Acquia

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to identify:

• Which contractual provisions changed;
• New rights or obligations;
• Changes to liability, confidentiality, security, intellectual property, or termination rights;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models; or
• Whether the customer can opt out of such use.

AI Training and Data-Use Changes

No specific language concerning AI model training or customer-data use is included in the diff. Therefore, no conclusion can be drawn about whether the amendment:

• Permits use of customer content for model training;
• Limits training use to aggregated, de-identified, or anonymized data;
• Allows human review or vendor access to customer data;
• Applies only to inputs, or also to outputs, metadata, usage data, or telemetry;
• Grants the customer an opt-out right;
• Imposes deletion, retention, or segregation requirements; or
• Restricts use of confidential, personal, regulated, or proprietary information.

Required Information

Please provide the actual added, deleted, and replacement text using the stated notation. Without the substantive wording, a legal risk analysis would be speculative and unreliable.

Key Changes and Risks

1. No Express AI-Training Provision Identified

• The diff does not expressly state that customer data, personal data, prompts, content, or Service data may be used to train, fine-tune, evaluate, or improve Acquia’s AI models.
• It also does not add an express prohibition on using customer data for AI training.
• References to using information “to better provide technical support,” improve services, administer the Site, and maximize the digital experience are broader service-improvement purposes, but should not automatically be read as authorization for model training.
• Customers should confirm whether separate product terms, service-specific terms, or an AI addendum addresses training and whether customer content is excluded from generalized model development.

2. Expanded Data Collection

The revised policy substantially expands the categories of information Acquia may collect, including:

• Employment and organizational data, such as title, department, supervisor, employment history, employer, work status, training, and business-travel information.
• Personal and business contact details, home address, emergency contacts, photographs, biographical and directory information.
• Social-media profiles/posts, usernames, login credentials, device identifiers, access logs, actions performed in IT systems, and localization data.
• Detailed technical and website information, including IP address, operating-system and server versions, PHP/database versions, Drupal code, website availability, user counts, nodes, and comments.

Risk: The policy now supports collection and processing of substantially more sensitive, confidential, and operational information than the prior wording. Customers may need to provide additional notices, obtain consents, or update data-minimization controls.

3. Increased Linking and Profiling Risk

• Website and service telemetry may be linked to personally identifiable information and user accounts.
• Acquia may use this information for technical support, service administration, content improvement, and general service optimization.

Risk: Linking operational telemetry with identifiable users increases profiling, re-identification, insider-access, and regulatory risk, particularly where website statistics or Drupal data could reveal customer operations or end-user behavior.

4. Customer Responsibility for Third-Party Data

The revised language states that where a customer provides personal data about others, the customer represents that it has authority and, where required, obtained consent.

Risk: This places clearer compliance responsibility on customers for employee, contractor, end-user, visitor, and other third-party data submitted to Acquia.

5. Broader Marketing Use

The policy changes from primarily service-related communications to information about products, services, special deals, and promotions, including communications from third-party providers and Acquia technology partners.

Risk: Marketing disclosures and partner communications are broader, although opt-out rights remain described. Service-related announcements generally remain non-optional, with account deactivation presented as an alternative.

6. International Processing and Rights

The policy continues to permit global transfers and processing by affiliates and third parties. It adds or clarifies regional representatives and contact details for the EU, UK, and India, and updates privacy-rights language.

Overall assessment: The principal change is expanded data collection, telemetry, linking, and marketing—not an express AI-training authorization.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 372 words to the document”

Because the text of the additions, deletions, or replacements is missing, it is not possible to reliably identify:

• Changes to the parties’ rights or obligations
• New fees, liability, indemnity, or termination provisions
• Changes to confidentiality or data-protection obligations
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether such data use is subject to consent, opt-out rights, anonymization, aggregation, or contractual limits
• Any changes to ownership or licensing of customer data, outputs, prompts, or model improvements
• New data-retention, deletion, security, or subprocessors provisions

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training because the relevant language is not included. The added 372 words could potentially introduce significant rights, including permission to use customer content, prompts, inputs, outputs, or usage data for model development. The precise wording is necessary to determine:

1. What data is covered — whether “customer data” includes personal information, confidential information, prompts, files, or metadata.

2. What uses are permitted — training, fine-tuning, testing, benchmarking, product improvement, or commercial model development.

3. Whether use is mandatory or optional — and whether the customer can opt out or withdraw consent.

4. Whether data is anonymized — and whether anonymization is defined or independently verified.

5. Who owns resulting models or improvements — including whether the provider receives a broad, perpetual, worldwide license.

6. Whether confidentiality and deletion duties still apply — particularly after termination.

Required Information

Please provide the full marked-up text showing the 372 added words and any deletions or replacements. Without that text, a substantive legal-risk analysis would be speculative.

Executive Summary

The revised policy substantially reorganizes and expands the categories of information Acquia may collect and use. The most significant changes concern broader telemetry, customer/user data categories, marketing communications, and data linked to accounts. The diff contains no express provision authorizing or prohibiting use of customer data to train artificial-intelligence models. Accordingly, the policy does not provide customers with a clear assurance that their data will be excluded from AI training, nor does it explain whether de-identified, aggregated, support, telemetry, or publicly submitted data may be used for that purpose.

Important Changes and Risks

1. Expanded collection of personal information

The revised text adds or clarifies collection of:

• Device and usage data, including IP addresses, identifiers, cookies, beacons, and email-interaction data.
• Financial and billing information.
• Call recordings.
• Visitor information, including name, contact details, company, and arrival date/time.
• Broad employment and professional information, including employment history, employer, work contact details, photographs, biographies, social-media information, login credentials, device-use data, access logs, employee actions, travel arrangements, training, and localization data.
• Website and Drupal telemetry, including software versions, server configuration, website availability, user statistics, nodes, users, and comments.

Risk: The collection scope is materially broader and may include sensitive business, employee, credential, and operational information. Customers should confirm whether their own data, employee data, or end-user data may be transmitted through Acquia modules or services.

2. Increased linkage and profiling

The revised language states that technical and website statistics may be linked to personally identifiable information and user accounts and used to improve technical support, services, content, and administration.

Risk: Linking operational telemetry with identified users increases profiling and re-identification risks. The policy does not clearly state retention periods, specific safeguards, or whether customers can disable this collection.

3. Broader marketing and third-party communications

The policy changes service-related communications into broader communications about products, services, special deals, promotions, and potential future purchases. It also references third-party service providers and Acquia technology partners.

Risk: Customers may receive more marketing communications, and data may be shared with additional commercial parties. The opt-out language appears inconsistent, particularly regarding service-related versus promotional messages.

4. Customer-controlled processing language

The policy continues to state that the customer determines the type and extent of personal data processed by Acquia as controller/customer-directed processor. It also adds a representation that a customer has authority and required consent for information concerning other individuals.

Risk: This places responsibility on customers to obtain permissions and define lawful use, while the policy does not fully specify Acquia’s downstream processing, retention, deletion, or subcontractor controls.

AI-Training Assessment

No language in the diff expressly addresses:

• Training, fine-tuning, or improving AI or machine-learning models;
• Whether customer content, prompts, support interactions, telemetry, or personal data may be used for training;
• Whether data is anonymized or aggregated before such use;
• Customer opt-out or consent rights;
• Restrictions on third-party AI providers.

Recommended action: Obtain a written contractual commitment stating whether customer data is excluded from model training and identifying any exceptions.

Summary of Important Changes

AI Model Training

• No express reference to artificial intelligence, machine learning, generative AI, or training AI models appears in the supplied diff.
• The revised text does expand Acquia’s ability to collect and use technical, usage, website, account, and customer-service data, but it does not expressly state that customer data, customer content, prompts, outputs, or service data may be used to train AI models.
• This diff therefore does not establish whether Acquia:
• uses customer data for model training;
• anonymizes or aggregates data before training;
• allows customers to opt out; or
• prohibits use of customer content for AI development.
• Customers should review any separate AI terms, product-specific terms, data processing addendum, or service agreement for those rights and restrictions.

Expanded Data Collection

The revised policy adds or clarifies collection of:

• Device and usage information, including IP addresses, identifiers, cookies, web beacons, and email engagement data.
• Purchase, billing, and financial information.
• Recorded phone calls.
• Visitor information, including name, contact details, company, and arrival date/time.
• Detailed employment and organizational information, including employment history, employer, manager, work status, training, business travel, emergency contacts, photographs, biographies, social-media information, login identifiers, device-access information, activity logs, and localization data.
• Drupal and service telemetry, including operating-system, server, PHP, database, Drupal-code and version information, website availability, number of nodes, users, comments, and other website statistics.

New or Material Uses and Risks

• Acquia may link website, service, and usage statistics to personally identifiable information and user accounts.
• Subscription modules may report technical and website information to Acquia automatically.
• Acquia may use this information to provide technical support, improve administration and content, and operate subscription services.
• The policy permits marketing communications concerning products, services, deals, promotions, third-party providers, and Acquia technology partners. Service-related announcements generally cannot be opted out of, although account deactivation may be available.
• Customers supplying information about other individuals now expressly represent that they have authority and, where required, obtained consent. This creates an additional compliance obligation for customers.

Customer Data Processing

• The policy continues to describe Acquia as processing customer personal data to provide contractually agreed services, with the customer controlling the type and extent of data.
• The listed data categories and data subjects are substantially expanded, increasing the apparent scope of information that may be processed.
• Global transfers to Acquia affiliates and third-party processors remain permitted.

Other Changes

• Privacy-contact information and regional representative details are updated.
• References to the EU-U.S. Data Privacy Framework and related complaint procedures are refined.
• Many changes appear editorial or structural, but the expanded data categories and telemetry disclosures are substantive.

Summary

The provided diff does not include the actual added, deleted, or replaced contractual language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine what legal terms changed or whether the customer’s data may now be used to train AI models.

AI Training and Data-Use Review

No substantive language is provided addressing:

• Whether customer data, content, prompts, or outputs may be used to train, fine-tune, or improve AI models
• Whether data is used for product development, analytics, benchmarking, or service improvement
• Whether training use is automatic or requires customer consent or an opt-out
• Whether data is anonymized, aggregated, or de-identified before use
• Whether human reviewers or third-party providers may access customer data
• Whether customer data may be retained after termination
• Whether the customer owns or controls data-derived models, embeddings, or improvements
• Whether confidential information may be included in training datasets
• Whether different rules apply to business, personal, or sensitive data

Risk Assessment

Because the actual text is missing, no reliable assessment can be made of:

• Expansion or restriction of the provider’s data-use rights
• New privacy, confidentiality, intellectual-property, or regulatory risks
• Changes to consent, notice, opt-out, or deletion rights
• Conflicts with existing data-processing agreements or security commitments

If the added language grants the provider broad rights to use customer content to “improve,” “develop,” or “train” services, that could materially expand the provider’s rights beyond merely delivering the contracted services. Particular concern would arise if the language lacks limits on purpose, retention, sharing, de-identification, or use of confidential information.

Information Needed

Please provide the actual 372 words, including any deleted or replaced text. The changes can then be analyzed for their specific effect on AI training, data ownership, confidentiality, privacy, security, and termination obligations.

Summary

Key limitation

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions changed;
• Whether customer data may be used to train AI models;
• Whether consent, opt-out, or deletion rights were added or removed;
• Whether liability, confidentiality, security, or intellectual-property obligations changed; or
• Whether the customer’s data may be shared with affiliates, vendors, or AI providers.

AI-training analysis

No substantive language addressing AI, machine learning, model training, data use, data retention, or customer-content rights appears in the supplied diff. Therefore, no conclusion can be drawn about whether the contract:

• Permits training models using customer data;
• Limits training to de-identified or aggregated data;
• Requires the customer’s prior consent;
• Provides an opt-out mechanism;
• Grants the provider ownership or broad usage rights; or
• Protects customer data from being used to improve products or services.

Recommended next step

Provide the actual redline text, including the approximately 372 added words and any surrounding deleted or replacement language. The analysis should focus particularly on terms such as:

• “Customer Data,” “Content,” or “Usage Data”;
• “Train,” “fine-tune,” “improve,” or “develop” AI or machine-learning models;
• “De-identified,” “aggregated,” or “anonymized” data;
• Rights to retain, copy, disclose, sublicense, or commercialize data;
• Customer consent or opt-out rights; and
• Data deletion, confidentiality, security, and indemnity obligations.

Executive Summary

The diff substantially expands and reorganizes the information Acquia says it may collect and use. Although much of the change appears to update wording, examples, and formatting, several additions materially broaden the scope of personal-data collection, customer-data monitoring, marketing, and data sharing.

AI Training / Model Use

• No express reference to artificial intelligence, machine learning, generative AI, model training, or using customer data to train models appears in the supplied diff.
• The changes therefore do not clearly authorize AI training or establish whether customer content, usage data, support communications, or service data may be used for that purpose.
• However, the policy continues to describe broad uses of data, including:
• Automated collection and processing of website and service data.
• Use of technical, performance, security, configuration, availability, and usage information to improve services and support customers.
• Sharing with affiliates, partners, vendors, and service providers.
• These broad provisions could potentially support analytics or automated-service development, but they should not be treated as an explicit AI-training permission. Customers seeking certainty should request a written statement addressing whether their data, prompts, outputs, logs, or content are used to train or improve AI models, and whether data is de-identified or excluded.

Important Data-Collection Changes

• The policy adds or clarifies collection of:
• Device identifiers, IP addresses, cookies, web-beacon data, and email interaction data.
• Financial and billing information.
• Recorded telephone calls.
• Office-visitor details, including name, contact information, company, arrival time, photographs, and biographical information.
• Extensive employee and workforce information, including employment history, supervisor, work status, travel, training, device use, localization, login credentials, and activity on the customer’s systems.
• Customer website and Drupal data is described in greater detail, including:
• Software and server versions, PHP and database versions, Drupal code, website availability, user statistics, nodes, users, and comments.
• Linking this information to personally identifiable information and user accounts.

Customer Responsibilities and Risks

• Customers supplying personal data about other individuals must represent that they have authority and, where required, obtained consent.
• The expanded categories may create additional compliance obligations for customers acting as controllers, especially for employee, workforce, login, localization, and potentially sensitive operational data.
• The policy states that Acquia may use collected information to improve content, administration, technical support, and services. The wording is broad and does not specify detailed retention limits, segregation controls, or restrictions on secondary uses.

Marketing and Communications

• Marketing language is broadened to include products, services, special deals, promotions, third-party providers, and Acquia technology partners.
• Service-related communications remain generally non-optional, while promotional communications retain opt-out language.
• The policy adds a marketing email address and updates contact and privacy-request details.

Other Changes

• Global transfers and processing by affiliates and third parties are reaffirmed.
• EU, UK, India representative and privacy-contact information is updated.
• Many changes are editorial or structural, but the cumulative effect is a materially broader and more detailed description of data collection and use.

Summary

The supplied diff does not include the actual contractual language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added, deleted, or replaced;
• Whether liability, indemnity, confidentiality, intellectual property, privacy, or termination rights changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether any AI-related data use is optional, opt-out, limited to de-identified data, or subject to customer consent;
• Whether the provider may share customer data with affiliates, vendors, or model providers; or
• Whether the customer receives any rights or protections concerning outputs, retained data, or model-generated derivatives.

AI Training and Data-Use Assessment

No conclusion can be reached regarding AI model training because the added language itself has not been provided. In particular, the diff should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “enhance” models or services;
• “inputs,” “outputs,” “customer data,” “content,” or “usage data”;
• “de-identified,” “aggregated,” or “anonymized” information;
• rights to use data after termination or deletion;
• sharing data with subprocessors or third-party AI providers; and
• customer opt-out, consent, or enterprise privacy controls.

Required Information

Please provide the complete redlined text using the stated notation—for example:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

Without the actual wording, any legal-risk analysis would be speculative.

Summary of Important Changes

AI Model Training

• No express provision concerning AI, machine learning, generative AI, or training models appears in the provided diff.
• The revised language does not state that customer data, service data, website content, prompts, outputs, or usage data may—or may not—be used to train AI models.
• Accordingly, the diff provides no new contractual restriction against AI training and no affirmative authorization for it. Customers should verify whether AI-use terms appear elsewhere, such as the Services Agreement, Data Processing Addendum, product terms, or an AI-specific policy.
• The absence of an AI-training commitment may create uncertainty, particularly because the policy expands the categories of data Acquia collects and uses.

Expanded Data Collection

The revised policy substantially expands and reorganizes the information Acquia may collect, including:

• Device and usage data, IP addresses, identifiers, operating-system and server details, PHP and database versions.
• Website and Drupal telemetry, including whether a website is live, user statistics, number of nodes, users, and comments.
• Detailed employee and business information, including employment history, employer, manager, work status, business travel, training, localization data, photographs, biographical information, social-media profiles, login identifiers, and activity performed while accessing customer systems.
• Financial and billing information, communications, event-registration data, office-visitor information, and recorded telephone calls.

Risk: The scope is materially broader and may capture sensitive employee, customer-user, website, and operational information.

Customer Data Use and Linking

• Website and service telemetry may be linked to personally identifiable information and user accounts.
• Acquia may use this information to provide technical support, improve services and website administration, and support subscription services.
• Drupal modules may report technical and usage information directly to Acquia.

Risk: Linking technical telemetry with identified users increases profiling, traceability, and disclosure risks. Customers should confirm whether this collection is consistent with their instructions and data-minimization obligations.

Marketing and Third-Party Sharing

• The policy restores or expands references to communications about products, services, deals, promotions, and communications from third-party providers or Acquia technology partners.
• Acquia may share information with affiliates, partners outside the corporate group, vendors, service agencies, and technology partners.
• Service-related communications generally cannot be opted out of, while promotional communications have opt-out mechanisms.

Risk: The revised language may permit broader marketing and partner-related processing than the prior wording suggested.

Compliance and Drafting Issues

• The customer remains the controller for customer personal data, while Acquia processes it to provide contracted services.
• Categories of personal data and data subjects are significantly expanded.
• Several changes appear poorly integrated or duplicative, potentially creating ambiguity about applicable purposes, data categories, and rights contacts.

Recommended action: Request confirmation that customer content and service data will not be used to train AI models without express written authorization, and review the governing DPA and product-specific terms.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 372 words to the document”

Without the added, deleted, or replaced text, it is not possible to reliably identify:

• Changes to customer data rights or ownership
• New permissions to collect, use, disclose, or retain customer data
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data may be anonymized, aggregated, or shared with service providers
• New confidentiality, security, or breach-notification obligations
• Changes to liability, indemnification, warranties, or regulatory compliance
• New termination, deletion, or data-return requirements

AI-Training Risk Assessment

No conclusion can be reached about AI-model training from the information provided. The diff does not show whether the contract:

• Permits use of customer content or personal data for model training
• Limits training use to de-identified or aggregated data
• Requires customer consent or provides an opt-out
• Allows use of data to improve services for other customers
• Gives the provider ownership of model outputs, derivatives, or learned information
• Prohibits disclosure of confidential information through training or model development

Required Information

Please provide the actual redlined text, using the stated notation:

• {added text}
• [deleted text]
• [{deleted text}]{added text} for replacements

The full wording is necessary because small changes—such as adding “service improvement,” “machine learning,” “aggregated data,” or “affiliates and vendors”—can materially expand the provider’s rights to use customer data.

Structured Summary of Important Changes

1. Customer and end-user data collection is substantially expanded

The revised policy replaces narrower descriptions of collected information with a much broader list, including:

• Employment history, employer, department, supervisor, position, and work status
• Business and home addresses, emergency contacts, photographs, and biographical information
• Social-media profiles, usernames, login credentials, and device identifiers
• Access logs, actions performed in customer IT systems, localization data, business travel, and training information
• Website, application, and service-usage statistics

Risk: The policy now covers significantly more personal and potentially sensitive information, including employee data, credentials, photographs, and location-related information. Customers may need to confirm that they have appropriate notices, authority, and consents for providing this data to Acquia.

2. Greater collection and linkage of customer telemetry

The revised language confirms that Drupal or other service modules may report technical and usage information to Acquia, including:

• IP address and operating-system details
• Server, PHP, database, and service-version information
• Website availability
• Numbers of nodes, users, comments, and other usage statistics

This information may be linked to personally identifiable information and user accounts and used to provide technical support, improve services, and administer the Site.

Risk: Linking operational telemetry to identified users or accounts increases profiling and re-identification risks. The purposes “improve the content and general administration” and “better provide” support are broad and should be clarified in customer agreements or data-processing documentation.

3. Broader marketing and third-party communications

The policy expands communications beyond service notices to include products, services, promotions, special deals, and communications from third-party providers and Acquia technology partners. Service-related communications generally cannot be opted out of, while promotional communications remain subject to the stated opt-out process.

Risk: Customers and users may receive marketing relating to third-party products. This could create consent, electronic-marketing, and controller/processor-role issues, especially where Acquia processes customer-controlled end-user data.

4. Expanded customer data-processing categories

The data-processing description changes from general customer representatives and end users to a detailed inventory of employment, identity, access, device, activity, and localization data.

Risk: The expanded inventory may function as a broader authorization for processing than the prior wording. Customers should verify that it matches the applicable order form, DPA, data map, and actual service functionality.

5. AI-model training

No express change authorizing the use of customer data to train AI models is visible in this diff. The revised policy does not mention artificial intelligence, machine learning, model training, model improvement, prompts, outputs, or use of customer content for generalized product development.

However, the expanded language permitting use of information to “improve” services is potentially ambiguous. It should not automatically be read as authorization to use customer content or personal data for AI training, but Acquia should confirm this expressly.

Recommended clarification: State whether customer data, prompts, outputs, telemetry, or support communications may be used to train or fine-tune Acquia or third-party AI models, and whether such use is opt-in, opt-out, aggregated/de-identified, or prohibited.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 372 words to the document”

Without the text of those additions—and any surrounding deleted or replaced language—it is not possible to reliably identify legal changes or risks.

AI Training and Customer Data

No determination can be made about whether the agreement now permits, restricts, or changes the use of customer data to train AI models. The missing language could address issues such as:

• Whether customer data, prompts, outputs, or usage data may be used for model training
• Whether use is limited to service improvement, safety, or internal analytics
• Whether data is anonymized, aggregated, or de-identified before use
• Whether the customer can opt out of training
• Whether human reviewers or third-party AI providers may access the data
• Whether the provider retains rights to use derived data or model improvements
• Whether confidential information, personal data, or regulated data is included
• Whether training use continues after termination

Key Limitation

Because the actual additions, deletions, and replacements are absent, no conclusions can be drawn about:

• New customer obligations
• Expanded provider rights
• Changes to confidentiality or data ownership
• Privacy, security, or regulatory exposure
• Changes to liability, indemnity, or termination rights

Please provide the full marked-up text, particularly the approximately 372 added words and any related deleted or replaced provisions, for a substantive legal analysis.

Structured Summary of Important Changes

Executive Summary

The diff substantially reorganizes and expands the information Acquia says it may collect and use. Most changes concern broader data categories, website/service telemetry, marketing communications, customer responsibilities, and international privacy contacts. The provided diff does not expressly add or remove language authorizing Acquia to use customer data to train AI models. However, the expanded descriptions of automated processing and broad service-improvement purposes should be reviewed to determine whether they could indirectly encompass AI or machine-learning activities.

Key Changes and Risks

1. Expanded data collection

The revised policy adds or clarifies collection of:

• Device and usage identifiers, including IP addresses and other identifiers.
• Website and service telemetry, including operating-system, server, PHP, database, Drupal, availability, user, node, and comment statistics.
• Financial and billing information.
• Recorded phone calls.
• Office-visitor information, including name, contact details, company, arrival time, and date.
• Extensive employee/customer workforce information, including employment history, supervisor, work location, emergency contacts, photographs, biographies, social-media information, login credentials, device data, system-access logs, actions taken in the services, travel, training, and localization data.

Risk: The scope of personal and potentially sensitive information is materially broader. Customers may need to update notices, consent mechanisms, data maps, retention rules, and vendor assessments.

2. Linking customer telemetry to identifiable users

The revised language states that website/service statistics and technical information may be linked to personally identifiable information and user accounts. It also states that Acquia may use this information to provide technical support, improve services, and administer the site.

Risk: This reduces the practical distinction between anonymous analytics and identifiable customer data and may create additional controller/processor, transparency, and security obligations.

3. Customer representations and responsibility

Customers providing personal data about other individuals now represent that they have authority and, where required, obtained necessary consent. The policy also says customer-controlled data is processed to provide contractually agreed services, with the customer determining the type and extent of personal data.

Risk: Customers bear clearer responsibility for lawful collection and disclosure, including workforce and end-user data. The expanded categories may exceed what customers previously expected to provide.

4. Broader marketing use

Marketing language is broadened from primarily service-related communications to products, services, special deals, promotions, and communications from third-party providers or Acquia technology partners. Opt-out rights remain, but service-related communications generally cannot be refused except by deactivating the account.

Risk: Increased marketing exposure and potential compliance issues under email, telemarketing, and regional privacy laws.

5. AI-model training

No express language in the diff states that Acquia may use customer content, personal data, telemetry, or usage data to train, fine-tune, or evaluate AI models. No express prohibition or customer opt-out is added either.

Risk: The broad purposes—“improve” services, automated processing, and technical-support analytics—could be interpreted expansively. Customers seeking assurance should require a separate contractual statement addressing AI training, permitted data, de-identification, model providers, retention, and opt-out rights.

Key Changes and Risks

1. No express AI-training authorization identified

• The diff does not expressly add language authorizing Acquia to use customer data, customer content, personal data, or service data to train, fine-tune, evaluate, or improve generative AI or other machine-learning models.
• It also does not expressly prohibit such use.
• References to using information to “better provide technical support,” “improve the content and general administration” of the Site and services, or “maximize your digital experience” are broad service-improvement purposes, but they do not clearly establish whether data may be used for AI training.
• Customers should seek clarification on whether service-improvement activities include model training and whether customer data is isolated, de-identified, or shared with AI providers.

2. Broader and more detailed data collection

The revised text adds or expands categories of information that may be collected, including:

• Employment and professional information, such as title, department, supervisor, employment history, employer, and work status.
• Contact and emergency-contact details, physical addresses, photographs, biographical and directory information.
• Social-media links or posts, usernames, login credentials, device identifiers, localization data, and activity logs.
• Business travel, training, device-access, and actions performed while using services.
• Website and technical information, including IP address, operating-system and server versions, PHP/database versions, Drupal code, website availability, user statistics, nodes, users, and comments.
• Financial and billing information, including payment-card or bank-account details.

Risk: The categories are significantly more expansive and may include sensitive employment, authentication, location, and operational data.

3. Increased linking and profiling risk

• Website, service, and usage statistics may now be linked to personally identifiable information and user accounts.
• This creates a clearer basis for combining technical, behavioral, account, and customer-environment data.

Risk: Linking may increase profiling, re-identification, insider-access, and regulatory exposure—especially where customer end-user data is involved.

4. Customer responsibility and authority

• Customers are stated to control the type and extent of personal data processed.
• Customers must represent that they have authority and, where required, obtained consent to provide data relating to other individuals.
• Acquia may process that information under the Privacy Policy and for subscription-service purposes.

Risk: Customers may bear increased responsibility for ensuring lawful collection, notices, consents, and permitted disclosures to Acquia.

5. Marketing and communications

• Marketing language is broadened to include products, services, special deals, promotions, and communications from third-party providers or Acquia technology partners.
• Service-related announcements remain generally non-optional, while promotional communications are subject to opt-out rights.

6. International processing and rights contacts

• The policy continues to permit global transfers and processing by affiliates and third parties.
• Contact details and representative information for the EU, UK, and India are added or reorganized, potentially improving rights-request access.

Overall assessment

The principal change is a substantial expansion and clarification of data categories, technical telemetry, account linkage, and customer responsibilities. The diff contains no clear AI-training provision, but its broad service-improvement language should be clarified before assuming customer data is excluded from AI development or model training.

Summary

The provided diff does not include the text of the added language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine what legal terms changed or whether the additions create new risks.

AI Training and Customer Data

No substantive language concerning AI, machine learning, model training, data use, data retention, or data sharing is included in the diff provided. Therefore, it cannot be determined whether the revised document:

• Permits the customer’s data to be used to train or improve AI models;
• Uses customer data, prompts, outputs, or usage metadata for model development;
• Requires customer consent or provides an opt-out right;
• Anonymizes, aggregates, or de-identifies data before training;
• Allows data to be shared with affiliates, vendors, or third-party AI providers;
• Grants the provider ownership or broad usage rights over customer content; or
• Imposes retention, deletion, confidentiality, or security obligations.

Risk Assessment

Because the actual 372 added words are missing, no reliable assessment can be made of:

• New permissions to use customer data;
• Changes to intellectual-property ownership;
• Expanded provider discretion or liability limitations;
• New disclosures or consent requirements;
• Data-protection compliance obligations; or
• Conflicts with existing confidentiality or customer-data restrictions.

Information Needed

Please provide the actual added text, showing the revisions using the stated notation. The AI-training provisions should be reviewed particularly carefully for language such as “improve,” “develop,” “train,” “fine-tune,” “de-identified,” “aggregated,” “service data,” or “customer content,” as these terms can materially expand the provider’s rights to use customer information.

Summary of Important Changes

1. Customer and user data collected

The revised policy substantially expands and reorganizes the categories of personal data Acquia may collect. New or more specific categories include:

• Employment information, including employer, job title, department, supervisor, employment history, and employment status.
• Personal and business contact details, including home address, emergency contacts, physical business address, and phone numbers.
• Photographs, biographical information, social-media-related information, usernames, IDs, and login credentials.
• Device and IT-system information, including identifiers, operating-system details, server and database versions, IP addresses, localization data, and logs.
• Employee activity, including actions performed while accessing or using services, training information, business travel, and access to customer IT systems.
• Website and service metrics, including user counts, comments, nodes, availability, configuration, performance, security, and software-version information.

Risk: The scope of data collection is materially broader and includes potentially sensitive employment, authentication, operational, and employee-monitoring information. Customers should verify that they have appropriate notices, authority, and consents for data supplied about other individuals.

2. Customer-controlled processing

The policy continues to state that the customer determines and controls the type and extent of customer personal data processed by Acquia. However, the revised language adds more detailed categories of customer data subjects and data elements.

Acquia also states that information collected through Drupal modules and subscription services may be linked to personal information and user accounts and used to provide technical support and improve Acquia services.

Risk: Linking technical telemetry, website statistics, and operational data with identifiable customer accounts may increase profiling and re-identification risks. The customer’s contractual data-processing terms should be checked for consistency with this broader description.

3. Use of customer data to train AI models

No express change concerning AI training was identified in the supplied diff. The revised text does not expressly state that customer data, service data, prompts, outputs, website content, or telemetry may or may not be used to train, fine-tune, evaluate, or improve AI models.

The policy does refer generally to using information to “improve” Acquia’s content, services, technical support, and general administration. That language is not an explicit AI-training authorization, but it is broad enough to create uncertainty if Acquia later applies data to AI development.

Recommended action: Seek written clarification or contractual language confirming whether customer data and service-generated data are excluded from model training, or specifying the applicable consent, anonymization, opt-out, retention, and deletion controls.

4. Marketing and communications

The policy broadens marketing descriptions to include products, services, promotions, third-party providers, and Acquia technology partners. Service-related communications remain generally non-optional, while promotional communications may be declined.

5. Other notable changes

• Acquia may record telephone calls.
• Cookies, web beacons, device identifiers, and usage data are described in greater detail.
• Global transfers to affiliates and third parties are reaffirmed.
• Privacy contact details and regional representatives are updated.
• The policy adds a representation that customers have authority and required consent for personal data relating to others.

Diff Analysis

Scope of the Review

The supplied diff does not include the actual added, deleted, or replacement language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine what legal terms changed or whether the amendments create new obligations or risks.

AI Training and Customer Data

No conclusions can be drawn about whether the changes:

• Permit the provider to use customer data, content, prompts, outputs, or metadata to train AI models;
• Allow use of data for model improvement, benchmarking, research, or product development;
• Apply such use by default or only with customer consent or an opt-out;
• Restrict training to aggregated, de-identified, or anonymized data;
• Permit disclosure of customer data to affiliates, contractors, or third-party AI providers;
• Establish retention, deletion, or confidentiality protections for training data; or
• Give the customer ownership or control over models trained using customer data.

Other Legal Risks That Cannot Be Assessed

The missing language also prevents review of potential changes to:

• Data ownership and license rights;
• Confidentiality and security obligations;
• Privacy-law compliance;
• Intellectual-property rights in inputs and outputs;
• Indemnities and liability limitations;
• Service suspension or termination rights;
• Audit and compliance rights;
• Data location and international transfers; and
• Notice, consent, or amendment procedures.

Required Information

Please provide the full marked-up text, including the language represented by {} for additions, [] for deletions, and []{} for replacements. Without the actual wording, any assessment of legal effect—particularly regarding AI-model training—would be speculative.

Executive Summary

The diff is extensive but appears to be primarily a rewrite, reorganization, and expansion of the Privacy Policy rather than a targeted change to AI-related data use. The most important substantive changes concern expanded data collection, broader use of customer and website data, marketing, and categories of data subjects.

Important Changes and Risks

1. Expanded categories of personal data collected

The revised text adds or expressly identifies:

• Device and usage identifiers, including IP addresses, cookies, web beacons, and similar technologies.
• Financial and billing information.
• Call recordings.
• Visitor information, including name, contact details, company, and visit date/time.
• Employment and professional data, including job title, department, supervisor, employment history, employer, business travel, training, and work status.
• Photographs, biographical information, social-media-related information, login identifiers, and localization data.
• Information about users’ devices, access to IT systems, actions performed within the Services, and usage logs.

Risk: The policy now clearly covers substantially more sensitive or operational data, including employee information, credentials-related identifiers, location data, and website telemetry.

2. Broader collection through Drupal and subscription modules

The revised language states that Drupal installations connected to Acquia subscription services may report:

• IP address and operating-system details;
• Web-server, PHP, database, and software-version information;
• Website availability;
• Website statistics, including nodes, users, and comments.

This information may be linked to personally identifiable information and user accounts and used to provide technical support, support customers, and improve Acquia’s services.

Risk: Customer website and operational data may be associated with identifiable accounts and used for purposes beyond strictly delivering the service. Customers should assess whether this conflicts with their own privacy notices, data-processing instructions, or regulatory obligations.

3. Expanded marketing and partner communications

The revised policy adds or restores broader communications regarding products, services, special deals, promotions, and future purchases, including communications from third-party providers and Acquia technology partners. Opt-out rights remain available for some communications, but service-related communications generally cannot be opted out of except by deactivating the account.

Risk: Customers may receive more marketing communications and may have less practical control over service-related messaging.

4. Customer-controller framework clarified

The policy states that the customer determines and controls the type and extent of personal data processed by Acquia, while Acquia processes it to provide contractually agreed Services. It also adds detailed categories of customer representatives and end users.

Risk: Customers remain responsible for ensuring they have authority and, where required, consent to provide data concerning employees, contractors, users, and other individuals.

AI Model Training

No express change regarding AI training was identified in the supplied diff. The revised language does not expressly state that customer data, customer content, website statistics, support data, or personal data may be used to train, fine-tune, evaluate, or improve generative-AI or machine-learning models.

However, the broader purposes—particularly “improve” services, automated processing, technical support, and use of website and usage data—could create ambiguity if Acquia later uses such data for AI development. Customers should seek confirmation that customer data is not used for model training unless expressly authorized, and should check any separate Services Agreement, Data Processing Addendum, or AI terms.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to identify the substantive changes, new obligations, allocation of risk, or effects on customer data and AI-model training.

AI Training and Data Use

No language is provided addressing whether customer data may be:

• Used to train, fine-tune, or improve artificial-intelligence or machine-learning models;
• Used to develop products, services, or features;
• De-identified, aggregated, or combined with other data;
• Shared with affiliates, vendors, or third-party AI providers;
• Retained after termination;
• Used for automated decision-making; or
• Excluded from model-training activities unless the customer opts in or opts out.

Because the added text is unavailable, no conclusion can be drawn about whether the amendment expands or restricts these rights.

Risks That Cannot Yet Be Assessed

The missing language may materially affect:

• Confidentiality: Whether customer information remains confidential when used for model development.
• Intellectual property: Whether the provider receives rights in customer content, outputs, derivatives, or model parameters.
• Privacy and regulatory compliance: Whether personal data may be processed for purposes beyond providing the contracted services.
• Control and consent: Whether the customer has an opt-out, deletion, audit, or approval right.
• Security: Whether data is transferred to third-party model providers or processed outside the customer’s approved environment.
• Retention: Whether data or derived information remains available after account termination.
• Indemnification and liability: Whether the provider disclaims responsibility for AI-related errors, unauthorized use, or regulatory violations.

Information Needed

Please provide the actual 372 words added to the document, together with any surrounding provisions that the new language modifies or references. The full redlined text is necessary to determine the legal effect and identify any new or heightened risks, especially concerning customer-data use for AI training.

Summary of Important Changes

1. Expanded categories of personal data collected

The revised policy substantially expands the examples of information Acquia may collect. New or more specific categories include:

• Employment history, employer, job title, department, supervisor, and work status
• Personal and business contact details, including home address, emergency contacts, and phone numbers
• Photographs and biographical information
• Social-media profiles or posts
• User names, IDs, login credentials, and identifiers associated with devices or access to IT systems
• Employee actions performed while using the Services
• Business travel, training, localization, and other workforce-related information
• Visitor information, including arrival date and time
• Recorded telephone calls
• Financial and billing information

Risk: The policy now supports collection of significantly more sensitive, employment-related, behavioral, and account-access information. Customers should verify that they have appropriate notices, consents, and contractual authority for supplying this data.

2. Increased monitoring of websites and service usage

Acquia may collect and link to customer accounts:

• IP addresses and device or server configuration data
• Drupal version, PHP and database versions
• Website availability or “live/down” status
• Website statistics, including numbers of nodes, users, and comments
• Performance, security, configuration, and availability information

Drupal modules connecting installations to Acquia’s subscription services may automatically report this information to Acquia.

Risk: The revised wording more clearly permits telemetry and operational monitoring, and expressly allows this information to be linked to personally identifiable information and user accounts. This may create profiling, confidentiality, and data-minimization concerns, particularly where website statistics or technical data reveal customer operations.

3. Broader marketing and third-party communications

The prior policy focused more narrowly on service-related communications. The revised language permits communications about products, services, special deals, and promotions, potentially involving third-party service providers or Acquia technology partners. Service-related communications remain generally non-optional, and users may need to deactivate their accounts to avoid them.

Risk: Customers may receive broader marketing communications, with limited opt-out rights for service-related messages.

4. Customer data processing framework

The policy continues to state that the customer determines the type and extent of customer personal data and acts as controller, while Acquia processes it to provide contractual Services. The revised text adds more detailed categories of customer representatives and end users.

Risk: The policy alone does not establish clear limits on retention, subprocessors, international transfers, or use beyond service delivery. Those matters should be checked in the applicable data processing agreement.

5. AI-model training

No express change addressing AI training was identified in this diff. The revised text does not expressly say that customer data, prompts, content, telemetry, or personal data may—or may not—be used to train, fine-tune, evaluate, or improve Acquia’s or third parties’ AI models.

Key risk: The absence of an AI-specific restriction leaves uncertainty. Customers should seek written confirmation that customer content and personal data will not be used for model training except with explicit authorization, and should clarify treatment of de-identified, aggregated, telemetry, and support data.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine:

• What legal terms were added, deleted, or replaced;
• Whether liability, indemnity, confidentiality, termination, or other obligations changed;
• Whether the customer granted new rights to use its data;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, vendors, or other third parties;
• Whether the customer can opt out of AI training or request deletion of training data; or
• Whether new security, privacy, retention, or intellectual-property risks were introduced.

Please provide the full redline text, including the words shown in {additions}, [deletions], and []{replacements}. Once provided, the changes can be analyzed for their legal effect and AI-training implications.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 372 words to the document”

As a result, it is not possible to identify the substantive legal changes, new obligations, allocation of risk, or effects on customer data.

AI Training and Data Use

No language is provided addressing whether customer data may be:

• Used to train, fine-tune, or improve AI models;
• Used to develop products, services, or algorithms;
• Retained after the customer relationship ends;
• Shared with affiliates, vendors, or model providers;
• De-identified, aggregated, or otherwise transformed before use;
• Excluded from model training by default or only upon opt-out;
• Used to generate or retain prompts, outputs, embeddings, logs, or metadata.

Accordingly, no conclusion can be reached about whether the amendment expands or restricts AI-related data use.

Important Risks Requiring Review

The missing text should be checked for:

1. Consent and scope — Whether customer data can be used for purposes beyond providing the contracted services.

2. Training rights — Whether the provider receives a broad, perpetual, irrevocable, worldwide, or royalty-free license to use data for AI training.

3. Confidentiality — Whether data used for training remains confidential and subject to contractual safeguards.

4. Deletion and retention — Whether training datasets, backups, logs, and derived data are deleted upon request or contract termination.

5. Third-party access — Whether data may be sent to external AI providers or used to train third-party models.

6. Customer control — Whether customers can opt out, and whether the opt-out applies retroactively.

7. Ownership and outputs — Whether the provider claims rights in customer data, derived data, models, or AI-generated outputs.

8. Compliance and liability — Whether the amendment changes responsibility for privacy, confidentiality, intellectual-property infringement, or regulatory violations.

Information Needed

Please provide the actual added, deleted, and replacement language. Without the text of the 372-word addition, a reliable legal comparison cannot be performed.

Summary of Important Changes

1. AI-Model Training

• No express change addresses training, fine-tuning, evaluating, or improving AI models.
• The revised text does not state whether customer data, usage data, support communications, website content, or personal data may be used to train Acquia’s or third-party AI models.
• Because the policy adds broad language about using information to “better provide technical support,” improve content, administer services, and maximize the digital experience, there is some ambiguity about whether data could be used for automated analytics or AI-enabled service improvement.
• Customers should seek clarification or contractual restrictions confirming that customer content and personal data will not be used for AI training unless expressly authorized.

2. Expanded Categories of Personal Data

The revised policy substantially expands the categories of information that may be collected, particularly in the customer-data processing section. New or more detailed categories include:

• Employment history, employer, department, title, supervisor, and employment status.
• Personal and business contact details, including home address, phone number, emergency contact information, and physical business address.
• Photographs, biographical and directory information.
• Linked social-media profiles or posts.
• Usernames, IDs, login credentials, and identifiers associated with devices used to access IT systems.
• IT-system logs, actions performed while using the services, training information, business-travel arrangements, and localization data.

Risk: The policy now potentially covers sensitive workforce, authentication, behavioral, and location-related information. Customers may need to verify that their notices, consents, data inventories, and data-processing agreements cover these categories.

3. Expanded Telemetry and Service Monitoring

The revised language more clearly permits Acquia to collect and link:

• IP addresses and operating-system, web-server, PHP, database, and service-version information.
• Drupal code and technical configuration information.
• Website availability status.
• Website statistics, including numbers of nodes, users, and comments.
• Information linked to personally identifiable information and user accounts.

This information may be used to provide technical support, improve Acquia’s services, administer the Site, and support the customer relationship.

Risk: Linking technical telemetry and website statistics to identifiable accounts increases profiling and re-identification risks. Customers should confirm whether this telemetry includes customer content, end-user activity, or regulated data.

4. Broader Marketing and Disclosure Language

• Marketing language changes from limited service-related announcements to communications about products, services, special deals, and promotions.
• Communications may involve third-party service providers and Acquia technology partners.
• Global transfers and disclosures to affiliates, partners, vendors, and service agencies remain broadly permitted.

5. Other Changes

• The policy adds recording of phone calls.
• It adds visitor information collection, including name, contact details, company, and arrival date/time.
• It adds clearer procedures and contact details for privacy requests and regional representatives.

Overall assessment: The revision significantly broadens data collection and operational uses, but contains no clear AI-training authorization or prohibition.

Summary

The diff only states that approximately 372 words were added, but does not include the added language or identify where it appears in the agreement.

AI Training and Data Use

• It is not possible to determine whether the changes permit, restrict, or otherwise affect the use of customer data to train AI models.
• The diff does not reveal whether the agreement now addresses:
• Training or fine-tuning AI or machine-learning models using customer data;
• Whether customer data, prompts, outputs, or usage data may be used;
• Whether data is used for general product improvement or only to provide services;
• Opt-out rights or consent requirements;
• Retention, deletion, anonymization, or aggregation of data;
• Whether subcontractors or third-party AI providers may access the data;
• Ownership of customer inputs, outputs, or models;
• Confidentiality and security protections applicable to AI processing; or
• Restrictions on using personal, sensitive, or regulated information.

Legal and Commercial Risks

Because the actual added wording is missing, the following potential risks cannot be assessed:

• Expansion of the provider’s license to use customer content;
• Use of customer data for purposes beyond contract performance;
• Disclosure of data to affiliates, vendors, or AI providers;
• Reduced confidentiality or privacy protections;
• Broad rights to retain or reuse data after termination;
• Unclear ownership or permitted use of AI-generated outputs; and
• New customer obligations, warranties, indemnities, or liability limitations.

Conclusion

No substantive legal analysis can be performed from the provided diff. The approximately 372 added words—or a redline showing the actual additions—are needed to identify the changes, assess their effect, and determine whether customer data may be used to train AI models.

Summary of Important Changes

1. Expanded categories of personal data collected

The revised policy substantially expands the types of information Acquia may collect, including:

• Employment information, such as job title, department, supervisor, employment history, employer, work status, training, and business travel.
• Personal and business contact details, including home address, emergency contacts, phone numbers, and physical addresses.
• Photographs, biographical and directory information.
• Social-media profile links or posts, company usernames or IDs, and login credentials.
• Device and access information, including identifiers, IP address, operating-system and server details, software versions, localization data, and activity logs.
• Website and service usage information, including website availability, user statistics, number of nodes, users, and comments.
• Financial and billing information, including credit-card or bank-account information.

Risk: The collection scope is materially broader and may include sensitive employment, security, authentication, and operational information. Customers should verify that they have appropriate notices, permissions, and legal bases for providing this information, particularly where it relates to employees, end users, or other individuals.

2. Increased monitoring of customer websites and service usage

The revised language more clearly states that Drupal modules connected to Acquia subscription services may report information to Acquia. Acquia may collect technical data and website statistics, link that information to personally identifiable information and user accounts, and use it to provide technical support and improve Acquia’s sites and services.

Risk: Customer activity and website telemetry may be associated with identifiable customer accounts. The policy does not, in this diff, specify detailed retention periods, aggregation standards, or limits on secondary use.

3. Broader marketing and communications use

The policy changes from primarily service-related or limited communications to allowing information about products, services, special deals, and promotions, including communications from third-party providers and Acquia technology partners. Users may opt out of promotional communications, but service-related communications generally cannot be opted out of except by deactivating the account.

Risk: Customers and users may receive broader marketing communications, and data may be shared with partners for those purposes. The distinction between “service-related” and promotional communications could be disputed or applied broadly.

4. New collection practices

The revised policy adds or clarifies collection of:

• Information submitted through surveys, events, webinars, contests, questionnaires, support requests, and content downloads.
• Device and usage data collected through cookies, web beacons, and similar technologies.
• Financial information for purchases.
• Recorded phone calls.
• Visitor information for Acquia offices.

It also adds an express requirement that individuals providing information about others have authority and, where required, consent.

5. AI-model training

No express change regarding AI or use of customer data to train AI models is identifiable in this diff. The revised language does not mention artificial intelligence, machine learning, model training, model improvement, prompts, outputs, or training datasets.

However, the broader rights to collect, link, analyze, and use website, account, usage, and technical information to improve Acquia’s sites and services could create ambiguity if Acquia later applies those data to AI-related development. Customers should seek separate contractual confirmation that customer content, service data, prompts, and outputs will not be used to train or improve models without express authorization.

Summary

The provided diff states only that “approximately 372 words” were added. It does not include the actual added language, deletions, or replacements.

Key Legal Changes

• Cannot be determined: The substance of the changes, including modifications to rights, obligations, liability, confidentiality, data processing, termination, or governing law, is not provided.
• No comparison possible: Because the original and revised wording are absent, it is not possible to identify whether provisions were expanded, narrowed, or otherwise changed.

Customer Data and AI Training

• No determination possible: The provided information does not reveal whether customer data may be:
• Used to train, fine-tune, evaluate, or improve AI or machine-learning models;
• Shared with affiliates, vendors, or other third parties for model development;
• Used in aggregated, de-identified, or anonymized form;
• Retained after termination for AI-related purposes; or
• Excluded from training or subject to an opt-out.

• Important risk to check: Any newly added language permitting use of customer content, inputs, outputs, usage data, or telemetry for AI training could materially expand the provider’s rights and create confidentiality, privacy, intellectual-property, or regulatory risks.

Information Needed

Please provide the actual redline text, including:

1. The original language;

2. The revised language; and

3. The additions, deletions, and replacements.

Without the underlying wording, no reliable legal-risk analysis can be performed.

Summary of Important Changes

AI Model Training

• No express provision addressing AI training was added or removed in the supplied diff.
• The revised text does, however, expand the categories of information Acquia may collect and link to identifiable users or accounts. This could become relevant if such information is later used in AI systems, but the policy does not state:
• whether customer data is used to train, fine-tune, or evaluate AI models;
• whether customer content is excluded from training;
• whether data is anonymized or de-identified before AI use;
• whether third-party AI providers receive the data;
• how customers or individuals can opt out; or
• how long AI-related copies or derived data are retained.
• Customers should seek clarification in the services agreement, data-processing addendum, or a specific AI/data-use policy. The absence of a restriction is a potential interpretive and compliance risk, particularly for confidential customer content and regulated personal data.

Expanded Data Collection

The revised policy substantially broadens the information Acquia may collect, including:

• employment and organizational information, such as job title, department, supervisor, employment history, employer, and work status;
• personal and business contact details, physical addresses, emergency contacts, photographs, and biographical information;
• social-media profiles or posts, usernames, login credentials, device identifiers, localization data, and activity logs;
• information about access to a customer’s IT systems and actions performed while using the Services;
• business travel, training, and device-use information; and
• financial and billing information, including credit-card or bank-account information.

Risk: The expanded categories may increase privacy, security, breach, minimization, and employee-monitoring obligations. Some data may be sensitive depending on context.

Customer Website and Service Telemetry

• Acquia now states that Drupal modules connected to its subscription services may report technical information, including IP address, software versions, website availability, and website-user statistics such as numbers of users, nodes, and comments.
• This information may be linked to personally identifiable information and user accounts and used to improve technical support, the Site, and Acquia’s services.

Risk: Linking operational or usage data to identifiable individuals increases profiling and re-identification concerns. Customers should confirm whether this telemetry can include customer content, end-user data, or production identifiers.

Marketing and Third-Party Disclosures

• Marketing language is broader: Acquia may send information about products, services, deals, and promotions, including communications from third-party providers and technology partners.
• It may share information with affiliates, partners, vendors, and service agencies.

Risk: Customers and users may receive broader marketing communications and may need to rely on opt-out mechanisms.

Other Changes

• Acquia may record telephone calls.
• Global transfers and access by affiliates and third parties are expressly described.
• The policy adds more detailed rights-request contacts and regional representatives.
• Customers providing information about other individuals must represent that they have authority and, where required, obtained consent.

Summary of Important Changes

AI Model Training

• No express reference to artificial intelligence, machine learning, generative AI, model training, fine-tuning, or use of customer data to develop AI models appears in the supplied diff.
• The revised language does, however, expand the categories of data Acquia may collect and use—including website telemetry, user statistics, Drupal code, device identifiers, usage information, support communications, and extensive employee information. Those provisions could create practical concern if such data is later used for analytics, product improvement, or AI-related purposes, but the diff itself does not authorize AI training expressly.
• Customers should confirm whether Acquia’s broader terms, service-specific notices, or data-processing addenda contain separate AI-training rights or restrictions.

Expanded Data Collection

The revised policy adds or clarifies collection of:

• Device and usage data, including IP addresses and other identifiers, cookies, web beacons, and email-interaction data.
• Financial and billing information, including credit-card or bank-account information.
• Telephone-call recordings.
• Visitor information, including name, email, phone number, company, arrival time, and date.
• Extensive business and employee data, including employment history, manager, work status, business travel, training, localization data, social-media information, login credentials, device-access data, and employee actions within systems.
• Website and Drupal telemetry, including IP address, operating-system and server versions, PHP/database versions, Drupal code, website availability, number of nodes, users, comments, and other user statistics.

Risk: The scope is materially broader and includes potentially sensitive information and credentials. Customers should assess whether the listed data is actually necessary and whether the policy aligns with their notices, consents, and contractual data-minimization obligations.

Linking and Use of Customer Data

• Website, service, and usage information is expressly stated to be linked to personally identifiable information and user accounts.
• Acquia may use this information to provide technical support, support customers, improve the Site and services, administer content, and maximize the customer’s digital experience.
• Drupal modules may automatically report technical and usage information to Acquia.

Risk: Linking telemetry to identifiable accounts increases profiling and re-identification risks. Customers may need to disclose this processing to their users and ensure contractual authorization exists.

Marketing and Communications

• Promotional communications expand from product/service updates to products, services, special deals, and promotions, potentially involving third-party providers and Acquia technology partners.
• Service-related communications remain generally non-optional, although the revised wording says users may deactivate their accounts instead.

Risk: Broader marketing disclosures and third-party involvement may create consent, electronic-marketing, and employee-communication compliance issues.

Customer Responsibilities and Transfers

• The policy reinforces that the customer controls the type and extent of customer personal data processed by Acquia.
• Customers providing data about others represent that they have authority and, where required, obtained consent.
• Global transfers to Acquia affiliates and third-party processors remain contemplated.

Risk: Customers should verify processor terms, international-transfer mechanisms, subprocessor disclosures, retention provisions, and security obligations separately.