Cognito Forms

Summary of Important Changes

AI-model training

• No express provision authorizes or prohibits using customer data to train, fine-tune, evaluate, or improve AI models.
• The revised language changes the general purpose from using personal information for “auditing, research and analysis” and to “operate and improve Cognito Forms” to narrower or different purposes, such as:
• diagnosing technical problems;
• administering the service;
• improving service quality and types;
• fraud, spam, and abuse prevention.
• These changes do not clearly address AI training. “Research,” “analysis,” and “improve” are broad enough that an AI-related use could remain arguable, particularly for service-generated or telemetry data. Customers seeking a firm restriction should request an explicit statement that customer content and personal data will not be used to train or improve generalized AI models without consent.
• The revised policy also does not distinguish between:
• customer-submitted form content;
• end-user/respondent data;
• account or usage metadata; and
• de-identified or aggregated information.

Expanded or changed data uses

• The policy now states that Cognito uses a customer’s first and last name, email address, and organization name to obtain additional contact information for sales and marketing activities. This is a material expansion from cookie-related personalization language.
• Email addresses may be used for notification emails and product announcements. The policy adds an option to opt out of sales calls, while confirming that marketing opt-out does not affect service access.
• The policy expressly describes use of:
• organization names to identify the organization to users and customers;
• profile images to identify users to other Cognito Forms users;
• IP addresses and provider information to estimate location, personalize the experience, comply with law, and combat fraud, spam, and abuse;
• cookies to identify unique visitors and provide login access.
• Refusing cookies may prevent users from logging in. The policy also clarifies that Cognito does not use cookies on public or embedded forms and does not track customers completing those forms.

Third-party disclosures and service providers

• The policy identifies or expands disclosures to Stripe, Google Maps, Zendesk, Pendo, Mailgun, and Google Analytics.
• Billing-address and tax-identifier validation may involve Stripe and Google Maps, with “minimal required information” shared. The policy should ideally specify exactly what data is sent and whether these providers may use it independently.
• Zendesk is described as receiving information from support interactions, including chat, email, and social-media contacts. Pendo is identified as an analytics and product-development platform.
• The policy now expressly permits disclosure to authorities to comply with legal obligations and to address crime and abuse.

Security and accuracy concerns

• The policy clarifies that actual passwords are not stored, only an encrypted hash.
• The revised wording appears to remove or narrow some prior assurances that personal information would not be disclosed for materially different purposes without subsequent consent. Although a purpose-limitation statement remains, the new permitted purposes are broader.
• The extensive text restructuring creates potential ambiguity and should be reviewed for internal consistency, especially concerning “internal use only” versus sharing with providers and authorities.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 357 words to the document”

Because the text of the additions, deletions, or replacements is missing, it is not possible to identify the legal or commercial impact of the changes.

AI Training and Customer Data

No conclusions can be drawn about whether the changes:

• Permit the provider to use customer data to train AI or machine-learning models;
• Allow use of customer data for improving products, services, or algorithms;
• Permit the use of customer prompts, inputs, outputs, files, or metadata;
• Apply data-use rights to human review, benchmarking, testing, or model evaluation;
• Use customer data for general-purpose or third-party models;
• Require customer consent or provide an opt-out;
• Restrict training use to aggregated, anonymized, or de-identified data; or
• Address ownership, confidentiality, retention, deletion, or security of data used for AI training.

Information Needed

Please provide the full diff, including the text enclosed in:

• {additions};
• [deletions]; and
• []{replacements}.

Once the actual language is provided, the analysis can identify changes to data-use rights, AI-training permissions, confidentiality obligations, intellectual-property ownership, customer controls, and associated risks.

Summary of Important Changes

1. AI-model training

• No express reference to artificial intelligence, machine learning, generative AI, model training, or use of customer data to train models appears in the diff.
• The prior language permitted use of “personal information for auditing, research and analysis” and to “operate and improve Cognito Forms.” This is replaced with narrower purposes focused on:
• verifying account access;
• diagnosing technical problems;
• administering and improving Cognito Forms; and
• preventing fraud, spam, and abuse.
• This may reduce the apparent scope for generalized analytics or product-improvement uses, but it does not expressly prohibit AI training or define whether “improve Cognito Forms” includes training AI systems.
• The policy also does not clarify whether customer-submitted form content, support communications, analytics data, or de-identified information may be used for model training. Customers seeking a firm no-training commitment should request explicit language addressing:
• customer content and personal data;
• training, fine-tuning, evaluation, and benchmarking;
• internal versus third-party AI models;
• retention and deletion of training data; and
• opt-out or consent rights.

2. New or expanded data uses

• Cognito may use customers’ first and last names, email addresses, and organization names to obtain additional contact information for sales and marketing activities. This is a material expansion beyond cookie-based service delivery.
• Email addresses are now used as usernames and to send product-feature announcements.
• IP addresses and provider information may be used to:
• estimate location;
• personalize the user experience;
• comply with law; and
• protect against fraud, spam, and abuse.
• Profile images may be displayed to identify users to other Cognito Forms users. This creates a new visibility and user-identification consideration.

3. Payments and billing

• The policy now states that Cognito does not capture, process, store, or transmit credit-card information; Stripe handles those interactions.
• Cognito may still use billing information to communicate about paid subscriptions and charge services, and may validate billing addresses and tax identifiers using Stripe and Google Maps. The “minimal required information” limitation is helpful but not technically defined.

4. Cookies and account access

• Cookies are described as necessary for login and service access. Rejecting cookies may prevent login.
• Cognito states it does not use cookies on public or embedded forms and does not track customers completing those forms, which is a favorable clarification.

5. Sharing and vendors

• New or clarified disclosures cover Zendesk for customer support and Pendo for onboarding, in-app messaging, analytics, and activity-related emails.
• Sharing with authorities is framed around legal obligations and reducing crime and abuse.
• These provisions increase transparency but also identify additional third-party processing risks and should be checked against the subprocessor/DPA terms.

6. Other changes

• Users may opt out of sales calls, with a do-not-call record maintained.
• A privacy/data-use contact email is added.
• The policy is dated October 7, 2026, and changes may be made with advance notice.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 357 words to the document”

Because the added, deleted, and replaced text is missing, it is not possible to identify:

• Changes to rights or obligations
• New fees, liability, indemnity, or termination provisions
• Changes to confidentiality or data-security duties
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether such use requires consent, is opt-in or opt-out, or applies retroactively
• Whether data is anonymized, aggregated, retained, shared with vendors, or transferred across borders
• Whether the customer receives any notice, control, deletion right, or restriction on model outputs derived from its data

AI-Training Risk Review

No conclusion can be reached about AI-training provisions without the actual added or modified wording. In particular, the review should look for terms such as:

• “train,” “fine-tune,” “develop,” “improve,” or “evaluate” models
• “customer data,” “content,” “inputs,” “prompts,” or “usage data”
• Rights to use data in “de-identified,” “aggregated,” or “anonymized” form
• Permission to share data with affiliates, subprocessors, or third-party AI providers
• Retention periods and deletion obligations
• Opt-out, consent, or enterprise-data exclusions
• Ownership or licensing rights in models, outputs, or derived data
• Statements that data may be used after termination

Information Needed

Please provide the complete redline or the actual text showing:

• Additions in {braces}
• Deletions in [brackets]
• Replacements in []{braces}

Without that text, any legal-risk assessment would be speculative.

Structured Summary of Important Changes

1. Customer and billing information

• The policy now states that Cognito Forms does not capture, process, store, or transmit credit-card information. Stripe is identified as the PCI-compliant processor handling card information.
• Cognito will collect and validate billing addresses and business tax identifiers, using Stripe and Google Maps and sharing “only the minimal required information.”
• Billing information may be used to communicate about paid subscriptions and charge the customer’s card.
• Risk: The “minimal required information” limitation is not defined, and the policy does not explain the retention, security, or international-transfer arrangements for billing and tax data.

2. Expanded use of personal information

The revised policy identifies additional uses, including:

• Using first and last name, email address, and organization name for sales and marketing activities.
• Using organization names throughout the service and displaying profile images to identify users to other Cognito Forms users.
• Using IP address and provider information to estimate location, personalize the experience, comply with law, and combat fraud, spam, and abuse.
• Using personal information for auditing, research, analysis, and operating and improving Cognito Forms.
• Using Pendo for onboarding, in-app messaging, activity-related emails, analytics, and development planning.
• Sharing information with Zendesk for customer-support requests and related communications.

Risk: These purposes are broader than merely providing the service. “Research,” “analysis,” “personalization,” and “improving” are not narrowly defined and may permit profiling or secondary uses. The policy does not specify categories of data used, retention periods, whether data is aggregated or de-identified, or whether users can object to these uses.

3. AI-model training

• The diff contains no express reference to artificial intelligence, machine learning, generative AI, model training, model improvement, prompts, or customer content being used to train models.
• However, the continued authorization to use personal information for “research and analysis” and to “operate and improve Cognito Forms” is broad enough that it could potentially be interpreted to cover analytics or development of automated systems, depending on the surrounding terms and actual practices.
• The policy does not say whether customer-submitted form data, end-user responses, support communications, or telemetry may be used for AI training.
• Key risk: There is no clear contractual commitment that customer content is excluded from AI training, anonymized before training, used only with consent, or deleted from training datasets upon request. Customers requiring an AI-training prohibition should seek an express exclusion or written data-processing commitment.

4. Cookies and tracking

• Cookie language is reorganized and now states that cookies identify unique Cognito Forms visitors and provide login access and a personalized experience.
• Cognito states that it does not use cookies on public or embedded forms and does not track customers filling out those forms.
• Rejecting cookies may prevent users from logging in.
• Risk: The policy provides limited detail about cookie categories, analytics, consent mechanisms, and whether third-party tools receive identifiable usage data.

5. Sharing and legal disclosures

• The policy more clearly identifies authorized providers, including Zendesk, Pendo, Stripe, Google Maps, Mailgun, and Google Analytics.
• It permits disclosure to authorities to comply with legal obligations and to reduce crime and abuse.
• Providers are stated to be required to protect information and use it only for specified purposes.
• Risk: The revised language is more operationally specific but still does not fully describe provider locations, subprocessors, retention, or the customer’s ability to object.

6. User choices and support

• Users may opt out of sales calls, with a do-not-call record maintained.
• Marketing-email opt-out does not affect service access.
• A privacy/data-use contact address is added: privacy@cognitoforms.com.
• Customer support now expressly uses Zendesk and Pendo, including chat, email, social-media interactions, onboarding, and activity messaging.

Summary

The provided diff does not include the actual added, deleted, or replacement language. It only states:

> “Added approximately 357 words to the document”

Accordingly, it is not possible to identify the legal effect of the changes or determine whether they create new risks.

AI Training and Customer Data

No substantive language addressing any of the following is provided:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether customer prompts, inputs, outputs, or account data are retained for training;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether customer data may be shared with AI service providers or other third parties;
• Whether customers can opt out of AI training or data-use practices;
• Ownership or licensing rights in customer data, prompts, or generated outputs;
• Security, confidentiality, or deletion obligations applicable to AI-training data; or
• Whether data may be transferred across jurisdictions for model development.

Risk Assessment

The risk level cannot be assessed from the information provided. The approximately 357 added words could materially change:

• The provider’s rights to use customer content;
• Confidentiality and privacy protections;
• Intellectual-property ownership;
• Data-retention and deletion obligations;
• Liability for unauthorized use or disclosure; or
• Customer consent and opt-out rights.

Please provide the actual redline text, including the wording shown in {additions}, [deletions], and []{replacements}, for a substantive legal analysis.

Summary of Important Changes

AI Model Training

• No express change to AI training or model-development rights appears in this diff.
• The revisions do not add language authorizing Cognito Forms, Zendesk, Pendo, Google, or other providers to use customer data to train, fine-tune, improve, or evaluate artificial-intelligence models.
• They also do not expressly prohibit such use. Any AI-training terms located elsewhere in the Privacy Policy, Terms of Service, Data Processing Addendum, or vendor policies remain important.
• The revised language concerning Pendo analytics, onboarding, in-app messaging, and activity-related emails could involve analysis of customer activity, but it does not state that this data is used for AI training.

Customer Support and Third-Party Data Sharing

The most substantive change substantially rewrites the Customer Support section:

• Cognito Forms now states that it provides direct, one-on-one customer support, rather than describing support primarily as a public forum.
• It expressly identifies Zendesk as the platform used for email, chat, and social-media support.
• Information shared with Zendesk may include information from:
• Chat sessions;
• Emails;
• Social-media communications; and
• Requests submitted to Customer Success.
• The revised language says Cognito shares information with Zendesk to create and track support requests and that Zendesk uses it to support the request-resolution process.
• The former limitation that Cognito sends only the “minimum information necessary” appears to remain, although the wording and placement are reorganized. This limitation should be checked for consistency with the actual categories of data transmitted.
• The revised text links to the Zendesk Privacy Policy, making Zendesk’s handling of information more relevant to customers.

Risk

The revised wording may clarify operational practices but also confirms broader use of third-party support tools, including social-media support and activity-related communications. The policy does not specify:

• Exactly what customer or form-submission data may be sent;
• Retention periods;
• Whether Zendesk or Pendo acts only as a processor;
• Whether data may be transferred internationally; or
• Whether these providers may use data for their own analytics, product improvement, or AI purposes.

Pendo

• Pendo is newly or more clearly described as an “analytics, communication and development-planning platform.”
• Cognito says it uses Pendo for user onboarding, in-app messaging, and activity-related emails.
• This may expand transparency about behavioral tracking and product-usage monitoring, but the policy does not identify the data collected, opt-out controls, retention period, or any restrictions on secondary use.

Privacy Rights and Contact Information

• A new or more prominent instruction directs users with privacy or data-use concerns to privacy@cognitoforms.com.
• The policy states that deleted information may remain in backups, but the diff does not establish a deletion deadline.
• The account-deletion language continues to state that deleting an account also deletes all associated organizations, which may create significant operational consequences.

Other Changes

• Several edits are grammatical, formatting, or stylistic only.
• The policy records a modification date of May 29, 2026.
• No material change to marketing opt-out rights is apparent.

Summary

The provided diff does not include the actual revised contract language. It only states:

> “Added approximately 149 words to the document”

As a result, it is not possible to identify the legal changes, new obligations, or allocation of risk.

AI Training and Customer Data

The diff contains no substantive language addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models
• Whether inputs, outputs, prompts, or usage data are retained
• Whether data is anonymized, aggregated, or de-identified
• Whether customer data may be shared with affiliates, vendors, or model providers
• Whether the customer can opt out of AI training or data-use practices
• Ownership or licensing rights in customer data, outputs, or derived data
• Security, confidentiality, or deletion requirements relating to AI processing

Accordingly, no conclusion can be drawn about whether the contract expands or restricts the provider’s rights to use customer data for AI training.

Required Information

Please provide the actual text of the additions, deletions, and replacements using the stated notation:

• Additions: {new language}
• Deletions: [removed language]
• Replacements: [old language]{new language}

Without the substantive redline, a meaningful legal risk analysis is not possible.

Key Changes and Risks

1. Customer-support vendors and data sharing

The policy substantially revises the Customer Support section:

• Zendesk remains the support platform, but the description is rewritten to say Cognito Forms uses it to provide email, chat, and social-media support.
• Cognito Forms now states that information shared during a chat session, email, or social-media interaction is sent to Zendesk.
• The policy says Zendesk uses that information to:
• Create and track support requests; and
• Support the request-resolution process.
• The prior language stated that Cognito Forms sent only the minimum information necessary and that Zendesk used it only for the support purpose. The revised wording still says only the minimum information necessary is sent, but the limitation is less direct and should be checked for consistency.
• The policy now refers readers to the Zendesk Privacy Policy, creating reliance on a third party’s separate terms.

Risk: Customers may not clearly understand what categories of information are transferred to Zendesk, whether Zendesk retains the data, or whether Zendesk may use subprocessors or transfer data internationally. The revised language also appears repetitive and may contain drafting or formatting errors.

2. New use of Pendo

The policy adds Pendo, described as an “analytics, communication and development-planning platform.”

The listed uses include:

• User sessions;
• Onboarding;
• In-app messaging; and
• Activity-related emails.

Risk: This appears to authorize collection and analysis of customer activity within the service for product analytics, onboarding, communications, and product planning. The policy does not clearly identify:

• What specific activity or account data Pendo receives;
• Whether customer-submitted form data or end-user data is included;
• How long Pendo retains the information;
• Whether Pendo uses the data for its own purposes; or
• Whether customers can opt out.

3. AI-model training

No express change concerning AI or training AI models appears in the supplied diff.

The additions do not state that Cognito Forms, Zendesk, Pendo, or any other provider may use customer data, form submissions, or support content to train, fine-tune, or improve artificial-intelligence models. Conversely, the revised vendor language does not expressly prohibit such use.

Risk: Because the policy now expands descriptions of analytics and third-party support processing, customers may want explicit confirmation that their data—including form submissions, support communications, and usage data—is not used for AI training except with authorization or under a clearly stated anonymization standard.

4. Account deletion and privacy requests

The policy clarifies that deleting an account through the account page deletes both the user account and all organizations associated with it. Deleted information may still remain in backups.

A new contact route is added: privacy@cognitoforms.com for privacy or data-use concerns.

5. Other changes

• Minor wording, punctuation, apostrophe, and formatting updates.
• The policy states it was modified on May 29, 2026.
• No material change is apparent regarding marketing-email opt-outs, Google Analytics, Google Maps, security notices, or the Data Privacy Framework.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 149 words to the document”

As a result, it is not possible to determine:

• What terms were added, deleted, or replaced;
• Whether liability, confidentiality, intellectual-property, security, or termination provisions changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether any customer consent, opt-out, anonymization, retention, or deletion rights were added or removed; or
• Whether data may be shared with affiliates, vendors, or third-party model providers.

AI Training Review

No conclusion can be reached about AI-model training because the added contractual wording was not provided. The relevant language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models or services;
• “customer data,” “content,” “inputs,” “outputs,” or “usage data”;
• Rights that are “perpetual,” “irrevocable,” “worldwide,” “royalty-free,” or transferable;
• Permission to use data in aggregated, de-identified, or anonymized form;
• Opt-out or deletion mechanisms;
• Restrictions on human review or provider access; and
• Whether data is used only to provide the services or also for broader commercial purposes.

Please provide the actual marked-up text, including the 149 added words and any deleted or replaced language, for a substantive legal-risk analysis.

Summary of Important Changes

AI Model Training

• No express change concerning AI training was identified. The revised language does not state that customer data, form submissions, support communications, analytics data, or other personal information may be used to train, fine-tune, evaluate, or improve artificial-intelligence models.
• It also does not expressly prohibit such use. If the underlying policy contains separate AI-related language not shown here, that language should be reviewed carefully.
• The new references to Pendo analytics and Zendesk support could involve processing customer activity or communications by third-party technology providers, but the diff does not authorize those providers to use the information for AI training.

Third-Party Support and Analytics Providers

• The support description is substantially rewritten. It now says Cognito Forms uses:
• Zendesk for email, chat, social-media support, and creating/tracking support requests; and
• Pendo for user chat sessions, onboarding, in-app messaging, and activity-related emails.
• The prior language emphasized sharing only the minimum information necessary and stated that Zendesk uses it to support request resolution. The revised language still says information is shared with Zendesk and used to create and track requests, but the wording is less tightly framed around data minimization.
• The revision identifies Pendo as an “analytics, communication and development-planning platform.” This may broaden or clarify the purposes for which user activity data is collected and processed, particularly for product-development planning.
• The policy directs users to Zendesk’s privacy policy, but the diff does not describe retention, deletion, international transfers, security obligations, or restrictions on Zendesk’s or Pendo’s independent use of data. Those terms should be checked in the linked policies and any data-processing agreement.

Account Deletion and Marketing

• The deletion instructions are clarified: users can permanently delete their account through the account page. Deletion also removes all organizations associated with the user account.
• The marketing opt-out language is reformatted but appears substantively unchanged: users may unsubscribe using the link in marketing emails.

Privacy Rights and Contact

• A new privacy/data-use contact is added: privacy@cognitoforms.com. Users are invited to report privacy or data-use concerns there.
• The policy now states that Cognito will promptly address such concerns and includes expanded contact details and a modification date of May 29, 2026.
• The revised wording retains the statement that deleted information may remain in backups, which may limit the practical immediacy of deletion.

Other Changes

• Various edits standardize grammar, punctuation, possessives, and terminology. The security-breach language now refers to an organization’s information using corrected grammar.
• No material change is apparent in the Google Analytics, Google Maps, Data Privacy Framework, or policy-scope provisions from the portions provided.

Summary

The supplied diff does not include the actual amended legal language. It only states:

> “Added approximately 149 words to the document”

Accordingly, the specific legal changes, obligations, rights, and risks cannot be analyzed reliably.

AI Training and Data Use

No text is provided showing whether the customer’s data may be:

• Used to train, fine-tune, or improve artificial-intelligence or machine-learning models;
• Combined with other customers’ data for model development;
• Reviewed by human personnel for model training or quality assurance;
• Retained after the customer’s account ends;
• De-identified, anonymized, or aggregated before use;
• Used to create derivative data, analytics, or model outputs;
• Excluded from training only through an opt-out process; or
• Shared with service providers or other third parties for AI-related purposes.

Therefore, no conclusion can be drawn about whether the amendment expands or restricts the provider’s rights to use customer data.

Key Risks That Should Be Checked in the Missing Text

When the full 149-word addition is available, review it for:

1. Scope of “Customer Data”

Whether it includes personal information, confidential information, prompts, files, outputs, metadata, or usage data.

2. Training Authorization

Whether the provider receives a broad, perpetual, irrevocable, worldwide, royalty-free license to use data for AI training or product improvement.

3. Consent and Opt-Out Rights

Whether training is automatic, optional, account-specific, or subject to a separate opt-out request.

4. De-identification Standards

Whether data must be genuinely anonymized or merely described as “de-identified,” and whether re-identification is prohibited.

5. Confidentiality and Security

Whether data used for training remains subject to confidentiality, security, deletion, and breach-notification obligations.

6. Ownership and Outputs

Whether the provider claims ownership of trained models, derived insights, or outputs based on customer data.

7. Third-Party Sharing and Retention

Whether data may be shared with affiliates, contractors, model providers, or retained indefinitely.

Required Information

Please provide the actual added, deleted, and replacement text. Without the substantive diff, any analysis of the legal effect—particularly AI-training provisions—would be speculative.

Summary of Important Changes

AI and Data Use

• The existing language allowing Cognito Forms to use and distribute Content from Forms and accounts to create algorithms and programs (“Tools”) that help identify problematic accounts appears to remain, but is not materially expanded in the provided diff.
• The revised privacy/data language is broader and may support Cognito’s use of customer-submitted information to provide its “tools.” Customers must:
• Comply with all applicable data-protection and privacy laws;
• Protect sensitive information and personal identifiers;
• Obtain and maintain explicit consent from their customers for access to, use, or disclosure of the information by the customer and Cognito Forms;
• Obtain any authorizations needed for Cognito Forms to provide the Services; and
• Explain in a written privacy policy how they plan to use data collected.
• No express statement clearly authorizes Cognito to train general-purpose AI models using Customer Content. However, the reference to algorithms, programs, and “tools,” combined with broad rights to use or distribute Content, creates ambiguity about whether customer data may be used for machine-learning development, model training, profiling, or security systems.
• Customers should seek clarification on whether data is:
• Used to train or fine-tune AI models;
• De-identified or aggregated first;
• Shared with affiliates or third-party AI providers;
• Retained after account termination; and
• Excluded from model training when customers opt out.

Increased Customer Compliance Exposure

• The former, more specific requirements for European/UK/Swiss data (including signing a Data Processing Addendum) and California data have been replaced with broader obligations applying to all applicable privacy laws.
• The customer now bears responsibility for obtaining consents and authorizations that enable Cognito Forms’ processing. This may create significant compliance and indemnity exposure, particularly for sensitive, health, children’s, financial, or regulated data.
• The customer must determine whether the service is suitable under laws such as COPPA, HIPAA, GLBA, and EU privacy laws. Credit-card data remains prohibited except where supported through approved payment processors.

Liability and Indemnity

• The revised provisions retain a broad disclaimer of warranties and a cap on Cognito’s liability at the amount paid for the Service in the prior month.
• The revised indemnity language specifically covers claims, losses, and attorney fees arising from data collected through the customer’s forms and alleged violations of the revised data policy.
• This shifts substantial regulatory, privacy, and third-party claim risk to the customer, potentially beyond the liability cap protecting Cognito.

Other Material Changes

• Free Individual Accounts may be permanently deleted after six months of inactivity, including associated data.
• Cognito may terminate accounts without cause, with only a prorated refund of unused prepaid fees; no refund is due for termination for cause.
• Privacy/data changes require at least 15 days’ notice; billing or subscription changes require at least 30 days’ notice.
• Cognito may charge customer costs for responding to subpoenas, including employee time, record retrieval, document preparation, and depositions.
• The revision is dated May 29, 2026.

Summary

The supplied diff does not include the actual amended language. It only states:

> “Added approximately 247 words to the document”

Accordingly, it is not possible to identify:

• What contractual provisions were added or changed;
• Whether customer data may be used to train, fine-tune, or evaluate AI models;
• Whether such use is permitted for the provider’s own models or third-party models;
• Whether customer consent is required;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether the provider may retain data after termination;
• Any new confidentiality, security, ownership, or liability risks; or
• Whether customers have opt-out, deletion, audit, or indemnification rights.

Key Limitation

No substantive additions, deletions, or replacements are visible in the provided material. The statement that approximately 247 words were added is insufficient to determine the legal effect of the changes.

Information Needed

Please provide the actual diff text, including the added language shown in {...} and any deleted or replaced language shown using the specified notation. Once provided, the changes can be assessed for:

1. AI training rights — whether customer data, inputs, outputs, or usage data may train or improve AI models.

2. Scope of permitted use — whether use is limited to providing the services or extends to commercial model development.

3. Data controls — anonymization, aggregation, retention, deletion, and security requirements.

4. Customer rights — consent, opt-out, objection, audit, and ownership provisions.

5. Risk allocation — confidentiality, regulatory compliance, indemnity, warranties, and liability limitations.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 247 words to the document”

Without the text of the additions, deletions, or replacements, it is not possible to determine:

• What contractual rights or obligations changed;
• Whether liability, confidentiality, security, indemnity, or termination provisions were modified;
• Whether customer data may be used for artificial-intelligence (AI) or machine-learning training;
• Whether such use is permitted by default, requires consent, or is limited to de-identified or aggregated data;
• Whether the provider may retain customer data or use it to improve products or services;
• Whether customer data may be shared with affiliates, vendors, or third-party AI providers; or
• Whether the customer has any opt-out, deletion, audit, or enforcement rights.

AI Training and Data-Use Review

No conclusions can be drawn about AI-model training because the relevant added language is not included. The key terms to identify in the complete diff include:

• “train,” “fine-tune,” “develop,” “improve,” or “evaluate” AI or machine-learning models;
• “customer data,” “content,” “inputs,” “outputs,” metadata, or usage data;
• “de-identified,” “aggregated,” or “anonymized” information;
• rights to use data after termination or deletion;
• sharing data with subprocessors or model providers;
• restrictions on using data to train models available to other customers; and
• customer consent, opt-out, or approval requirements.

Information Needed

Please provide the full diff, including the text within {}, [], and []{}. Once provided, the changes can be analyzed for legal effect and specific risks, particularly any expansion of rights to use customer data for AI training or product improvement.

Summary

The diff does not include the actual added language. It only states that approximately 149 words were added.

Legal and Commercial Impact

• The specific changes cannot be analyzed without the text of the additions.
• It is not possible to determine whether the new language:
• Expands or restricts permitted uses of customer data;
• Authorizes the provider to use customer data to train, fine-tune, test, or improve AI models;
• Allows use of customer data for aggregated, de-identified, or derived data;
• Changes data ownership or licensing rights;
• Creates new data-retention, security, or deletion obligations;
• Permits disclosure of data to affiliates, subprocessors, or AI vendors;
• Changes confidentiality obligations or liability protections; or
• Applies retroactively to previously supplied customer data.

AI-Training Review

No conclusion can be reached about AI-model training because the added wording is not provided. In particular, the following terms should be checked for:

• “Train,” “fine-tune,” “improve,” or “develop” models;
• “Service improvement” or “product improvement” rights;
• “Aggregated,” “anonymized,” or “de-identified” data;
• Rights to retain prompts, outputs, or usage data;
• Opt-out mechanisms or customer consent requirements; and
• Restrictions on using data to train general-purpose or third-party models.

Required Information

Please provide the actual 149 words added to the agreement, including any surrounding sentence or section headings. Without that text, a reliable legal-risk analysis is not possible.

Summary of Important Changes

1. Customer Support Providers and Data Sharing

The privacy notice substantially revises the description of customer-support tools:

• Zendesk is now described as the platform used to provide email, chat, and social-media support, create and track requests, and facilitate communications needed to answer questions or resolve issues.
• The revised language states that information is shared with Zendesk and that Zendesk uses it to support the request-resolution process.
• The prior wording stated that Cognito Forms would send only the minimum information necessary to create support requests and referred users to Zendesk’s privacy protections. The new wording retains the “minimum information necessary” concept, but places it later and makes the explanation less direct.
• Pendo is newly identified as an “analytics, communication and development-planning platform.” It is used for user chat, onboarding, in-app messaging, and activity-related emails.

Risk/impact

The update gives third-party support and product-analytics vendors a more prominent role and may clarify that support interactions and related account or activity information are shared with them. However, the notice does not clearly specify:

• Exactly what data is sent to Zendesk or Pendo;
• How long those vendors retain it;
• Whether the data is used for their own purposes;
• Whether customer-submitted form data or sensitive information may be included.

The change from “Customer Success team” language to broader “customer support” language may also expand the apparent scope of covered communications.

2. AI Model Training

No express change concerning artificial-intelligence training was identified.

The diff does not add or remove language stating whether Cognito Forms, Zendesk, Pendo, Google, or another provider may use customer data, support content, form submissions, or usage data to:

• Train, fine-tune, or evaluate AI models;
• Improve generative-AI products;
• Create profiles or automated inferences.

Accordingly, the revised text provides no clear opt-out, prohibition, consent requirement, or limitation on AI training. This is a material gap if the policy is intended to address current AI-related data practices.

3. Account Deletion and Marketing

• The deletion instructions now expressly state that deleting an account will delete both the user account and all organizations associated with it. This may create operational risk for users who manage multiple organizations.
• The marketing opt-out wording is effectively unchanged and continues to direct users to the unsubscribe link.

4. Privacy Contacts and Other Changes

• A dedicated privacy email address, privacy@cognitoforms.com, is added for privacy or data-use concerns.
• The policy states that deleted information may remain in backups.
• Various wording, punctuation, and terminology changes appear non-substantive.
• The policy is marked as modified May 29, 2026.

Summary

The provided diff does not include the actual added or deleted legal language. It only states:

> “Added approximately 149 words to the document”

Accordingly, it is not possible to determine what contractual rights, obligations, or risks have changed.

AI Training and Customer Data

• No substantive wording concerning AI, machine learning, model training, data usage, data retention, or customer data is included in the diff.
• Therefore, it cannot be determined whether the amendment:
• Permits the provider to use customer data to train or improve AI models;
• Limits training to aggregated, de-identified, or anonymized data;
• Allows use of customer prompts, inputs, outputs, personal information, or confidential information;
• Grants the provider ownership or a broad license over customer data;
• Permits disclosure of customer data to affiliates or third-party AI providers;
• Provides an opt-out, consent, deletion, or data-retention mechanism; or
• Imposes security, confidentiality, or regulatory safeguards.

Risk Assessment

Because the actual language is missing, no reliable assessment can be made of:

• New data-use permissions;
• Expanded intellectual-property rights;
• Confidentiality or privacy risks;
• Liability allocation;
• Compliance obligations; or
• Whether the changes are favorable or unfavorable to the customer.

Information Needed

Please provide the full marked-up text, including the 149 added words and any deleted or replaced language. The changes can then be analyzed for their legal effect, including any provisions allowing customer data to be used for AI model training.

Key Changes and Risks

1. Customer-support data and new service providers

The policy now states that Cognito Forms provides direct customer support through:

• Zendesk for email, chat, social-media support, and tracking support requests.
• Pendo for user-session chat, onboarding, in-app messaging, and activity-related emails.

The revised language says Cognito shares information with Zendesk to create and track support requests and that Zendesk uses the information to support request resolution. It also refers users to the Zendesk Privacy Policy.

Risks and implications:

• Customer information may be transferred to and processed by third-party vendors.
• The policy does not clearly identify the categories of information shared, retention periods, applicable locations, or whether vendors may use the information for their own analytics or product-improvement purposes.
• The addition of Pendo suggests increased collection or use of usage and behavioral data, including session activity and interactions with onboarding or in-app messaging.
• The statement that Zendesk “only uses” the information to support request resolution is narrower than the broader description of Pendo’s analytics and communication functions, creating some ambiguity about how activity data is used.

2. AI-model training

No express change concerning artificial intelligence or training AI models appears in the supplied diff.

The revised language does not expressly state that customer data:

• May be used to train, fine-tune, or evaluate AI models;
• Will not be used for those purposes;
• May be shared with AI providers; or
• Will be de-identified before any AI-related use.

Accordingly, the diff does not create a clear contractual permission or prohibition regarding AI training. The new references to Zendesk and Pendo could be relevant if those providers use automated or AI-enabled tools, but the policy does not address that issue directly. Customers seeking assurance should request a specific written commitment regarding AI training and model-development use.

3. Account deletion

The policy now clarifies that selecting “Delete Account” permanently deletes both the user account and all associated organizations.

However, the policy continues to state that deleted information may remain in backups. Customers should confirm backup-retention periods and whether legal, security, or operational exceptions apply.

4. Privacy inquiries and complaints

A new contact route is provided: privacy@cognitoforms.com for privacy or data-use concerns, questions, and complaints. This improves the process for raising issues but does not create a stated response deadline or guaranteed remedy.

5. Other changes

The remaining edits are primarily wording, formatting, grammatical, or terminology updates, including references to Google Analytics, Google Maps, security notifications, the Data Privacy Framework, and notice periods. No material change to those subjects is apparent from the diff.

Key Changes and Risks

1. Customer-data use and AI/model training

• The existing provision allowing Cognito Forms to use Content from Forms and accounts to create “algorithms and programs” that help identify problem accounts remains, with only punctuation changes to the defined term “Tools.”
• The revised data-privacy language is substantially broader and more explicit. Customers must:
• Comply with applicable privacy and data-protection laws.
• Protect sensitive information and personal identifiers.
• Obtain and maintain explicit consent from their customers for access, use, or disclosure of the data and for Cognito Forms to provide its “tools.”
• Explain in a written privacy policy how they plan to use data collected through their forms.
• Obtain any authorizations needed to enable Cognito Forms to provide the Services.
• The text does not expressly say that Cognito Forms may use customer data to train generative-AI or machine-learning models, nor does it specify whether data will be anonymized, aggregated, retained, shared with model providers, or excluded from model training.
• Nevertheless, “algorithms and programs” and “tools” are broad enough that customers may need to obtain consent for analytics, automated detection, or potentially AI-related processing. Customers should not assume that data is excluded from model training merely because the Terms do not use the word “AI.”
• The customer bears the practical burden of making disclosures and obtaining consent. Failure could create regulatory exposure and contractual liability.

2. Greater customer responsibility and indemnity exposure

• The revised language shifts responsibility for collected data more clearly to the customer, including acts or omissions relating to data collected through the customer’s forms.
• Customers must defend, indemnify, and hold Cognito Forms harmless from claims, suits, or proceedings arising from data collection or policy violations.
• The indemnity also covers third-party claims resulting from the customer’s use or misuse of the Services or conduct by someone using the customer’s password.
• This could expose customers to uncapped costs even though Cognito Forms’ direct liability remains limited.

3. Liability and warranty changes

• The liability limitation is restated broadly: Cognito Forms disclaims responsibility for use or inability to use the Services and excludes indirect, punitive, special, and consequential damages.
• The liability cap remains the amount paid for the Service in the preceding month.
• The warranty disclaimer is expanded or clarified to exclude warranties concerning merchantability, fitness for purpose, security, reliability, timeliness, and performance.

4. Privacy, compliance, and operational changes

• The prior geography-specific references to the EEA, UK, Switzerland, GDPR, and California privacy law are replaced with broader obligations applying to all relevant jurisdictions.
• Credit-card handling language is clarified: Cognito Forms says its servers and client scripts do not process, store, or transmit card information when supported payment processors are used.
• Cognito may permanently delete inactive free Individual Accounts and associated data after six months without login.
• Subpoena-related costs may be charged to the customer, including employee time and deposition participation.
• Material privacy changes receive at least 15 days’ notice; billing or subscription changes receive at least 30 days’ notice.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 149 words to the document”

Without the text of the additions, deletions, or replacements, it is not possible to identify:

• Changes to the parties’ rights or obligations
• New liability, indemnity, confidentiality, or security risks
• Changes to data ownership or permitted uses
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is anonymized, aggregated, retained, shared with providers, or used for human review
• Any opt-out, consent, deletion, or restriction mechanisms

AI-Training Review

No specific AI-training language is visible in the supplied diff. Accordingly, no conclusion can be reached about whether the contract:

• Permits training on customer content or inputs
• Limits training to de-identified or aggregated data
• Allows use of customer data to improve products or services
• Permits disclosure to affiliates, subprocessors, or model providers
• Gives the customer an opt-out or requires affirmative consent
• Specifies retention, deletion, or model-output treatment

Information Needed

Please provide the actual redlined text, using the stated notation:

• Additions: {new text}
• Deletions: [deleted text]
• Replacements: [old text]{new text}

Once provided, the changes can be analyzed for legal effect and specific risks, particularly regarding the use of customer data to train or improve AI models.

Key Changes and Risks

1. Customer data, AI, and automated tools

• The Terms continue to allow Cognito Forms to use and distribute Content from Forms and accounts to create algorithms and programs (“Tools”) designed to identify problematic accounts.
• The revised language does not expressly state that customer data may be used to train general-purpose AI models, nor does it clearly prohibit such use.
• However, the broader data language appears to permit Cognito Forms to use data collected through Forms for providing its tools and services. Depending on how “tools,” “algorithms,” and “data” are interpreted, this could allow automated analysis, machine-learning development, or model improvement.
• The Terms do not clearly address:
• Whether customer content is anonymized or de-identified;
• Whether data is retained after account termination;
• Whether data is shared with AI vendors or subprocessors;
• Whether customers can opt out of model training or automated analysis; or
• Whether models trained using customer data are deleted if the customer requests deletion.
• Customers handling confidential, regulated, or sensitive information should seek clarification or a contractual restriction on AI/model-training use.

2. Expanded customer privacy responsibilities

The prior, more specific requirements for GDPR/UK/Swiss data and California data are replaced with broader obligations requiring customers to:

• Comply with all applicable privacy and data-protection laws;
• Protect sensitive information, including personal identifiers;
• Obtain and maintain explicit consent for access, use, or disclosure of data to Cognito Forms;
• Obtain any authorizations necessary for Cognito Forms to provide the Services; and
• Explain in a written privacy policy how data will be collected and used.

This shifts more compliance responsibility and risk to the customer. The revised language also appears to remove the earlier express requirement to sign a Data Processing Addendum for EEA, UK, and Swiss data, although customers remain responsible for compliance.

3. New indemnity exposure

Customers must defend, indemnify, and hold Cognito Forms harmless from claims arising from:

• Acts or omissions concerning data collected through the customer’s Forms;
• The customer’s use or misuse of the Service; and
• Third-party claims or conduct involving the customer’s account or passwords.

This may expose customers to potentially substantial legal fees and damages, particularly for privacy, consent, or data-use claims.

4. Liability and warranties

The liability provisions are reorganized but retain significant protections for Cognito Forms:

• No liability for indirect, punitive, special, or consequential damages;
• No warranty regarding security, reliability, timeliness, performance, or fitness for purpose;
• Total liability capped at amounts paid for the Service in the preceding month.

The revised wording may make the customer’s recovery especially limited following a data incident or service failure.

5. Other notable changes

• Free Individual Accounts inactive for six months may be permanently deleted, including associated data.
• Material privacy or data-processing changes receive at least 15 days’ notice; material billing changes receive 30 days’ notice.
• Cognito Forms may charge customers for costs associated with responding to subpoenas, including employee time and deposition participation.
• The Terms were marked Modified May 29, 2026.

Summary of Important Changes

1. Customer-support vendors and data disclosures

The policy replaces the former description of Mailgun/Zendesk support with a substantially expanded explanation that:

• Cognito Forms uses Zendesk to provide customer support through email, chat, and social media.
• Cognito Forms uses Pendo for user chat, onboarding, in-app messaging, and activity-related emails.
• Information submitted or generated during support interactions is shared with Zendesk to create and track requests and facilitate issue resolution.
• The policy states that Cognito sends only the minimum information necessary to create support requests and directs users to Zendesk’s Privacy Policy.

Risks and implications

• The revised language expressly covers more communication channels and product-usage activity, potentially broadening the categories of customer information processed by third parties.
• “Minimum information necessary” is not defined, leaving uncertainty about whether form content, account information, usage data, or other customer data may be transferred.
• Pendo’s inclusion suggests additional collection of behavioral or activity-related data for onboarding, analytics, messaging, and communications.
• The repeated and somewhat awkward wording should be reviewed for clarity and consistency, particularly concerning whether Pendo or Zendesk receives specific categories of data.

2. AI-model training

No express change concerning the use of customer data to train AI models appears in the supplied diff.

The revised language does not grant or remove an explicit right to:

• use customer content or form submissions to train, fine-tune, or evaluate AI models;
• allow Zendesk, Pendo, or other subprocessors to use customer data for AI training;
• opt out of AI-related processing; or
• require deletion of data from AI training datasets.

Accordingly, the diff does not establish a new AI-training authorization, but it also does not clarify or restrict any AI-related rights that may exist elsewhere in the Privacy Policy, Terms of Service, Data Processing Addendum, or vendor terms. Customers should review those documents for AI-use provisions.

3. Account deletion

The policy now expressly states that using the “Delete Account” button will delete both the user account and all organizations associated with it. This is a useful clarification but may create operational risk if organizations are deleted unintentionally. Deleted information may still remain in backups.

4. Privacy inquiries and complaints

A new, prominent instruction directs users to contact privacy@cognitoforms.com regarding privacy or data-use concerns. The policy also adds a statement that Cognito will investigate and seeks to resolve privacy concerns.

5. Other changes

• Marketing opt-out wording is standardized.
• Several grammatical, punctuation, and formatting corrections were made.
• The policy records a modification date of May 29, 2026.
• No material change to breach notification, analytics, Google services, or data-transfer provisions is apparent from the diff.

Summary

The supplied diff does not include the actual amended contract language. It only states:

> “Added approximately 247 words to the document”

Because the added text is not provided, it is not possible to determine:

• What contractual provisions changed;
• Whether any existing rights or obligations were expanded or restricted;
• Whether liability, indemnity, confidentiality, security, payment, termination, or governing-law terms changed;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, vendors, or third-party AI providers; or
• Whether the customer has any opt-out, deletion, ownership, or confidentiality protections relating to AI use.

AI-Training Analysis

No specific language concerning AI models or training is visible in the supplied diff. Accordingly, no conclusion can be reached about whether the amendment:

• Authorizes use of customer data or content for model training;
• Permits use of de-identified, aggregated, derived, or metadata information;
• Allows human review or vendor access to customer inputs and outputs;
• Retains customer data after termination for model development;
• Grants the provider ownership or broad usage rights in customer data; or
• Imposes restrictions on using customer data to train general-purpose or third-party models.

Required Information

Please provide the actual redlined text, including the approximately 247 added words and any surrounding language. Once provided, the changes can be assessed for:

1. New or expanded data-use rights;

2. AI training and model-improvement permissions;

3. Data retention, deletion, and de-identification;

4. Third-party disclosures and subprocessors;

5. Customer consent, opt-out, and ownership rights; and

6. New legal or commercial risks.

Key Changes and Risks

1. Customer data use and AI/model training

• The Terms continue to state that Cognito Forms may use and distribute content from Forms and accounts to create “algorithms and programs” or “Tools” to identify problem accounts.
• The diff does not expressly add a right to use customer data to train, fine-tune, or improve generative AI or machine-learning models.
• However, the wording is broad and could potentially encompass automated analytics, algorithm development, or machine-learning systems, particularly because it refers to distributing customer content and creating tools. The Terms do not clearly limit this use to aggregated, anonymized, or de-identified data.
• There is also no clear customer opt-out, deletion mechanism, restriction on use of sensitive data, or commitment that customer content will not be used to train third-party models.
• Customers handling confidential, regulated, or personal information should seek clarification on whether Form submissions, attachments, metadata, or account content may be used for AI or model development.

2. Expanded customer privacy and data-compliance obligations

The previous jurisdiction-specific provisions are replaced with broader obligations requiring customers to:

• Comply with all applicable data-protection and privacy laws.
• Appropriately use and protect sensitive information and personal identifiers.
• Obtain and maintain explicit consent from customers for access, use, or disclosure of data and for Cognito Forms to provide its tools and services.
• Obtain any authorizations necessary to enable Cognito Forms to provide the Services.
• Explain in a written privacy policy how collected data will be used.
• Comply with applicable requirements for California residents and individuals in the EEA, UK, or Switzerland.

Risk: The revised language is broader and places more responsibility on the customer, while removing the more specific prior references to signing a Data Processing Addendum. It may also require customer disclosures or consents that are difficult to obtain, especially where data is used for analytics or potential AI-related purposes.

3. New indemnity exposure for data practices

The customer must defend, indemnify, and hold Cognito Forms harmless from claims, suits, or proceedings arising from:

• Acts or omissions concerning data collected through the customer’s forms.
• Failure to comply with the revised privacy/data-use obligations.
• Third-party claims relating to the customer’s use or misuse of the Service.

This creates potentially significant financial exposure, particularly because the indemnity is not clearly limited to direct damages or subject to the liability cap.

4. Liability and warranty changes

• The liability cap remains generally limited to fees paid for the Service in the prior month.
• Broad exclusions for indirect, punitive, special, and consequential damages remain.
• The revised language expressly disclaims warranties regarding security, reliability, timeliness, and performance.
• Cognito Forms more clearly disclaims responsibility for losses resulting from the customer’s data collection and use.

5. Other notable changes

• Free Individual Accounts may be permanently deleted after six months of inactivity.
• Material privacy/data-processing changes require at least 15 days’ notice; billing or subscription changes require 30 days’ notice.
• Cognito Forms may charge subpoena-related costs, including employee time and deposition participation.
• The Terms are marked as modified May 29, 2026.

Summary

The diff only states that approximately 149 words were added; it does not include the text of the additions or identify where they were inserted.

Important Legal Changes

• Cannot be determined: Without the actual added language, it is not possible to assess changes to warranties, liability, confidentiality, termination, data rights, or other contractual obligations.
• No confirmed changes to AI training rights: The diff provides no language indicating whether the customer’s data may be:
• Used to train, fine-tune, or improve artificial intelligence or machine-learning models;
• Shared with model providers or other third parties for training;
• Anonymized, aggregated, or otherwise de-identified before such use;
• Retained after termination for model-training purposes; or
• Excluded from training and limited to providing the contracted services.

Key Risk Areas to Check in the Added Text

If the new language concerns data use, review whether it:

1. Grants broad rights to use customer data, prompts, outputs, metadata, or usage information;

2. Allows use for “improvement,” “research,” analytics, or product development, which may include AI training;

3. Permits use of de-identified or aggregated data without clearly defining those terms;

4. Allows disclosure to affiliates, subprocessors, or third-party AI providers;

5. Removes or weakens the customer’s ability to opt out;

6. Creates rights that continue after the agreement ends; or

7. Conflicts with confidentiality, data-protection, security, or deletion obligations elsewhere in the contract.

Required for a Definitive Analysis

Please provide the actual 149-word addition, including any surrounding text and markup. Without it, no reliable conclusion can be reached about the legal effect or any new AI-training-related risks.

Key Changes and Legal Risks

1. No express AI-training provision added

• The diff does not expressly authorize Cognito Forms, Zendesk, Pendo, Mailgun, Google, or any other provider to use customer data to train artificial intelligence or machine-learning models.
• It also does not expressly prohibit such use.
• The revised language says Zendesk uses shared information to support and resolve customer requests, but this is not the same as a clear contractual restriction against using the information for:
• Generative-AI training;
• Product or model improvement;
• Automated profiling; or
• Training models operated by the service provider.
• Customers concerned about AI use should seek a specific commitment that customer content and form-submission data will not be used for AI or model training, except where expressly authorized.

2. Expanded description of customer-support data sharing

The support section is substantially rewritten. It now states that Cognito Forms:

• Provides direct, one-on-one customer support;
• Uses Zendesk for email, chat, and social-media support;
• Uses Pendo for user chat, onboarding, in-app messaging, and activity-related emails; and
• Shares information with Zendesk when customers engage through chat, email, Facebook, Twitter, or similar channels.

Risk: The revised wording may make the categories of data and support interactions covered by third-party processing broader or clearer, particularly for social-media communications and activity-related messages. It does not specify precisely what information may be shared, how long it is retained, or whether sensitive form data could be included.

The language also refers customers to the Zendesk Privacy Policy, potentially incorporating a third party’s separate practices and terms.

3. Pendo analytics and behavioral data

Pendo is newly described as an “analytics, communication and development-planning platform.” The revised text also references user sessions, onboarding, in-app messaging, and activity-related emails.

Risk: This suggests collection and processing of usage or behavioral data beyond ordinary support-ticket information. The policy does not clearly state:

• Which activity data is collected;
• Whether it is linked to identifiable users;
• How long it is retained; or
• Whether Pendo may use it for its own analytics, product improvement, or AI-related purposes.

4. Privacy rights and account deletion

• The account-deletion instruction is clarified: deleting an account deletes the user account and all organizations associated with it.
• Deleted information may still remain in backups.
• A new privacy/data-use contact email is added: privacy@cognitoforms.com.
• The policy provides an updated notice date of May 29, 2026 and states that certain processing changes will receive at least 15 days’ advance notice.

Risk: The deletion language does not specify backup-retention periods or when backups are permanently overwritten.