appcues

Key Changes and Risks

1. New “last updated” date and reorganized privacy overview

• The policy is now identified as “Privacy Policy — Last updated: May 2026.”
• The introductory security and privacy overview has been substantially rewritten.
• New or emphasized topics include:
• At-rest and in-transit encryption
• Customer control through identity verification
• The shared responsibility model for security and privacy
• The Appcues Trust Center and related implementation measures
• The amount of personally identifiable information (“PII”) handled by Appcues

Risk/impact: These additions may provide more detail about security practices, but they also appear to shift important information to the Trust Center and other referenced materials. Customers should verify whether those materials are contractual, incorporated into the policy, or subject to change without notice.

2. Broader description of third-party data use

The policy continues to state that Appcues does not sell data to third parties, but the wording concerning disclosures has been clarified or expanded. Appcues may provide data to third-party services:

• For use within or in support of the Appcues product or business;
• At the direction of the customer; and
• For purposes such as providing analytics graphs in the Appcues Studio application and managing related services.

Risk/impact: Although this is not described as a sale, the provision may authorize broader sharing with service providers and other third parties. The excerpt does not identify the categories of providers, data involved, geographic locations, retention limits, or whether providers may use data for their own purposes. Customers should review the vendor/subprocessor list and applicable data-processing terms.

3. Potential change to deletion or aggregation language

The prior language appears to state that certain data is deleted or aggregated in the ordinary course of business, with deletion requests directed to support@appcues.com. The revised text is difficult to reconstruct from the diff, but the deletion/aggregation statement appears to have been moved or altered.

Risk/impact: Any removal or narrowing of routine deletion or aggregation commitments could increase retention uncertainty. The complete revised policy should be reviewed to confirm retention periods and deletion rights.

4. No express AI-model training authorization identified

The provided diff contains no clear new language authorizing Appcues to use customer or end-user data to train, fine-tune, validate, or improve AI models. It also does not expressly prohibit such use.

The references to analytics, third-party services, and use “within or in support of” the Appcues business could potentially be broad enough to raise questions about AI-related processing, but they do not expressly establish an AI-training right in the excerpt.

Recommended action: Confirm in the full policy, data-processing agreement, and subprocessors list whether customer data, prompts, outputs, telemetry, or end-user data may be used for AI training or product improvement, and whether customers can opt out.

Summary

The diff does not include the text of the approximately 86 added words. It only indicates that additional language was inserted.

Legal and Commercial Impact

• The specific legal effect of the amendment cannot be determined without seeing the added wording.
• It is not possible to assess whether the changes:
• Expand or restrict the customer’s rights;
• Change confidentiality, privacy, security, or data-retention obligations;
• Add new warranties, indemnities, liability exposure, or compliance duties;
• Modify termination, audit, or subcontracting rights; or
• Change ownership or licensing of customer data or derived data.

AI Training and Customer Data

The provided diff contains no substantive language addressing AI or machine-learning model training. Accordingly, it is not possible to determine whether the amendment:

• Permits or prohibits using customer data to train, fine-tune, validate, or improve AI models;
• Limits training to de-identified, aggregated, or anonymized data;
• Allows use of prompts, inputs, outputs, metadata, or usage data for model development;
• Gives the provider ownership or broad usage rights over customer data or model outputs;
• Requires customer consent or provides an opt-out mechanism;
• Imposes data deletion, retention, segregation, or confidentiality requirements; or
• Allows customer data to be shared with affiliates, vendors, or third-party model providers.

Risk Assessment

No reliable risk assessment can be completed from the supplied information. The actual 86 added words are required to identify new obligations, permissions, or risks—particularly any authorization to use customer data for AI training.

Executive Summary

The revision substantially reorganizes the account, access-rights, and acceptable-use provisions. It adds operational requirements and a new framework for Appcues AI Features, but the supplied diff does not expressly state whether customer data, prompts, outputs, or usage information may be used to train AI models.

Important Changes and Risks

1. Account registration and security obligations

New provisions require that:

• Accounts be registered by a human; bot or automated registrations are prohibited.
• Customers provide a valid email address and other information requested by Appcues.
• Customers maintain the security of their account and password.
• Customers use the Services only for lawful or authorized purposes.
• One person or legal entity may not maintain more than one account.

Appcues disclaims liability for losses caused by the customer’s failure to comply with the security obligation. This may increase the customer’s responsibility for unauthorized access or compromised credentials.

2. Privacy policy incorporation

The revision states that personally identifiable information submitted by the customer is subject to Appcues’ Privacy Policy. This is important because the Privacy Policy may contain additional disclosures about data collection, analytics, service providers, retention, international transfers, or AI-related processing.

Risk: The contract does not reproduce or limit those practices. Customers should review the Privacy Policy and determine whether it permits uses inconsistent with their internal policies, customer commitments, or data-processing agreements.

3. New AI Features provisions

The revision adds provisions stating that use of Appcues AI Features:

• Must comply with the Acceptable Use Policy.
• Is subject to a separate AI AUP available at appcues.com/ai-aup.
• Is otherwise governed by the general Service access and usage provisions.

The AI AUP is incorporated by website reference, apparently without its terms being included in the agreement.

AI training impact: The diff does not expressly grant Appcues the right to use customer data, prompts, inputs, outputs, or usage data to train, fine-tune, evaluate, or improve AI models. It also does not expressly prohibit those activities. The absence of a clear restriction leaves an important issue to the Privacy Policy, AI AUP, documentation, or other referenced terms.

Customers should seek express language confirming whether their data is:

• Used to train or improve Appcues’ or third-party models;
• Shared with AI vendors;
• Retained for model-development purposes; or
• Excluded from model training by default or upon request.

4. Expanded usage restrictions

The revised restrictions prohibit, among other things:

• Reselling, sublicensing, leasing, or providing the Services to others;
• Unlawful, infringing, defamatory, or privacy-violating content;
• Malicious code or interference with Service performance;
• Circumventing usage limits;
• Copying, framing, mirroring, or accessing the Services to build a competitive product.

These restrictions may limit integrations, benchmarking, reverse engineering, and use by affiliates or contractors unless expressly permitted in an order form.

5. Drafting and incorporation concerns

The diff contains extensive duplicated and interleaved text, suggesting formatting or redlining problems. The final agreement should be checked carefully to ensure that the operative version is coherent and that referenced AUPs, Privacy Policy terms, and documentation are identifiable, accessible, and subject to appropriate change controls.

Summary

The provided diff does not include the actual contractual language that was added, deleted, or replaced. It only states:

> “Added approximately 86 words to the document”

Accordingly, there is not enough information to assess the legal or commercial impact of the changes.

AI Training and Customer Data

• No clause concerning the use of customer data to train, fine-tune, validate, or improve AI models is included in the diff.
• It is therefore impossible to determine whether the changes:
• Permit or restrict AI training using customer data;
• Apply to personal data, confidential information, prompts, outputs, or usage data;
• Require anonymization, de-identification, or aggregation;
• Allow sharing of data with affiliates, subprocessors, or third-party model providers;
• Provide an opt-out right;
• Establish ownership or licensing rights in data or model outputs; or
• Address deletion, retention, security, or audit requirements.

Risk Assessment

No specific new legal risks can be identified from the material provided. The statement that approximately 86 words were added is not itself a contractual provision and does not reveal the substance or effect of those additions.

Information Needed

Please provide the actual redline text, including:

• Added language in {braces};
• Deleted language in [brackets]; and
• Replacement language using the stated [old] {new} format.

The complete text is necessary to evaluate changes to data rights, AI model training, confidentiality, privacy, intellectual property, liability, and compliance obligations.

Summary

The supplied diff does not include the actual amended contract language. It only states:

> “Added approximately 186 words to the document”

Because the inserted wording is not provided, it is not possible to determine:

• What contractual provisions changed;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether customer data may be shared with affiliates, vendors, or model providers;
• Whether the customer’s confidential information or personal data is protected;
• Whether the customer can opt out of AI training or revoke consent;
• Whether the provider receives ownership or broad usage rights in customer data;
• Whether data is retained after termination or used in aggregated/de-identified form;
• Whether the provider disclaims responsibility for model outputs or data leakage; or
• Whether new security, privacy, indemnity, or regulatory obligations were added.

AI-Training Risk Assessment

No conclusion can be reached from the information provided. The phrase “Added approximately 186 words” does not identify whether the additions authorize AI training or otherwise expand the provider’s rights.

The actual added language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “evaluate” models;
• “machine learning,” “artificial intelligence,” or “generative AI”;
• “customer content,” “inputs,” “outputs,” or “usage data”;
• “de-identified,” “aggregated,” or “anonymized” data;
• rights granted to affiliates, subprocessors, or third-party AI providers;
• opt-out, consent, deletion, retention, or confidentiality provisions; and
• ownership or license rights that survive termination.

Information Needed

Please provide the complete diff, including the actual text within the addition markers ({}), deletion markers ([]), and replacement markers ([]{}). Without that text, a reliable legal-risk analysis is not possible.

Executive Summary

The diff appears to substantially reorganize the privacy policy and update its security/privacy overview. However, the excerpt is heavily fragmented, so some apparent changes may reflect formatting or section reordering rather than substantive revisions.

Important Changes

1. Expanded security and privacy overview

The policy now expressly references:

• Encryption at rest and in transit;
• Customer and end-user data generally;
• Customer control through identity verification;
• A “Shared Responsibility Model” for security and privacy; and
• The Appcues Trust Center and related implementation measures.

Risk: These statements may create clearer security commitments or expectations. If the Trust Center contains more specific promises, those materials could become relevant to contractual or regulatory claims.

2. Revised description of third-party data sharing

The prior language apparently stated that Appcues does not sell data, while allowing disclosures to third parties in specific cases. The revised language clarifies that data may be provided to third-party services:

• For use within or in support of the Appcues product or business;
• At the customer’s direction; and
• For examples including analytics graphs in the Appcues Studio application and management-related functions.

Risk: The wording is broader and may permit sharing with service providers or subprocessors for a wider range of product and business purposes. It does not appear to limit disclosures strictly to necessary processing, identify categories of recipients, or specify whether third parties may use the data for their own purposes. The “we never sell data” statement remains, but “sale” is narrower than general sharing or disclosure.

3. Deletion and aggregation language retained or clarified

The excerpt refers to information being deleted or aggregated in the ordinary course of business and states that deletion requests may be sent to support@appcues.com.

Risk: “Ordinary course of business” may allow retention for an unspecified period. The policy does not appear to state clear deletion timelines, backup exceptions, or whether aggregated data can be retained indefinitely.

4. Contact and policy-update provisions

The contact section is reformatted and expressly invites questions about privacy, collection and use of personal information, and exercise of legal rights. The policy also retains language indicating that continued use constitutes acceptance of modifications.

Risk: Deemed acceptance through continued use may be insufficient for certain legal changes or jurisdictions requiring notice or consent.

AI Training Analysis

No express language in the supplied diff authorizes or prohibits using customer or end-user data to train, fine-tune, evaluate, or improve AI models. The revised references to analytics and third-party services do not, by themselves, clearly grant AI-training rights.

Nevertheless, the broader language permitting data use “within or in support of the Appcues product or business” could create ambiguity if Appcues later uses data for AI development. Customers should seek an explicit statement addressing AI training, including data eligibility, de-identification, opt-out rights, model ownership, retention, and restrictions on using customer data for general-purpose models.

Summary

The supplied diff does not include the actual amended contractual language. It only states:

> “Added approximately 86 words to the document”

Because the added words are not provided, it is not possible to assess:

• Changes to the parties’ rights or obligations
• New liability, indemnity, confidentiality, or termination risks
• Changes to data ownership, licensing, or permitted uses
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether customer data may be disclosed to service providers or third-party AI vendors
• Any opt-out, consent, deletion, security, or retention provisions relating to AI training

AI-Training Review

No language addressing AI models or the use of customer data for AI training appears in the supplied material. This does not establish that the contract contains no such language; it only means the relevant text was omitted from the diff.

Required Information

Please provide the actual 86 added words, along with any surrounding deleted or replaced language. The analysis should specifically check whether the new provision:

1. Grants a license to use customer data for model training or improvement.

2. Applies to personal, confidential, proprietary, or regulated data.

3. Allows use of aggregated, de-identified, or anonymized data.

4. Permits sharing data with affiliates, contractors, or third-party model providers.

5. Makes AI training use automatic or subject to customer consent or opt-out.

6. Requires deletion or stops further training after termination.

7. Allocates responsibility for privacy, security, intellectual-property, or regulatory claims.

Summary

The provided diff does not include the actual amended contractual language. It only states:

> “Added approximately 186 words to the document”

Accordingly, the specific legal changes, new obligations, and risks cannot be determined.

AI Training and Data Use

No language was provided addressing whether the customer’s data may be:

• Used to train, fine-tune, or improve AI models;
• Used to develop products or services;
• Shared with affiliates, vendors, or third parties for AI-related purposes;
• Anonymized, aggregated, or otherwise processed for model training;
• Retained after termination for training or evaluation;
• Excluded from training by default or only upon customer request; or
• Subject to opt-out, consent, confidentiality, security, or deletion requirements.

Therefore, no conclusion can be reached about whether the contract expands or restricts the provider’s rights to use customer data for AI training.

Other Legal Risks

The actual additions are necessary to assess potential changes involving:

• Data ownership and licensing rights;
• Confidentiality and permitted uses;
• Privacy and regulatory compliance;
• Security and breach responsibilities;
• Subprocessors and third-party disclosures;
• Intellectual-property ownership;
• Indemnities and liability limitations;
• Data retention and deletion; and
• Termination rights or post-termination obligations.

Required Information

Please provide the 186 words of added text, together with any surrounding or replaced language. Without the substantive diff, a reliable legal analysis is not possible.

Important Changes

1. New AI-specific provisions

• The revised terms add references to “Appcues AI Features.”
• Use of AI Features must comply with a separate AI Acceptable Use Policy at appcues.com/ai-aup.
• The AI provisions appear to impose usage restrictions, but the diff does not state:
• Whether customer data, prompts, inputs, outputs, or usage data may be used to train, fine-tune, or improve AI models;
• Whether data is shared with third-party AI providers;
• Whether customer data is retained by AI providers;
• Whether customers can opt out of training or secondary uses; or
• Who owns AI-generated outputs.

Risk: The terms introduce AI functionality without clearly addressing AI data governance. Any permissions regarding model training may instead be contained in the separate AI AUP, Privacy Policy, or other linked documents. Those documents should be reviewed and incorporated terms should be controlled contractually.

2. Privacy Policy is expressly incorporated

• Personally identifiable information submitted by the customer is now stated to be subject to Appcues’ Privacy Policy.
• This creates an additional external document governing customer information and potentially permits data processing practices not described in the Terms.

Risk: The Privacy Policy may be changeable without negotiation and may address analytics, product improvement, AI processing, retention, or disclosures to vendors. The contract does not appear to establish a data-processing addendum, controller/processor roles, deletion obligations, or customer audit rights.

3. Account and security obligations change

The revised language:

• Requires accounts to be registered by a human;
• Prohibits bot or automated account registration;
• Requires a valid email address and other registration information;
• Makes the customer responsible for account and password security; and
• States that Appcues is not liable for losses caused by the customer’s failure to meet those obligations.

Risk: The liability disclaimer may reduce Appcues’ responsibility for account compromise, although its scope and interaction with any security commitments are unclear.

4. Expanded and reorganized usage restrictions

The revised terms consolidate restrictions and expressly prohibit, among other things:

• Illegal or unauthorized use;
• Providing access to anyone other than the customer or authorized users;
• Reselling, sublicensing, leasing, or using the Services as a service bureau;
• Misuse involving privacy rights, malicious code, system interference, circumvention of usage limits, copying, framing, or competitive product development.

The customer may also be limited to using the Services for one product, unless the Order Form says otherwise.

5. External AUP and AI AUP

• Email Services must comply with the general AUP.
• AI Features must comply with the AI AUP.

Risk: Important operational and compliance requirements are moved to web-based policies. Confirm whether Appcues may change those policies unilaterally and whether changes permit suspension, termination, or additional data use.

6. Drafting concern

The supplied diff contains substantial duplication and fragmented replacement text. The clean revised agreement should be reviewed to confirm that no provisions were accidentally omitted, especially termination, data handling, confidentiality, warranties, and liability terms.

Summary

The provided diff does not include the actual amended contract language. It only states that approximately 186 words were added. As a result, it is not possible to determine:

• What contractual provisions changed;
• Whether customer data may be used for AI model training;
• Whether any new consent, license, or ownership rights were granted;
• Whether data may be shared with affiliates, vendors, or third parties;
• Whether confidentiality, security, retention, or deletion obligations changed; or
• Whether the customer received any opt-out or objection rights.

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training because the added language is not shown. In particular, the missing text should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models;
• “machine learning,” “artificial intelligence,” or “generative AI”;
• rights to use “content,” “customer data,” “inputs,” “outputs,” or “usage data”;
• broad licenses allowing use for business, research, product-improvement, or commercial purposes;
• aggregation, de-identification, or anonymization provisions;
• sharing data with subprocessors or model providers; and
• restrictions or commitments concerning human review, model memorization, or deletion.

Needed Information

Please provide the actual 186 words added, together with any surrounding or replaced language. Without the text of the additions, a legal risk analysis would be speculative.

Executive Summary

The diff appears to substantially restructure the Privacy Policy’s opening sections and security overview. It does not expressly add language authorizing the use of customer data to train AI models. However, the excerpt is heavily fragmented, so the full revised policy should be reviewed to confirm that no AI-training provision appears elsewhere.

Important Changes and Risks

1. Security and privacy framework replaces information-collection overview

The policy changes from describing categories of information collected to emphasizing:

• At-rest and in-transit encryption;
• Customer control over the amount of personally identifiable information handled by Appcues, through “Identity Verification”;
• A shared-responsibility model for security and privacy;
• The Appcues Trust Center and related implementation measures.

Risk: This may provide more general security information but less direct detail about what data Appcues collects, how it is categorized, and how each category is used. Customers may need to consult the Trust Center or other incorporated materials to understand the applicable controls and commitments.

2. Third-party service language is clarified and expanded

The policy retains the statement that Appcues does not sell data to third parties, but describes disclosures to third-party services:

> “for use within or in support of the Appcues product or business or at the direction of our customers”

A new example appears to involve providing analytics graphs in the Appcues Studio application. The wording also appears to state that data may be deleted or aggregated in the ordinary course of business.

Risks:

• The phrase “in support of the Appcues product or business” is broad and could permit sharing with a wider range of vendors or service providers.
• “At the direction of our customers” may shift responsibility to customers for determining whether a particular disclosure is authorized.
• The excerpt does not identify the categories of data shared, the types of vendors involved, or applicable contractual restrictions.
• “Deleted or aggregated in the ordinary course of business” does not provide a specific retention period and may allow retention for an uncertain duration.

3. No express AI-model training authorization identified

The provided changes do not mention:

• Training, fine-tuning, or improving artificial intelligence or machine-learning models;
• Using customer data or end-user data as training data;
• De-identifying data for model development;
• Sharing data with AI providers for model training; or
• Customer opt-out or consent rights regarding AI training.

Accordingly, no new AI-training right can be confirmed from this excerpt. Nevertheless, the broad “support of the Appcues product or business” language could potentially be argued to cover analytics, product improvement, or similar activities unless restricted elsewhere in the policy, terms, or data-processing agreement.

4. Deletion-request and contact provisions are reorganized

The policy appears to preserve or add a deletion-request contact route through support@appcues.com and updates the contact section to invite questions and privacy-rights requests through that address.

Risk: The excerpt does not specify verification requirements, response deadlines, exceptions, or whether deletion requests apply to backups, aggregated data, or third-party providers.

Summary of Important Changes

1. AI features and training of customer data

• The revised terms expressly introduce “Appcues AI Features” and require their use to comply with a separate AI Acceptable Use Policy at appcues.com/ai-aup.
• The diff does not state:
• whether customer inputs, outputs, prompts, usage data, or personal data may be used to train, fine-tune, evaluate, or improve Appcues’ or third-party AI models;
• whether customer data is excluded from model training by default;
• whether data is shared with AI subprocessors or model providers;
• how long AI-related data is retained or how it is deleted; or
• whether the customer owns AI outputs or whether outputs may be reused by Appcues.
• This omission is a significant risk. The separate AI AUP may contain additional permissions, restrictions, or disclaimers, but those terms are not included in the diff. The customer should review and contractually confirm the data-use and training position, preferably in the Terms, Order Form, or a data-processing addendum.

2. New and expanded account obligations

The revision adds or clarifies that:

• Accounts must be registered by a human; automated or “bot” registrations are prohibited.
• Customers must provide a valid email address and other information requested during registration.
• Customers are responsible for account and password security.
• Appcues disclaims liability for losses resulting from the customer’s failure to meet those security obligations.
• Personally identifiable information submitted by the customer is subject to Appcues’ Privacy Policy.
• Customers may not maintain more than one account and may not use the Services for illegal or unauthorized purposes.

These provisions increase the customer’s operational and compliance responsibilities and incorporate the Privacy Policy, which may be changeable separately from the Terms.

3. Revised usage restrictions

The prior limited license and usage restrictions are reorganized and expanded into a detailed list. The revised restrictions prohibit, among other things:

• use for anyone other than the customer or authorized users;
• resale, sublicensing, leasing, service-bureau use, or inclusion in outsourcing offerings;
• unlawful, infringing, tortious, or privacy-violating content;
• malicious code or interference with Service integrity or performance;
• unauthorized access;
• circumventing contractual usage limits;
• copying, framing, mirroring, or reproducing the Services; and
• accessing documentation or Services to build a competitive product or service.

Violations may create suspension, termination, indemnity, or other liability exposure, depending on the rest of the agreement.

4. External policies and scope

• Email Services must comply with the general AUP.
• AI Features must comply with a separate AI-specific AUP.
• The revised language makes the customer’s access expressly limited to the subscription term, applicable Order Form, and internal business purposes.
• The phrase “one product, unless otherwise specified in your order form” may restrict multi-product or broader enterprise use unless expressly negotiated.

5. Drafting concern

The diff is highly repetitive and appears to interleave old and new text. The final consolidated agreement should be reviewed to ensure no accidental duplication, missing provisions, or conflicting usage restrictions remain.

Summary of Important Changes

1. AI Features and Customer Data

• The revised terms add a specific restriction covering “any use of Appcues AI Features”.
• Use of AI Features must comply with a separate AI Acceptable Use Policy at appcues.com/ai-aup.
• The diff does not expressly state:
• whether customer data, prompts, inputs, outputs, or usage data may be used to train Appcues’ or third-party AI models;
• whether data is retained for model improvement;
• whether customer data is anonymized or aggregated before such use;
• whether customers can opt out of training;
• whether AI providers or subprocessors may receive the data; or
• who owns AI-generated outputs.

Risk: The AI policy is incorporated by URL and may contain material data-use terms outside the main agreement. Customers should review the linked policy and confirm in writing that their data and prompts will not be used to train general-purpose or third-party AI models unless expressly authorized.

2. Privacy Policy Added

• The revision adds that personally identifiable information submitted by the customer is subject to Appcues’ Privacy Policy.
• The Privacy Policy is therefore an additional governing document and may change independently of the Terms.

Risk: Data-processing rights, retention, international transfers, subprocessors, and AI-related processing may be addressed outside the contract. The Terms do not appear to provide a customer-specific data processing agreement or clear precedence rule between the Terms, Privacy Policy, and Order Form.

3. Account and Security Obligations

New requirements include:

• Accounts must be registered by a human; automated or “bot” accounts are prohibited.
• A valid email address and other registration information must be provided.
• Customers must protect account credentials and passwords.
• Appcues disclaims liability for losses caused by the customer’s failure to meet security obligations.
• One person or legal entity may not maintain more than one account.

Risk: The security disclaimer could limit recovery for unauthorized access where the customer is alleged to have failed to protect credentials. The scope of required security measures is undefined.

4. Expanded Usage Restrictions

The revised language:

• Prohibits illegal or unauthorized use.
• Limits use to one product unless the Order Form says otherwise.
• Requires compliance with the general AUP and the separate AI AUP.
• Reorganizes and expands restrictions on resale, sublicensing, copying, reverse engineering, unauthorized access, security interference, circumvention of usage limits, and competitive use.
• Restricts use to the customer’s internal business purposes and authorized users.

Risk: Breach of either externally linked AUP could potentially justify suspension or termination. The AUPs may be changeable and should be reviewed for unilateral-change provisions and enforcement consequences.

5. Rights Clarified, Not Expanded

The license is framed as limited, non-exclusive, non-transferable, and non-sublicensable. Appcues and its licensors retain all intellectual-property rights. No broader customer rights appear to be granted.

Summary

The provided diff does not include the actual added, deleted, or replaced contractual language. It only states:

> “Added approximately 86 words to the document”

Accordingly, it is not possible to identify:

• Changes to customer data rights or permitted uses;
• Whether customer data may be used to train, fine-tune, test, or improve AI models;
• Whether data may be de-identified, aggregated, or combined with other data;
• Any new data-retention, confidentiality, security, or deletion obligations;
• Whether the provider may share data with affiliates, subprocessors, or third parties;
• Changes to intellectual-property ownership or licensing;
• New customer consent requirements, opt-out rights, or restrictions; or
• Allocation of liability for unauthorized use or disclosure of customer data.

Information Needed

Please provide the actual 86-word addition and any surrounding text, using the stated notation:

• {added text}
• [deleted text]
• []{replacement text}

Without the substantive wording, no reliable legal risk assessment—particularly regarding AI-model training—can be performed.

Summary

The diff states only that approximately 186 words were added, but it does not include the actual added text or any deleted/replaced language.

Legal and Commercial Impact

• Cannot assess substantive changes: The provided diff does not reveal what contractual terms changed.
• Cannot identify new risks: It is not possible to evaluate changes involving liability, confidentiality, intellectual property, data protection, service obligations, termination, or other legal terms.
• No AI-training assessment possible: The diff does not show whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with model providers or other third parties;
• Aggregated, anonymized, or retained for model development;
• Excluded from training by default or only upon customer opt-out;
• Used for human review, monitoring, or automated evaluation; or
• Subject to deletion, confidentiality, security, or data-processing restrictions.

Information Needed

Please provide the actual 186 words added, together with any surrounding text or the complete redline. Without the wording, no reliable legal analysis or assessment of AI-related data-use changes can be made.

Summary of Important Changes

1. Privacy policy date and organization

• The policy is now identified as “Privacy Policy — Last updated: May 2026.”
• The opening sections have been substantially reorganized. The prior discussion of information categories and general handling practices appears to have been replaced with an overview focused on:
• Encryption at rest and in transit;
• Customer control through identity verification;
• The amount of personally identifiable information handled;
• A shared responsibility model for security and privacy; and
• The Appcues Trust Center and related implementation measures.

Risk/impact: The revised structure may make the policy less explicit about the categories of information collected and the specific handling principles that previously appeared near the beginning. The substantive data-category descriptions should be checked elsewhere in the full policy to ensure they were not unintentionally removed.

2. Third-party service providers

• The policy continues to state that Appcues does not sell data to third parties.
• It now more clearly describes disclosures to third-party services for purposes including:
• Use within or support of the Appcues product or business;
• Activities performed at the customer’s direction; and
• Providing analytics graphs in the Appcues Studio application.
• The wording appears to emphasize that certain data may be shared with service providers as part of product functionality and business operations.

Risk/impact: Although this may clarify existing practice rather than expand it, the language could permit broad disclosures to vendors and other third parties. The policy should identify the types of data shared, applicable vendors, security obligations, international transfers, retention limits, and whether vendors may use the data for their own purposes.

3. Retention, deletion, and aggregation

• The revised text states that information is deleted or aggregated in the ordinary course of business.
• It also adds or preserves a process for deletion requests through support@appcues.com.

Risk/impact: “Ordinary course of business” is not a specific retention period and may provide limited certainty about when customer data is deleted. Customers may want contractual deletion timelines, backup treatment, and confirmation procedures.

4. Contact information and rights requests

• The contact section has been rewritten to invite questions about the policy, collection and use of personal information, and the exercise of privacy rights.
• It expressly directs users to contact support@appcues.com and provides Appcues’ mailing address.

5. AI-model training

• No express change addressing AI, artificial intelligence, machine learning, model training, model improvement, or use of customer data to train models is visible in the supplied diff.
• The revised third-party-sharing language does not expressly authorize AI training, but its broad references to product, business, analytics, and customer-directed purposes could be relevant if AI providers are used.
• The full policy and related customer agreement should be reviewed for separate AI-training terms, especially any provision allowing use of customer data to improve services or permitting subprocessors to train models.

Structured Summary of Important Changes

1. Account and Registration Requirements

The revised terms add several new account obligations:

• Accounts must be registered by a human; automated or “bot” accounts are prohibited.
• Customers must provide a valid email address and any additional information Appcues requests.
• Customers are responsible for account and password security.
• Appcues disclaims liability for losses caused by the customer’s failure to maintain security.
• Personally identifiable information submitted by the customer is expressly made subject to Appcues’ Privacy Policy.
• One person or legal entity may not maintain more than one account.

Risk: The customer has increased compliance obligations and may bear losses resulting from weak account security. The Privacy Policy becomes important because it may contain additional data-use rights not stated in the Terms.

2. Broader Usage Restrictions

The revision replaces or reorganizes the prior usage-rights language and adds detailed restrictions. Customers may not:

• Use the Services for illegal or unauthorized purposes.
• Use the Services for more than one product unless the Order Form permits it.
• Resell, sublicense, lease, distribute, or provide the Services to third parties or as part of a service-bureau/outsourcing offering.
• Store or transmit unlawful, infringing, libelous, tortious, or privacy-violating material.
• Transmit malicious code or disrupt the Services.
• Circumvent contractual usage limits.
• Copy, mirror, frame, reverse engineer, or access the Services to build a competitive product or service.
• Permit unauthorized access or attempt to access related systems or networks.

Risk: These restrictions are more comprehensive and could support suspension or termination for a wider range of conduct. The “one product” limitation may materially restrict internal or multi-product use unless addressed in the Order Form.

3. Acceptable Use Policies

The revised language expressly requires:

• Use of Appcues email Services to comply with the general Acceptable Use Policy.
• Use of Appcues AI Features to comply with a separate AI Acceptable Use Policy at appcues.com/ai-aup.

Risk: Important obligations are incorporated by reference through external web pages. Those policies should be reviewed, preserved, and checked for unilateral-change provisions, enforcement rights, prohibited content, and suspension consequences.

4. AI Features and Training of Models

The diff adds references to “Appcues AI Features” and makes their use subject to the AI AUP. However, the provided changes do not expressly state:

• Whether customer data, prompts, inputs, outputs, or usage data may be used to train Appcues’ or third-party AI models.
• Whether data is used for model improvement, benchmarking, or product development.
• Whether customer data is excluded from training by default or only upon opt-out.
• Whether AI outputs are retained, shared with vendors, or used to train foundation models.

Key risk: The Terms do not provide a clear contractual restriction or authorization concerning AI training. The answer may instead be found in the Privacy Policy, AI AUP, data-processing agreement, or documentation. Customers should obtain express written confirmation that their data and prompts will not be used to train models, unless specifically authorized.

5. Overall Assessment

The revision appears to add operational controls and substantially expand prohibited-use language, while narrowing and restructuring the service license. The most important unresolved issue is AI data governance: the new AI provisions regulate use of the features but do not clearly address training or secondary use of customer data.

Key Changes

1. Privacy policy structure and scope

• The opening language has been substantially reorganized.
• The prior description of four categories of information and general data-handling practices appears to be replaced with an overview focused on:
• At-rest and in-transit encryption;
• The amount of personally identifiable information handled;
• Customer control through identity verification;
• A shared responsibility model for security and privacy; and
• The Appcues Trust Center and related implementation measures.
• Risk: The revised overview may provide less direct detail about the types of information collected and how each category is used. The full policy should be reviewed to confirm that the deleted categorization and disclosures appear elsewhere.

2. Third-party disclosures clarified or expanded

• The policy continues to state that Appcues does not sell data to third parties.
• The permitted disclosure language is revised to state that Appcues may provide data to third-party services:
• For use within or in support of the Appcues product or business;
• At the direction of customers; and
• For purposes such as providing analytics graphs in the Appcues Studio application and managing related services.
• Risk: “In support of the Appcues product or business” is broad and could authorize disclosures to a wider range of vendors or service providers. The policy does not, in this diff, identify specific providers, data categories, retention limits, or restrictions on vendors’ independent use of the data.

3. Deletion and aggregation language

• Data is stated to be deleted or aggregated in the ordinary course of business.
• A new or more prominent process is added for deletion requests through support@appcues.com.
• Risk: “Ordinary course of business” is not a specific retention period and may leave uncertainty about when deletion occurs. The policy should clarify exceptions, backup retention, legal holds, and whether aggregated data can be retained indefinitely.

4. Contact and rights requests

• The contact section is revised to expressly invite questions about the policy, collection and use of personal information, and requests to exercise rights under the policy and applicable law.
• The support email remains the principal contact method.

AI-Training Changes

• No express change concerning the use of customer data or end-user data to train, fine-tune, evaluate, or improve AI models appears in the provided diff.
• The expanded third-party/service-provider language could theoretically encompass AI or analytics vendors, but it does not expressly authorize AI training or prohibit it.
• Recommended clarification: Add an explicit statement addressing whether customer data, prompts, outputs, telemetry, and end-user data may be used for AI training or product improvement, including opt-out rights, de-identification requirements, vendor restrictions, and retention limits.

Summary

The supplied diff does not include the text of the approximately 186 added words. It only states that words were added, so the legal effect of the changes cannot be assessed.

AI Training and Customer Data

There is not enough information to determine whether the additions:

• Permit the provider to use customer data to train, fine-tune, or improve AI models;
• Restrict training to de-identified, aggregated, or anonymized data;
• Allow use of customer prompts, inputs, outputs, files, or metadata;
• Give the provider ownership or broad usage rights over customer data;
• Permit sharing of data with affiliates, subprocessors, or third-party model providers;
• Create opt-out, deletion, confidentiality, or data-retention rights; or
• Apply different rules to consumer and enterprise customers.

Other Legal Risks

The additions cannot be evaluated for changes involving:

• Intellectual-property ownership and licensing;
• Confidentiality obligations;
• Data protection and regulatory compliance;
• Security and breach responsibilities;
• Indemnities and liability limitations;
• Data retention and deletion;
• Subcontracting or international transfers; or
• Changes to termination and post-termination obligations.

Information Needed

Please provide the actual redline text, including the added language and any surrounding provisions. Without the wording of the additions, no reliable comparison or identification of new legal risks—particularly AI-training-related risks—is possible.

Key Changes and Risks

1. Account registration and security obligations

The revised language adds requirements that:

• Accounts must be registered by a human; automated or “bot” accounts are prohibited.
• Customers must provide a valid email address and other information requested during registration.
• Customers are responsible for account and password security.
• Appcues disclaims liability for losses caused by the customer’s failure to meet those security obligations.
• One person or legal entity may not maintain more than one account.

Risk: The customer bears clearer responsibility for unauthorized account activity and may have limited recourse if losses result from weak credentials or inadequate security practices. The required registration information is not defined and may expand over time.

2. New privacy-policy incorporation

The revision states that personally identifiable information submitted by the customer is subject to Appcues’ Privacy Policy.

Risk: The Privacy Policy becomes an important contractual reference, but its terms, amendment rights, data-retention rules, subprocessors, international transfers, and deletion obligations are not included in this diff. The customer should review whether the Privacy Policy permits uses inconsistent with its data-protection requirements.

3. New Acceptable Use Policies, including an AI-specific AUP

The revised terms:

• Require use of the email services to comply with the general Acceptable Use Policy.
• Add a separate AI Acceptable Use Policy at appcues.com/ai-aup.
• State that any use of Appcues AI Features must comply with that AI AUP.

Risk: The AI AUP is incorporated by URL rather than reproduced in the agreement. This may allow Appcues to change the AI rules outside the main contract and could impose additional restrictions, monitoring rights, or customer responsibilities. The customer should obtain and review the current AUP and determine whether changes require notice or consent.

4. Broader and reorganized usage restrictions

The revised text retains or clarifies restrictions against:

• Reselling, sublicensing, leasing, or providing the services to third parties.
• Using the services for unauthorized or illegal purposes.
• Uploading unlawful, infringing, malicious, or privacy-violating material.
• Circumventing usage limits.
• Unauthorized access, copying, mirroring, interference, or reverse engineering.
• Using the services to build a competing product or service.

The prior restriction allowing framing on the customer’s intranet appears narrowed or reorganized, while internal-business-use rights are restated in a separate access grant.

Risk: Violations may support suspension or termination, and the broader wording could restrict integrations, benchmarking, competitive analysis, or use by affiliates unless expressly permitted in an Order Form.

5. AI training and use of customer data

No express provision in the supplied diff states that Appcues may use customer data, inputs, outputs, or usage information to train, fine-tune, evaluate, or improve AI models. The diff adds AI features and an AI AUP but does not establish:

• Whether customer prompts or data are used for model training;
• Whether data is shared with third-party AI providers;
• Whether training is opt-in or opt-out;
• Ownership or confidentiality treatment of AI inputs and outputs; or
• Deletion or retention periods for AI data.

Important gap: Customers should request an express “no training on customer data” commitment, or clearly defined consent/opt-out and data-handling terms, before using confidential or personal data with the AI Features.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 86 words to the document”

Because the added, deleted, or replaced wording is not shown, it is not possible to identify:

• Changes to the parties’ rights or obligations
• New fees, liability, indemnity, termination, or confidentiality provisions
• Changes to ownership or permitted use of customer data
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Any opt-out, consent, anonymization, retention, or deletion requirements
• Whether data may be shared with affiliates, vendors, or third-party AI providers

AI Training and Data-Use Risk

No conclusion can be drawn about AI-model training from the information provided. The 86 added words could potentially introduce important permissions—for example, allowing the provider to use customer content, prompts, outputs, usage data, or personal information to train or improve artificial-intelligence systems—but the actual wording is necessary to assess that risk.

Particular language to review includes terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models
• “customer data,” “content,” “inputs,” “outputs,” or “usage data”
• “de-identified,” “aggregated,” or “anonymized”
• “service providers,” “affiliates,” or “third parties”
• “perpetual,” “irrevocable,” “worldwide,” or “royalty-free”
• Consent, opt-out, deletion, retention, and security provisions

Required Information

Please provide the actual redline text, including the 86 added words and any deleted or replaced language. Without the wording of the amendment, a substantive legal-risk analysis is not possible.

Summary

The provided diff does not include the actual added or deleted legal language. It only states:

> “Added approximately 186 words to the document”

Accordingly, the substantive legal changes cannot be evaluated.

AI Training and Data Use

• No specific language is provided addressing whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Used to develop products or services;
• Combined with other customers’ data;
• Reviewed by humans or shared with service providers;
• Retained after termination; or
• Anonymized, aggregated, or otherwise de-identified before use.
• It is therefore not possible to determine whether the amendment creates new rights for the provider to use customer data for AI training or imposes restrictions on such use.
• The absence of visible language should not be interpreted as meaning that no such change exists.

Other Legal Risks

The available information is insufficient to assess changes involving:

• Confidentiality and data protection;
• Ownership or licensing of customer content;
• Security obligations and breach notification;
• Data retention and deletion;
• Liability, indemnification, or limitations of liability;
• Subprocessors or third-party disclosures;
• Compliance with applicable privacy laws; or
• Changes to termination, audit, or dispute-resolution rights.

Information Needed

Please provide the actual redlined text, including the approximately 186 added words and any corresponding deletions or replacements. Once provided, the changes can be analyzed for their legal effect, including whether customer data may be used to train or improve AI models.

Summary

Insufficient Information

The provided diff states only:

> “Added approximately 186 words to the document”

It does not include the actual added language or identify any deleted or replaced terms. As a result, it is not possible to determine:

• What contractual provisions changed;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is limited to de-identified, aggregated, or anonymized data;
• Whether customer data may be shared with affiliates, vendors, or third-party AI providers;
• Whether the customer can opt out of AI training or other secondary uses;
• How long data may be retained or whether it may be deleted;
• Whether the provider obtains rights to use customer content beyond providing the services;
• Whether confidential information, personal data, or regulated data is covered;
• Whether the provider disclaims responsibility for model outputs or AI-related security risks.

Required Information

Please provide the actual marked-up text, including:

• Additions shown in {braces};
• Deletions shown in [brackets];
• Replacements shown as []{}
• Any relevant surrounding clauses needed to interpret the changes.

Without the substantive wording, no reliable legal-risk or AI-training analysis can be performed.

Summary of Important Changes

1. Major restructuring of access and usage provisions

• The prior “Account Right to Access and Use the Service” language has been substantially reorganized into a separate “Right to Access and Use the Service” section.
• The customer’s license remains limited, non-exclusive, non-transferable, non-sublicensable, and restricted to internal business purposes during the subscription term.
• The revised language expressly states that Appcues and its licensors retain all rights, title, and interest in the Services and related intellectual property.
• The customer may not use the Services for illegal or unauthorized purposes and must comply with applicable laws, including copyright law.

Risk: The reorganization does not clearly change the commercial license, but it may make the operative restrictions easier for Appcues to enforce and may create uncertainty if other sections or order forms use the former terminology.

2. New account and security obligations

The revised terms add or clarify that:

• Accounts must be registered by a human; bot or automated registrations are prohibited.
• Customers must provide a valid email address and other requested registration information.
• Customers may not maintain more than one account.
• Customers are responsible for account and password security.
• Appcues disclaims liability for losses caused by the customer’s failure to meet its security obligations.
• Personally identifiable information submitted by the customer is subject to Appcues’s Privacy Policy.

Risk: The security disclaimer shifts losses arising from compromised credentials or inadequate customer security practices to the customer. The Privacy Policy becomes important contractually, even though its terms are not included in this diff.

3. New Acceptable Use Policy requirements

• Email Services must comply with the general Acceptable Use Policy at appcues.com/aup.
• Use of Appcues AI Features must comply with a separate AI AUP at appcues.com/ai-aup.
• The AI AUP is incorporated by reference, apparently without its terms being reproduced here.

Risk: Appcues may be able to modify the linked policies separately, potentially changing permitted uses, suspension grounds, or customer obligations without a signed amendment. The customer should review both policies and confirm how updates are handled.

4. AI data use and model training

• The diff introduces “Appcues AI Features” and subjects their use to the AI AUP.
• The revised language does not expressly state whether customer inputs, outputs, prompts, uploaded content, telemetry, or personal data may be used to train, fine-tune, evaluate, or improve AI models.
• It also does not expressly prohibit Appcues or its subprocessors from using customer data for model training.

Key risk: The terms leave AI training and secondary data use ambiguous. The customer should seek express language addressing: (i) whether customer data is used for training; (ii) whether data is shared with third-party model providers; (iii) retention and deletion; (iv) ownership of inputs and outputs; and (v) opt-out or no-training commitments.

5. Expanded or clarified usage restrictions

The revised restrictions cover unlawful content, third-party privacy rights, malicious code, interference, unauthorized access, circumvention of usage limits, copying, framing, and competitive-product development.

Risk: Breach of these restrictions could support suspension or termination, and the restrictions may apply broadly to customer data and third-party data handled through the Services.

Summary

The provided diff does not include the actual added or deleted legal language. It only states:

> “Added approximately 186 words to the document”

Accordingly, the substantive changes and legal risks cannot be determined.

AI Training and Customer Data

There is no text showing whether the changes:

• Permit the provider to use customer data, content, prompts, outputs, or metadata to train, fine-tune, or improve AI models;
• Limit such use to aggregated, anonymized, or de-identified data;
• Require customer consent or provide an opt-out;
• Allow human review of customer data for model development or safety purposes;
• Grant the provider ownership or broad usage rights over customer data or AI outputs;
• Apply different rules to personal data, confidential information, or regulated data; or
• Continue data-use rights after termination of the agreement.

Legal Risk Assessment

Because the actual wording is missing, it is not possible to assess:

• Whether customer data-use rights have expanded;
• Whether confidentiality protections have been weakened;
• Whether the provider may use data for commercial model training;
• Whether the customer has meaningful control over such use;
• Whether data retention, deletion, or security obligations have changed; or
• Whether the revised terms create privacy, intellectual-property, regulatory, or contractual risks.

Information Needed

Please provide the full redlined language, including the approximately 186 added words and any related deletions or replacements. The AI-training provisions should be reviewed in context with the agreement’s sections on:

• Customer data and content;
• Confidentiality;
• Privacy and data protection;
• Intellectual-property ownership;
• Service improvement and analytics;
• Data retention and deletion; and
• Termination.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 86 words to the document”

Without the specific added, deleted, or replaced text, it is not possible to determine the legal effect of the changes.

AI Training and Data Use

No language has been provided concerning:

• Whether customer data may be used to train, fine-tune, or improve AI models
• Whether prompts, inputs, outputs, usage data, or personal information are retained
• Whether data is shared with service providers or third-party model providers
• Whether customer data is used for product development, analytics, or benchmarking
• Whether the customer can opt out of AI training or data usage
• Ownership or licensing rights in customer inputs and outputs
• Confidentiality, security, deletion, or anonymization of data used in AI systems

Accordingly, no conclusion can be reached about whether the contract expands or restricts the provider’s rights to use customer data for AI training.

Legal Risk Assessment

The principal risk is that potentially material language may have been omitted from the supplied diff. An 86-word addition could materially change:

• The provider’s permitted uses of customer data
• Confidentiality obligations
• Intellectual-property rights
• Data retention and deletion requirements
• Compliance obligations relating to privacy and regulated information
• Customer consent or opt-out rights

Please provide the actual text of the additions, deletions, and replacements for a substantive contract analysis.

Key Changes and Risks

1. New AI-specific terms

• The revised terms introduce “Appcues AI Features” for the first time.
• Use of AI Features must comply with a separate AI Acceptable Use Policy at appcues.com/ai-aup.
• The AI AUP is incorporated by reference, meaning it may impose additional restrictions and may potentially be changed outside the main Terms of Service.
• The revised language makes use of AI Features subject to both the Terms of Service and the AI AUP, but does not describe:
• Which AI features are covered;
• Whether customer prompts, inputs, outputs, or usage data are retained;
• Whether customer data is shared with AI providers;
• Whether data is used to train, fine-tune, or improve Appcues’ or third-party AI models;
• Whether customers can opt out of training or model improvement; or
• What confidentiality, security, deletion, or data-location protections apply.

AI training risk

The diff does not expressly authorize or prohibit using customer data to train AI models. This is a significant unresolved issue. The added reference to the Privacy Policy may cause data-use practices to be governed by that separate document rather than the Terms. Customers should review the current Privacy Policy and AI AUP for any training, model-improvement, retention, subprocessors, or data-sharing provisions and seek an express contractual prohibition or opt-out if needed.

2. Privacy Policy incorporated

• Personally identifiable information submitted by the customer is now expressly stated to be subject to Appcues’ Privacy Policy.
• This creates an additional governing document and may expand Appcues’ permitted data uses beyond what is stated in the Terms.
• The Privacy Policy is not attached or summarized, creating uncertainty about data processing roles, international transfers, retention, analytics, and AI use.

3. Account and security obligations changed

The revised terms add requirements that:

• Accounts must be registered by a human, not a bot or automated method.
• Customers must provide a valid email address and other information requested during registration.
• Customers are responsible for account and password security.
• Appcues disclaims liability for losses caused by the customer’s failure to meet those security obligations.

This increases customer responsibility and may limit recovery for unauthorized access caused by weak credentials or poor account management.

4. Broader and reorganized usage restrictions

The prior limited-use license and usage restrictions are reorganized and expanded. The revised terms expressly prohibit, among other things:

• Illegal or unauthorized use;
• Use for anyone other than the customer or authorized users;
• Resale, sublicensing, leasing, service-bureau use, or outsourcing;
• Infringing, unlawful, malicious, or privacy-violating content;
• Interference with service integrity or performance;
• Circumvention of contractual usage limits;
• Copying, mirroring, framing, or accessing the Services to build a competitive product.

These restrictions may create additional suspension, termination, or breach exposure, particularly where customers use integrations, contractors, affiliates, or automated tools.

5. Additional incorporation by reference

Email Services are made subject to the general AUP, while AI Features are subject to the separate AI AUP. Customers should assess whether these external policies can be modified unilaterally and whether they conflict with negotiated Order Forms or data-processing terms.

Executive Summary

The diff appears to substantially reorganize the Privacy Policy’s introductory and data-handling sections, although the markup is fragmented and difficult to interpret reliably. The most important apparent changes are below.

Key Changes and Risks

1. More specific security commitments

The policy now expressly references:

• Encryption of data at rest and in transit;
• Customer control, through Identity Verification, over the amount of personally identifiable information handled by Appcues;
• A Shared Responsibility Model for security and privacy; and
• The Appcues Trust Center and implementation of measures described there.

Risk: These statements may create stronger representations about Appcues’s security controls and customer responsibilities. The policy should clearly explain what customers must do, what Appcues is responsible for, and whether Trust Center materials are incorporated into contractual commitments.

2. Revised data categorization language

The prior language apparently described four categories of information based on sensitivity. The replacement instead emphasizes the amount of PII handled, customer control, shared responsibility, and security measures.

Risk: Removing or narrowing the description of data categories could make it less clear what types of customer and end-user data Appcues processes and how sensitive data is treated.

3. Third-party service disclosures clarified or expanded

The policy continues to state that Appcues does not sell data to third parties. It now more expressly permits disclosure to third-party services:

• For use within or in support of the Appcues product or business;
• At the direction of customers; and
• For examples such as providing analytics graphs in the Appcues Studio application.

Risk: This may broaden or clarify the permitted purposes for sharing data. The policy should identify the categories of vendors, data shared, applicable safeguards, and whether vendors may use data for their own purposes. The wording appears grammatically incomplete in places, which creates interpretation risk.

4. Deletion requests

The revised text expressly states that data may be deleted or aggregated in the ordinary course of business and provides support@appcues.com for deletion requests.

Risk: “Ordinary course of business” may permit retention or aggregation without specifying retention periods, legal exceptions, or whether aggregated data can be used indefinitely.

5. Updated contact and rights language

The contact section now invites questions about collection and use of personal information and requests to exercise privacy rights, directing users to support@appcues.com. The company’s address formatting also appears corrected or reformatted.

AI Model Training

No express provision was identified in this diff authorizing or prohibiting use of customer or end-user data to train, fine-tune, evaluate, or improve AI models. The new third-party and analytics language should not be assumed to grant that permission, but its broad wording could create ambiguity. A separate, explicit AI-use provision should state whether customer data, personal information, prompts, outputs, or telemetry may be used for model training and whether customers can opt out.

Summary

Available Information

The supplied diff states only:

> “Added approximately 186 words to the document”

It does not include the actual added language, deleted language, or replacement text.

Legal Analysis

Because the substantive wording is missing, it is not possible to determine:

• What contractual obligations or rights changed;
• Whether liability, indemnity, confidentiality, privacy, security, or termination provisions were modified;
• Whether the customer’s data may be used for artificial intelligence or machine-learning purposes;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is limited to de-identified, aggregated, or anonymized data;
• Whether the provider may retain data after termination;
• Whether the provider may share data with affiliates, subprocessors, or third-party AI providers;
• Whether the customer has an opt-out, approval, deletion, or audit right; or
• Whether the provider claims ownership or a broad license over customer data or resulting models.

AI-Training Issues to Check

The added language should be reviewed for terms such as:

• “train,” “fine-tune,” “develop,” “improve,” or “enhance” models;
• “machine learning,” “artificial intelligence,” or “generative AI”;
• “inputs,” “outputs,” “usage data,” “ telemetry,” or “derived data”;
• “de-identified,” “aggregated,” or “anonymized” information;
• Rights to use data across customers or for commercial product development;
• Rights to retain prompts, uploaded materials, or outputs;
• Restrictions on using confidential, personal, regulated, or proprietary information; and
• Customer consent, opt-out, deletion, or data-segregation mechanisms.

Required for a Reliable Review

Please provide the actual diff text, including the 186 added words and any surrounding provisions. Without that language, no specific new risk—particularly regarding AI-model training—can be identified.

Executive Summary

The revision substantially restructures the account, access, and usage-rights provisions. It adds detailed user obligations and an AI-specific acceptable-use framework, but the supplied diff does not expressly state whether customer data may be used to train Appcues’ or third-party AI models. That issue should be addressed directly before acceptance.

Important Changes and Risks

1. Customer data and AI-model training

• The revision adds restrictions requiring any use of “Appcues AI Features” to comply with a separate AI Acceptable Use Policy at appcues.com/ai-aup.
• The AI provisions regulate how the customer may use the AI features, but do not state:
• whether customer prompts, inputs, outputs, or other data are retained;
• whether customer data is shared with AI providers or subprocessors;
• whether data is used to train, fine-tune, evaluate, or improve AI models;
• whether training is opt-in, opt-out, or prohibited;
• whether data is anonymized or deleted after processing; or
• whether customer data is segregated from other customers’ data.
• The new reference to the Privacy Policy may make data practices dependent on a separate, potentially changeable document. The contract should expressly prohibit training on customer data unless the customer gives affirmative consent, and should identify all relevant subprocessors and retention periods.

2. Access rights and account obligations

• The prior grant of a limited license to access and use the Services is replaced or reorganized into a new “Right to Access and Use” provision.
• Users must be human; bot or automated registrations are prohibited.
• Customers must provide a valid email address and other requested registration information, maintain account/password security, and accept responsibility for security failures.
• Appcues expressly disclaims liability for losses caused by the customer’s failure to maintain security. This increases customer risk in the event of compromised credentials.

3. Expanded usage restrictions

The revised terms expressly prohibit or restrict:

• illegal or unauthorized use;
• use beyond one product unless permitted by the order form;
• resale, sublicensing, leasing, service-bureau, or outsourcing uses;
• unlawful, infringing, tortious, or privacy-violating content;
• malicious code, interference, unauthorized access, circumvention of usage limits, copying, mirroring, framing, and competitive use.

These restrictions are clearer but broader and may support suspension or termination for a wider range of conduct.

4. External policies and compliance burden

• Email use is made subject to the general AUP.
• AI use is made subject to a separate AI AUP, creating additional obligations outside the main agreement.
• Customers should confirm whether Appcues may modify these policies unilaterally and whether a policy change can materially reduce functionality or expand data-use rights.

5. Drafting concern

The diff appears repetitive and mechanically merged in places. The final consolidated agreement should be reviewed to ensure that deleted license language, customer-data protections, remedies, and policy-incorporation provisions have not been unintentionally omitted.