Brightspot

Summary

The diff only states that approximately 271 words were added; it does not include the actual added contractual language.

AI Training and Data Use

• No assessment is possible regarding whether customer data may be used to train, fine-tune, test, validate, or improve AI models.
• The diff does not reveal whether the new language:
• Authorizes use of customer content or personal data for model training;
• Limits training to aggregated, anonymized, or de-identified data;
• Requires customer consent or provides an opt-out;
• Allows disclosure of data to third-party AI providers;
• Grants the provider ownership or broad rights in customer inputs, outputs, or derived data;
• Imposes deletion, retention, confidentiality, or security obligations; or
• Applies the authorization retroactively to previously collected data.

Other Legal Risks

The substantive additions are not provided, so changes affecting confidentiality, intellectual-property ownership, privacy compliance, liability, indemnification, data retention, or termination rights cannot be identified.

Needed Information

Please provide the actual 271 words of added text, using the stated notation for additions, deletions, and replacements. Without the contractual language, no reliable legal comparison or risk analysis can be performed.

Executive Summary

The revised Privacy Policy substantially restructures the disclosures and expands the categories of data collected and permitted uses. The most significant changes concern broader marketing activities, cookies and tracking, third-party sharing, and international data transfers.

Key Changes and Risks

1. Expanded data collection

The policy now expressly covers:

• Information shared when requesting support or assistance.
• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences regarding third-party marketing.
• Any information users provide when uploading content to websites hosted by Brightspot.
• Communications through email, post, social media, and other channels, including mailing addresses and social-media handles.
• Technical information such as IP address, login/logout records, prior visits, browser and device information, location data, operating system, demographics, and statistical information.
• Publicly available information and information Brightspot may use to associate an individual with an employer or organization for sales and marketing.

Risk: The collection description is broader and more detailed, increasing the types of customer and end-user data that may be processed and combined.

2. Broader purposes for processing

The revised policy adds or clarifies uses including:

• Account creation and administration.
• Customer support and responding to inquiries.
• Payment collection and recovery of amounts owed.
• Marketing communications and targeted marketing.
• Product and service improvement based on usage data.
• Security, troubleshooting, testing, hosting, reporting, and system maintenance.
• Providing third-party tools and integrations.

The policy now relies more explicitly on contractual necessity, legitimate interests, legal obligations, and other uses “permitted by law.”

Risk: “Legitimate interests” and “permitted by law” provide flexible bases for processing and may allow uses beyond a customer’s immediate expectations, particularly for marketing and analytics.

3. Advertising and third-party sharing

The prior language stated that Brightspot did not disclose website information to advertise third-party products. The revised language instead states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing.

The policy also permits sharing with third parties for integrations, hosting, infrastructure, professional advice, and other service functions.

Risk: Increased disclosure to advertising, hosting, and integration providers, potentially involving profiling and cross-service tracking. The policy does not identify specific providers or provide detailed opt-out mechanisms in the supplied text.

4. Cookies and tracking

The revised policy expands cookie-related disclosures to cover website visits, navigation, analytics, advertising, marketing, and other technologies gathering information about visits. It also clarifies that cookies are required to use the Brightspot CMS.

5. International transfers and vendors

The policy changes from describing U.S.-based servers and vendor safeguards to stating that vendors and hosting partners may be located outside the United States or the user’s country of residence. It adds consent language for transferring and storing data on Brightspot’s or vendors’ systems.

Risk: Broader international-transfer exposure and potentially weaker transparency regarding locations, transfer mechanisms, and vendor accountability.

AI Model Training

No express provision was identified authorizing Brightspot to use customer data, uploaded content, or personal data to train, fine-tune, or evaluate artificial-intelligence or machine-learning models. The revised policy does, however, authorize broad product improvement, analytics, hosting, testing, and third-party processing. Those provisions should not automatically be treated as AI-training permission, but they could create ambiguity if AI systems are used for those purposes. A separate, explicit prohibition or authorization would be advisable.

Executive Summary

The revised Privacy Policy substantially reorganizes and expands Brightspot’s descriptions of data collection, use, sharing, cookies, hosting, and vendors. The changes generally increase the categories of information Brightspot may collect and broaden permitted business and marketing uses. No express provision authorizing use of customer data to train, fine-tune, or evaluate AI models appears in the diff. However, the expanded purposes and vendor-sharing language may still create indirect AI-related risks if AI tools are used by Brightspot or its service providers.

Important Changes and Risks

1. Broader data collection

The revised policy adds or more clearly identifies:

• Information provided when contacting support or assistance channels.
• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences regarding third-party marketing.
• Any information shared when uploading content to a Brightspot-hosted website.
• Postal addresses and social-media handles.
• More detailed technical information, including IP address, login/logout records, prior visits, device and software information, location data, operating system, platform, and demographic/statistical data.
• Publicly available information and information permitted or required by law.

Risk: The scope is materially broader and less limited to information necessary to provide the services. Customer-uploaded content is expressly referenced, but the policy does not clearly distinguish customer-controlled content from ordinary personal data or explain how long it is retained.

2. Expanded purposes for use

The revised purposes include:

• Providing and administering purchased services.
• Processing payments, fees, charges, and amounts owed.
• Responding to communications and support requests.
• Marketing and communications, including marketing based on stated preferences.
• Hosting applications and data.
• Troubleshooting, analytics, testing, maintenance, reporting, and other operational functions.
• Developing and improving products and services using aggregated information.

The prior detailed legal-basis language is replaced or compressed into broader statements that data is used for the purposes for which it was collected, unless otherwise required or permitted by law.

Risk: The revised wording may provide Brightspot greater flexibility to reuse data for secondary purposes. “Other functions,” “data analysis,” and “improving products and services” are potentially broad terms.

3. Advertising and third-party sharing

The policy now states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing. It continues to state that Brightspot does not sell personal data.

Risk: “No sale” does not necessarily prevent targeted advertising, sharing with advertising platforms, profiling, or disclosure of identifiers and usage data.

4. Hosting, vendors, and international transfers

The revised policy describes third-party platforms, vendors, and hosting partners more generally and allows vendors to be located outside the United States or the customer’s country of residence. It states that data may be stored on Brightspot’s servers and that customers consent to related transfers by using the services.

Vendor-assessment and contractual-protection language is retained but condensed.

Risk: The policy provides limited detail about specific subprocessors, transfer mechanisms, retention, deletion, audit rights, or customer notification of vendor changes.

5. Cookies and Brightspot CMS

The revised policy adds broader cookie and website-use language and distinguishes information collected through Brightspot websites from information collected through use of the Brightspot CMS. It states that Brightspot does not gather information from a customer’s use of the CMS, while separately addressing hosted websites and website analytics.

Risk: The distinction may be unclear where Brightspot hosts or operates a customer website, particularly regarding uploaded content, usage data, cookies, and telemetry.

AI Training Assessment

No language expressly states that customer data, uploaded content, personal data, or CMS data may be used to train or improve artificial-intelligence or machine-learning models. The revised references to “data analysis,” “improving products and services,” “testing,” and third-party vendors are not, by themselves, an explicit AI-training authorization. Customers should nevertheless seek a contractual clarification that customer content and personal data will not be used for AI training or shared with AI providers without prior written consent.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 271 words to the document”

Because the added wording is not shown, it is not possible to identify:

• Changes to rights or obligations
• New fees, liability, indemnity, or termination provisions
• Changes to confidentiality or data-security duties
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is anonymized, aggregated, retained, or shared with third parties
• Whether the customer can opt out of AI-training uses
• Whether any AI-training permission applies to historical data or only future data
• Whether the provider obtains ownership or broad usage rights in customer inputs, outputs, or derived data

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training from the information supplied. The phrase “added approximately 271 words” does not itself establish that customer data may—or may not—be used for AI training.

The missing language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models
• “service improvement” or “product improvement”
• “inputs,” “content,” “customer data,” or “usage data”
• “de-identified,” “aggregated,” or “anonymized”
• “retain,” “store,” “share,” or “disclose”
• “affiliates,” “subprocessors,” or “third-party providers”
• Opt-out, deletion, or data-retention rights

Required Information

Please provide the actual text of the additions and any deletions or replacements. Without the underlying wording, a reliable legal comparison and risk analysis cannot be performed.

Summary

The provided diff only states that approximately 271 words were added; it does not include the added contract language or identify where the additions occur.

AI Training and Data-Use Changes

• Cannot be determined from the information provided.
• There is no text showing whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Combined with other customers’ data;
• Reviewed by humans for model development;
• Retained after termination;
• De-identified or anonymized before use;
• Shared with affiliates, vendors, or model providers; or
• Excluded from training by default or only upon customer request.

Other Legal Risks

The scope of the additions and any changes to customer rights, confidentiality, security, intellectual property, liability, or termination obligations also cannot be assessed without the actual contractual language.

Required Information

Please provide the complete diff, including:

• Added language in {braces};
• Deleted language in [brackets]; and
• Replacement language in []{braces}.

Without the underlying text, no reliable legal comparison or risk analysis is possible.

Key Changes and Risks

1. Expanded categories of data collected

The revised policy broadens the information Brightspot may collect, including:

• Billing information and payment transaction records.
• Marketing and communications preferences, including preferred contact methods.
• Content uploaded to websites hosted by Brightspot.
• Communications through email, post, social media, and other channels.
• Social media handles and mailing addresses.
• IP addresses, login/logout records, prior site visits, device information, operating system, platform, time zone, location, demographics, and statistical data.
• Information publicly available or obtained where required or permitted by law.

Risk: The revised language is materially broader and may permit collection of additional identifying, behavioral, and content-related data. The policy should clarify whether customer-uploaded content is treated as personal data and whether collection is limited to what is necessary.

2. Broader purposes for using personal data

The revised purposes include:

• Registering users and creating accounts.
• Providing support, responding to queries, and managing payments.
• Delivering purchased products and services.
• Marketing and communications.
• Hosting applications and data.
• Troubleshooting, testing, reporting, system maintenance, data analysis, and business protection.
• Improving products and services using aggregated technical information.
• Managing the customer relationship and notifying users about service or term changes.

The policy now generally states that personal data will be used for the purposes for which it was collected, unless required or permitted by law, rather than retaining the more specific prior statement that use would be limited to legally permitted purposes and identified legal bases.

Risk: The revised wording may be less precise about applicable legal bases and purpose limitation, particularly for marketing, analytics, and product improvement.

3. Marketing and advertising disclosures

The revised policy states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing via third-party services.

It continues to state that Brightspot does not sell personal data, but the advertising disclosure is broader than the prior language, which stated that website information would not be disclosed or used to advertise third-party products or services.

Risk: Sharing data with advertising partners may constitute “sale,” “sharing,” or targeted advertising under certain privacy laws, even if Brightspot does not describe the activity as a sale. The policy should identify the data categories, partner types, opt-out rights, and applicable consent requirements.

4. Vendors, integrations, and international transfers

The revised policy expressly addresses:

• Third-party platforms and integrations.
• Vendors and hosting partners storing data.
• Vendors located outside the United States or the customer’s country.
• Transfer and storage of data on Brightspot’s servers.
• Vendor assessments and contractual protections.

Risk: Customers may face international-transfer, government-access, and onward-transfer risks. The policy does not clearly identify transfer mechanisms or provide a detailed vendor/subprocessor process.

5. AI-model training

No express change concerning AI training was identified. The diff does not add or remove language expressly authorizing Brightspot to use customer data, uploaded content, prompts, outputs, or personal data to train, fine-tune, evaluate, or improve AI models.

However, the broad additions concerning “data analysis,” “improve our products and services,” hosting, third-party vendors, and aggregated information could create ambiguity if AI systems are used for those purposes.

Recommended clarification: Add an explicit statement confirming whether customer data or content may be used for AI training, whether data is de-identified, whether third parties may train models on it, retention periods, and available opt-out or contractual restrictions.

Summary of Important Changes

1. Expanded categories of personal data collected

The revised policy substantially expands the information Brightspot says it may collect, including:

• Billing information, payment and transaction records, fees, charges, and amounts owed.
• Marketing and communications preferences, including preferences regarding third-party marketing and preferred contact methods.
• Any information shared when uploading content to a Brightspot-hosted website.
• Information provided through email, postal mail, social media, and other communication channels.
• Internet protocol (IP) address, login/logout records, prior site visits, browser and device information, operating system, platform, time zone, city, country, demographic information, and statistical data.
• Publicly available information and information obtained or permitted by law.

Risk: The collection language is broader and less specific, potentially allowing Brightspot to collect and combine more identifiable usage, contact, organizational, and behavioral information.

2. Broader purposes for processing

The revised policy expressly permits use of personal data to:

• Register and manage user accounts.
• Provide support, process payments, respond to inquiries, and manage customer relationships.
• Host applications and data.
• Perform troubleshooting, testing, maintenance, reporting, analytics, and data analysis.
• Provide marketing and communications, including marketing about Brightspot’s own services.
• Improve products and services using aggregated technical information.

The previous language focused more generally on contract performance, legitimate interests, and legal obligations. The new wording is more operational and detailed but retains broad “legitimate interests” and legally permitted uses.

3. Advertising and marketing disclosures

The policy changes its prior statement that Brightspot did not disclose website information to advertise third-party products. It now states that Brightspot may disclose information to third-party advertising partners to market its own services, grow its user base, and provide targeted marketing through third-party services.

Risk: This is a significant expansion of disclosure and targeted advertising activity, particularly where cookies or other tracking technologies are involved. The policy says Brightspot does not sell personal data, but disclosure for targeted advertising may still qualify as “sharing” or “sale” under some privacy laws.

4. Cookies and tracking

The revised policy adds or restores a detailed cookies section. Cookies and similar technologies may support analytics, marketing, service delivery, third-party tools, website administration, and understanding user visits.

5. Third parties and international transfers

The policy more clearly permits sharing with third-party platforms, vendors, infrastructure providers, professional advisers, and hosting partners. Data may be stored in the United States or other countries, including countries outside the customer’s country of residence. Customers are deemed to consent to these transfers by using the services.

6. AI model training

No express change concerning AI training was identified. The diff does not add language authorizing Brightspot to use customer data, uploaded content, personal data, or hosted application data to train, fine-tune, evaluate, or improve artificial-intelligence or machine-learning models. The general language concerning analytics, product improvement, aggregated information, and service operation should not automatically be treated as an AI-training authorization, but it is broad enough that customers may wish to seek express contractual clarification.

Summary

The diff only states that approximately 271 words were added. It does not include the actual inserted language or identify where the additions appear.

Legal and Data-Use Analysis

Because the substantive text is missing, it is not possible to determine:

• Whether the customer’s data may be used to train, fine-tune, test, or improve AI models.
• Whether such use is limited to de-identified, aggregated, or anonymized data.
• Whether customer content may be shared with affiliates, vendors, or third-party AI providers.
• Whether the customer can opt out of AI training or request deletion of data used for that purpose.
• Whether the provider obtains ownership or broad license rights in customer data or resulting models.
• Whether confidential, personal, regulated, or proprietary information receives special protection.
• Whether new retention, security, audit, disclosure, or compliance obligations have been added.
• Whether liability, indemnification, warranty disclaimers, or limits of liability have changed.

Key Risk Assessment

No specific new legal risks can be identified from the available diff. The statement that 271 words were added is not sufficient to compare contractual rights or obligations.

Information Needed

Please provide the actual text of the additions, using the stated notation—for example:

• {new language}
• [deleted language]
• [old language]{new language}

The full surrounding clause would also be helpful, particularly any provisions concerning customer data, content, privacy, confidentiality, service improvement, machine learning, artificial intelligence, model training, or data retention.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 271 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added, removed, or replaced;
• Whether liability, confidentiality, data protection, intellectual property, or termination rights changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether customer data may be shared with affiliates, vendors, or third-party AI providers;
• Whether data is retained after termination or used in aggregated, anonymized, or de-identified form; or
• Whether the customer has any opt-out, deletion, or audit rights.

Information Needed

Please provide the full marked-up contract text, using the stated notation:

• {added text}
• [deleted text]
• []{replacement text}

The actual wording is necessary to identify legal effects and risks, particularly any provisions concerning:

1. AI training and model improvement — whether customer content, prompts, outputs, usage data, or metadata may be used to train or improve models;

2. Scope of permission — whether use is limited to providing the service or extends to commercial, research, or product-development purposes;

3. Data controls — anonymization, aggregation, retention, deletion, security, and access restrictions;

4. Third-party disclosures — use of subprocessors, cloud providers, or external model providers;

5. Ownership and licensing — rights granted in customer data, outputs, feedback, and derived materials; and

6. Customer protections — consent requirements, opt-out rights, confidentiality obligations, indemnities, and remedies.

Without the underlying additions and deletions, no reliable legal analysis can be performed.

Summary of Important Changes

Executive Overview

The revised Privacy Policy substantially expands the categories of data Brightspot collects and the purposes for which it may use and share that data. It also replaces several specific limitations with broader, more general language. The diff does not expressly mention artificial intelligence, machine learning, model training, model improvement, or use of customer content to train AI models. Accordingly, no explicit AI-training authorization was added or removed. However, the broader purposes and vendor-sharing provisions could create indirect risk if AI providers or AI-enabled vendors process customer data.

Key Changes and Risks

1. Expanded data collection

The revised policy adds or clarifies collection of:

• Billing information and payment transaction records.
• Marketing and communications preferences.
• Information shared when contacting support.
• Any information submitted when uploading content to a Brightspot-hosted website.
• Postal addresses, social-media handles, and other communications data.
• IP addresses, login/logout records, prior site visits, device information, time zone, city, operating system, platform, demographics, and statistical data.
• Publicly available information.

Risk: The policy now covers a considerably broader data set, including customer-submitted content and potentially identifiable technical or behavioral information.

2. Broader permitted purposes

The revised purposes include account creation, customer support, payment collection, communications, marketing, hosting, troubleshooting, testing, data analysis, system maintenance, reporting, and service improvement.

The prior language referred more specifically to using data for the purposes for which it was collected. The revised language retains that concept but adds numerous operational and marketing purposes.

Risk: “Data analysis,” “testing,” and “service improvement” are broad terms that could potentially encompass analytics, automated systems, or AI-related processing unless contract terms impose stricter limits.

3. Marketing and advertising disclosures

The policy removes or narrows the prior statement that Brightspot did not disclose website information to advertise third-party products or services. It now states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services, grow its user base, and provide targeted marketing through third-party services.

Risk: This expands behavioral advertising and third-party disclosure rights. “Does not sell” personal data remains, but sharing for targeted advertising may still constitute “sale” or “sharing” under some privacy laws.

4. Customer content and CMS data

The prior policy stated that Brightspot gathered no information from a customer’s use of the Brightspot CMS. That language is removed or replaced with broader statements about hosting websites and processing information submitted through those services.

Risk: The revised text is less clear about whether customer CMS content, usage data, or website visitor data may be accessed or analyzed by Brightspot. Customers should seek express contractual restrictions covering customer content.

5. Vendors, hosting, and international transfers

The policy continues to permit third-party vendors and hosting partners to process data and confirms that vendors may be located outside the United States or the customer’s country. It adds vendor-assessment and contractual-protection language.

Risk: Vendor categories remain broad, and the policy does not identify specific providers, processing locations, retention periods, or limits on secondary use.

AI Model-Training Assessment

No express provision authorizes Brightspot or its vendors to use customer data or content to train, fine-tune, or improve AI models. Nevertheless, the expanded “data analysis,” “testing,” “service improvement,” and vendor-processing language is sufficiently broad that AI-related processing may not be clearly excluded. Customers should request written confirmation that customer data and content will not be used for AI model training without prior consent.

Key Changes and Risks

1. No express AI-training authorization

• The diff does not add language expressly permitting Brightspot or its vendors to use customer data, uploaded content, or personal data to train, fine-tune, evaluate, or improve AI models.
• It also does not expressly prohibit such use.
• The revised policy refers generally to:
• “data analysis,” testing, troubleshooting, reporting, and system maintenance;
• improving products and services;
• aggregated technical information; and
• third-party vendors and hosting partners.
• These broad purposes could potentially be argued to cover machine-learning activities, depending on the contract and how “data analysis” or “improve our products and services” is interpreted. However, the policy does not clearly say whether customer content is excluded from AI training, whether data is de-identified, or whether third-party AI providers may receive it.
• Customers seeking assurance should request a separate contractual commitment addressing AI training, including deletion, retention, model-isolation, and vendor-use restrictions.

2. Broader categories of data collected

The revised policy expands or clarifies collection to include:

• Billing information and payment transaction records;
• Marketing and communications preferences;
• Any information shared when contacting Brightspot, including email, postal, and social-media communications;
• Content uploaded to websites hosted by Brightspot;
• IP address, login/logout records, prior site visits, device information, location indicators, operating system, browser, and usage statistics;
• Information obtained from publicly available sources; and
• Information used to associate an individual with an employer or organization for sales and marketing.

Risk: The scope is materially broader, particularly because hosted-site content and communications may contain confidential business or personal information.

3. Expanded permitted uses

The revised purposes include providing and supporting purchased services, hosting applications and data, responding to inquiries, managing payments, marketing, administering surveys and reviews, security, troubleshooting, analytics, testing, reporting, and improving products and services.

The former wording focused more specifically on contractual performance, legitimate interests, legal obligations, and aggregated technical information. The new wording is more operationally detailed but less protective in places because it permits use for broad business and marketing purposes.

4. Increased marketing and advertising disclosures

The policy now states that Brightspot may disclose information to third-party advertising partners to market its own services and grow its user base, including targeted marketing through third-party services.

Although it still states that Brightspot does not sell personal data, the expanded advertising language creates potential “sharing” or targeted-advertising concerns under privacy laws.

5. Third-party vendors and international transfers

• The policy continues to permit use of third-party vendors and hosting partners.
• It expressly allows vendors to be located outside the United States or the customer’s country of residence.
• Use of the services is described as consent to transfer and store data on Brightspot’s servers.
• Vendor protections are described generally, but the revised text provides fewer operational details about vendor-selection controls than the prior language.

6. Important drafting concern

The diff appears to contain extensive duplicated and internally interleaved text. Before publication, Brightspot should validate the final policy for readability, accurate section headings, and consistency—particularly around cookies, CMS data, advertising, data storage, and permitted uses.

Diff Analysis

Key Limitation

The supplied diff states only:

> “Added approximately 271 words to the document”

It does not include the actual added language, deleted language, or replacement text. As a result, it is not possible to determine:

• What contractual rights or obligations changed;
• Whether liability, confidentiality, security, termination, payment, or governing-law provisions were modified;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is optional, consent-based, or automatic;
• Whether customer data may be shared with affiliates, vendors, or third-party AI providers;
• Whether data is anonymized, aggregated, retained, or deleted; or
• Whether the customer has an opt-out, deletion, audit, or indemnification right.

AI-Training Risk Assessment

No conclusion can be reached about AI-model training from the information provided. The fact that approximately 271 words were added does not establish whether the new terms:

• Permit use of customer content or personal data to train models;
• Limit use to service improvement or abuse prevention;
• Permit human review or disclosure to subprocessors;
• Allow training on prompts, outputs, uploaded files, metadata, or usage data;
• Apply different rules to consumer, enterprise, or API customers; or
• Continue to apply after termination.

Information Needed

Please provide the actual redline text, including the content inside {}, [], and []{}. Once provided, the analysis can identify:

1. The specific contractual changes;

2. New customer risks and obligations;

3. Any expansion of data-use rights;

4. Whether AI-training rights are express or implied;

5. Opt-out, retention, deletion, and confidentiality protections; and

6. Recommended negotiation points.

Summary

The provided diff does not include the actual added, deleted, or replaced legal language. It only states:

> “Added approximately 271 words to the document”

Accordingly, it is not possible to determine:

• What contractual terms changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is opt-in, opt-out, or automatic;
• Whether customer data may be shared with third-party AI providers;
• Whether data is anonymized, aggregated, or retained after termination;
• Whether the provider claims ownership or license rights over inputs, outputs, or derived data;
• Whether confidentiality, security, deletion, or regulatory obligations changed; or
• Whether the amendments create additional customer liability or reduce the provider’s obligations.

Key limitation

No substantive legal analysis can be performed without the actual text of the additions and any surrounding provisions they modify. The statement that approximately 271 words were added does not reveal the legal effect of those additions.

Information needed

Please provide the complete diff, including:

• Added language in {curly braces};
• Deleted language in [square brackets];
• Replacement language in []{}
• The relevant surrounding contract text, if necessary to understand cross-references.

Once provided, the analysis can identify the specific legal changes, including any provisions authorizing the use of customer data to train or improve AI models and the associated risks.

Summary of Important Changes

1. Expanded categories of personal data collected

The revised policy materially broadens the information Brightspot may collect, including:

• Billing information, payment transaction records, fees, charges, and amounts owed.
• Marketing and communications preferences, including preferences about receiving marketing from Brightspot or third parties.
• Content uploaded to websites hosted by Brightspot.
• Communications through email, post, social media, and other channels, including mailing addresses and social-media handles.
• Technical and usage data, including IP address, login/logout records, prior site visits, browser and device details, operating system, location information, demographics, and statistical data.
• Information from publicly available sources and information used to associate an individual with an employer or organization for sales and marketing.

Risk: The scope of data collection is significantly wider and may include user-generated content, communications, and information that can indirectly identify individuals.

2. Broader purposes for using personal data

The revised policy replaces more specific descriptions with a broader list of purposes, including:

• Account creation and administration.
• Customer support and responding to queries.
• Processing payments and recovering amounts owed.
• Marketing and communications.
• Providing purchased products and services.
• Hosting applications and data.
• Troubleshooting, testing, reporting, system maintenance, and data analysis.
• Protecting Brightspot’s business and services.
• Providing third-party tools and managing customer relationships.
• Complying with legal obligations.

The policy also states that Brightspot will use personal data for the purposes for which it was collected, unless otherwise required or permitted by law.

Risk: The revised language may give Brightspot greater flexibility to use data for operational, marketing, analytics, and product-improvement purposes. The “legitimate interests” basis remains, potentially allowing processing without consent where Brightspot determines its interests are not overridden by individual rights.

3. Increased marketing and advertising disclosures

The revised policy changes the prior statement that Brightspot did not disclose website information to advertise third-party products. It now states that Brightspot may disclose information to third-party advertising partners to:

• Market Brightspot’s own services.
• Grow its user base.
• Provide targeted marketing through third-party services.

Brightspot continues to state that it does not sell personal data, but the permitted advertising disclosures are broader.

4. Third-party vendors and international transfers

The revised policy permits sharing with third-party platforms, vendors, hosting providers, and integration partners. It also states that vendors may be located outside the United States or the customer’s country of residence, and that use of the services constitutes consent to transfer and storage of data.

Risk: Customers may have reduced control over international transfers and downstream vendor processing.

5. AI model training

No express change addressing AI training was identified. The diff does not expressly authorize or prohibit using customer data, uploaded content, communications, or hosted data to train, fine-tune, evaluate, or improve AI models.

However, the broadened references to “data analysis,” “improve our products and services,” “testing,” and “other functions” could arguably create ambiguity about model-development activities.

Recommended clarification: Require an express statement that customer data and customer content will not be used to train or improve general-purpose or third-party AI models without the customer’s prior written consent, and specify whether de-identified or aggregated data may be used.

Executive Summary

The revision substantially restructures and expands Brightspot’s Privacy Policy. It broadens the categories of data collected, adds more purposes for processing and marketing, expands disclosures involving advertising partners and vendors, and changes the treatment of cookies, hosting, and international transfers. The diff does not expressly authorize using customer data to train AI models, nor does it mention artificial intelligence, machine learning, model training, or product-development training datasets.

Important Changes and Risks

1. Expanded data collection

The revised policy expressly covers:

• Information provided when requesting support or assistance.
• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences regarding third-party marketing.
• Content uploaded to websites hosted by Brightspot.
• Communications through email, post, social media, and other channels.
• Social media handles, mailing addresses, and other information users share.
• IP addresses, login/logout records, prior site visits, device information, location data, operating systems, demographics, and statistical data.
• Information obtained from public sources or otherwise permitted by law.

Risk: The scope is materially broader, particularly for hosted-site content, communications, behavioral data, and information used to associate individuals with employers or organizations for sales and marketing.

2. Broader purposes for processing

The revised purposes include:

• Account creation, customer support, and responding to queries.
• Processing payments, fees, charges, and amounts owed.
• Providing purchased services and third-party tools.
• Marketing and communications based on user preferences.
• Security, troubleshooting, analytics, testing, maintenance, reporting, hosting, and business protection.
• Improving products and services based on feature usage.

The former language limiting use to purposes for which data was collected is retained in revised form, but the listed purposes are significantly more expansive.

3. Marketing and advertising disclosures

The policy now states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing. It also states that information may indirectly identify a person when combined with other data.

Risk: This is a notable expansion from the prior statement that Brightspot did not use website information to advertise third-party products or services. It may create broader profiling, ad-targeting, and third-party sharing concerns.

4. Cookies and tracking

The revised policy provides a fuller description of cookies and tracking technologies used for website operation, analytics, marketing, communications, and service improvement.

5. Vendors and international transfers

The policy now permits sharing with third-party vendors and hosting partners for infrastructure, professional advice, integrations, and other critical business functions. Vendors may be located outside the United States or the user’s country of residence. The policy relies on consent through use of the services and describes vendor-assessment and contractual safeguards.

Risk: Customers may face cross-border transfers and broader vendor access without a specific vendor list or detailed transfer mechanism.

6. AI-model training

No express change authorizes Brightspot to use customer or personal data to train AI or machine-learning models. The references to analytics, aggregated technical information, and improving products are general and should not automatically be read as a training right. However, the broad language could leave ambiguity about whether identifiable or customer-submitted content might later be used for AI-related development. A separate contractual restriction or explicit clarification would be advisable.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 271 words to the document”

Without the added, deleted, or replacement text, it is not possible to identify:

• Changes to the parties’ rights or obligations
• New liability, indemnity, confidentiality, or termination risks
• Changes to ownership or permitted use of customer data
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data may be shared with affiliates, vendors, or third-party model providers
• Whether customer consent, anonymization, opt-out rights, or deletion obligations have changed

AI Training/Data-Use Review

No conclusion can be reached regarding AI-model training because the relevant language is not included in the supplied diff. The added text should be reviewed specifically for terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models or services
• “input,” “output,” “customer data,” or “usage data”
• Rights to use data in aggregated, de-identified, or anonymized form
• Sharing data with subprocessors or third-party AI providers
• Retention, deletion, or security obligations
• Customer opt-out or consent requirements
• Ownership or licensing rights in data, inputs, outputs, or derived models

Required Information

Please provide the actual 271 words added to the agreement, together with any deleted or replaced language using the stated notation:

• Additions: {new text}
• Deletions: [old text]
• Replacements: [old text]{new text}

Once provided, the changes can be analyzed for legal effect and specific AI-training risks.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 271 words to the document”

Accordingly, I cannot reliably identify:

• Changes to rights, obligations, liability, confidentiality, or termination;
• New customer-data permissions or restrictions;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data is shared with affiliates, service providers, or third parties;
• Data retention, deletion, anonymization, or opt-out rights; or
• Any new security, intellectual-property, or indemnification risks.

Required Information

Please provide the full redlined text, including:

• Additions in {curly braces};
• Deletions in [square brackets]; and
• Replacements in the format []{replacement}.

Once the substantive language is provided, I can prepare a structured summary identifying the important legal changes and any specific AI-training or customer-data risks.

Key Changes and Risks

1. No express AI-training authorization

• The revised policy does not expressly state that customer or user data may be used to train, fine-tune, evaluate, or improve AI models.
• It also does not prohibit such use or provide model-training safeguards, such as:
• no-training commitments;
• limits on using customer content as training data;
• de-identification requirements;
• retention/deletion controls;
• restrictions on sharing data with AI providers; or
• rights to opt out.
• The new language permits use of personal data for the purposes for which it was collected, service provision, product and service improvement, analytics, testing, troubleshooting, and other broad business purposes. Depending on how “improve our products and services” or “data analysis” is interpreted, this could potentially support AI-related development, but the policy does not clearly establish that right.
• Customers seeking certainty should request a contractual statement specifically addressing whether their content, prompts, outputs, usage data, or hosted data may be used for AI training.

2. Expanded categories of data collected

The revised policy adds or more clearly identifies:

• billing information and payment transaction records;
• marketing and communications preferences;
• information users provide when uploading content to a Brightspot-hosted website;
• email addresses, mailing addresses, and social-media handles;
• IP addresses;
• login/logout records and prior site visits;
• device, browser, operating-system, location, demographic, and usage data; and
• publicly available information, which may be combined with Brightspot’s existing data to associate a user with an employer or organization for sales and marketing.

Risk: The collection scope is materially broader, and combining data may make supposedly aggregated or technical information indirectly identifiable.

3. Broader marketing and advertising disclosures

The revised policy adds permission to:

• use communications preferences for marketing;
• provide targeted marketing for Brightspot’s own services through third-party services;
• disclose information to third-party advertising partners to grow Brightspot’s user base; and
• use cookies and similar technologies to analyze visits and support marketing.

Although the policy still says Brightspot does not sell personal data, disclosure to advertising partners creates profiling, tracking, and onward-use risks.

4. Broader operational uses

New purposes include hosting applications and data, support, reporting, testing, maintenance, troubleshooting, surveys, reviews, payment collection, fraud/business protection, and managing customer relationships. The policy also relies more explicitly on legitimate interests and legal obligations as processing bases.

5. Third parties and international transfers

• The revised language expressly permits sharing with third-party platforms, vendors, hosting providers, and integration partners.
• It states that vendors or hosting partners may be located outside the United States or the user’s country of residence.
• Use of the services is treated as consent to transfer and storage on Brightspot’s servers.
• Vendor-protection language remains, but the practical scope of third-party access is expanded.

6. Other notable changes

• The prior statement that Brightspot gathers no information from use of the Brightspot CMS is retained, but the surrounding language clarifies that Brightspot-hosted websites may collect extensive information.
• The prior detailed data-storage/vendor-assessment language is reorganized and partly replaced by broader disclosures.
• The policy continues to allow legally required disclosures and permits withdrawal of consent, subject to limitations.

Summary

The provided diff states only:

> “Added approximately 271 words to the document”

It does not include the actual added language, nor any deletions or replacements. As a result, the substantive legal changes and risks cannot be reliably assessed.

AI Training and Customer Data

• No conclusion can be reached about whether the customer’s data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with model providers or other third parties;
• Retained after account termination;
• De-identified, aggregated, or combined with other data;
• Used for human review, testing, or automated product development; or
• Excluded from training unless the customer opts in or opts out.

Potential Legal Issues to Check

The missing 271 words should be reviewed for changes involving:

• Data-use rights: Broad licenses to use customer content, inputs, outputs, telemetry, or usage data.
• AI training permissions: Express or implied rights to train models using customer data.
• Confidentiality: Exceptions allowing disclosure or use of confidential information for AI development.
• Ownership: Whether the customer retains ownership while granting expansive usage rights.
• De-identification: Whether “de-identified” data can reasonably be reidentified or linked back to the customer.
• Third-party providers: Transfers to cloud, analytics, or AI vendors and the applicable safeguards.
• Opt-out mechanisms: Whether opting out is available, effective prospectively only, or limited to certain services.
• Retention and deletion: Whether data remains available for model weights, backups, logs, or derived datasets.
• Indemnity and liability: New exclusions or limitations relating to AI-generated content or data use.
• Regulatory compliance: Treatment of personal data under privacy, confidentiality, sector-specific, or international-transfer rules.

Required Information

Please provide the actual 271-word addition and any marked deletions or replacements. Without the wording itself, it is not possible to identify the specific legal changes, obligations, or new risks.

Summary of Important Changes

1. Expanded categories of data collected

The revised policy significantly expands the information Brightspot says it may collect, including:

• Billing information, payment transaction records, fees, charges, and amounts owed.
• Marketing and communications preferences, including preferences regarding third-party marketing.
• Information shared through email, post, social media, support interactions, surveys, and reviews.
• Content uploaded to websites hosted by Brightspot.
• IP addresses, login/logout records, prior site visits, browser and device information, operating system, location, demographics, and other usage data.
• Publicly available information and information used to associate an individual with an employer or organization for sales and marketing.

Risk: The collection description is broader and more detailed, particularly for hosted-site content, communications, behavioral data, and marketing profiles.

2. Broader permitted uses

The revised policy replaces or supplements several specific descriptions with broader purposes, including:

• Providing and hosting applications and services.
• Support, troubleshooting, testing, reporting, system maintenance, and data analysis.
• Managing payments, fees, charges, and collection of amounts owed.
• Marketing and communications, including targeted marketing through third-party services.
• Protecting Brightspot’s business and services.
• Improving products and services based on usage patterns.

Brightspot also states that personal data may be used for the purposes for which it was collected, unless otherwise required or permitted by law.

Risk: The revised wording may provide Brightspot greater flexibility to reuse data for operational, analytics, marketing, and service-improvement purposes.

3. Advertising and third-party disclosures

The prior language stated that Brightspot did not disclose website information to advertise third-party products, although it could use advertising partners to market Brightspot’s own services. The revised policy preserves the distinction but more clearly permits:

• Disclosure of information to third-party advertising partners.
• Targeted marketing of Brightspot’s own services.
• Use of information to grow Brightspot’s user base.
• Indirect identification where aggregated or other data is combined.

Brightspot continues to state that it does not sell personal data.

Risk: “No sale” does not prevent sharing with advertising, hosting, analytics, or other service providers.

4. Vendors, hosting, and international transfers

The revised language expressly permits sharing with third-party platforms, vendors, and hosting partners to provide services and integrations. Vendors may be located outside the United States or the customer’s country of residence. The policy relies on vendor assessments and contractual protections rather than guaranteeing a fixed processing location.

5. AI model training

No express change authorizes Brightspot to use customer data or uploaded content to train AI models. The revised policy does not mention artificial intelligence, machine learning, model training, prompts, outputs, or model improvement.

However, the broader language concerning “data analysis,” “testing,” “improving products and services,” hosted content, third-party vendors, and service providers could create uncertainty about whether customer data might be used for AI-related analytics or improvement. Customers should seek an express contractual statement confirming whether customer content and personal data are excluded from model training and whether vendors may use them for that purpose.

6. Other changes

The policy now more clearly describes cookies, hosted websites, surveys, reviews, communications, and payment processing. The legal-basis wording is reorganized around contract performance, legitimate interests, legal obligations, and legally permitted uses.

Summary

The supplied diff does not include the actual added language. It only states that approximately 271 words were added. As a result, the legal and commercial impact of the changes cannot be reliably assessed.

AI Training and Customer Data

• No specific language is provided addressing:
• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether customer prompts, inputs, outputs, or account data are retained for training;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether human reviewers or service providers may access customer data;
• Whether the customer can opt out of AI training or withdraw consent;
• Whether model-training rights continue after termination; or
• Whether the provider may use customer data to develop products or services for other customers.

Accordingly, no conclusion can be drawn about whether the new language expands or restricts the provider’s rights to use customer data for AI training.

Other Legal Risks

The added wording could potentially affect important provisions such as:

• Confidentiality and permitted-use restrictions;
• Intellectual-property ownership and licenses;
• Data protection and privacy obligations;
• Data retention and deletion;
• Use of subcontractors or third-party AI providers;
• Security and breach responsibilities;
• Liability, indemnification, or limitation-of-liability provisions; and
• Customer audit, consent, or termination rights.

Required for Complete Review

Please provide the actual 271 words added to the agreement, together with any surrounding language or marked-up text. Without the substantive wording, it is not possible to identify the specific changes, new obligations, or additional risks.

Executive Summary

The revision substantially rewrites and expands the Privacy Policy. It broadens the categories of data collected and the purposes for which data may be used or shared, while removing or weakening several specific limitations. The diff does not expressly mention artificial intelligence, machine learning, model training, prompts, inputs, or customer content being used to train AI models.

Important Changes and Risks

1. Expanded data collection

The revised policy expressly covers:

• Billing information and payment transaction records;
• Marketing and communications preferences;
• Information shared through email, post, social media, support, and other channels;
• Content uploaded to websites hosted by Brightspot;
• IP addresses, login/logout records, prior site visits, browser and device information, operating system, location details, and other technical data;
• Publicly available information and information obtained from existing Brightspot systems.

Risk: The expanded wording may permit collection and combination of substantially more customer, user, employee, and website-visitor data than before. The policy also states that supposedly aggregated data may indirectly identify a person when combined with other information.

2. Broader purposes for processing

The revised purposes include account creation, customer support, payment collection, communications, marketing, hosting, troubleshooting, testing, analytics, system maintenance, product improvement, security, and legal compliance.

The prior statement that data would be used only for specified purposes is replaced with broader language allowing use for purposes for which the data was collected, and where required or permitted by law.

Risk: The “permitted by law” and legitimate-interests language is broad and may support additional uses without separate consent, subject to applicable privacy law.

3. Marketing and advertising disclosures

The revision changes a prior limitation that Brightspot would not disclose website information to advertise third-party products. It now permits disclosure to third-party advertising partners to market Brightspot’s own services, grow its user base, and provide targeted marketing through third-party services.

Risk: More extensive advertising-related sharing, profiling, cookies, and tracking may occur. The policy does not clearly identify the advertising partners, retention periods, or opt-out mechanism in this diff.

4. Customer content and hosted websites

The revised policy expressly addresses content uploaded to websites hosted by Brightspot and hosting data as a processing function.

Risk: It does not clarify whether customer-uploaded content is used solely to provide hosting/services or may be analyzed for product development, analytics, advertising, or other secondary purposes.

5. Vendors and international transfers

The revision adds broader sharing with third-party platforms, vendors, infrastructure providers, professional advisers, and hosting partners. Vendors may be located outside the United States or the customer’s country, with transfers accepted through use of the services.

Vendor-protection language remains, but the practical scope of permitted disclosures is broader.

6. AI model training

No express authorization or prohibition concerning AI training appears in the diff. There is no statement addressing whether customer data, uploaded content, communications, or usage data may be used to train, fine-tune, evaluate, or improve AI models.

Recommended clarification: Add an explicit customer-data AI provision stating whether customer content and personal data may be used for AI training, whether data is de-identified, whether opt-out rights exist, and whether third-party AI providers receive the data.

Summary

The provided diff does not include the actual added or deleted contract language. It only states: “Added approximately 271 words to the document.”

Analysis Limitations

Without the wording of those 271 words, it is not possible to determine:

• What contractual rights or obligations changed;
• Whether liability, indemnification, confidentiality, security, termination, or governing-law provisions were modified;
• Whether the customer granted broader rights to use its data;
• Whether customer data may be used to train, fine-tune, validate, or improve AI models;
• Whether data may be anonymized, aggregated, shared with affiliates or service providers, or retained after termination;
• Whether the customer can opt out of AI training or request deletion;
• Whether the provider may use inputs, outputs, metadata, usage information, or personal information for model development; or
• Whether the changes create new compliance or intellectual-property risks.

AI-Training Risk

No specific change concerning the use of customer data to train AI models can be identified from the information provided. The statement that approximately 271 words were added does not reveal whether the new language:

• Authorizes training on customer prompts, files, or outputs;
• Limits training to de-identified or aggregated data;
• Requires customer consent;
• Permits human review of data;
• Allows sharing with third-party model providers; or
• Gives the provider ownership or a broad license over customer content.

Required Information

Please provide the full redlined text, including the added language shown in {} and any deleted or replaced language shown in [] and []{}. The actual wording is necessary to assess the legal effect and identify any new AI-data-use risks.

Key Changes and Risks

1. Expanded categories of data collected

The revised policy substantially expands the data Brightspot says it may collect, including:

• Billing and payment transaction records.
• Marketing and communications preferences.
• Information shared through email, post, social media, support, surveys, and reviews.
• Content uploaded to websites hosted by Brightspot.
• IP addresses, login/logout records, prior site visits, device information, location data, operating system, browser details, and user demographics.
• Publicly available information and information used to associate an individual with an employer or organization for sales and marketing.

Risk: The collection scope is materially broader and more detailed. Customer-uploaded content and communications are now expressly within the described data categories.

2. Broader permitted uses

The revised policy replaces a more limited description of use with a broad list of purposes, including:

• Account creation and administration.
• Support and responding to queries.
• Payment processing and recovery of amounts owed.
• Marketing and communications.
• Providing purchased services and third-party tools.
• Hosting applications and customer data.
• Troubleshooting, testing, system maintenance, reporting, data analysis, and protecting Brightspot’s business.
• Improving products and services through aggregated technical information.

It also more clearly relies on contract necessity, legitimate interests, legal obligations, and other uses permitted by law.

Risk: The “legitimate interests” and “purposes for which we collected it, unless required or permitted by law” language may give Brightspot flexibility to use data for additional purposes without obtaining fresh consent.

3. Advertising and marketing disclosures

The revised policy changes the treatment of advertising-related data. It now states that information may be disclosed to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing via third-party services.

Although the policy still says Brightspot does not sell personal data, the expanded advertising disclosure could involve sharing identifiers, browsing information, or contact data with marketing providers.

Risk: “No sale” does not necessarily mean no disclosure or targeted advertising. Customers should review cookie settings, opt-out mechanisms, and applicable data-processing terms.

4. Third-party vendors and international transfers

The revised text continues to permit sharing with third-party vendors, hosting partners, and integration platforms. It expressly states that vendors may be located outside the United States or the customer’s country of residence. Use of the services is described as consent to transferring and storing data on Brightspot’s servers.

Risk: The policy provides limited detail about specific countries, transfer safeguards, retention periods, or customer controls over vendors.

5. AI model training

No express change concerning AI training was identified in the supplied diff. The revised language does not expressly say that customer data, uploaded content, communications, or hosted data will—or will not—be used to train, fine-tune, evaluate, or improve artificial-intelligence models.

The broad references to:

• “data analysis,”
• “testing,”
• “improve our products and services,”
• hosting data, and
• third-party vendors

could potentially be relevant to AI-related processing, but they do not clearly authorize or prohibit model training.

Recommended clarification: Obtain an express contractual statement addressing whether customer data and customer content may be used for AI training, whether it is de-identified, whether third-party AI providers receive it, and whether customers can opt out.

Executive Summary

The diff substantially rewrites the Privacy Policy rather than making limited edits. It expands the categories of data collected and the purposes for which data may be used, while removing or changing several specific protections and disclosures. The formatting also appears to create duplicated or reordered text, so the final consolidated version should be reviewed carefully for inconsistencies.

Key Changes and Risks

1. Expanded data collection

The revised language expressly covers:

• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences concerning marketing from Brightspot or third parties.
• Information shared when uploading content to a Brightspot-hosted website.
• Communications by email, post, social media, or other channels.
• Social media handles.
• IP address, login/logout records, prior site visits, browser and device information, operating system, platform, time zone, country, city, and demographic or statistical information.
• Information obtained from publicly available sources.
• Information used to associate an individual with an employer or other organization for sales and marketing.

Risk: The collection description is materially broader and may cover customer content, usage data, and business-contact information that were not previously identified as clearly.

2. Broader purposes for using data

The revised policy authorizes use for:

• Account registration, support, query handling, payment collection, and service delivery.
• Marketing communications and provision of other products or services.
• Product improvement, testing, analytics, troubleshooting, reporting, hosting, and system maintenance.
• Managing customer relationships and requesting reviews or survey participation.
• Targeted marketing of Brightspot’s own services through third-party services.
• Compliance with legal obligations and other purposes permitted by law.

The prior language more specifically described contractual necessity, legitimate interests, and legal obligations. The replacement appears to rely more generally on using data for the purposes for which it was collected and where permitted by law.

Risk: The revised purposes may provide Brightspot greater flexibility, particularly for marketing, analytics, and service improvement.

3. Third-party sharing and advertising

The prior policy stated that Brightspot did not sell personal data and described sharing with third parties for integrations and service delivery. The revised language retains a “does not sell” statement but expressly permits disclosure to third-party advertising partners to market Brightspot’s own services and grow its user base.

It also permits sharing with third-party platforms, vendors, hosting partners, and other service providers.

Risk: Customers may be subject to targeted advertising or marketing activity involving third-party platforms, even if the data is not technically “sold.”

4. International transfers and vendors

The revised language states that servers are in the United States, but third-party vendors and hosting partners may be located outside the United States or the customer’s country of residence. It also adds vendor-assessment and contractual-protection language.

Risk: Data may be transferred internationally, with the practical safeguards depending on vendor contracts and applicable law.

AI Model Training

No express language was added authorizing Brightspot to use customer data, uploaded content, or personal data to train, fine-tune, evaluate, or improve artificial-intelligence or machine-learning models. The policy also does not expressly prohibit such use.

The broad references to “product improvement,” “data analysis,” “testing,” and “other functions” could potentially be argued to encompass AI-related activities, but they do not clearly address AI training. Customers seeking certainty should request an explicit restriction or authorization covering customer content and personal data.

Summary

The supplied diff does not include the actual contractual language. It only states that approximately 271 words were added. As a result, it is not possible to identify:

• The specific legal or commercial changes;
• New customer obligations or provider rights;
• Changes to liability, confidentiality, security, or termination provisions; or
• Any provisions concerning the use of customer data to train, improve, or evaluate AI models.

AI Training and Data-Use Analysis

No conclusion can be reached about AI-model training because the added wording is not provided. In particular, the missing text may address whether the provider may:

• Use customer data, prompts, inputs, outputs, or account information to train or fine-tune AI models;
• Use data for service improvement, analytics, testing, or product development;
• Use data in aggregated, de-identified, or anonymized form;
• Share data with affiliates, subcontractors, or AI-model providers;
• Retain data after termination; or
• Allow customers to opt out of training or other secondary uses.

These provisions can materially affect confidentiality, intellectual-property ownership, privacy compliance, and the customer’s control over sensitive information.

Information Needed

Please provide the full diff, including the text marked as additions, deletions, and replacements. Once provided, the changes can be analyzed for:

1. New rights granted to the provider

2. New customer responsibilities or restrictions

3. Changes to data ownership, licensing, and confidentiality

4. AI training, model improvement, and data-retention rights

5. Privacy, security, and regulatory risks

6. Changes to liability, indemnification, or remedies

Summary of Important Changes

1. Expanded categories of data collected

The revised policy significantly broadens the information Brightspot may collect, including:

• Billing information and payment transaction records.
• Marketing and communications preferences, including preferences regarding marketing from Brightspot or third parties.
• Information shared when uploading content to a Brightspot-hosted website.
• Communications through email, post, social media, and other channels, including mailing addresses and social-media handles.
• More detailed technical and usage information, including IP addresses, login status and history, prior site visits, device and software information, time zone, country, city, operating system, platform, demographics, and statistical data.
• Publicly available information and information Brightspot obtains where legally required or permitted.

Risk: The policy now permits collection and combination of a broader range of personal and behavioral data. The reference to associating individuals with their employer or another organization for sales and marketing purposes also creates additional profiling and business-development risk.

2. Broader permitted uses

The revised policy replaces a relatively specific list of purposes with a broader statement that Brightspot will use personal data for the purposes for which it was collected, unless required or permitted by law. It also expressly lists purposes such as:

• Account creation and administration.
• Customer support and responding to queries.
• Processing payments, fees, charges, and amounts owed.
• Marketing and communications.
• Hosting applications and data.
• Product and service improvement.
• Security, troubleshooting, testing, maintenance, reporting, and business protection.
• Providing third-party tools and purchased services.

The revised policy retains legitimate-interest and legal-obligation bases, but the wording is reorganized and less clearly tied to particular processing activities.

Risk: The broader formulation may give Brightspot greater flexibility to reuse data for secondary purposes, while making it harder for customers to determine exactly which legal basis applies to each use.

3. Advertising and targeted marketing

A significant change concerns advertising disclosures. The prior language stated that Brightspot did not disclose or use website information to advertise third-party products or services. The revised language states that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base, including through targeted marketing delivered via third-party services.

Risk: Customer information may now be shared with advertising partners for targeted marketing. The policy does not specify the partners, data elements, retention periods, or opt-out mechanism in this excerpt.

4. Hosting, vendors, and international transfers

The revised policy continues to state that servers are located in the United States, unless a contract provides otherwise. It also expressly permits use of third-party vendors and hosting partners, potentially located outside the United States or the customer’s country of residence, and states that using the services constitutes consent to such transfers and storage.

The detailed vendor-assessment commitments were condensed, although the revised text still says vendors’ handling of personal data is assessed and that contractual protections are used.

Risk: Increased reliance on broadly described vendors and international transfers, with less operational detail in the privacy policy.

5. AI model training

No express change authorizing or prohibiting use of customer data to train AI models appears in the supplied diff. The revised policy refers generally to product improvement, data analysis, testing, and other functions, but does not mention AI, machine learning, model training, prompts, inputs, outputs, or model providers.

Risk: Because “product improvement” and similar language is broad, customers should not assume it excludes AI-related processing. A separate agreement or AI/data-processing addendum should be reviewed for any training rights.

Summary

The supplied diff does not include the actual amended contract language. It only states:

> “Added approximately 271 words to the document”

Accordingly, it is not possible to determine what terms changed or whether the additions create new legal risks.

AI Training and Customer Data

No substantive language is provided concerning:

• Whether the customer’s data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, uploaded files, or usage data are retained;
• Whether data may be shared with affiliates, vendors, or third-party AI providers;
• Whether customer data is used in aggregated, de-identified, or identifiable form;
• Whether the customer can opt out of AI training or request deletion;
• Ownership or licensing rights in customer data and AI-generated outputs; or
• Security, confidentiality, or cross-border transfer protections applicable to AI processing.

Therefore, no conclusion can be reached about changes to AI-training rights or related privacy and confidentiality risks.

Required Information

Please provide the actual redlined text, including:

• The 271 added words;
• Any surrounding provisions needed to interpret the additions; and
• Any deletions or replacements, if applicable.

Once provided, the changes can be analyzed for data-use rights, AI-training permissions, ownership, confidentiality, retention, security, and termination-related risks.

Summary of Important Changes

1. Customer data used to train AI models

• No express provision was added authorizing Brightspot to use customer or personal data to train, fine-tune, evaluate, or improve AI models.
• No express prohibition was added either. The revised policy permits use of personal data for broad purposes, including:
• Providing and hosting services;
• Troubleshooting, data analysis, testing, system maintenance, support, and reporting;
• Improving products and services;
• Marketing and communications; and
• Complying with legal obligations.
• Because “data analysis,” “improve our products and services,” and similar language can potentially be interpreted broadly, the policy does not clearly establish whether customer-uploaded content may be used for AI development.
• The policy should be supplemented with a specific AI/data-use clause addressing whether customer content is:
• Used for model training;
• De-identified or aggregated before use;
• Shared with AI providers;
• Retained for training purposes; and
• Excluded from training at the customer’s request.

2. Expanded categories of collected data

The revised policy adds or more clearly identifies:

• Billing and payment records;
• Marketing and communications preferences;
• Preferred contact methods;
• Information shared when uploading content to a Brightspot-hosted website;
• Email addresses, mailing addresses, and social-media handles when communicating with Brightspot;
• IP addresses;
• Login/logout records and prior site visits;
• Device, software, operating-system, location, demographic, and statistical information; and
• Information obtained from publicly available sources or other Brightspot systems.

This increases the types of information Brightspot may collect and combine, including information that may indirectly identify an individual.

3. Broader processing and marketing purposes

The revised language expressly permits use of personal data for service delivery, hosting, support, troubleshooting, analytics, testing, maintenance, reporting, and related business functions.

The marketing language changes from stating that Brightspot does not use website information to advertise third-party products to stating that Brightspot may disclose information to third-party advertising partners to market Brightspot’s own services and grow its user base through targeted marketing.

Risk: Customers may face broader tracking, profiling, and disclosure to advertising platforms, potentially creating additional consent and regulatory obligations.

4. Vendors, integrations, and international transfers

• Brightspot may share data with third parties when necessary to facilitate requested integrations.
• Third-party vendors and hosting partners may be located outside the United States or the customer’s country of residence.
• The prior language emphasizing legally binding vendor protections and compliance is substantially replaced or relocated, although similar assurances remain elsewhere.
• Use of the services is stated to constitute consent to transfer and storage of data on Brightspot’s servers.

Risk: The revised wording may provide less prominent detail about vendor safeguards, international-transfer mechanisms, and customer control over subprocessors.

5. Other notable changes

• The policy now expressly treats payment, fee, charge, collection, and recovery information as personal data.
• The revised policy adds an email address for privacy questions: privacy@brightspot.com.
• Several references to the Brightspot CMS are replaced with broader references to Brightspot-hosted websites and services, expanding the apparent scope of the policy.

Summary

The diff does not include the actual added or modified contractual language. It only states:

> “Added approximately 271 words to the document”

Because the wording of the additions is unavailable, it is not possible to reliably identify:

• New legal obligations or rights
• Changes to liability, indemnification, termination, confidentiality, or governing law
• Changes to ownership or licensing of customer data
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is anonymized, aggregated, retained, shared with vendors, or used for product development
• Any customer consent, opt-out, deletion, or security rights

AI Training and Data-Use Analysis

No specific change concerning AI-model training can be determined from the provided diff. The phrase indicating that approximately 271 words were added does not reveal whether the new language:

• Authorizes training on customer prompts, inputs, outputs, files, or other content
• Permits use of data for generalized model improvement
• Limits training to de-identified or aggregated data
• Applies only to selected service tiers or accounts
• Requires the customer to opt in or provides an opt-out
• Allows retention or use of data after termination
• Grants the provider rights to disclose data to affiliates or subprocessors

Risk Assessment

The principal issue is lack of visibility into the revised terms. A meaningful legal-risk analysis requires the exact additions, deletions, and replacements. In particular, the customer should not assume that the absence of an explicitly described AI-training change means that no such change occurred.

Information Needed

Please provide the full redlined text, including the approximately 271 added words and any surrounding provisions. The analysis should then focus especially on:

1. The definition of “Customer Data” and “Content”

2. Rights granted to the provider to access, copy, analyze, or create derivative works

3. Any authorization to train or improve AI models

4. De-identification, aggregation, retention, and deletion provisions

5. Opt-out or consent mechanisms

6. Security, confidentiality, and third-party sharing restrictions