AI coding tool data terms by team plan: training, retention, DPA and indemnity
Before a team rolls out an AI coding tool, someone asks what happens to the code. This table puts five answers side by side for each team or business plan: whether the vendor trains on your code by default, how long it keeps data, whether a DPA is available, what it says about IP indemnity, and whether there's a zero-data-retention option. Every cell is a short quote from the vendor's own public page. Where the vendor's pages don't say, the cell reads "Not stated on public pages".
Data terms by tool and plan (checked 2026-10-17)
| Tool and plan | Trains on your code by default? | Retention (as stated) | DPA available? | IP indemnity (as stated) | Zero-data-retention option |
|---|---|---|---|---|---|
| CursorTeams | Vendor pages differ For teams, Privacy Mode is enabled by default for all team members.Source: cursor.com (opens in a new tab) Privacy Mode is on by default for Enterprise teams. Teams and Enterprise admins can enforce it organization-wide so members cannot disable it.Source: cursor.com (opens in a new tab) checked | Custom chat data retention for Teams (no period stated) Team-wide privacy mode enforcement and custom Chat data retentionSource: cursor.com (opens in a new tab) · checked | Vendor pages differ For Teams and Enterprise customers, the DPA and privacy and data governance docs describe processor commitments and sub-processor coverage.Source: cursor.com (opens in a new tab) Cursor's Data Processing Agreement governs how Cursor processes personal data under enterprise contracts.Source: cursor.com (opens in a new tab) checked Read the DPA (opens in a new tab) | Not stated on public pages Pages checked: cursor.com/terms-of-service (opens in a new tab), cursor.com/terms/dpa (opens in a new tab), cursor.com/security (opens in a new tab), cursor.com/help/security-and-privacy/privacy.md (opens in a new tab) · checked | Yes, with Privacy Mode on (exceptions) Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.Source: cursor.com (opens in a new tab) · checked Applies when Privacy Mode is enabled. Help page: “ZDR doesn't apply when you use your own API keys.” Data-use page: non-ZDR models are designated or need admin opt-in; abuse-flagged data may be stored. (our note) |
| GitHub CopilotBusiness / Enterprise | No No. GitHub does not use either Copilot Business or Enterprise data to train its models.Source: github.com (opens in a new tab) · checked | IDE chat/completions: not retained; other access: 28 days; engagement data: 2 years Prompts and Suggestions: Retained for 28 days.Source: github.com (opens in a new tab) · checked | Yes These practices are outlined in GitHub’s Data Protection Agreement ( DPA ), which details our data handling commitments to our data controller customers.Source: github.com (opens in a new tab) · checked DPA link from that page (opens in a new tab) DPA page didn't load on | Yes, for unmodified suggestions with filtering enabled You’re entitled to IP indemnification from GitHub for the unmodified suggestions when Copilot’s filtering is enabled.Source: github.com (opens in a new tab) · checked | No general ZDR toggle; IDE prompts not retained; ZDR on request for some Claude models Customers can request to use Claude Fable 5 or Claude Fable 5.1 with zero data retention (ZDR) through the end of 2026 under a time-bound exemptionSource: docs.github.com (opens in a new tab) · checked Model-specific and time-bound (through end of 2026). No plan-wide ZDR option stated. (our note) |
| Claude (Claude Code)Team | No Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms, unless the customer has chosen to provide their data to us for model improvementSource: code.claude.com (opens in a new tab) · checked | 30 days (standard) Standard: 30-day retention periodSource: code.claude.com (opens in a new tab) · checked Listed under “Commercial users (Team, Enterprise, and API)”. (our note) | Yes Data submitted through the Services will be processed in accordance with the Anthropic Data Processing Addendum (“ DPA ”), which is incorporated into these Terms by reference.Source: anthropic.com (opens in a new tab) · checked Read the DPA (opens in a new tab) | Yes, for paid use and Outputs (with exclusions in K.3) " Customer Claim " means a third-party claim, suit, or proceeding alleging that Customer’s paid use of the Services (which includes data Anthropic has used to train a model that is part of the Services) in accordance with these Terms or Outputs generated through such authorized use violates any third-party intellectual property right.Source: anthropic.com (opens in a new tab) · checked | Enterprise only, per organisation, eligibility-based ZDR is not included in the standard Enterprise plan; it is enabled on a per-organization basis by your account team after confirming eligibilitySource: code.claude.com (opens in a new tab) · checked Not available on Team. Doc: “Zero data retention : available to qualified accounts for Claude Code on Claude for Enterprise.” (our note) |
| OpenAI Codex (ChatGPT Business)Business | No By default, we do not use your business data for training our models.Source: openai.com (opens in a new tab) · checked | Admin-controlled; deleted/unsaved chats removed within 30 days Any deleted or unsaved conversations are removed from our systems within 30 days, unless longer retention is required by lawSource: openai.com (opens in a new tab) · checked | Yes we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the APISource: openai.com (opens in a new tab) · checked Read the DPA (opens in a new tab) | Yes, third-party IP claims (Services Agreement 13.1) OpenAI agrees to indemnify, defend, and hold Customer harmless against any liabilities, damages and costs (including reasonable attorneys’ fees) payable to a third party arising out of a Claim alleging that the Services infringe any third-party IP Right.Source: openai.com (opens in a new tab) · checked | Not stated on public pages Pages checked: openai.com/enterprise-privacy (opens in a new tab), openai.com/policies/services-agreement (opens in a new tab), openai.com/policies/data-processing-addendum (opens in a new tab) · checked |
| Devin Desktop (formerly Windsurf)Teams | Opt-out By default, we may use your data for model training purposes to improve and enhance the Services. If you’re on a paid plan, you can opt out at any time on the Data Controls settings page.Source: docs.devin.ai (opens in a new tab) · checked “On the Teams plan, only an administrator can exercise the opt-out.” (our note) | Duration of the customer relationship Cognition only retains data processed through Devin for the duration of the relationship with a given Customer, unless otherwise specified by the Customers.Source: docs.devin.ai (opens in a new tab) · checked | Yes Cognition's Data Processing Addendum posted at cognition.ai/dpa shall apply.Source: cognition.com (opens in a new tab) · checked Read the DPA (opens in a new tab) | Yes, paid tiers (patents, copyrights, trade secrets) This Section 9.1 applies only to Customers on the Paid Service Tiers and does not apply to Customers on the Free Service Tier.Source: cognition.com (opens in a new tab) · checked | Yes, after admin opt-out After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.Source: docs.devin.ai (opens in a new tab) · checked Requires the training opt-out (admin-only on Teams). (our note) |
| KiroPro / Pro+ / Pro Max / Power via organisation (IAM Identity Center) | No We do not use content from Kiro enterprise users for service improvement.Source: kiro.dev (opens in a new tab) · checked Individual subscribers: “Subject to your opt out , content may be used for service improvement.” Depends on purchase route. (our note) | Model-specific abuse-detection retention (e.g. up to 30 days) For OpenAI GPT models, classifier-flagged traffic will be retained for up to 30 days (unless otherwise required by law) for automated offline abuse detection.Source: kiro.dev (opens in a new tab) · checked | Yes These Service Terms incorporate the AWS Data Processing Addendum (“DPA”), when you use AWS Services to process Customer Data (as defined in the DPA).Source: aws.amazon.com (opens in a new tab) · checked Read the DPA (opens in a new tab) | Yes, paid subscribers (AWS Service Terms 50.10) Yes, we provide an output indemnity for paid Kiro subscribers. Coverage is subject to Kiro Excluded Models and Section 50.10 of the AWS Service Terms.Source: kiro.dev (opens in a new tab) · checked | Not stated on public pages Pages checked: kiro.dev/docs/privacy-and-security/data-protection (opens in a new tab), kiro.dev/faq (opens in a new tab), aws.amazon.com/service-terms (opens in a new tab) · checked |
| ReplitPro | Opt-out Pro users can opt out from their content being used to develop and improve our models.Source: docs.replit.com (opens in a new tab) · checked “For Enterprise users, Replit does not use customer content to train its models.” (our note) | Not stated on public pages Pages checked: replit.com/pro-agreement (opens in a new tab), replit.com/dpa (opens in a new tab), replit.com/privacy-policy (opens in a new tab), docs.replit.com/legal-and-security-info/deleting-your-data.md (opens in a new tab), docs.replit.com/legal-and-security-info/model-improvement.md (opens in a new tab) · checked | Vendor pages differ Replit and Customer will comply with applicable data protection laws and the Data Processing Agreement.Source: replit.com (opens in a new tab) forms part of and is incorporated into the Replit Commercial AgreementSource: replit.com (opens in a new tab) checked Read the DPA (opens in a new tab) | Not stated on public pages Pages checked: replit.com/pro-agreement (opens in a new tab), replit.com/dpa (opens in a new tab), docs.replit.com/legal-and-security-info/model-improvement.md (opens in a new tab) · checked | Not stated on public pages Pages checked: replit.com/pro-agreement (opens in a new tab), replit.com/dpa (opens in a new tab), docs.replit.com/legal-and-security-info/model-improvement.md (opens in a new tab), docs.replit.com/teams/information-security/overview.md (opens in a new tab) · checked |
| LovableBusiness | Vendor pages differ On Business and Enterprise plans: No. Customer prompts, code, and workspace data are not used to train Lovable models.Source: lovable.dev (opens in a new tab) We may use your Customer Data to develop and train artificial intelligence and machine learning models.Source: lovable.dev (opens in a new tab) checked | While account open; 30-day post-termination return/delete window Your account and Customer Content — kept while your account is open, then deleted or de-identified after it closes or after a verified deletion request, unless the law requires us to keep it longer.Source: lovable.dev (opens in a new tab) · checked | Yes If you're on a Business or Enterprise plan, your usage includes our Data Processing Agreement (DPA).Source: lovable.dev (opens in a new tab) · checked Read the DPA (opens in a new tab) | Not stated on public pages Pages checked: lovable.dev/terms (opens in a new tab), lovable.dev/data-processing-agreement (opens in a new tab), lovable.dev/security (opens in a new tab) · checked | Not stated on public pages Pages checked: lovable.dev/security (opens in a new tab), lovable.dev/privacy (opens in a new tab), lovable.dev/data-processing-agreement (opens in a new tab) · checked |
| Bolt.newTeams | No This Section 3.5 does not apply to: (i) Bolt Model Development Content in accounts governed by a separate written agreement with Stackblitz that addresses the uses described in this Section, in which case that agreement controls; (ii) organization-managed accounts, including Teams and Enterprise workspacesSource: stackblitz.com (opens in a new tab) · checked For individual accounts, Section 3.5 grants a training and dataset-licensing licence “Unless and until you opt out”. (our note) | While account active; no period stated Personal information and user content associated with an account are retained while the account remains active.Source: stackblitz.com (opens in a new tab) · checked | Not found. Not stated on public pages Pages checked: stackblitz.com/terms-of-service (opens in a new tab), stackblitz.com/privacy-policy (opens in a new tab), trust.bolt.new (opens in a new tab), stackblitz.com/dpa (opens in a new tab) · checked DPA page returned 404 on | Not stated on public pages Pages checked: stackblitz.com/terms-of-service (opens in a new tab), stackblitz.com/privacy-policy (opens in a new tab) · checked | Not stated on public pages Pages checked: stackblitz.com/terms-of-service (opens in a new tab), stackblitz.com/privacy-policy (opens in a new tab), trust.bolt.new (opens in a new tab) · checked |
| v0 by VercelPlus | Vendor pages differ | Data Opt-out | No | No | No | Yes | Yes |From the Plus column of v0's pricing tableSource: v0.app (opens in a new tab) Enterprise customers can opt out of having their content used for model trainingSource: v0.app (opens in a new tab) checked | Not stated on public pages Pages checked: v0.app/docs/faqs.md (opens in a new tab), v0.app/docs/pricing.md (opens in a new tab), v0.app/docs/security.md (opens in a new tab), v0.app/policy (opens in a new tab), vercel.com/legal/terms (opens in a new tab), vercel.com/legal/privacy-policy (opens in a new tab) · checked | Not found. Not stated on public pages Pages checked: vercel.com/legal/dpa (opens in a new tab), vercel.com/legal/terms (opens in a new tab), v0.app/docs/faqs.md (opens in a new tab), v0.app/policy (opens in a new tab) · checked | Not stated on public pages Pages checked: vercel.com/legal/terms (opens in a new tab), vercel.com/legal/ai-product-terms (opens in a new tab), v0.app/docs/faqs.md (opens in a new tab) · checked | Not stated on public pages Pages checked: v0.app/docs/faqs.md (opens in a new tab), v0.app/docs/security.md (opens in a new tab), v0.app/policy (opens in a new tab), vercel.com/legal/ai-product-terms (opens in a new tab) · checked |
| v0 by VercelBusiness | Vendor pages differ | Data Opt-out | No | No | No | Yes | Yes |From the Business column of v0's pricing tableSource: v0.app (opens in a new tab) Enterprise customers can opt out of having their content used for model trainingSource: v0.app (opens in a new tab) checked | Not stated on public pages Pages checked: v0.app/docs/faqs.md (opens in a new tab), v0.app/docs/pricing.md (opens in a new tab), v0.app/docs/security.md (opens in a new tab), v0.app/policy (opens in a new tab), vercel.com/legal/terms (opens in a new tab), vercel.com/legal/privacy-policy (opens in a new tab) · checked | Not found. Not stated on public pages Pages checked: vercel.com/legal/dpa (opens in a new tab), vercel.com/legal/terms (opens in a new tab), v0.app/docs/faqs.md (opens in a new tab), v0.app/policy (opens in a new tab) · checked | Not stated on public pages Pages checked: vercel.com/legal/terms (opens in a new tab), vercel.com/legal/ai-product-terms (opens in a new tab), v0.app/docs/faqs.md (opens in a new tab) · checked | Not stated on public pages Pages checked: v0.app/docs/faqs.md (opens in a new tab), v0.app/docs/security.md (opens in a new tab), v0.app/policy (opens in a new tab), vercel.com/legal/ai-product-terms (opens in a new tab) · checked |
| EmergentBusiness (custom) | Vendor pages differ By default, we may use your Content, including your code, to develop and train artificial intelligence and machine learning models.Source: app.emergent.sh (opens in a new tab) Emergent shall not use Customer Personal Data for the purpose of training, retraining, fine-tuning or otherwise developing any artificial intelligence or machine learning modelSource: app.emergent.sh (opens in a new tab) checked | 45 days post account deletion (DPA Annex 1) 45 days post account deletionSource: app.emergent.sh (opens in a new tab) · checked | Yes If and to the extent we process Personal Data on behalf of you, or where applicable, your organization in connection with the Services, our Data Processing Agreement (available at http://app.emergent.sh/dpa) applies to that processing and forms part of your agreement with us.Source: app.emergent.sh (opens in a new tab) · checked Read the DPA (opens in a new tab) | Not stated on public pages Pages checked: app.emergent.sh/terms-of-service (opens in a new tab), app.emergent.sh/dpa (opens in a new tab), emergent.sh/pricing (opens in a new tab) · checked | Not stated on public pages Pages checked: app.emergent.sh/terms-of-service (opens in a new tab), app.emergent.sh/dpa (opens in a new tab), emergent.sh/pricing (opens in a new tab) · checked |
| Google AntigravityBusiness (via Google Cloud / Gemini Enterprise) | No Google will not use Customer Data to train or fine-tune any AI/ML models without Customer's prior permission or instruction.Source: cloud.google.com (opens in a new tab) · checked | Not stated on public pages Pages checked: antigravity.google/docs/enterprise (opens in a new tab), antigravity.google/pricing (opens in a new tab), cloud.google.com/terms (opens in a new tab), cloud.google.com/terms/service-terms (opens in a new tab) · checked | Yes This Cloud Data Processing Addendum (including its appendices, the “ Addendum ”) is incorporated into the Agreement(s) (as defined below) between Google and Customer.Source: cloud.google.com (opens in a new tab) · checked Read the DPA (opens in a new tab) | Yes, Google defends against IP infringement allegations (Cloud ToS 13.1) Google will defend Customer and its Affiliates using the Services under Customer’s Account and indemnify them against Indemnified Liabilities in any Third-Party Legal Proceeding to the extent arising from an allegation that any Service or any Google Brand Feature, in each case used in accordance with this Agreement, infringes the third party's Intellectual Property Rights.Source: cloud.google.com (opens in a new tab) · checked | Not stated on public pages Pages checked: antigravity.google/docs/enterprise (opens in a new tab), antigravity.google/pricing (opens in a new tab), cloud.google.com/terms (opens in a new tab), cloud.google.com/terms/service-terms (opens in a new tab) · checked |
How to read this table
- Trains on your code by default? Yes, No, Opt-out (the vendor trains unless you switch it off), or Not stated.
- DPA available? Yes (with a link), On request, or Not found on public pages.
- Retention, IP indemnity and zero-data-retention are quoted as the vendor states them. We don't summarise or rate them.
- Your plan's actual terms are in your contract. Public pages can change, and a vendor's enterprise agreement can differ from them.
FAQ
What does "Not stated on public pages" mean?
The vendor's public pages we checked didn't say. We don't guess or fill the gap from memory. Your contract or the vendor's sales team may have the answer.
Where does each cell come from?
Each cell quotes the vendor's own page word for word, links to that page and shows the date we checked it.
Does this replace my contract or DPA?
No. Your own contract, DPA or enterprise agreement with the vendor overrides public pages. Check the vendor's current terms and your contract before relying on this.
Which tools are covered?
The business or team plans of Cursor, GitHub Copilot, Claude (Claude Code), OpenAI Codex (ChatGPT Business), Devin Desktop (formerly Windsurf), Kiro, Replit, Lovable, Bolt.new, v0 by Vercel, Emergent, Google Antigravity.
Related
Get told when these terms change
Join the free waitlist. We'll email you when alerts for changes to these terms open, and ask what your team needs.
We only use your email for these updates. Unsubscribe any time. See our privacy page.
Spotted an error or a change? Email us