Rights & Agreement Rules · User right or choice

Rights to object to certain processing and to restrict processing in limited circumstances

The rights that may be available include objecting to certain types of processing, where Anysphere says it will stop processing unless it has legitimate legal grounds to continue, and restricting its processing of your personal data in limited circumstances, such as while a correction request is pending.

Supporting quotations

Objection to certain types of processing. Where applicable, we will stop processing unless we have legitimate legal grounds to continue.

Restriction of our processing of your personal data in limited circumstances, such as while a correction request is pending.

Qualifications & exceptions

• Objection applies "where applicable" and to certain types of processing; Anysphere may continue if it has legitimate legal grounds.
• Restriction applies only in limited circumstances; a pending correction request is the example given.

Not stated here

• The policy does not say which types of processing can be objected to or which other circumstances allow restriction.

Legal Rights & Agreement Rules · User right or choice

Right to withdraw consent where processing is based on consent; withdrawal does not affect earlier processing

The rights that may be available include withdrawal of consent, where the legal basis for Anysphere's processing is consent. Withdrawal does not affect the lawfulness of prior processing. The introduction also says that by accessing or using the Service you consent to Anysphere's practices.

Supporting quotations

Withdrawal of consent, where the legal basis for our processing is based on your consent. Withdrawal does not affect the lawfulness of prior processing.

By accessing or using the Service, you acknowledge you have been informed of and consent to our practices with regard to your personal information and data.

Qualifications & exceptions

• Only where the legal basis for processing is consent.
• Does not affect the lawfulness of processing before withdrawal.

Not stated here

• The policy does not say which processing relies on consent as its legal basis, or how consent is withdrawn.
• The policy does not say how this right relates to the statement in the introduction that using the Service means you consent to its practices.

Cross-references

• contrast (model-proposed): Accessing or using the Service is treated as acknowledging and consenting to these practices — The introduction treats use of the Service as consent to Anysphere's practices, while section 6 gives a right to withdraw consent where processing is based on consent. The policy does not say how the two fit.

Inference & Profiling · Company commitment

Anysphere says it makes no decisions based solely on automated processing with legal or similarly significant effects

Anysphere says it does not make decisions based solely on automated processing that impact your legal rights or have similarly significant effects, such as on your healthcare or financial circumstances.

Supporting quotations

No automated decisions: Anysphere does not make decisions based solely on automated processing that impact your legal rights or has similarly significant effects (e.g. your healthcare or financial circumstances).

Qualifications & exceptions

• Limited to decisions based solely on automated processing.
• Limited to decisions that impact legal rights or have similarly significant effects; healthcare and financial circumstances are examples.

Not stated here

• The policy does not say how decisions that combine automated processing with human involvement are treated.

Inference & Profiling · Company commitment

Anysphere says it does not process sensitive personal data to infer characteristics about a consumer

Anysphere says it does not process sensitive personal data for the purposes of inferring characteristics about a consumer.

Supporting quotations

We do not process sensitive personal data for the purposes of inferring characteristics about a consumer.

Qualifications & exceptions

• Limited to processing for the purpose of inferring characteristics about a consumer.

Not stated here

• The policy does not define sensitive personal data in this statement; section 1 gives examples in a separate statement about what it does not knowingly collect.
• The statement does not address processing sensitive data for other purposes.

Use & Processing · Company practice

Data is processed on servers in various jurisdictions, including the United States, with the same protections applied

Anysphere says it processes your personal data for the purposes described in the policy on servers located in various jurisdictions, including the United States. It says that although data protection laws vary by country, it applies the protections in this policy to your personal data regardless of where it is processed, and that it transfers data only in accordance with legally valid transfer mechanisms.

Supporting quotations

Anysphere processes your personal data for the purposes described in this Privacy Policy on servers located in various jurisdictions, including in the United States.

While data protection laws vary by country, we apply the protections outlined in this policy to your personal data regardless of where it is processed, and we only transfer data in accordance with legally valid transfer mechanisms.

Qualifications & exceptions

• Protections in the policy are applied regardless of where data is processed.
• Transfers are stated to follow legally valid transfer mechanisms.

Not stated here

• The jurisdictions other than the United States are not named.
• The transfer mechanisms are not named.

Use & Processing · Company practice

For EEA users, data may be transferred to the US and other countries, with adequate protection required

For users in the European Economic Area, the policy says personal data may be transferred to Anysphere's United States servers and to other countries outside the EEA and the UK. Where information is transferred outside the EEA or the UK, Anysphere says it requires an adequate level of data protection. The sentence about where the data may go reads "to our United States servers to other countries outside the EEA and the UK"; the text does not say whether the United States servers and the other countries are two destinations or one chain, and this card does not resolve that.

Supporting quotations

For users in the European Economic Area, (“EEA”), when you access our Service, your personal data may be transferred to our United States servers to other countries outside the EEA and the UK.

Where information is transferred outside the EEA or the UK, we require an adequate level of data protection.

Qualifications & exceptions

• Applies to users in the European Economic Area.
• Adequate level of protection is required where information is transferred outside the EEA or the UK.

Not stated here

• The wording "to our United States servers to other countries outside the EEA and the UK" is ambiguous as quoted.
• The policy does not say how an adequate level of data protection is determined or what is required.
• The policy does not state whether UK users are covered by a separate statement.

Legal Rights & Agreement Rules · Company practice

Anysphere may update the policy and will publish the updated version and an effective date at the top of the page

Anysphere says it may update the Privacy Policy from time to time. When it does, it says it will publish an updated version and effective date at the top of the page, unless another type of notice is legally required.

Supporting quotations

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date at the top of this page, unless another type of notice is legally required.

Qualifications & exceptions

• Updates "from time to time" and at Anysphere's discretion.
• Notice is by publication on the page unless another type of notice is legally required.

Not stated here

• The policy does not promise advance notice, direct notification or a notice period.
• The top of the page shows a last-updated date rather than a labeled effective date; the text does not say they are the same.

Legal Rights & Agreement Rules · Permission or license

Continued use of the site after a change counts as accepting the change

The policy states that your continued use of this site after any change in the Privacy Policy will constitute your acceptance of that change.

Supporting quotations

Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change.

Qualifications & exceptions

• Triggered by continued use of "this site" after a change.

Not stated here

• The policy says "site" while elsewhere it refers to the Service; the text does not say whether continued use of the Service software outside the website counts.
• The policy does not say whether you can reject a change.

Legal Rights & Agreement Rules · Procedure

Questions about the policy can be sent to hi@cursor.com

Anysphere encourages you to contact it at hi@cursor.com if you have any questions about this Privacy Policy.

Supporting quotations

We encourage you to contact us at hi@cursor.com if you have any questions about this Privacy Policy.