Brightspot

Summary of Important Changes

1. Expanded categories of data collected

The revised policy significantly broadens the information Brightspot may collect, including:

• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences regarding marketing from Brightspot or third parties.
• Information shared when uploading content to a Brightspot-hosted website.
• Communications through email, post, social media, and other channels, including mailing addresses and social-media handles.
• More detailed technical and usage information, including IP addresses, login status and history, prior site visits, device and software information, time zone, country, city, operating system, platform, demographics, and statistical data.
• Publicly available information and information Brightspot obtains where legally required or permitted.

Risk: The policy now permits collection and combination of a broader range of personal and behavioral data. The reference to associating individuals with their employer or another organization for sales and marketing purposes also creates additional profiling and business-development risk.

2. Broader permitted uses

The revised policy replaces a relatively specific list of purposes with a broader statement that Brightspot will use personal data for the purposes for which it was collected, unless required or permitted by law. It also expressly lists purposes such as:

• Account creation and administration.
• Customer support and responding to queries.
• Processing payments, fees, charges, and amounts owed.
• Marketing and communications.
• Hosting applications and data.
• Product and service improvement.
• Security, troubleshooting, testing, maintenance, reporting, and business protection.
• Providing third-party tools and purchased services.

The revised policy retains legitimate-interest and legal-obligation bases, but the wording is reorganized and less clearly tied to particular processing activities.

Risk: The broader formulation may give Brightspot greater flexibility to reuse data for secondary purposes, while making it harder for customers to determine exactly which legal basis applies to each use.

3. Advertising and targeted marketing

A significant change concerns advertising disclosures. The prior language stated that Brightspot did not disclose or use website information to advertise third-party products or services. The revised language states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing delivered via third-party services.

Risk: Customer information may now be shared with advertising partners for targeted marketing. The policy does not specify the partners, data elements, retention periods, or opt-out mechanism in this excerpt.

4. Hosting, vendors, and international transfers

The revised policy continues to state that servers are located in the United States, unless a contract provides otherwise. It also expressly permits use of third-party vendors and hosting partners, potentially located outside the United States or the customer’s country of residence, and states that using the services constitutes consent to such transfers and storage.

The detailed vendor-assessment commitments were condensed, although the revised text still says vendors’ handling of personal data is assessed and that contractual protections are used.

Risk: Increased reliance on broadly described vendors and international transfers, with less operational detail in the privacy policy.

5. AI model training

No express change authorizing or prohibiting use of customer data to train AI models appears in the supplied diff. The revised policy refers generally to product improvement, data analysis, testing, and other functions, but does not mention AI, machine learning, model training, prompts, inputs, outputs, or model providers.

Risk: Because “product improvement” and similar language is broad, customers should not assume it excludes AI-related processing. A separate agreement or AI/data-processing addendum should be reviewed for any training rights.

Summary

The supplied diff does not include the actual amended contract language. It only states:

> “Added approximately 271 words to the document”

Accordingly, it is not possible to determine what terms changed or whether the additions create new legal risks.

AI Training and Customer Data

No substantive language is provided concerning:

• Whether the customer’s data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, uploaded files, or usage data are retained;
• Whether data may be shared with affiliates, vendors, or third-party AI providers;
• Whether customer data is used in aggregated, de-identified, or identifiable form;
• Whether the customer can opt out of AI training or request deletion;
• Ownership or licensing rights in customer data and AI-generated outputs; or
• Security, confidentiality, or cross-border transfer protections applicable to AI processing.

Therefore, no conclusion can be reached about changes to AI-training rights or related privacy and confidentiality risks.

Required Information

Please provide the actual redlined text, including:

• The 271 added words;
• Any surrounding provisions needed to interpret the additions; and
• Any deletions or replacements, if applicable.

Once provided, the changes can be analyzed for data-use rights, AI-training permissions, ownership, confidentiality, retention, security, and termination-related risks.

Summary of Important Changes

1. Customer data used to train AI models

• No express provision was added authorizing Brightspot to use customer or personal data to train, fine-tune, evaluate, or improve AI models.
• No express prohibition was added either. The revised policy permits use of personal data for broad purposes, including:
• Providing and hosting services;
• Troubleshooting, data analysis, testing, system maintenance, support, and reporting;
• Improving products and services;
• Marketing and communications; and
• Complying with legal obligations.
• Because “data analysis,” “improve our products and services,” and similar language can potentially be interpreted broadly, the policy does not clearly establish whether customer-uploaded content may be used for AI development.
• The policy should be supplemented with a specific AI/data-use clause addressing whether customer content is:
• Used for model training;
• De-identified or aggregated before use;
• Shared with AI providers;
• Retained for training purposes; and
• Excluded from training at the customer’s request.

2. Expanded categories of collected data

The revised policy adds or more clearly identifies:

• Billing and payment records;
• Marketing and communications preferences;
• Preferred contact methods;
• Information shared when uploading content to a Brightspot-hosted website;
• Email addresses, mailing addresses, and social-media handles when communicating with Brightspot;
• IP addresses;
• Login/logout records and prior site visits;
• Device, software, operating-system, location, demographic, and statistical information; and
• Information obtained from publicly available sources or other Brightspot systems.

This increases the types of information Brightspot may collect and combine, including information that may indirectly identify an individual.

3. Broader processing and marketing purposes

The revised language expressly permits use of personal data for service delivery, hosting, support, troubleshooting, analytics, testing, maintenance, reporting, and related business functions.

The marketing language changes from stating that Brightspot does not use website information to advertise third-party products to stating that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base through targeted marketing.

Risk: Customers may face broader tracking, profiling, and disclosure to advertising platforms, potentially creating additional consent and regulatory obligations.

4. Vendors, integrations, and international transfers

• Brightspot may share data with third parties when necessary to facilitate requested integrations.
• Third-party vendors and hosting partners may be located outside the United States or the customer’s country of residence.
• The prior language emphasizing legally binding vendor protections and compliance is substantially replaced or relocated, although similar assurances remain elsewhere.
• Use of the services is stated to constitute consent to transfer and storage of data on Brightspot’s servers.

Risk: The revised wording may provide less prominent detail about vendor safeguards, international-transfer mechanisms, and customer control over subprocessors.

5. Other notable changes

• The policy now expressly treats payment, fee, charge, collection, and recovery information as personal data.
• The revised policy adds an email address for privacy questions: privacy@brightspot.com.
• Several references to the Brightspot CMS are replaced with broader references to Brightspot-hosted websites and services, expanding the apparent scope of the policy.

Summary

The diff does not include the actual added or modified contractual language. It only states:

> “Added approximately 271 words to the document”

Because the wording of the additions is unavailable, it is not possible to reliably identify:

• New legal obligations or rights
• Changes to liability, indemnification, termination, confidentiality, or governing law
• Changes to ownership or licensing of customer data
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is anonymized, aggregated, retained, shared with vendors, or used for product development
• Any customer consent, opt-out, deletion, or security rights

AI Training and Data-Use Analysis

No specific change concerning AI-model training can be determined from the provided diff. The phrase indicating that approximately 271 words were added does not reveal whether the new language:

• Authorizes training on customer prompts, inputs, outputs, files, or other content
• Permits use of data for generalized model improvement
• Limits training to de-identified or aggregated data
• Applies only to selected service tiers or accounts
• Requires the customer to opt in or provides an opt-out
• Allows retention or use of data after termination
• Grants the provider rights to disclose data to affiliates or subprocessors

Risk Assessment

The principal issue is lack of visibility into the revised terms. A meaningful legal-risk analysis requires the exact additions, deletions, and replacements. In particular, the customer should not assume that the absence of an explicitly described AI-training change means that no such change occurred.

Information Needed

Please provide the full redlined text, including the approximately 271 added words and any surrounding provisions. The analysis should then focus especially on:

1. The definition of “Customer Data” and “Content”

2. Rights granted to the provider to access, copy, analyze, or create derivative works

3. Any authorization to train or improve AI models

4. De-identification, aggregation, retention, and deletion provisions

5. Opt-out or consent mechanisms

6. Security, confidentiality, and third-party sharing restrictions

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 271 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added, removed, or replaced;
• Whether the changes alter the parties’ rights or obligations;
• Whether liability, confidentiality, security, intellectual property, or termination terms changed; or
• Whether the customer’s data may be used to train, improve, or evaluate AI models.

AI Training and Data-Use Review

No substantive language concerning AI, machine learning, model training, model improvement, data retention, data ownership, or use of customer content is included in the supplied diff. Therefore, no conclusion can be drawn about whether:

• Customer data may be used to train models;
• The provider may use data for product improvement or analytics;
• Data may be shared with affiliates, contractors, or third-party model providers;
• Customer data may be retained after termination;
• Inputs or outputs may be used to develop generalized models; or
• The provider has obligations to delete, anonymize, or segregate customer data.

Information Needed

Please provide the actual text of the additions, deletions, and replacements using the stated notation. The approximately 271 added words alone are necessary to identify the legal and commercial risks.

Summary of Important Changes

1. Expanded Categories of Data Collected

The revised policy substantially expands the data Brightspot says it may collect, including:

• Support and assistance communications.
• Billing information, paid-service subscription details, and payment transaction records.
• Marketing and communications preferences, including preferences regarding third-party marketing.
• Information provided when users upload content to websites hosted by Brightspot.
• Contact information from email, postal mail, and social-media communications.
• Technical and usage information relating to the user’s services, including:
• IP address;
• Login/logout records;
• Prior site visits;
• Browser and internet-protocol information;
• Device type;
• Time zone, country, and city;
• Operating system and platform;
• Demographic and statistical information.
• Publicly available information and information obtained or permitted by law.
• Information used to associate an individual with an employer or other organization for sales and marketing.

Risk: The collection description is materially broader and may permit profiling, marketing, and identification of users through combined datasets.

2. Broader Permitted Uses

The previous policy emphasized contractual necessity, legitimate interests, legal obligations, and aggregated technical analysis. The revised policy adds or expressly describes uses including:

• Registering users and customers and creating accounts.
• Providing support and responding to queries.
• Processing payments, fees, charges, and amounts owed.
• Marketing and communications based on user preferences.
• Providing purchased products and services.
• Hosting applications and data.
• Troubleshooting, testing, reporting, system maintenance, and data analysis.
• Managing customer relationships and notifying users about service or term changes.
• Providing third-party tools and requested integrations.
• Protecting Brightspot’s business and services.

The revised wording also states that personal data will generally be used for the purposes for which it was collected, unless otherwise required or permitted by law.

3. Advertising and Marketing Disclosure

A significant change permits disclosure of information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing via third-party services.

The former language stated that Brightspot did not disclose or use website information to advertise third-party products or services. The revised language retains that limitation but expressly permits third-party advertising support for Brightspot’s own offerings.

Risk: Users may be subject to targeted advertising and broader sharing with advertising partners, even though the policy continues to state that Brightspot does not sell personal data.

4. Third Parties, Hosting, and International Transfers

The revised policy:

• Describes sharing with third-party platforms for requested integrations.
• Permits use of third-party vendors and hosting partners for infrastructure, professional advice, and other operational functions.
• States that vendors may be located outside the United States or the user’s country of residence.
• Obtains consent to transfer and store data on Brightspot’s servers and with vendors.
• Adds vendor-assessment and contractual-protection language, but does not identify specific vendors or detailed transfer safeguards.

Risk: International processing and vendor access are broader and may make it harder to determine where data is stored or who can access it.

5. Cookies and Website Tracking

The revised policy provides a more detailed explanation of cookies and states that technologies may collect information about visits to Brightspot websites. It also clarifies that the Brightspot CMS itself does not collect information from a user’s use of the CMS, while Brightspot-hosted websites may use cookies and similar technologies.

6. AI Model Training

No express change concerning training AI models was identified. The diff does not add language authorizing Brightspot to use customer data, uploaded content, personal data, or service data to train, fine-tune, or evaluate AI models. References to “data analysis,” “testing,” and product improvement are general and should not automatically be interpreted as AI-training permission.

Nevertheless, customers should confirm in the governing services agreement or data-processing addendum whether uploaded content or customer data may be used for AI-related purposes, particularly by third-party vendors.

Executive Summary

The revised Privacy Policy materially reorganizes and expands Brightspot’s descriptions of data collection, use, cookies, third-party disclosures, hosting, and international transfers. It also removes or narrows several customer-protective statements. The diff does not expressly authorize using customer data to train AI models, nor does it expressly prohibit such use. This omission creates uncertainty, particularly because the policy permits broad processing, analytics, product improvement, and vendor use.

Important Changes and Risks

1. Expanded categories of data collected

The revised policy adds or clarifies collection of:

• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences concerning third-party marketing.
• Information supplied when uploading content to a Brightspot-hosted website.
• Communications through email, postal mail, social media, and other channels.
• IP address, login/logout records, prior site visits, device information, operating system, platform, location, demographics, and statistical data.
• Publicly available information and information used to associate an individual with an employer or organization for sales and marketing.

Risk: The scope of potentially collected personal data is broader and more detailed, including data connected with hosted content and customer communications.

2. Broader purposes for processing

The revised policy expressly permits use for:

• Account creation, customer support, payments, fees, and collection of amounts owed.
• Marketing and communications.
• Product and service improvement.
• Security, troubleshooting, testing, maintenance, reporting, and hosting.
• Third-party tools and integrations.
• Delivering websites and purchased services.

The policy changes from a more specific description of lawful bases to a broader statement that data may be used for the purposes for which it was collected, unless otherwise required or permitted by law.

Risk: The revised wording may provide Brightspot greater flexibility to repurpose data, particularly for analytics, product development, and marketing.

3. AI-model training

There is no express language addressing AI or machine-learning training. The policy does not state whether customer content, personal data, prompts, outputs, usage data, or aggregated data may be:

• Used to train, fine-tune, or evaluate AI models;
• Shared with AI providers;
• Retained for model development; or
• Excluded from model training.

Risk: Broad “product and service improvement,” “data analysis,” “testing,” and vendor-processing language could arguably be invoked to support AI-related processing, but it does not provide adequate transparency or a clear limitation. Customers should seek an express contractual restriction or permission framework.

4. Marketing disclosures expanded

The prior statement that Brightspot would not use website information to advertise third-party products is retained in revised form, but Brightspot may disclose information to third-party advertising partners to market its own services, grow its user base, and provide targeted marketing.

Risk: Increased tracking, profiling, and disclosure to advertising partners.

5. Third-party vendors and international transfers

The revised policy replaces detailed vendor-assessment and legally binding protection language with broader statements that vendors may process data, including outside the United States or the customer’s country of residence.

Risk: Less specific assurance regarding vendor safeguards, transfer mechanisms, and equivalent protection standards.

6. Customer communications and contact

The revised policy adds a dedicated privacy contact: privacy@brightspot.com.

Summary

The diff only states that approximately 271 words were added. It does not include the wording of those additions or identify which existing provisions were changed.

AI Training and Data Use

• No determination is possible regarding whether the customer’s data may be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Used to create or improve products, services, or algorithms;
• Combined with other customers’ data;
• De-identified, anonymized, or otherwise disclosed for model development;
• Retained after termination for training or testing; or
• Excluded from training unless the customer opts in or opts out.

• The actual added language should be reviewed for terms such as “train,” “improve,” “develop,” “machine learning,” “artificial intelligence,” “model,” “aggregated,” “de-identified,” “service data,” and “usage data.”

Other Legal Risks

Because the substantive text is missing, it is not possible to assess whether the additions change:

• The provider’s license to customer data;
• Confidentiality or privacy obligations;
• Data retention and deletion requirements;
• Security commitments or breach liability;
• Ownership of inputs, outputs, or trained models;
• Permitted disclosures to affiliates, contractors, or third parties;
• Compliance obligations under applicable privacy laws; or
• Customer termination, audit, indemnity, or liability rights.

Required Information

To provide a meaningful legal analysis, the actual 271-word addition—and any surrounding or replaced language—must be supplied. The statement that words were added alone does not reveal the new contractual obligations or risks.

Summary

The provided diff does not include the actual added contractual language. It only states:

> “Added approximately 271 words to the document”

Accordingly, it is not possible to identify:

• Changes to customer data rights or permitted uses
• Whether customer data may be used to train, fine-tune, or improve AI models
• Any new data-ownership, licensing, or confidentiality provisions
• Changes to security, retention, deletion, or disclosure obligations
• New liability, indemnity, audit, or compliance risks

AI Training Risk Assessment

No conclusion can be reached regarding AI-model training. The added language should be reviewed specifically for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “optimize” models
• “inputs,” “outputs,” “customer data,” or “usage data”
• Rights to use data in aggregated, de-identified, or anonymized form
• Broad licenses allowing use for commercial or product-development purposes
• Exceptions permitting human review or use by affiliates, vendors, or subprocessors
• Whether opt-out rights, deletion obligations, or restrictions on sensitive data apply

Required Information

Please provide the actual 271-word addition, including any deleted or replacement language. Without the text of the amendment, a legal-risk analysis would be speculative.

Summary of Important Changes

1. Expanded categories of data collected

The revised policy substantially expands the information Brightspot may collect, including:

• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences regarding third-party marketing and contact methods.
• Any information shared when uploading content to a Brightspot-hosted website.
• Communications through email, post, social media, and other channels.
• Technical and usage information, including IP address, login/logout records, prior site visits, browser and device information, location details, operating system, platform, demographic information, and statistical data.
• Publicly available information and information combined with data already held by Brightspot to associate an individual with an employer or organization for sales and marketing.

Risk: The scope of personal data collection is materially broader and may include information supplied by users or appearing in hosted content. The policy does not clearly limit the types of content that may be collected or the retention period.

2. Broader purposes for using personal data

The revised policy adds or clarifies numerous purposes, including:

• Account creation and administration.
• Customer support and responding to inquiries.
• Processing payments, fees, charges, and amounts owed.
• Marketing and communications, including targeted marketing.
• Hosting applications and data.
• Troubleshooting, testing, analytics, reporting, maintenance, and business protection.
• Providing third-party tools and purchased services.
• Improving products and services based on usage patterns.

The lawful-basis language is also reorganized and now expressly includes contractual necessity, legitimate interests, and legal obligations. “Permitted by law” is used broadly as a general limitation.

Risk: The policy may permit secondary uses—particularly marketing, analytics, profiling, and product improvement—without specifying clear opt-in requirements, retention limits, or separation between customer content and usage data.

3. Advertising and third-party disclosures

The revised language changes the previous restriction on using website information for third-party advertising. Brightspot may now disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing delivered via third-party services.

Brightspot continues to state that it does not sell personal data, but disclosure for targeted advertising may still constitute “sharing” or “sale” under certain privacy laws.

Risk: Customers may have reduced control over advertising-related disclosures, particularly where cookies or similar technologies are involved.

4. Vendors, integrations, and international transfers

The revised policy:

• Describes sharing data with third-party platforms when integrations are requested.
• Relies on third-party vendors and hosting partners for infrastructure, professional advice, and other business functions.
• States that vendors may be located outside the United States or the customer’s country.
• Obtains consent to transfer and store data on Brightspot’s servers and with vendors by use of the services.
• Adds vendor-assessment and contractual-protection language.

Risk: International transfers and vendor access are broader and may expose data to differing legal protections. The policy does not identify vendors, transfer mechanisms, or customer objection rights.

5. AI model training

No express change concerning AI training was identified. The diff does not state that customer data, uploaded content, usage data, or personal data will—or will not—be used to train, fine-tune, evaluate, or improve artificial-intelligence models.

Because the revised policy broadly authorizes analytics, product improvement, hosting, and third-party processing, it does not provide a clear contractual prohibition on AI training. Customers seeking certainty should request an explicit “no training” commitment covering customer content, prompts, outputs, telemetry, and personal data.