AI tool privacy · SpaceXSI and Cursor
Grok Bot and your company’s data
By David Michaelson, MS Last checked October 23, 2026
The short answer
Grok Bot follows your Cursor account’s Privacy Mode: with it on, Cursor says your data is not used for training, and it is on by default for teams; the pages we read do not say the default for personal accounts.
Safer setup: Use a Teams or Enterprise account with Privacy Mode enforced by an admin, and set “Execution on this computer” to “Never allow” unless a Bot needs your local files.
Plan by plan
Each answer comes from SpaceXSI’s and Cursor’s own policy or help pages, with the link and the date we read it. Setting names are quoted exactly as SpaceXSI and Cursor write them.
We could not confirm 2 answers on SpaceXSI’s and Cursor’s own pages. Those answers say so in plain words and link to the page we checked.
| Question | Personal account | Teams and Enterprise |
|---|---|---|
| Trains on your data by default? | Not stated for personal accounts. Cursor says customer data is not used for training while Privacy Mode is on, and may be used to train its models when it is off. The pages we read do not say which setting a personal account starts with. Page checked: cursor.com, October 23, 2026 | No, by default. Privacy Mode is on by default for team members and admins can enforce it. With it on, Cursor says customer data is not used for training. Read on October 23, 2026 Source: cursor.com |
| How long your data is kept | Not stated. Your cloud computer keeps files and browser sessions across sessions, and SpaceXSI says backend retention follows Cursor’s terms, but the pages we read give no period for conversations. Page checked: docs.x.ai, October 23, 2026 | Files and sign-ins stay on each member’s cloud computer until removed. Under Cursor’s data processing agreement, data is deleted or returned within 30 days of written direction after the service ends. There is no per-organization retention policy, and the pages we read give no period for conversations while you use the service. Read on October 23, 2026 Source: cursor.com |
| Who can see it | Your own account. Every Bot on your account uses one cloud computer assigned to you, and the Bots share its files, browser sessions, and logins. The pages we read do not say when staff may review conversations. Read on October 23, 2026 Source: docs.x.ai | Each member’s Bots act as that member and can never hold more access than that person. On Enterprise, admins can turn on Action Recording, off by default, which keeps a record of Bot actions for 90 days. The pages we read do not say whether admins can read conversations. Read on October 23, 2026 Source: cursor.com |
| Where data is stored | In the United States. Cursor says Grok Bot’s cloud computers run in the US today, and that this is not a written data residency commitment. Read on October 23, 2026 Source: cursor.com | In the United States. Cursor says Grok Bot’s cloud computers run in the US today, and that this is not a written data residency commitment. Read on October 23, 2026 Source: cursor.com |
| How to delete | Deleting a Bot removes its profile, conversation, and routines. Files and sign-ins on the shared cloud computer may remain, so remove those yourself. Read on October 23, 2026 Source: docs.x.ai | Members delete Bots, routines, connected apps, and files themselves. To end someone’s access, remove them from the team or turn off Grok Bot for their group, and revoke their sessions in your identity provider. Read on October 23, 2026 Source: cursor.com |
Safer setup, step by step
- Check that Privacy Mode is on. For teams it is on by default, and admins can enforce it for everyone from cursor.com/dashboard. Source: cursor.com for this step
- In Settings > Computer > Your computer, set “Execution on this computer” to “Never allow” unless a Bot has a specific reason to work on local files. Source: cursor.com for this step
- When a project ends, delete its routines, sign out of websites on the cloud computer, remove connected apps, and remove sensitive files from /workspace. Deleting a Bot doesn’t remove computer files or browser sessions. Source: cursor.com for this step
What to write in your policy
Staff use Grok Bot only on our company Teams or Enterprise account, with Privacy Mode enforced. Customer data never goes into a personal account.
Building your own approved tools list? The SafeStart Handbook includes one, with company accounts and safer privacy settings.