Contentstack

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 177 words to the document”

Because the inserted wording is not shown, it is not possible to reliably determine:

• What contractual terms changed;
• Whether customer rights or obligations were expanded;
• Whether liability, confidentiality, security, or termination provisions were modified;
• Whether new data-sharing or service-provider rights were added; or
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models.

AI Training and Data-Use Risk

No conclusion can be reached about AI-model training from the information provided. The added language could potentially address any of the following, but the diff does not reveal whether it does:

• Use of customer data to train or improve models;
• Use of de-identified, aggregated, or anonymized data;
• Retention of prompts, inputs, outputs, or usage metadata;
• Use of customer data by affiliates, subprocessors, or third-party model providers;
• Restrictions or permissions concerning confidential information;
• Opt-out rights or limitations on model training; or
• Ownership and permitted use of AI-generated outputs.

These provisions can materially affect confidentiality, intellectual-property rights, privacy compliance, and the customer’s ability to control its data.

Information Needed

Please provide the actual redlined text, using the stated notation:

• Additions: {new text}
• Deletions: [deleted text]
• Replacements: [old text]{new text}

Without the substantive wording, any legal-risk assessment would be speculative.

Structured Summary of Important Changes

1. Major restructuring and scope changes

• The prior privacy-policy introduction and detailed user classifications are largely replaced with a new, shorter description of Contentstack’s Sites, Software, and Services.
• The policy now refers to a broader set of linked legal documents, including:
• Artificial Intelligence Addendum
• External-Facing Services Policy
• Terms of Service
• Data Processing Agreements
• EU Standard Contractual Clauses
• Marketplace and EULA documents
• This creates a risk that important privacy or AI-related terms are incorporated by reference but are not visible in the Privacy Policy itself. Customers should review whether those linked documents impose additional data-use rights.

2. Controller/processor role changes

• The revised language more clearly distinguishes:
• Contentstack as controller for sales, customer-service, billing, visitor, customer, and referral-partner interactions; and
• Customers as controllers of End User data processed through the SaaS.
• The policy states that Contentstack processes customer-collected End User data on the customer’s instructions.
• However, the replacement is not entirely clean and appears to contain duplicated or mechanically inserted text. The final allocation of controller and processor responsibilities should be confirmed against the applicable Data Processing Agreement.

3. End User data

• The revised policy expands and clarifies the concept of End Users to include customers’ members, contractors, and employees.
• It retains language stating that Contentstack will not sell, disclose, or use End User personal data or content for third parties without controller authorization.
• The policy now expressly addresses customers and data subjects in the EEA, UK, Switzerland, and California, with processing governed by a DPA or other written contractual terms.
• A potential risk is that protections depend heavily on the customer having executed the correct DPA or other agreement.

4. AI model training and AI use

• No express authorization to train AI models appears in the supplied diff.
• The diff does not add language stating whether customer content, personal data, prompts, outputs, telemetry, or End User data may be used to train, fine-tune, evaluate, or improve AI models.
• The addition of a link to an Artificial Intelligence Addendum is significant. That separate document may contain the operative AI-training permissions, restrictions, opt-out rights, retention rules, or provider-sharing terms.
• Because the Privacy Policy now points to that addendum without stating its contents, there is a material risk of uncertainty about whether customer data may be used for AI development or shared with AI providers.
• Customers should obtain and review the AI Addendum and confirm that it expressly addresses:
• Training and fine-tuning;
• Use of customer content and personal data;
• Model-improvement and benchmarking;
• Human review;
• Subprocessors and third-party model providers;
• Opt-out or deletion rights; and
• Whether data is used only to provide the service or also for general product development.

5. Other notable changes

• Contact information is updated to privacy@contentstack.com.
• Consent and rights language is reorganized, including withdrawal-of-consent and access/deletion requests.
• The policy appears to update cross-border transfer references, including the Data Privacy Framework and contractual transfer mechanisms.

Summary

The supplied diff only states that approximately 6,448 words were removed. It does not identify which provisions were deleted or provide replacement language.

Key Legal Significance

• Substantive review is not possible: Without the deleted text, it is impossible to determine whether the changes affect liability, confidentiality, intellectual property, data protection, service levels, termination, payment terms, or other rights and obligations.
• Potential loss of customer protections: A large deletion may remove customer-favorable provisions, such as limitations on the provider’s use of data, security commitments, audit rights, indemnities, warranties, or restrictions on sublicensing and disclosure.
• Potential expansion of provider rights: If deleted restrictions are not replaced elsewhere, the revised document could give the provider broader discretion regarding data use, service changes, retention, disclosure, or allocation of risk.
• Cross-reference risk: Removing provisions may leave undefined terms, broken cross-references, inconsistent obligations, or gaps in procedures and remedies.

AI Training and Data Use

The provided diff contains no specific language showing whether customer data may be used to train, fine-tune, evaluate, or improve AI models.

Accordingly, it is not possible to determine whether the revision:

• Permits or prohibits training on customer data;
• Distinguishes customer content from usage data, prompts, outputs, telemetry, or aggregated/de-identified information;
• Allows human review or disclosure to subcontractors and model providers;
• Grants the provider ownership or a broad license to use customer data;
• Requires deletion or retention limits;
• Applies opt-out, consent, security, confidentiality, or geographic restrictions; or
• Addresses whether model outputs may be used to improve systems shared with other customers.

Recommended Next Step

Obtain a redline showing the actual deleted and added language, or provide the full prior and revised versions. Particular attention should be paid to provisions titled “Data Use,” “Customer Data,” “Content,” “Artificial Intelligence,” “Machine Learning,” “Service Improvement,” “Confidentiality,” “Privacy,” and “License.”

Structured Summary of Important Changes

1. Major restructuring of the Privacy Policy

• The prior introductory language identifying Contentstack and Lytics, the Sites, Software, and Services is replaced with a substantially different navigation/header structure.
• The revised text appears to incorporate or link to numerous separate documents, including:
• Artificial Intelligence Addendum
• Data Processing Agreements
• Subprocessor information
• Marketplace and community terms
• EU Standard Contractual Clauses
• Data Transfer Risk Assessment
• Risk: The diff appears to contain website navigation and document-directory content mixed into the policy text. It should be reviewed in the rendered version to ensure the operative Privacy Policy is complete, coherent, and not accidentally incorporating unrelated terms.

2. Changes to user categories and scope

• The policy continues to distinguish Visitors, Customers, and Referral Partners, but the definitions are rewritten.
• “Customers” now expressly includes persons using the Services through a free trial or by purchasing the Software.
• Referral Partners are described as persons requesting information about business referrals, rather than simply users connected to the Services.
• “End Users” are expanded or clarified to include customers, members, contractors, and employees of a Customer.
• Risk: The revised wording may broaden the categories of people and data covered by the policy, particularly individuals whose information is submitted through a Customer’s use of the Services.

3. Controller/processor roles

• The revised policy more clearly states that:
• Contentstack is the controller for its own sales, customer-service, billing, Visitor, Customer, and Referral Partner interactions.
• Customers are the data controllers for End User data collected through their use of the Services.
• Contentstack processes that End User data on the Customer’s instructions.
• The prior language referring to the Master Agreement and SaaS schedules is replaced with more detailed controller/processor wording.
• Risk: The allocation of responsibility is more explicit, but customers remain responsible for determining lawful instructions, providing notices, and obtaining any required consents from End Users.

4. International privacy-law treatment

• The revised policy expressly addresses the EEA, United Kingdom, Switzerland, and California.
• For applicable data, the policy refers to Data Processing Addenda, EU Standard Contractual Clauses, and other written agreements.
• The policy also updates contact information and references the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks.
• Risk: Customers should confirm that the incorporated DPA, transfer mechanisms, and supplementary measures match their actual data flows and contractual requirements.

5. AI-model training and use of Customer data

• The diff does not add express language authorizing Contentstack to use Customer data, End User data, prompts, content, or outputs to train, fine-tune, or improve AI models.
• It does add or prominently link to an Artificial Intelligence Addendum, but the substantive terms of that addendum are not included in the diff.
• The prior restriction stating that End User personal data or content would not be sold, disclosed, or used with third parties without controller authorization is substantially carried forward in the revised text.
• Key risk: The Privacy Policy alone does not establish whether Customer data may be used for AI training. The Artificial Intelligence Addendum, Master Agreement, DPA, and product-specific terms should be reviewed for:
• Training or model-improvement rights
• Opt-out or opt-in mechanisms
• Use of de-identified or aggregated data
• Third-party AI providers
• Retention and deletion of prompts and outputs
• Whether Customer content is used to train shared or customer-specific models

Summary

The diff only states that approximately 177 words were added; it does not include the added contractual language or identify where it appears.

AI Training and Customer Data

• No conclusion can be reached about whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models.
• The available diff does not show whether the new language:
• Grants the provider ownership or broad usage rights over customer data;
• Permits use of data in aggregated, anonymized, or de-identified form;
• Allows human review or use by subcontractors and model providers;
• Permits retention of prompts, outputs, or other usage data;
• Restricts use of confidential, personal, or regulated information;
• Provides an opt-out, deletion right, or assurance that data will not be used for AI training; or
• Addresses whether customer inputs or AI outputs may be used to improve services.

Legal and Commercial Risks

The actual 177-word addition is necessary to assess potential changes to:

• Data ownership and licensing;
• Confidentiality and privacy obligations;
• Security and data retention;
• Regulatory compliance;
• Intellectual-property rights in inputs and outputs;
• Liability and indemnity exposure; and
• Whether the provider can use customer data for purposes beyond delivering the services.

Conclusion

No substantive legal analysis is possible from the information provided. Please provide the actual added text, including any surrounding language and deletion/replacement markers, for a reliable assessment of the changes and any AI-training-related risks.

Summary of Important Changes

1. New or Expanded Legal Resources

The navigation now expressly includes:

• Artificial Intelligence Addendum
• External-Facing Services Policy
• Marketplace terms and EULAs
• Data Processing Agreements for US/CA and EMEA/UK
• Security Addendum
• Data Transfer Risk Assessment
• Privacy Notices for employees, contractors, candidates, and potential contractors
• Sub-processors information

Risk

The addition of an Artificial Intelligence Addendum is significant. However, the diff does not include the text of that addendum. Customers should review it separately, because it may contain the operative terms governing AI functionality, including data inputs, model training, retention, ownership, use of providers, and opt-out rights.

2. Customer and End-User Data

The policy continues to state that:

• Customers control End User data and generally act as the data controller.
• Contentstack processes End User data under the Master Agreement, schedules, DPAs, or other applicable transfer terms.
• Contentstack will not sell, disclose, or use End User personal data or content with third parties without controller authorization, except as expressly provided in the Privacy Policy.
• Customer content and software usage are collected.
• Content, Personal Data, Tracking Information, and usage history may be used for fraud prevention, security, service administration, analytics, and service improvement.
• Customer Content and End User data are deleted within 180 days after termination, subject to legal and business-retention exceptions.

Risk

The “except as expressly set forth” language preserves broad exceptions elsewhere in the policy. The policy also permits use of data for service improvement, analytics, security, marketing, and aggregated statistics. These provisions should be reconciled with the customer’s contractual DPA and any AI-specific terms.

3. AI Model Training

No Express Training Authorization Identified

The provided substantive privacy-policy text does not expressly state that Customer Data, Customer Content, End User data, prompts, outputs, or usage data may be used to train, fine-tune, or improve generative AI models.

The only apparent AI-related change is the addition of the Artificial Intelligence Addendum to the legal-resource navigation.

Key Unresolved Risk

Because the AI Addendum text is not included, the diff does not establish whether:

• Customer Data may be used for model training;
• data may be shared with third-party AI providers;
• inputs or outputs are retained;
• data is anonymized or aggregated before model use;
• customers have an opt-out or no-training commitment;
• Contentstack obtains rights to use outputs or feedback; or
• AI data is deleted upon termination.

Customers should obtain and review the AI Addendum before using AI-enabled features or submitting confidential, personal, regulated, or proprietary information.

4. Other Notable Changes

The policy continues to disclose extensive tracking, advertising, analytics, international transfers, and third-party provider processing. It also states that California personal information may be shared for targeted advertising and provides related opt-out rights.

Overall Assessment

The most important apparent development is the formal introduction of AI-specific contractual documentation, but the actual AI data-use terms cannot be determined from this diff alone.

Change Summary

Executive Overview

The diff appears to replace a largely technical/rendered page fragment with the full Privacy Policy page content and expanded legal-navigation content. It is difficult to identify precise clause-by-clause amendments because the diff includes duplicated page markup and Next.js framework output. Nevertheless, the visible legal text includes several important privacy provisions and risks.

Customer Data and AI-Model Training

• No express authorization to train AI models was identified.
• The Privacy Policy does not expressly state that Customer Content, End User Data, prompts, outputs, usage data, or other submitted information may be used to train, fine-tune, evaluate, or improve generative-AI or machine-learning models.
• The text does state that Contentstack:
• collects “Customer content” and tracks Customer usage;
• may use Personal Data, Content, Tracking Information, and usage history for fraud prevention, security, service stability, and service improvement; and
• may use tracking information and usage history to improve service quality and user experience.
• These broad service-improvement rights could create interpretive uncertainty if AI systems are used as part of service improvement. However, they do not clearly authorize model training, and the policy does not identify whether data used for improvement is de-identified, aggregated, retained in model weights, or shared with AI vendors.
• The navigation now references an “Artificial Intelligence Addendum.” That may be the document governing AI-related processing, but the diff does not show its terms. Customers should review that addendum and confirm whether it overrides or supplements the Privacy Policy.

Other Material Privacy Provisions and Risks

End User Data

• Customers remain identified as the controllers of End User data.
• Contentstack says it will not sell, disclose, or use End User data or content for third parties without controller authorization, subject to express exceptions in the Privacy Policy.
• Processing is also governed by the Master Agreement, schedules, and applicable Data Processing Addenda. The contractual hierarchy should be confirmed.

Tracking and Profiling

• Contentstack may use cookies, pixels, web beacons, third-party tracking, IP addresses, device identifiers, and usage history.
• Tracking data may be linked to personal information and shared with advertisers or service providers.
• The policy expressly permits targeted or behavioral advertising and states that California personal information is shared for that purpose.

Third-Party and International Sharing

• Broad sharing rights apply to affiliates, contractors, analytics providers, marketing platforms, support vendors, and other service providers.
• Processing may occur in the United States and other countries, relying on Data Processing Addenda, Standard Contractual Clauses, Binding Corporate Rules, or the Data Privacy Framework.

Retention and Deletion

• Customer Content and End User data are stated to be deleted within 180 days after account termination, subject to legal, contractual, and dispute-related retention.
• Deletion of personal information may terminate access to the Services.

Recommended Follow-Up

Confirm whether the Artificial Intelligence Addendum contains separate rights to use Customer Data for AI training, whether opt-out rights exist, and whether Customer Content is excluded from model training by default.

Summary of Important Changes

1. New or Expanded Legal-Document Links

The navigation now includes additional legal and privacy materials, including:

• Artificial Intelligence Addendum
• External-Facing Services Policy
• Privacy Notice for Employees and Contractors
• Privacy Notice for Candidates and Potential Contractors
• Sub-processors disclosure
• Marketplace terms and EULAs
• Data Processing Agreements for US/CA and EMEA/UK
• Security Addendum
• Data Transfer Risk Assessment
• International Data Transfer Addendum
• EU Standard Contractual Clauses

Risk

These linked documents may contain terms that materially supplement or override the Privacy Policy. In particular, the Artificial Intelligence Addendum appears to be a new or newly surfaced governing document. Customers should review it because the diff does not include its substantive text.

2. Scope of the Privacy Policy

The policy now more clearly describes Contentstack and its subsidiary Lytics, Inc. as operating the Sites and Services. It also reorganizes or expands user categories and related privacy notices, including:

• Customers and account users
• Referral Partners
• Employees and contractors
• Candidates and potential contractors

Risk

The policy may apply to a broader range of individuals and data-processing activities than before. Separate employee, candidate, contractor, and partner notices may impose additional processing purposes or disclosures not described in this policy.

3. Customer and End-User Data

The policy continues to state that:

• The Customer controls End User data and is generally the data controller.
• Contentstack processes End User data under the Master Agreement, schedules, DPAs, or other applicable data-transfer terms.
• Contentstack will not sell, disclose, or use End User personal data or content for third parties without controller authorization, except as otherwise stated.
• Customer Content and usage data may be collected.
• Customer Content and End User data are generally deleted within 180 days after termination, subject to legal, contractual, security, and anonymization-related retention.

Risk

The language preserves broad rights to process usage history, Tracking Information, Customer Content, and personal data for security, fraud prevention, service improvement, analytics, marketing, and legal purposes. The references to anonymization and aggregated data may allow retention and further use after account termination.

4. AI Model Training

No express change in the supplied Privacy Policy text states that Customer data or Customer Content will be used to train AI models, nor does it expressly prohibit such use.

However, the addition of an Artificial Intelligence Addendum link is significant. That addendum may address:

• Whether Customer Content, prompts, outputs, or usage data may train or fine-tune models
• Whether data is shared with AI providers
• Opt-out or consent requirements
• Ownership and confidentiality of inputs and outputs
• Retention and deletion of AI-related data

Key Action

Do not assume that Customer data is excluded from AI training based solely on this diff. Review the Artificial Intelligence Addendum and the Master Agreement/DPA for controlling language, especially any provisions concerning service improvement, aggregated data, subprocessors, and Customer Content.

Summary of Important Changes

1. No identifiable AI-training change

• The diff does not contain any express language authorizing Contentstack to use Customer Data, End User Data, Customer Content, prompts, outputs, or other service data to train, fine-tune, evaluate, or improve AI models.
• It also does not add restrictions stating that Customer Data will not be used for AI training.
• References to using data to “improve the quality of our Services,” conduct analytics, compile aggregated statistics, detect fraud, or monitor usage appear to be existing privacy-policy language and are not specifically expanded to mention AI models.
• The navigation includes an “Artificial Intelligence Addendum,” but the diff does not show the addendum’s terms or establish whether it applies to Customer Data. Customers should review that separate document.

2. Substantive privacy-policy terms appear largely unchanged

The supplied diff appears heavily affected by page-source/rendering changes and repeated content. The visible substantive policy text continues to state that:

• The Customer controls End User Data and is generally the data controller.
• Contentstack processes End User Data under the Master Agreement, applicable schedules, and data-processing agreements.
• Contentstack will not sell, disclose, or use End User personal data or content for third parties without controller authorization, subject to stated exceptions.
• Customer Content and usage information may be collected and used for service administration, security, fraud prevention, support, analytics, service improvement, and marketing.
• Customer and End User data may be shared with affiliates, subprocessors, service providers, account owners, teammates, and authorities where legally required.
• Customer Content and End User Data are deleted within 180 days after termination, subject to legal, contractual, security, and anonymization-related retention.

These provisions remain broad and could potentially encompass AI-related service improvement if an AI feature or separate addendum defines such processing broadly.

3. Other apparent changes

• Page metadata and legal-site navigation were revised or re-rendered, including links to:
• Artificial Intelligence Addendum
• Data-processing agreements
• Security and transfer documents
• Privacy notices
• The displayed metadata contains malformed or concatenated text, including references to EMEA/US solution-partner agreements and privacy notices. This appears to be a technical or extraction issue rather than a clear legal change.
• The company description continues to identify Contentstack and Lytics, Inc. as operating the Sites and Services.

Key customer risks and follow-up

• AI-training rights remain unclear from this diff. Obtain and review the Artificial Intelligence Addendum and applicable Master Agreement/DPA.
• Confirm whether “improve the quality of our Services” permits use of Customer Content or End User Data for model training, and whether de-identification, opt-out, retention, human review, or subprocessors are addressed.
• The policy’s broad service-improvement, analytics, aggregation, and usage-monitoring language may create ambiguity unless contract documents expressly prohibit AI training.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 177 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions were added or changed;
• Whether liability, confidentiality, security, intellectual property, or termination rights were affected;
• Whether the customer’s data may be used to train, fine-tune, validate, or improve AI models;
• Whether customer data may be shared with affiliates, vendors, or third-party model providers;
• Whether any opt-out, consent, deletion, retention, or usage restrictions apply; or
• Whether the new language creates broader rights for the provider than the prior agreement.

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training because the text describing the additions is missing. The key language to review would include terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “enhance” models or services;
• “customer data,” “content,” “inputs,” “outputs,” or “usage data”;
• rights to use data in “de-identified,” “aggregated,” or “anonymized” form;
• sharing data with “service providers,” “subprocessors,” or third-party AI providers;
• retention after account termination; and
• customer consent, objection, or opt-out mechanisms.

Required Information

Please provide the actual redline or the added wording, using the stated notation:

• Additions: {text}
• Deletions: [text]
• Replacements: [old text]{new text}

Without the substantive diff, any assessment of legal effect or AI-training rights would be speculative.

Executive Summary

The diff appears to replace and substantially restructure the Privacy Policy’s introductory sections, user classifications, controller/processor descriptions, and links to related legal documents. Much of the apparent change is website navigation/menu content rather than operative privacy language, which creates some ambiguity about the final published text.

Important Changes and Risks

1. Expanded scope of covered users and activities

The revised policy expressly covers:

• Visitors;
• Customers, including free-trial users and purchasers;
• Referral Partners;
• Customers’ employees, contractors, members, and other end users; and
• Interactions involving sales, customer service, billing, and referrals.

This is broader and more detailed than the prior wording. Customers should confirm that the policy accurately distinguishes data submitted by customers from data collected directly by Contentstack.

2. Revised controller/processor roles

The revised language states that:

• Customers generally control end-user data collected through the SaaS;
• Contentstack acts as a processor for that data when acting on customer instructions; but
• Contentstack acts as a controller for its own sales, customer-service, billing, visitor, customer, and referral-partner activities.

This allocation is legally significant because it may determine responsibility for notices, lawful bases, data-subject requests, security obligations, and regulatory liability. The revised language should be reconciled with the Master Agreement, Data Processing Addendum, and any regional data-processing terms.

3. New or expanded regional privacy framework

The revision more clearly addresses individuals and entities connected with the EEA, United Kingdom, Switzerland, and California. It refers to Data Processing Addenda, EU Standard Contractual Clauses, and other written agreements as governing certain processing activities.

The wording appears to make the DPA or another written agreement particularly important for regulated data. Customers should verify that those documents contain consistent provisions on international transfers, subprocessors, deletion, audits, security, and assistance with data-subject rights.

4. Changes concerning disclosure and use of end-user data

The prior language stated that Contentstack would not sell, disclose, or use end-user personal data or content with third parties without controller authorization, except as expressly provided. The replacement retains a similar restriction but places it within a substantially reorganized framework and adds broader descriptions of Contentstack’s own controller activities.

This could create uncertainty over whether data may be used for Contentstack’s independent business purposes, particularly where data is associated with customer support, billing, analytics, product improvement, or referrals.

AI Training and Model Use

No express provision in the supplied diff states that customer data, end-user data, prompts, content, or outputs may be used to train, fine-tune, or improve AI models. The diff does add or expose links to an Artificial Intelligence Addendum and AI-related site content, but the operative AI terms are not included here.

Accordingly:

• The diff does not clearly grant or remove a right to train AI models using customer data.
• The linked AI Addendum should be reviewed separately.
• Customers should obtain express confirmation that their data will not be used for model training or improvement unless specifically authorized in writing, with clear rules for retention, de-identification, subprocessors, opt-out rights, and deletion.

5. Consent language

The revised introduction again states that use of the Sites and Services indicates consent to the Privacy Policy. This broad “consent by use” formulation may be inadequate for certain jurisdictions or processing activities requiring a specific lawful basis or affirmative consent.

Summary

The provided diff does not include the actual added, deleted, or replaced legal language. It only states that approximately 177 words were added.

AI Training and Data-Use Changes

No determination can be made regarding:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, files, or usage metadata are retained or reviewed;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether customer data may be shared with affiliates, vendors, or other third parties for AI development;
• Whether the customer can opt out of AI training or revoke consent;
• Whether any training-related rights continue after termination; or
• Whether the provider claims ownership or broad usage rights over customer content or AI outputs.

Other Legal Risks

The actual wording is necessary to assess potential changes involving:

• Confidentiality and permitted data uses;
• Intellectual-property ownership and licenses;
• Security and data-breach obligations;
• Data retention and deletion;
• Compliance with privacy laws;
• Liability limitations and indemnities; and
• Changes to termination, audit, or notice rights.

Required Information

Please provide the full marked-up text, including the additions in {}, deletions in [], and replacements in []{}. Without the underlying language, no reliable legal-risk analysis is possible.

Summary of Important Changes

1. Privacy policy scope and website structure

• The opening navigation and marketing content has been substantially replaced with links to Contentstack’s legal and privacy resources.
• The policy now refers broadly to Contentstack’s websites, software, services, marketplace offerings, developer services, EULA, community, and other related resources.
• References to Lytics, Inc. and certain former site descriptions appear to have been removed or replaced.
• The policy now expressly covers employees and contractors through separate privacy notices.

Risk: The policy’s scope is broader and less tied to specific services. Customers should verify which linked terms, addenda, marketplace terms, and product-specific documents apply to them.

2. User categories and roles

• The prior three-category structure—“Visitors,” “Customers,” and “Referral Partners”—has been retained but rewritten.
• “Customers” now expressly includes persons using the services through a free trial or by purchasing the software.
• The revised language clarifies that Contentstack acts as a controller for its own sales, customer-service, billing, visitor, customer, and referral-partner interactions.
• For customer-submitted or end-user data processed through the SaaS, the customer is identified as the data controller, while Contentstack acts as a processor.

Risk: The controller/processor allocation is more explicit but split across the Privacy Policy, Master Agreement, Data Processing Addendum, and other documents. Conflicts between those documents could affect responsibility for notices, lawful bases, data-subject requests, and regulatory compliance.

3. End-user data

• The policy now expressly addresses data submitted by a customer’s customers, members, contractors, and employees.
• It states that end-user data remains under the customer’s control and is processed according to the customer’s instructions.
• The prior promise that Contentstack would not sell, disclose, or use end-user data without controller authorization is retained in substantially similar form.
• The revised text adds more detailed treatment for customers and data subjects in the EEA, UK, Switzerland, and California, including reliance on a DPA or other applicable contractual terms.

Risk: Customers remain responsible for having appropriate notices, consents, and instructions for end-user data. The policy does not itself establish all required contractual protections; a DPA may be necessary.

4. AI training and use of customer data

• The diff adds a link to an “Artificial Intelligence Addendum” among Contentstack’s legal documents.
• However, the revised language shown does not expressly state whether customer content or end-user data may be used to train, fine-tune, evaluate, or improve AI models.
• No clear opt-out, data-retention rule, anonymization standard, model-training restriction, or prohibition on using customer data for general-purpose model development appears in the displayed changes.

AI-related risk: The absence of substantive AI-training language creates uncertainty. Customers should review the separate Artificial Intelligence Addendum and contract documents to confirm whether their data may be used for AI training or model improvement, by whom, and subject to what controls.

Key Changes and Risks

1. Major restructuring of the policy

• The opening description is substantially rewritten. The policy now covers Contentstack’s websites, software, services, and various linked legal documents, including:
• Artificial Intelligence Addendum
• Data Processing Addenda
• EU Standard Contractual Clauses
• Marketplace and EULA terms
• Subprocessor and security materials
• The diff appears to include substantial website-navigation content inserted into the policy text. This creates a risk that the published policy may be confusing, internally inconsistent, or technically defective if the navigation text is not properly separated from the operative terms.

2. Changed user classifications and controller roles

• The former categories of “Visitors,” “Customers,” “Referral Partners,” and “End Users” are retained but reorganized.
• Contentstack now expressly describes itself as the data controller for sales, customer-service, billing, and interactions with visitors, customers, and referral partners.
• For customer-provided End User data, the policy more clearly states that:
• The customer controls the data and instructs Contentstack how to process it.
• Contentstack acts as a processor/service provider.
• Customer End User data remains governed by the customer’s contractual arrangements, including a Data Processing Addendum where applicable.
• This is generally favorable for customer data governance, but the revised text may create ambiguity because Contentstack is controller for some processing and processor for other processing. The relevant purposes and boundaries should be clearly documented.

3. End User data and disclosure limitations

• The prior language stated that Contentstack would not sell, disclose, or use End User personal data or content with third parties without controller authorization.
• The replacement retains a similar restriction but places it within a broader and reorganized framework. Customers should confirm that the final policy does not inadvertently authorize additional uses through incorporated documents or linked terms.

4. AI model training and AI-related use

• No express new authorization to use customer data to train AI models appears in the supplied diff.
• The diff adds or exposes links to an Artificial Intelligence Addendum, but does not provide its substantive terms.
• Because the policy now expressly links to that addendum, the addendum may contain important permissions, restrictions, or definitions governing:
• AI model training or fine-tuning
• Use of prompts, outputs, or customer content
• Retention of AI inputs and outputs
• Use by third-party AI providers
• Whether data is de-identified or aggregated
• Customers should review the AI Addendum and contract hierarchy carefully. The policy’s general processor restrictions may not fully protect data if the AI Addendum separately permits model improvement or training.

5. Compliance and operational updates

• The policy more expressly addresses the EEA, UK, Switzerland, and California, and references DPAs and contractual transfer mechanisms.
• Contact details and privacy-rights procedures are cleaned up.
• These changes may improve regulatory clarity, but the extensive replacement of prior language means the final consolidated policy should be checked for missing provisions, broken cross-references, and conflicts with the Master Agreement or DPA.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 177 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added, deleted, or replaced;
• Whether liability, confidentiality, intellectual property, privacy, or termination terms changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether customer data may be shared with affiliates, subprocessors, or third-party model providers;
• Whether the customer can opt out of AI training or require deletion of data used for that purpose; or
• Whether any new permissions, restrictions, warranties, or indemnities were introduced.

AI-Training Review

No specific AI-training language appears in the supplied material. The phrase indicating that approximately 177 words were added is not sufficient to identify whether the contract now permits or restricts:

• Training or fine-tuning models using customer content;
• Use of prompts, inputs, outputs, usage data, or metadata for model improvement;
• Retention of data for training or evaluation;
• Human review or labeling of customer data;
• Anonymization or aggregation before model use; or
• Opt-out rights and deletion obligations.

Information Needed

Please provide the actual diff, including the text marked with:

• {additions};
• [deletions]; and
• []{replacements}.

Once provided, the changes can be analyzed for legal effect, including any new rights to use customer data for AI training and any related privacy, confidentiality, intellectual-property, and risk-allocation concerns.

Summary

The provided diff does not include the actual amended language. It only states:

> “Added approximately 177 words to the document”

Accordingly, it is not possible to identify:

• The specific legal changes;
• New obligations, rights, restrictions, or liabilities;
• Changes to data ownership, confidentiality, security, or permitted use;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is subject to consent, opt-out rights, anonymization, aggregation, or retention limits; or
• Whether the customer’s data may be shared with vendors or used to create derived data or model outputs.

Please provide the full diff, including the text within {} and any deleted or replacement provisions. Once provided, the changes can be analyzed and summarized in a structured format of no more than 500 words.