Crownpeak

Summary

Scope of the Diff

• The diff states only that approximately 23 words were added.
• The actual wording of those additions is not provided.
• No deletions, replacements, or substantive clause text are shown.

Legal and Commercial Impact

• It is not possible to determine whether the added language:
• Changes the parties’ rights or obligations;
• Expands permitted uses of customer data;
• Modifies confidentiality, security, ownership, licensing, or liability provisions;
• Introduces new consent, notice, audit, or termination rights; or
• Creates additional compliance obligations.

AI Model Training

• The supplied diff does not identify whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• It is therefore not possible to assess:
• Whether customer content, personal data, prompts, outputs, or usage data may be used for training;
• Whether training is conducted by the provider or its subprocessors;
• Whether data is anonymized, aggregated, or retained;
• Whether the customer can opt out;
• Whether data is used to train shared models or customer-specific models; or
• Whether the provider obtains a license or other rights to use customer data for those purposes.

Recommended Next Step

Please provide the actual 23 added words, including the surrounding clause if possible. The legal effect and any AI-training risks cannot be reliably analyzed from the word-count description alone.

Summary

Nature of the Change

• The diff states only: “Removed approximately 77 words from the document.”
• The specific deleted language is not provided.
• No additions, replacements, or identifiable clause text are shown.

Legal and Commercial Impact

Because the deleted wording is unavailable, it is not possible to determine:

• Which contractual rights or obligations changed.
• Whether liability, indemnification, confidentiality, security, intellectual property, or termination provisions were affected.
• Whether the deletion narrows or expands either party’s rights.
• Whether any customer protections, warranties, restrictions, or compliance obligations were removed.

AI Training and Customer Data

The available diff does not identify whether customer data may be used to train, fine-tune, evaluate, or improve AI models.

In particular, it is impossible to determine whether the deleted text:

• Prohibited or permitted using customer data for model training.
• Required customer consent or provided an opt-out.
• Limited training to aggregated, de-identified, or anonymized data.
• Restricted use of prompts, inputs, outputs, files, personal information, or usage metadata.
• Addressed retention, deletion, confidentiality, or human review of data used for AI purposes.
• Granted the provider ownership or broad license rights over customer data or model outputs.
• Required the provider to disclose whether third-party or foundation models receive customer data.

Risk Assessment

Risk level: Indeterminate. The deletion could be immaterial, or it could remove important customer protections—particularly if the deleted language concerned data use or AI training. No reliable conclusion can be drawn from the word count alone.

Information Needed

To complete the analysis, provide either:

1. The actual 77 deleted words; or

2. The full “before” and “after” versions of the relevant provision.

The AI-data analysis should focus especially on any changes to terms such as “train,” “improve,” “develop,” “fine-tune,” “de-identified,” “aggregated,” “customer data,” “inputs,” “content,” “service data,” and “model.”

Key Changes and Risks

1. Customer data use and AI training

• No express reference to AI, machine learning, model training, or use of customer data to train AI models appears in the diff.
• The revised language does, however, broaden permitted sharing and use of personal data for:
• “internal reporting”
• “customer insights”
• “service optimization”
• improving platform and website functionality
• analytics and marketing optimization
• assisting with IT and social-media management
• These purposes are not expressly limited to human review or traditional analytics. Depending on how the services operate, the broad wording could potentially be interpreted to permit analytics or automated processing, including AI-enabled optimization.
• Important limitation: the diff does not add a clear right to use customer content, confidential information, or personal data to train general-purpose or product AI models. It also does not provide opt-out, deletion-from-training, model-use, or model-output protections.
• Customers should seek clarification on whether any data—including prompts, uploaded content, usage data, or derived data—may be used to train, fine-tune, test, or improve AI models, and whether such use is limited to the customer’s instance or benefits Crownpeak’s products generally.

2. Expanded disclosures and corporate sharing

• A new disclosure category permits sharing with Crownpeak subsidiaries for marketing, internal reporting, customer insights, and service optimization.
• Sharing with service providers and business partners is expressly expanded to include platform improvements, information collection, IT assistance, social-media management, and data analytics.
• This may increase the number of entities with access to personal data and makes vendor/subprocessor diligence more important.
• The prior detailed discussion of Facebook, Instagram, LinkedIn, and X responsibilities is replaced with a broader social-media and analytics description. The revised wording states that those platforms are responsible for responding to data-subject requests under joint-responsibility arrangements.

3. Government, transaction, and legal disclosures

• New disclosure grounds cover a prospective sale or purchase of a business or assets.
• Disclosures to authorities and other third parties are broadened to include subpoenas, legal processes, fraud investigations, government requests, and protecting Crownpeak’s or others’ rights.
• The prior breach language—describing procedures and notification—appears replaced by a narrower statement that notification occurs where legally required. This could reduce contractual transparency regarding incident response.

4. International transfers

• The notice shifts from specific transfer descriptions to a generalized framework covering global transfers outside the UK and EEA.
• It continues to reference adequacy decisions, standard contractual clauses, other safeguards, lawful exceptions, and the EU/UK/Swiss-U.S. Data Privacy Frameworks.
• The revised wording may provide Crownpeak greater flexibility regarding transfer mechanisms and destinations, while giving customers less operational detail.

5. Security and drafting concerns

• Detailed security commitments, audit/certification language, and security-related website references are removed or substantially replaced with broader, less specific wording.
• Numerous formatting and continuity problems appear in the diff, including missing spaces and duplicated/reordered sections. These may create ambiguity and should be corrected before publication.

Summary

The provided diff does not include the actual added, deleted, or replacement language. It only states:

> “Added approximately 138 words to the document”

Accordingly, it is not possible to determine what legal terms changed or whether any new risks were introduced.

AI Training and Customer Data

The diff provides no information about whether:

• Customer data may be used to train, fine-tune, or improve AI models;
• Customer prompts, inputs, outputs, or personal information may be retained or reviewed;
• Data may be combined with information from other customers;
• Customer data may be shared with service providers or AI subcontractors;
• Customers can opt out of AI training or request deletion of training data;
• Confidentiality, security, ownership, or intellectual-property protections have changed; or
• The provider may use de-identified, aggregated, or pseudonymized data for model development.

Risk Assessment

No meaningful legal risk assessment can be made from the information supplied. The statement that approximately 138 words were added does not reveal:

• The scope of any new rights granted to the provider;
• Whether use of customer data has expanded;
• Whether liability, indemnification, or compliance obligations changed;
• Whether customer consent is required for new data uses; or
• Whether the changes apply retroactively to previously submitted data.

Please provide the actual redlined text, including the added language shown in {}, deleted language shown in [], and replacement language shown in []{}.

Summary

The supplied diff does not include the actual amended contract language. It only states that approximately 138 words were added. As a result, the legal and commercial impact cannot be reliably assessed.

AI Training and Customer Data

• No specific language is provided showing whether customer data may be:
• Used to train, fine-tune, or improve artificial intelligence or machine-learning models;
• Used to develop products, services, or algorithms;
• Combined with other customers’ data;
• Reviewed by personnel or service providers for model training or quality assurance;
• Retained after termination for training or research purposes; or
• De-identified, anonymized, or otherwise processed before such use.

• It is therefore not possible to determine whether the changes expand the provider’s rights to use customer data or introduce new AI-related risks.

Other Legal Risks

The missing text also prevents assessment of potential changes concerning:

• Ownership and control of customer data;
• Confidentiality obligations;
• Data retention and deletion;
• Privacy-law compliance;
• Security and breach responsibilities;
• Subprocessors or third-party AI providers;
• Intellectual-property rights in outputs or trained models;
• Liability, indemnification, and limits of liability; and
• Customer consent or opt-out rights.

Required Information

Please provide the actual redlined language, including the added, deleted, and replacement text. Without the substantive wording, no meaningful comparison or identification of new contractual obligations can be made.

Summary of Important Changes and Risks

AI Training

• No express provision authorizing use of customer or personal data to train, fine-tune, or evaluate AI models appears in the diff.
• The revised language does, however, broaden permitted sharing with:
• Crownpeak group companies for “customer insights” and service optimization; and
• Service providers and business partners for platform improvement, information collection, IT, management, analytics, and marketing optimization.
• These purposes do not expressly include AI training. Nevertheless, if AI tools are used for analytics, optimization, or platform improvement, the language could create ambiguity about whether data may be supplied to AI vendors or used in model development. A separate, clear restriction or authorization addressing AI training would be advisable.

Expanded Data Sharing

The revised notice replaces the narrower description of social-media profiles with broader categories of recipients and purposes. It now permits sharing with:

• Crownpeak subsidiaries for marketing, internal reporting, customer insights, and service optimization;
• Service providers and business partners acting on Crownpeak’s behalf;
• Providers supporting functionality improvements, IT, social-media management, data analytics, marketing optimization, and search-engine services; and
• Social-media platforms, including Facebook, Instagram, LinkedIn, and X.

Risk: The new wording is substantially broader and less specific about the data shared, retention limits, vendor controls, and whether recipients may use data for their own purposes.

Government, Corporate-Transaction, and Legal Disclosures

The revised text expressly permits disclosure to:

• Law-enforcement agencies, courts, regulators, governmental authorities, or other third parties where Crownpeak believes disclosure is necessary to comply with legal obligations, subpoenas, investigate fraud, or protect rights;
• A prospective buyer or seller in connection with a sale or purchase of a business or assets; and
• Other third parties responding to government requests.

Risk: The “where we believe this is necessary” standard may give Crownpeak considerable discretion, and the corporate-transaction language creates a new pathway for personal data to be transferred as part of a business deal.

International Transfers

The detailed transfer section is replaced with a more general explanation covering transfers outside the UK and EEA through adequacy decisions, standard contractual clauses, other safeguards, or legal exceptions. References to EU-U.S., UK, and Swiss-U.S. Data Privacy Framework certifications are retained but reorganized.

Risk: The revised wording is less entity-specific and may make it harder to determine which companies are certified, which transfer mechanism applies, and how onward transfers are controlled.

Security and Breach Language

Detailed descriptions of security controls, audits, certifications, and breach procedures are removed or shortened. The notice now generally states that Crownpeak will address breaches where legally required.

Risk: This reduces transparency and may weaken assurances concerning security practices and breach notification.

Drafting and Governance Concerns

• Numerous edits remove spaces and punctuation, creating readability and interpretation issues.
• The notice appears to have been materially restructured, with sections potentially displaced or merged.
• The expanded purposes should be checked against applicable privacy-law notice requirements and any customer contract restrictions.

Summary of Important Changes

AI Model Training

• No express reference to AI, machine learning, model training, or use of customer data to train AI models appears in the diff.
• The revised sharing language permits use of personal data for “customer insights,” “service optimization,” “analytics,” “marketing optimization,” and improving platform functionality. These terms are broad and could potentially encompass analytics or AI-related development, but they do not expressly authorize AI training.
• Risk: The policy remains unclear about whether customer data, usage data, prompts, content, or outputs may be used to train or improve AI models. If AI functionality is involved, a separate contractual restriction or explicit “no training without consent” commitment should be considered.

Expanded Data Sharing and Commercial Uses

• New disclosures expressly allow sharing with:
• Crownpeak subsidiaries for marketing, internal reporting, customer insights, and service optimization;
• Service providers and business partners supporting platform and website functionality, information collection, IT, and social-media management;
• Analytics, marketing-optimization, and search-engine providers.
• This replaces more limited language focused on maintaining social-media profiles and informing users about services.
• Risk: The revised wording broadens the categories of recipients and purposes, potentially allowing more extensive internal and third-party profiling and marketing.

Social-Media Processing

• The policy now expressly covers Facebook, Instagram, LinkedIn, and X/Twitter profiles.
• It adds joint-responsibility language and states that these platforms are responsible for responding to data-subject requests.
• Links and descriptions of social-media privacy practices are retained in substantially revised form.
• Risk: Customers may have reduced practical control over data shared with social platforms, and responsibility for rights requests may be fragmented.

Government, Corporate-Transaction, and Legal Disclosures

• New language permits disclosure where Crownpeak believes it is necessary to:
• comply with subpoenas or other legal processes;
• protect Crownpeak or third-party rights;
• investigate fraud;
• respond to government requests; or
• sell or buy a business or assets.
• This replaces more specific security-program and breach-response language.
• Risk: The disclosure standard appears broader and more discretionary (“where we believe this is necessary”).

Security and Breach Language

• Detailed references to operational controls, audits, assessments, certifications, and security practices are removed or substantially shortened.
• The revised wording retains a breach-notification commitment only where legally required.
• Risk: The policy provides less specific public assurance about security controls and may give customers less information about Crownpeak’s security commitments.

International Transfers and Privacy Frameworks

• The policy replaces detailed transfer descriptions with broader language allowing global transfers using adequacy decisions, safeguards, or lawful exceptions.
• References to EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework compliance are reorganized and expanded.
• Risk: The revised presentation is more complex and may make it harder to determine which transfer mechanism applies to a particular customer’s data.

Drafting/Presentation

• Numerous spacing, punctuation, and formatting changes appear throughout. These are mostly non-substantive but may reduce readability and create ambiguity in the heavily revised sections.

Summary

The supplied diff does not include the actual contract language. It only states:

> “Added approximately 138 words to the document”

Accordingly, it is not possible to identify:

• Changes to the parties’ rights or obligations;
• New fees, liability, warranties, termination rights, or confidentiality duties;
• Changes to ownership or permitted use of customer data;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, subprocessors, or third-party AI providers;
• Any opt-out, deletion, retention, or data-security rights; or
• Whether the new language applies retroactively to previously supplied data.

AI-Training Risk Review

No conclusion can be reached regarding AI-model training because the added wording is not provided. The actual 138 words should be reviewed for terms such as:

• “train,” “fine-tune,” “develop,” “improve,” or “enhance” models or services;
• “customer content,” “inputs,” “outputs,” telemetry, usage data, or feedback;
• rights granted to use data on an aggregated, de-identified, anonymized, or unrestricted basis;
• use by affiliates, vendors, or subprocessors;
• retention after termination;
• rights to opt out or require deletion; and
• ownership or licensing of models trained using customer data.

Required Information

Please provide the complete marked-up diff, including the text shown in braces, brackets, and replacement notation. Without the actual additions, deletions, and replacements, a reliable legal-risk analysis cannot be performed.

Summary of Important Changes

AI Training and Model Use

• No express reference to AI, machine learning, generative AI, or training models appears in the diff.
• The revised notice does not clearly authorize or prohibit using customer data to train AI models.
• However, new broad purposes—such as “customer insights,” “service optimization,” “improving functionality,” “data analytics,” and “marketing optimization”—could potentially be interpreted broadly enough to include analytics or model development, depending on the underlying practices.
• Risk: Customers do not receive a clear statement about whether their data, prompts, content, usage data, or derived data may be used for AI training, whether data is anonymized, whether training is performed by providers, or whether customers can opt out.
• Recommended clarification: State expressly whether customer data is used to train, fine-tune, evaluate, or improve AI models; identify the data involved, recipients, retention period, safeguards, and opt-out/deletion implications.

Expanded Data Sharing

The revised language replaces a narrow description of Crownpeak’s social-media presence with substantially broader disclosure categories, including:

• Crownpeak group companies, for marketing, internal reporting, customer insights, and service optimization.
• Service providers and business partners acting on Crownpeak’s behalf, including providers supporting platform functionality, data collection, IT, social-media management, and analytics.
• Search-engine providers and other parties involved in improving or optimizing the website.
• Social-media platforms, including Facebook, Instagram, LinkedIn, and X, for marketing and communications.

Risk: The categories and purposes are broader and less specific, potentially permitting more extensive sharing with affiliates, vendors, analytics providers, and marketing platforms. The revised language also identifies Crownpeak and the social platforms as having joint-responsibility arrangements, which may complicate data-subject requests and accountability.

Government, Transaction, and Legal Disclosures

The revised notice newly permits disclosure where Crownpeak believes it is necessary to:

• Comply with subpoenas, legal process, or other legal obligations.
• Protect Crownpeak’s or another party’s rights.
• Investigate fraud or respond to government requests.
• Support a sale or purchase of a business or assets.

Risk: These provisions are broader than the prior breach-focused language and may permit disclosure without the previous express limitation to legally required circumstances.

International Transfers

• The detailed prior language referring to specific transfer mechanisms, including the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks, is largely replaced with more general statements about global transfers using lawful methods, adequacy decisions, safeguards, or exceptions.
• The revised text still references the Data Privacy Framework certifications, but the presentation is less direct and more generalized.

Risk: The revised wording may provide less practical transparency about the exact mechanism used for a particular transfer and onward-transfer protections.

Security and Retention

• Detailed security commitments, audits, certifications, and breach procedures are replaced with more general statements.
• The revised rights section expressly says Crownpeak may retain minimum personal data to document deletion requests and avoid reusing deleted data.

Risk: Security assurances are less concrete, while retention after deletion requests is more expressly reserved.

Drafting Quality

The diff contains substantial formatting, punctuation, and apparent text-order problems. The final notice should be reviewed carefully before publication to ensure the provisions are coherent and legally accurate.

Summary

The supplied diff does not include the actual contractual language. It only states:

> “Added approximately 138 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added or changed;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is optional, automatic, or subject to consent or opt-out;
• Whether customer data will be anonymized, aggregated, retained, or shared with third parties;
• Whether the customer receives ownership or other rights in model outputs;
• Whether confidential information, personal data, or regulated data may be included in training datasets; or
• Whether the changes create new indemnity, compliance, security, or liability risks.

Required Information

Please provide the actual diff text, including the words shown as:

• {additions};
• [deletions]; and
• []{replacements}.

Once provided, the changes can be analyzed for their legal and commercial impact, particularly any language that allows the provider to use customer content, inputs, outputs, usage data, telemetry, or other information to train or improve AI models.

Summary

The provided diff does not include the actual amended contract language. It only states that approximately 138 words were added. As a result, it is not possible to identify:

• The substantive legal changes;
• New customer obligations or provider rights;
• Changes to liability, confidentiality, security, termination, or fees; or
• Any provisions concerning the use of customer data to train, fine-tune, evaluate, or improve AI models.

AI Training and Data Use

No conclusions can be drawn about AI-model training from the information provided. The added language could potentially address issues such as:

• Whether customer data may be used to train or improve models;
• Whether data is used by default or only with consent;
• Whether prompts, outputs, metadata, or usage analytics are included;
• Whether data is anonymized, aggregated, or retained;
• Whether human reviewers or third-party providers may access the data;
• Whether the customer can opt out; and
• Whether training rights continue after termination.

These issues require review of the actual added wording, including any definitions and exceptions.

Required Information

Please provide the full diff, showing the inserted and deleted language using the stated notation. Without the text of the changes, a reliable legal-risk analysis cannot be performed.

Summary of Important Changes

AI Model Training

• No express reference to AI, machine learning, foundation models, or training models appears in the diff.
• The revised notice does not expressly authorize or prohibit using customer data to train AI models.
• References to “customer insights,” “service optimization,” “improving functionality,” analytics, and collecting information about users are broad, but they do not clearly state whether data may be used for AI training.
• Risk: The absence of a specific AI-training provision creates uncertainty. If Crownpeak or its service providers use customer data for model training, the notice may not provide sufficiently transparent notice or a clearly defined purpose—particularly for regulated data or data received from customers under contractual restrictions.
• Customers should seek confirmation of:
• Whether customer content or personal data is used for AI training;
• Whether data is used to train Crownpeak’s models or third-party models;
• Whether data is anonymized, aggregated, or retained for training;
• Whether customers can opt out; and
• Whether customer data is used to improve services for other customers.

Expanded Data Sharing and Use

The revised language replaces the prior description of Crownpeak’s social-media presence with broader disclosures allowing sharing with:

• Crownpeak group companies for marketing, internal reporting, customer insights, and service optimization;
• Service providers and business partners assisting with platform and website functionality, information collection, IT, and social-media management;
• Analytics, marketing-optimization, and search-engine providers; and
• Facebook, LinkedIn, and X, under stated joint-responsibility arrangements.

Risk: These purposes and recipient categories are broader and less specific than the former wording. They may permit wider internal and third-party use of personal data, including for profiling, analytics, and marketing.

New Disclosure and Transfer Grounds

The notice adds or emphasizes disclosure to:

• A prospective buyer or seller in connection with a business or asset transaction;
• Law-enforcement agencies, courts, regulators, government authorities, or other third parties where Crownpeak believes disclosure is necessary to comply with legal obligations, subpoenas, investigate fraud, or protect rights.

International-transfer language is substantially rewritten. It now describes adequacy decisions, standard contractual clauses, other safeguards, lawful exceptions, and reliance on the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks.

Risk: The new wording may allow broader disclosures based on Crownpeak’s judgment that disclosure is necessary, rather than only where legally required. Transfers may also involve more jurisdictions and recipients.

Security and Breach Language

Detailed statements about operational controls, audits, certifications, and security procedures are replaced with more general language. The revised notice states Crownpeak will address suspected breaches and notify parties where legally required.

Risk: This reduces the specificity of Crownpeak’s stated security commitments and may narrow notification obligations to statutory minimums.

Other Changes

• The rights section is reorganized and expanded for EU, UK, and Swiss individuals.
• The notice identifies additional group companies and updates Data Privacy Framework language.
• Numerous formatting and punctuation changes appear non-substantive.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 138 words to the document”

Accordingly, it is not possible to determine what contractual provisions changed or whether the amendments create new legal risks.

AI Training and Customer Data

No language addressing any of the following is included in the diff:

• Whether customer data may be used to train, fine-tune, or improve AI models
• Whether prompts, inputs, outputs, usage data, or account information are retained
• Whether data may be shared with affiliates, vendors, or third-party AI providers
• Whether customer data is used in aggregated, de-identified, or identifiable form
• Whether the customer can opt out of AI training or data use
• Ownership or licensing rights in customer data, inputs, or outputs
• Security, deletion, retention, or confidentiality obligations relating to AI systems

Therefore, no conclusion can be reached about changes to AI-training rights or related data risks.

Recommended Next Step

Provide the actual text of the additions, deletions, and replacements—for example:

• Added text in {braces}
• Deleted text in [brackets]
• Replacements using [{old text}]{new text}

Once the substantive language is provided, it can be reviewed for changes involving data ownership, permitted uses, AI training, confidentiality, retention, third-party disclosures, liability, and customer opt-out rights.

Executive Summary

The diff appears to substantially rewrite the privacy notice, although many changes are formatting, punctuation, or restructuring. The most important legal and privacy changes are below.

AI Model Training

• No express new authorization to use customer data to train AI models is visible in this diff.
• The revised language refers to sharing data for:
• “customer insights”
• “service optimization”
• improving platform and website functionality
• analytics and marketing optimization
• These purposes could potentially include AI-related analytics or product improvement, but the text does not expressly mention artificial intelligence, machine learning, model training, generative AI, prompts, outputs, or whether customer content is retained for training.
• Because the revised purposes are broad, customers should seek clarification on whether their data—including submitted content, usage data, telemetry, or personal information—is used to train or fine-tune models, whether it is de-identified, and whether customers can opt out.

Expanded Data Sharing

The former reference to Crownpeak’s social-media profiles has largely been replaced with broader categories of recipients and purposes. The revised notice expressly permits sharing with:

• Crownpeak subsidiaries for marketing, internal reporting, customer insights, and service optimization;
• service providers and business partners performing services on Crownpeak’s behalf;
• providers assisting with platform and website functionality, information collection, IT, management, analytics, marketing optimization, and search-engine services;
• social-media platforms, including Facebook, Instagram, LinkedIn, and X.

Risk: These descriptions are broader and more operationally focused than the prior wording. They may permit wider disclosure to affiliates and vendors, including for marketing and profiling-related activities.

New or Broadened Disclosure Grounds

The revised notice adds sharing with:

• prospective buyers or sellers in connection with a business or asset transaction;
• law-enforcement agencies, courts, regulators, governmental authorities, or other third parties where Crownpeak believes disclosure is necessary to comply with legal obligations, investigate fraud, respond to government requests, or protect rights.

Risk: The “where we believe this is necessary” standard may give Crownpeak considerable discretion, and the business-transfer provision could expose data to a successor organization.

International Transfers

The detailed prior descriptions of EU, UK, and Swiss transfer mechanisms have been replaced with a more general framework referring to adequacy decisions, standard contractual clauses, international transfer agreements, lawful exceptions, and the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks.

Risk: The revised language is more generalized and may provide less jurisdiction-specific detail about safeguards, onward transfers, and the entities covered.

Data-Subject Rights

The rights section is reorganized and simplified. It continues to recognize access, rectification, erasure, restriction, objection, and portability rights, while adding or clarifying exceptions—particularly retention for legal claims, documentation, or other lawful purposes.

Drafting and Compliance Concerns

• Several replacements appear to remove spaces, headings, and sentence boundaries, creating potentially ambiguous or defective text.
• The revised notice should be checked for internal consistency, especially regarding social-media joint-controller arrangements, breach notification commitments, transfer mechanisms, and the identity of responsible entities.
• The AI/data-training position should be stated expressly rather than left to implication.

Structured Summary of Important Changes

1. Overall nature of the changes

The diff appears to revise website and marketing copy rather than contractual provisions. It substantially replaces references to specific customer testimonials, named executives, and prior business claims with broader promotional language about Rezolve Ai’s products, partnerships, and growth.

There is no apparent change to operative legal terms such as data ownership, licensing, confidentiality, security, indemnification, or limitation of liability.

2. Product and positioning changes

The revised copy:

• Replaces “Rezolve’s brain Suite of AI solutions” with a broader focus on “intelligent automation” and “conversational AI.”
• Repositions the technology as being designed for commerce and retail, rather than generally transforming “digital transactions.”
• Expands the claimed application beyond retail to “other sectors.”
• Describes benefits including:
• Improved productivity;
• Enhanced customer experiences;
• Increased conversion, AOV, and customer satisfaction;
• Streamlined operations; and
• Scalable, AI-driven tools.

Risk: These broader claims may create advertising, substantiation, or misrepresentation risk if the product does not perform consistently across sectors or achieve the stated metrics.

3. Partnership and endorsement changes

The copy changes or adds references to:

• Google Cloud and its “Trusted Partners” program;
• Tech Mahindra;
• Microsoft-related statements and a Microsoft executive;
• A Google Cloud integration and infrastructure strategy;
• A named EMEA executive, Tara Brady.

Some prior customer-specific endorsements, including Liverpool Mexico and an executive attribution, are removed or replaced.

Risks:

• Confirm that all partner names, logos, endorsements, quotations, and “Trusted Partner” references are authorized and current.
• Confirm that named individuals approved the quotations and titles.
• Avoid implying an official Google Cloud, Microsoft, or Tech Mahindra endorsement beyond the actual relationship.
• Financial and performance statements—particularly the “$130.8m H1 Revenue” and “nearly 21-fold” growth claims—should be verified and appropriately qualified.

4. AI model and customer-data use

The revised language introduces or emphasizes:

• A “proprietary Large Language Model specifically designed for the retail sector”;
• “Business-safe AI solutions”;
• Personalized consumer engagement; and
• Agentic commerce and AI-driven automation.

However, the diff does not add or change language stating that customer data, prompts, conversations, transactions, or other customer content may be used to train, fine-tune, evaluate, or improve AI models.

It also does not clarify:

• Whether customer data is used for model training;
• Whether data is aggregated, anonymized, or shared with Google Cloud, Tech Mahindra, or other providers;
• Whether customers can opt out;
• Who owns model outputs, derivatives, or improvements; or
• How long data is retained.

Key conclusion: No express training-use authorization is added in this diff. Nevertheless, the new proprietary-model claims make the absence of clear data-use language more significant. Any separate agreement or privacy policy should expressly address training, model improvement, subprocessors, data isolation, and customer opt-out rights.

Summary

The provided diff states only that approximately 94 words were removed from the document. The specific deleted language is not included.

Key Legal Implications

• Substantive review is not possible: Without the actual deleted text, it is impossible to determine whether the changes affect liability, confidentiality, intellectual property, data protection, termination rights, warranties, or other contractual obligations.
• Potential risk from deletion: Removing language can eliminate protections, restrictions, disclosures, or obligations. The legal effect depends entirely on what was removed and whether related provisions remain elsewhere in the agreement.
• No identifiable AI-training change: The supplied diff does not show whether customer data may now be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Used to develop products or services;
• Shared with model providers or other third parties;
• Retained for training after termination; or
• Excluded from training or limited to aggregated/de-identified data.

Information Needed

To assess the changes, provide either:

1. The actual 94 deleted words; or

2. The surrounding before-and-after contract language.

Particular attention should be given to provisions concerning customer data, usage rights, data retention, confidentiality, de-identification, service improvement, artificial intelligence, machine learning, analytics, and third-party subprocessors.

Analysis

The provided material does not include the actual contract language. It only states:

> “Added approximately 138 words to the document”

Without the added, deleted, or replacement text, it is not possible to determine:

• What legal obligations or rights changed;
• Whether liability, confidentiality, intellectual property, security, termination, or payment terms were modified;
• Whether customer data may be used for artificial intelligence (AI) training;
• Whether such use is optional, mandatory, or subject to consent;
• Whether data may be shared with affiliates, vendors, or third-party AI providers;
• Whether customer data may be retained after termination; or
• Whether the customer receives any opt-out, deletion, or audit rights.

AI Training Review

No conclusion can be drawn regarding AI-model training because the relevant wording is not included. The key provisions to look for are language stating that the provider may:

• Use customer data, content, prompts, inputs, outputs, or usage data to train, fine-tune, improve, or evaluate AI models;
• Create or use aggregated, anonymized, or de-identified data;
• Permit subcontractors or third-party model providers to access or train on the data;
• Retain data for model development after the customer relationship ends; or
• Use data without additional notice, approval, or compensation.

Information Needed

Please provide the full marked-up diff, including the text shown in {additions}, [deletions], and []{replacements}. Once provided, the changes can be assessed for their legal effect and summarized in a structured format.

Summary of Important Changes

1. AI-model training

• No express change addresses AI, machine learning, or training of AI models.
• The revised text does not add a right to use customer data to train AI systems, nor does it expressly prohibit such use.
• However, the new broad sharing language permits disclosure to:
• Crownpeak group companies for “marketing purposes, internal reporting, customer insights” and “service optimization”; and
• Service providers and business partners assisting with platform functionality, information collection, IT, management, analytics, and marketing optimization.
• Depending on how these terms are interpreted, such recipients could potentially process data for analytics or model-development activities. The policy should expressly state whether customer data, prompts, content, usage data, or derived data may be used to train or improve AI models, and whether identifiable or de-identified data is included.

2. Expanded and changed data sharing

• The prior references to Crownpeak’s Facebook, Instagram, LinkedIn, and X profiles are replaced with broader disclosures to:
• Crownpeak subsidiaries;
• Service providers and business partners;
• Data analytics, marketing optimization, search-engine providers, and social-media management providers.
• The revised wording is broader and less specific about recipient identity, purposes, and safeguards. This creates increased transparency and purpose-limitation risk, particularly for regulated data.
• The policy now describes Crownpeak and Facebook, LinkedIn, and X as having a joint responsibility agreement, with those platforms responsible for responding to data-subject requests. This may make accountability and rights enforcement more complex.

3. Broader disclosure to authorities and transaction parties

• New language permits disclosure to a prospective buyer or seller in connection with a business or asset transaction.
• Government and law-enforcement disclosures are broadened to include subpoenas, legal processes, fraud investigations, government requests, and protection of Crownpeak’s or third parties’ rights.
• These provisions may permit disclosure in more circumstances than the previous wording.

4. Security and breach notifications

• Detailed commitments regarding security controls, audits, certifications, and breach procedures are removed or substantially replaced.
• The revised language says Crownpeak will notify individuals or regulators only where legally required, rather than describing a broader notification commitment. This reduces the company’s stated notification obligation.

5. International transfers

• The detailed transfer framework is rewritten and now emphasizes global transfers using adequacy decisions, standard contractual clauses, other safeguards, legal exceptions, and applicable Data Privacy Framework certifications.
• The framework remains broad, but the revised presentation is less specific about particular transfer mechanisms and onward-transfer obligations. Certification status and current transfer safeguards should be verified.

6. Data-subject rights and drafting quality

• Rights are reorganized and generally retained, but the deletion, restriction, and request procedures are materially reworded.
• The diff contains extensive duplicated, reordered, and run-together text, creating ambiguity about the operative policy. A clean consolidated version should be reviewed before publication.

Summary of Important Changes and Risks

1. AI model training

• No express provision has been added authorizing use of customer or personal data to train, fine-tune, evaluate, or improve AI models.
• The revised language does, however, permit broader use and sharing of personal data for:
• “customer insights”;
• internal reporting;
• service optimization;
• improving platform and website functionality;
• analytics and marketing optimization; and
• improving the company’s website and services.
• These purposes are broad enough that, depending on how the company operates its AI tools, data could potentially be used in analytics or service-improvement systems, but the policy does not clearly say whether AI training is included or excluded.
• Risk: The policy may be viewed as insufficiently transparent if customer data is in fact used to train AI models. Customers should seek an explicit statement addressing AI training, including data categories, purposes, retention, anonymization, opt-out rights, and whether data is shared with model providers.

2. Expanded data sharing and business purposes

The revised policy replaces a description of Crownpeak’s social-media pages with broader disclosures to:

• Crownpeak group companies for marketing, internal reporting, customer insights, and service optimization;
• service providers and business partners acting on Crownpeak’s behalf;
• providers supporting platform functionality, information collection, IT, social-media management, analytics, and marketing optimization;
• search-engine providers; and
• sponsors in the context of hosted events and webinars.

Risk: These changes substantially broaden the categories of recipients and purposes. “Customer insights” and “service optimization” are not precisely defined, potentially permitting extensive secondary use.

3. Social-media processing

The new language states that Crownpeak and Facebook, LinkedIn, and X have a joint responsibility agreement, and that those platforms are responsible for responding to data-subject requests. Links to the platforms’ privacy policies are provided.

Risk: Personal data may be processed directly by major social-media companies under their own policies, including for profiling, advertising, and international transfers. The division of responsibility may make enforcement of individual rights more difficult.

4. International transfers

The revised policy:

• expands the description of global transfers;
• expressly covers the UK, EEA, and Switzerland;
• references adequacy decisions, standard contractual clauses, international transfer agreements, and lawful exceptions; and
• updates reliance on the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks.

This is generally more comprehensive, but the policy still permits transfers to a wide range of countries and recipients.

5. Government disclosures and asset transactions

The company may disclose data where it believes necessary to comply with subpoenas, legal processes, government requests, investigate fraud, protect rights, or respond to legal obligations. It may also disclose data during a sale or purchase of a business or assets.

Risk: The revised wording is broader and more discretionary than the prior breach-focused language.

6. Rights and drafting quality

The rights section is reorganized and expanded, but the diff contains extensive formatting problems, duplicated text, and apparent sentence-fragment substitutions.

Risk: Ambiguous or corrupted wording could undermine transparency and regulatory compliance. The final published policy should be carefully proofread and legally validated.

Summary

The diff does not include the actual added, deleted, or replaced contract language. It only states that approximately 138 words were added. As a result, the legal and commercial impact cannot be assessed reliably.

AI Training and Customer Data

There is no language in the supplied diff identifying whether:

• Customer data may be used to train, fine-tune, or improve AI models;
• Customer prompts, inputs, outputs, or account information may be retained or reviewed;
• Data may be used in aggregated, de-identified, or anonymized form;
• the provider may permit affiliates, vendors, or third parties to use customer data for AI development;
• customers can opt out of AI training or data-use practices;
• the provider must delete data after processing or contract termination;
• customer data may be used to train general-purpose models whose outputs benefit other customers; or
• the provider offers confidentiality, security, or ownership protections for AI-related data use.

Risk Assessment

No specific new risks can be identified without the wording of the 138 added words. In particular, it is not possible to determine whether the additions:

• expand the provider’s license to use customer data;
• create a broad or perpetual right to use data;
• permit model training without customer consent;
• weaken confidentiality obligations;
• change ownership of inputs, outputs, or derived data; or
• limit the customer’s ability to object, opt out, or seek deletion.

Information Needed

Please provide the actual redlined text, including the additions and any surrounding provisions. The complete language is necessary to assess the changes, especially any provisions concerning data use, artificial intelligence, machine learning, model training, service improvement, confidentiality, retention, ownership, or de-identification.

Summary

The diff only states that approximately 138 words were added, but it does not include the actual added language or identify where it appears in the agreement.

Legal and Commercial Impact

• The substance of the changes cannot be evaluated from the information provided.
• It is not possible to determine whether the additions affect:
• Customer or provider obligations
• Fees, renewal, or termination rights
• Liability, indemnification, or warranties
• Confidentiality or intellectual-property ownership
• Data security, privacy, or regulatory compliance
• Audit rights or use of subcontractors
• Governing law or dispute resolution

AI Training and Customer Data

The diff does not provide enough information to determine whether the agreement now:

• Allows the provider to use customer data, content, prompts, outputs, or usage data to train or improve AI models
• Allows such use for commercial or product-development purposes
• Uses customer data in aggregated, de-identified, or identifiable form
• Applies training-related rights to historical data or only data submitted after the amendment
• Gives the customer an opt-out right
• Provides deletion, retention, confidentiality, or security protections for training data
• Grants the provider ownership or broad licensing rights over customer inputs or outputs
• Permits sharing of data with affiliates, vendors, or third-party model providers

Risk Assessment

No specific new legal risk can be identified without the text of the 138 added words. In particular, the word-count description alone does not establish whether customer data may be used to train AI models.

Information Needed

Please provide the actual redlined language, including the surrounding provisions and any additions shown in {braces}. The AI-training terms should be reviewed especially closely for broad licenses, “service improvement” language, de-identification standards, opt-out mechanisms, and limits on retention and third-party sharing.

Key Changes and Risks

1. AI-model training

• No express change concerning the use of customer data to train, fine-tune, evaluate, or improve AI models was identified.
• The revised notice refers generally to:
• “service optimization”;
• “customer insights”;
• improving platform and website functionality; and
• analytics and marketing optimization.
• These terms could potentially encompass machine-learning or AI-related analytics, but the language does not expressly authorize AI training or explain whether customer content, prompts, outputs, usage data, or personal data may be used for that purpose.
• Risk: If Crownpeak’s services use AI, the notice may be insufficiently specific for transparency, purpose limitation, or contractual requirements—particularly where customers expect their submitted data to remain confidential or excluded from model training. A separate product notice, DPA, or agreement should clarify:
• what data is used;
• whether it is used to train shared or customer-specific models;
• whether data is anonymized or aggregated;
• retention and deletion rules; and
• available opt-out or restriction rights.

2. Expanded disclosure and internal use

The revised sharing section adds or clarifies disclosure to:

• Crownpeak subsidiaries for marketing, internal reporting, customer insights, and service optimization;
• service providers and business partners performing services on Crownpeak’s behalf, including platform improvement, information collection, IT assistance, and data analytics; and
• search-engine providers.

This replaces the more specific discussion of Crownpeak’s Facebook, Instagram, LinkedIn, and X pages with broader language concerning social-media management, analytics, and marketing optimization.

Risk: The new wording is broader and less precise about the categories of recipients, purposes, and data involved. It may permit wider intra-group and vendor use of personal data than the previous language clearly described.

3. Social-media processing

The revised notice states that Crownpeak maintains social-media profiles and has entered into corresponding joint-responsibility arrangements with Facebook, LinkedIn, and X. It says those platforms are responsible for responding to data-subject requests.

Risk: Responsibility for compliance and rights handling may be unclear, particularly where Crownpeak and the platforms jointly determine processing purposes.

4. Business transfers and legal disclosures

New language permits disclosure to a prospective seller or buyer if Crownpeak sells or acquires a business or assets. It also permits disclosure to authorities or other third parties where Crownpeak believes this is necessary to comply with legal obligations, subpoenas, investigate fraud, or protect rights.

Risk: The legal-disclosure standard appears broader (“where we believe this is necessary”) and may allow disclosure without prior notice where legally permitted.

5. International transfers

The detailed transfer framework is replaced or reorganized to cover the UK, EEA, and Switzerland, relying on adequacy decisions, standard contractual clauses, other safeguards, exceptions, and the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks.

Risk: The revised text appears heavily reformatted and contains potential drafting inconsistencies. The final published version should be checked for accuracy, especially regarding DPF certification, onward-transfer obligations, and applicable safeguards.

6. Data-subject rights and presentation

Rights are reorganized into clearer categories, including access, rectification, erasure, restriction, and portability. The notice retains limited deletion exceptions and may retain minimum data to document requests.

Risk: The redline contains substantial formatting and sentence-structure problems. These should be corrected before publication to avoid ambiguity or an allegation that required privacy disclosures are unclear.

Structured Summary of Important Changes

Executive Overview

The diff substantially rewrites the privacy notice, particularly the sections on data sharing, international transfers, security, data-subject rights, and regulatory disclosures. Much of the replacement appears mechanically misaligned, so the final document should be reviewed for formatting, missing text, and legal coherence before publication.

AI Model Training

• No express provision authorizes using customer or personal data to train, fine-tune, evaluate, or improve AI models.
• The revised language refers generally to:
• “service optimization”
• “customer insights”
• “improving functionality of our platforms and websites”
• “collecting information about you”
• These phrases could potentially support broad product-improvement activities, but they do not clearly state that data will be used for AI training.
• The notice also does not clarify:
• whether customer content or inputs are used to train third-party or Crownpeak models;
• whether data is de-identified before model use;
• whether customers can opt out;
• whether prompts, outputs, telemetry, or usage data are retained; or
• whether data is shared with AI vendors.
• If AI training is intended, a specific disclosure and contractual allocation of rights should be added. If it is not intended, the customer agreement should state that customer data will not be used for model training except as expressly authorized.

Expanded or Changed Data Sharing

The revised text replaces detailed references to Crownpeak’s social-media pages with broader disclosures permitting sharing with:

• Crownpeak subsidiaries for marketing, internal reporting, customer insights, and service optimization;
• service providers and business partners performing services on Crownpeak’s behalf;
• providers supporting platform and website functionality, information collection, IT, social-media management, data analytics, marketing optimization, and search-engine services;
• prospective buyers or sellers in connection with a sale or purchase of a business or assets; and
• government authorities or other third parties where Crownpeak believes disclosure is necessary to comply with legal obligations, investigate fraud, respond to government requests, or protect rights.

Risk: These categories are broader and less specific than the deleted language, potentially increasing uncertainty about recipients and purposes.

International Transfers

• The notice now describes global transfers outside the UK and EEA using adequacy decisions, safeguards such as Standard Contractual Clauses or the International Data Transfer Agreement, and legal exceptions.
• It adds or reorganizes reliance on the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks.
• The revised wording appears to preserve onward-transfer responsibility but is materially restructured and should be checked for accuracy.

Security and Breach Notification

• Detailed security-audit and certification language is replaced with a more general statement about operational controls, information-security practices, audits, and certifications.
• Breach language is narrowed from procedures addressing suspected breaches and notification where legally required to notification where legally required.

Risk: This may reduce the appearance of a proactive security commitment and should be reconciled with contractual security obligations.

Data-Subject Rights

• Rights are reformatted and generally restated for EU, UK, and Swiss individuals.
• Deletion language now expressly permits retaining the minimum data necessary to document requests and avoid further use.
• The request process remains relatively general but requires a description of the request and the data at issue.

Other Issues

• Contact details and punctuation/spacing have been altered.
• References to “Rezolve” remain in the contact email, which may create entity-identity confusion.
• The diff contains extensive apparent text-order and formatting corruption. A clean consolidated version should be legally proofread before reliance.

Summary

The provided diff does not include the text of the approximately 138 added words. It only states that words were added, without showing their content.

Legal and Commercial Impact

Because the actual additions are missing, it is not possible to determine:

• Whether the contract’s rights, obligations, or liability provisions changed.
• Whether new fees, renewal terms, termination rights, warranties, or indemnities were added.
• Whether confidentiality, security, privacy, or data-processing obligations changed.
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models.
• Whether data may be shared with affiliates, vendors, subprocessors, or third-party AI providers.
• Whether the customer has any opt-out, deletion, audit, or access rights concerning AI training.
• Whether the provider receives broader rights to use customer content, usage data, prompts, outputs, metadata, or de-identified information.
• Whether the contract limits the provider’s responsibility for AI-generated outputs or data leakage.

AI Training Review

No specific language addressing AI model training or use of customer data is visible in the supplied diff. Accordingly, no conclusion can be reached about whether the revised contract:

1. Permits training on customer content by default;

2. Restricts training to de-identified or aggregated data;

3. Prohibits use of customer data for model training;

4. Allows use of data to improve products or services;

5. Applies different rules to inputs, outputs, telemetry, or personal information; or

6. Provides contractual safeguards concerning retention, deletion, confidentiality, or third-party model providers.

Required Information

Please provide the actual 138-word addition, using the indicated {added} notation and, if applicable, the corresponding deleted or replaced text. The legal and AI-data implications can then be analyzed reliably.

Executive Summary

The update substantially rewrites the privacy notice’s data-sharing, international-transfer, security, and data-subject-rights provisions. It does not expressly authorize using customer data to train AI models, nor does it mention artificial intelligence, machine learning, model training, model improvement, prompts, outputs, or retaining data for those purposes.

AI Model Training and Data Use

• No explicit AI-training provision added or removed. The revised notice does not state that customer data, content, inputs, outputs, usage data, or personal data may be used to train or fine-tune AI models.
• The new wording permits sharing data for:
• “customer insights”;
• “service optimization”;
• “improving functionality” of platforms and websites;
• analytics and marketing optimization; and
• internal reporting.
• These purposes are broader and could potentially support analytics or product-improvement activities, including AI-related development, but the notice does not clearly say that data will be used for model training. If AI training is intended, the privacy notice should address it expressly, including data categories, purposes, legal basis, retention, opt-out/objection rights, de-identification, and whether data is used to train general-purpose or customer-specific models.

Important Changes and Risks

Expanded data sharing

The revised notice adds or clarifies sharing with:

• Crownpeak group companies for marketing, internal reporting, customer insights, and service optimization;
• service providers and business partners supporting platform functionality, information collection, IT, and social-media management;
• analytics, marketing-optimization, and search-engine providers; and
• Facebook, Instagram, LinkedIn, and X, with revised language describing Crownpeak’s social-media pages and joint responsibility arrangements.

Risk: The purposes and recipient categories are broader, potentially increasing secondary use, profiling, marketing, and onward-disclosure exposure.

Business transactions and legal disclosures

New language permits disclosure to a prospective buyer or seller if Crownpeak sells or buys a business or assets. It also broadens government and third-party disclosures where Crownpeak believes disclosure is necessary to comply with legal or regulatory obligations, subpoenas, fraud investigations, or protection of rights.

Risk: Data may be disclosed during corporate transactions or under a broader “necessary” standard, with less emphasis on breach-related notification.

International transfers

The detailed transfer section is replaced with a more general framework covering transfers outside the UK and EEA. It references adequacy decisions, standard contractual clauses, international transfer agreements, lawful exceptions, and the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks.

Risk: The revised language is less specific about particular transfer mechanisms and onward-transfer obligations, potentially reducing transparency about where data goes and which safeguards apply.

Security and breach language

Specific descriptions of audits, certifications, and security procedures are removed or condensed. The revised notice states Crownpeak will address breaches and notify users or regulators where legally required.

Risk: The commitment is less detailed and appears more legally conditional.

Data-subject rights

The rights section is reorganized and expanded for EU, UK, and Swiss individuals, including access, rectification, erasure, restriction, objection, and portability. Crownpeak may retain minimum data to document deletion requests and comply with legal obligations.

Risk: Rights remain subject to legal exceptions, and retention after deletion requests is expressly preserved.

Summary

The provided diff does not include the actual added, deleted, or replaced contractual language. It only states:

> “Added approximately 138 words to the document”

Accordingly, it is not possible to identify the legal or commercial effect of the changes.

AI Training and Customer Data

No substantive language concerning any of the following is provided, so no conclusion can be reached about whether the contract has changed its treatment of customer data:

• Using customer data to train, fine-tune, or improve AI or machine-learning models
• Using customer content for product development, analytics, or benchmarking
• Whether customer data may be used in aggregated, de-identified, or anonymized form
• Whether inputs, outputs, prompts, or usage data are retained
• Whether data is shared with affiliates, vendors, or third-party AI providers
• Whether the customer can opt out of AI training or data-use practices
• Ownership, confidentiality, or intellectual-property rights in customer data and AI outputs
• Security, deletion, retention, or cross-border transfer obligations
• Whether the provider may use data from one customer to benefit other customers

Risk Assessment

No specific new risks can be identified without the text of the 138-word addition and any surrounding provisions it modifies. The missing language could materially affect:

• The scope of the provider’s license to customer data
• Confidentiality protections
• The customer’s ability to restrict secondary uses
• Compliance with privacy and data-protection laws
• Responsibility for AI-generated outputs
• The provider’s rights to retain or reuse data after termination

Information Needed

Please provide the actual redlined wording, including:

1. The 138 added words;

2. Any deleted or replaced wording;

3. The relevant surrounding section, if the change depends on existing definitions or obligations.

Once provided, the changes can be analyzed for specific legal effects and AI-training risks.

Summary of Legal Changes

Scope of the Diff

The diff only states that approximately 366 words were removed. It does not identify:

• Which provisions were deleted;
• Whether the deletions were replaced with new language;
• Whether the changes affect customer data, confidentiality, security, intellectual property, or liability; or
• Whether any AI-training provisions were added, removed, or modified.

Customer Data and AI Model Training

No reliable conclusion can be drawn about the use of customer data to train AI models from the information provided.

The deleted text could have included restrictions or permissions concerning:

• Using customer data to train, fine-tune, or improve artificial-intelligence or machine-learning models;
• Using customer data to generate anonymized, aggregated, or de-identified datasets;
• Retaining customer prompts, inputs, outputs, or usage data for model development;
• Sharing data with affiliates, subprocessors, or AI service providers;
• Opt-out rights or customer consent requirements;
• Deletion obligations after termination; or
• Ownership and permitted use of data-derived models, outputs, or analytics.

If any of these provisions were removed without replacement, the deletion may create ambiguity or materially broaden the provider’s rights—particularly if other general-purpose data-use language remains in the agreement.

Potential Legal Risks from Unspecified Deletions

Depending on the deleted language, the changes could:

1. Expand data-use rights by eliminating limitations on secondary use of customer data.

2. Remove customer protections relating to confidentiality, security, deletion, or data minimization.

3. Reduce transparency regarding subcontractors or third-party AI providers.

4. Affect compliance obligations under privacy and data-protection laws.

5. Change allocation of risk by deleting warranties, indemnities, audit rights, or liability protections.

6. Create interpretive uncertainty if defined terms or cross-references remain after the deletions.

Conclusion

The provided diff is insufficient for a substantive legal comparison. The full redline, or at least the 366 deleted words and the surrounding provisions, is needed to determine whether customer data may now be used for AI training and whether the changes create new legal or commercial risks.