Cursor

GDPR overview

The enterprise page states plainly that Cursor is compliant with the requirements of GDPR and CCPA. The privacy policy, effective 6 October 2025, enumerates the usual rights, namely the right to know, access and portability, deletion, correction, objection, restriction and withdrawal of consent, with hi@cursor.com as the single address both for exercising them and for appealing a refusal. Anysphere states that it neither sells nor shares personal data for targeted advertising and takes no solely automated decisions with legal effect. Transfers from the EEA and the United Kingdom go to United States servers under what the policy calls an adequate level of protection. Two gaps deserve naming: no Article 27 representative in the European Union is designated anywhere on the site, and no data processing agreement is published or announced. Subprocessors, by contrast, are listed publicly and reviewed annually.

Who owns the data?

Anysphere separates Inputs, the content you submit, from Suggestions, the responses generated from them, and treats both as your material rather than company property. You keep the right to access, port, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent, all through hi@cursor.com. Two caveats matter in practice. Where Anysphere acts as a processor for a commercial customer, that customer's contract governs the data instead of the public privacy policy. And when your account belongs to an organisation, its administrators may access and manage your use of the service, and receive account-related information about you.

Reuse rights

The terms do not transfer ownership of what you write or of what the agent produces for you: you may reuse your code and the generated output in your own projects without asking permission. What changes is what Cursor may do with it. With Privacy Mode enabled, customer data is not used for training by Cursor or by its model providers, which are bound by zero data retention agreements; models that fall outside those agreements are flagged as such or require an administrator to opt in. With Privacy Mode disabled, Cursor may store and use codebase data, prompts, editor actions and code snippets to improve its AI features and train its models. In both cases requests travel through Cursor's backend, even when you supply your own API key, and indexing uploads code in small chunks so that embeddings can be computed.

Data retention & training

Hosting summary

Anysphere processes personal data on servers located in several jurisdictions, including the United States. The privacy policy states that data belonging to users in the European Economic Area and the United Kingdom may be transferred to Anysphere's United States servers and to other countries outside those areas, under what it calls an adequate level of data protection and legally valid transfer mechanisms. The enterprise page is more specific about the platform: Cursor currently operates on SOC 2 Type II compliant AWS infrastructure, and on-premises deployment is not offered. The security page adds that Cursor maintains no infrastructure in China and engages no subprocessor headquartered there. Data is encrypted with AES-256 at rest and TLS 1.2 or above in transit, and file contents cached to reduce latency are encrypted with client-generated keys that exist on Cursor's servers only for the duration of a request. The list of subprocessors is published on the trust portal and re-reviewed annually. No European data residency option is announced anywhere on the site.