Domestika

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 156 words to the document”

Because the added words and any deleted or replaced language are not shown, it is not possible to identify:

• Changes to the parties’ rights or obligations
• New liability, indemnity, confidentiality, or security risks
• Changes to data ownership or permitted data uses
• Whether customer data may be used to train, fine-tune, test, or improve AI models
• Whether data may be shared with affiliates, vendors, or third parties
• Changes to retention, deletion, or anonymization requirements
• Any new customer consent or opt-out rights

AI Training and Customer Data

No conclusion can be reached about AI-model training from the supplied material. The actual added or modified language should be reviewed for terms such as:

• “train,” “fine-tune,” “develop,” “improve,” or “enhance” models
• “usage data,” “customer data,” “inputs,” “outputs,” or “content”
• Rights to use data in aggregated, de-identified, or anonymized form
• Disclosure to subprocessors or model providers
• Opt-out, deletion, confidentiality, or security protections
• Whether model-training rights continue after termination

Required Information

Please provide the full diff, including the actual text within {}, [], and []{}. Without that text, a substantive legal-risk analysis cannot be performed.

Summary of Important Changes

1. No express change concerning AI-model training

• The diff does not add or remove any express provision authorizing Domestika to use customer data, content, prompts, uploads, course activity, or other personal data to train artificial-intelligence models.
• The policy does mention profiling and personalisation based on platform activity, including courses viewed or purchased, members followed, and payment methods. This is described as being used to prioritise content and personalise the user experience—not to train AI models.
• “Artificial Intelligence courses” and “ChatGPT courses” appear only as website navigation or course-category content. They do not create an AI-training permission.
• The absence of an AI-training clause means the policy remains unclear on whether data may be used for model training under broad purposes such as analytics, service improvement, or product development. Users seeking certainty should request clarification or review any separate terms governing uploaded content, projects, or generative-AI features.

2. Expanded U.S. state privacy rights

The revised policy substantially expands the rights notice for residents of:

• Colorado
• Connecticut
• Montana
• Oregon
• Texas
• Utah
• Virginia

The listed rights now include:

• Access to and copies of personal data
• Deletion
• Correction of inaccurate data
• Opting out of data sales and targeted advertising
• Data portability
• Appeals where a request is denied

The policy also adds Nevada-specific privacy-rights language and states that requests should generally be submitted from the email address associated with the user’s Domestika account.

Risk: The policy now expressly contemplates data sales or transfers that may qualify as “sales” under applicable U.S. privacy laws, although the Nevada section says Domestika does not currently sell personal information as defined under Nevada law. The terminology is not entirely uniform across jurisdictions and may require careful interpretation.

3. New layered privacy notice

A new Section 13 provides a summary table covering:

• Domestika’s identity and contact details
• Processing purposes
• Legal bases
• Recipients and service providers
• International transfers
• Retention periods
• User rights

The summary lists profiling and personalisation, fraud prevention, legal compliance, analytics, CRM, mailing, hosting, IT, and payment providers.

Risk: The summary is expressly only an overview. The detailed provisions elsewhere in the policy control, so users must still review the full policy for the scope and limitations of each processing activity.

4. Profiling and automated decisions

The policy continues to permit profiling based on platform activity and allows content prioritisation. It preserves rights to object, express a view, contest relevant decisions, and request human intervention.

5. Mostly editorial changes

Many other changes correct punctuation, spacing, formatting, broken headings, and website-navigation text. These do not appear to materially alter substantive privacy rights or obligations.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 152 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions were added or changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data is shared with affiliates, vendors, or model providers;
• Whether the customer retains ownership and control of its data;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether the customer can opt out of AI training or withdraw consent;
• How long data is retained or where it is processed;
• Whether confidential information, personal data, prompts, outputs, or usage metadata are included;
• Whether the provider may use customer data for product development, analytics, advertising, or other secondary purposes; or
• Whether any new indemnity, liability, security, or regulatory risks arise.

Information Needed

Please provide the complete diff, including the text shown in the following formats:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

Without the substantive wording, no reliable legal-risk analysis—particularly regarding AI model training—can be performed.

Key Changes and Risks

1. No express AI-training provision identified

• The diff does not add or remove language expressly authorizing Domestika to use customer data, content, prompts, uploads, or interactions to train, fine-tune, evaluate, or improve AI models.
• “Artificial Intelligence courses” and “ChatGPT courses” appear only as website navigation/category text, not as a data-use authorization.
• The existing purposes listed—profiling/personalisation, fraud prevention, analytics, communications, and legal compliance—remain broadly stated. Depending on interpretation, Domestika might argue that some data-improvement or analytics activities fall within these purposes, but the policy does not clearly identify AI training.
• Risk: The policy remains ambiguous regarding whether user-generated content or platform activity may be used for AI development. Customers should not assume that AI training is prohibited merely because it is not mentioned. A separate terms of use, creator agreement, product-specific notice, or processor disclosure may address this issue.

2. Expanded U.S. state privacy rights

The revision replaces the narrower Nevada-focused notice with a broader section covering residents of:

• Colorado
• Connecticut
• Montana
• Oregon
• Texas
• Utah
• Virginia

The listed rights now include:

• Access and a copy of personal data
• Deletion
• Correction of inaccurate data
• Opt-out of data sales and targeted advertising
• Data portability

The revision also states that these rights are subject to exceptions and adds an appeal process where a request is denied.

Risk: The expanded rights may permit users to restrict targeted advertising or certain data-sharing practices, but the policy does not expressly explain whether any AI-related processing would qualify as targeted advertising, a sale, profiling, or another regulated activity.

3. Revised California/Nevada sale language

• The policy continues to state that, in some circumstances, data “could be sold” under the CCPA’s broad definition, which can include sharing or transferring personal information for value.
• It also retains exceptions for sharing with service providers and similar activities.
• The Nevada notice is reorganized and now directs users to exercise rights from the email address associated with their Domestika account.

Risk: “Could be sold” is broad and may create uncertainty about the actual categories of recipients, purposes, and opt-out mechanisms. Customers should verify whether their data is presently sold or shared for targeted advertising.

4. New layered privacy summary

A new Section 13 provides a condensed “First Layer Information Notice” summarizing:

• Controller and DPO contact details
• Processing purposes
• Legal bases
• Recipients and processors
• International transfers
• Retention periods
• User rights

This is primarily a transparency and usability improvement, with full details remaining in the main policy.

5. Automated decision-making language

The policy continues to describe profiling based on platform activity, including courses viewed or purchased, followed members, and payment methods. It states that content may be prioritised and preserves rights to human intervention, contest decisions, and object.

Risk: Personalisation and profiling remain relatively broad, and the policy does not clarify whether automated systems—or AI models—are used in these processes.

No

Executive Summary

The revised Privacy Policy appears to make several clarifications and updates, particularly regarding contact information, profiling safeguards, and U.S. state privacy rights. However, the diff is heavily affected by apparent webpage-content and formatting artifacts, so the final published text should be reviewed carefully.

Important Changes and Risks

1. No express AI-model training authorization identified

• The diff does not add language expressly allowing Domestika to use customer data, user content, course activity, communications, or other Personal Data to train, fine-tune, or improve artificial-intelligence or machine-learning models.
• Although the policy references “Artificial Intelligence courses” in website navigation, that is not an AI-data-use provision.
• The policy does allow broad processing for purposes such as:
• Profiling and personalization;
• Quality and satisfaction surveys;
• Fraud prevention;
• Platform and service improvement; and
• Analysis of user activity and interactions.
• Depending on the full unchanged text, these provisions might support analytics or algorithmic improvement, but they do not clearly authorize AI training. A separate AI or product-improvement clause would be needed for clear authorization.

2. Additional safeguard for automated decisions

The profiling section now expressly allows users to contact Domestika at dataprotection@domestika.org to obtain human intervention. Existing rights to express a view, contest decisions, and object remain.

Risk: Domestika may still use activity data—such as courses viewed or purchased, followed members, and payment methods—to create profiles and prioritize content. The policy should clarify whether profiling affects prices, eligibility, account access, or other significant outcomes.

3. Expanded U.S. state privacy rights

The revised policy adds or clarifies rights for residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia, including:

• Access to and copies of personal data;
• Deletion;
• Correction;
• Opting out of data sales and targeted advertising; and
• Data portability.

Requests must generally be sent from the email address associated with the account, and identity verification may be required.

4. Nevada privacy clarification

The policy now states that Nevada residents may opt out of certain sales of personal information, while also stating that Domestika does not currently sell information as defined under Nevada law.

Risk: The policy separately says that information may be “sold” under the CCPA, where “sale” can include certain transfers or sharing. This could create confusion about whether Domestika shares data for targeted advertising or similar purposes.

5. Updated contact and transparency information

The DPO/contact email, dataprotection@domestika.org, is inserted throughout the policy. Additional processor information and transfer documentation may be requested through that address.

Overall assessment: The changes improve regulatory disclosures and user-rights procedures, but the apparent CCPA “sale” language and broad profiling provisions warrant clarification. No clear customer-data-to-AI-training change appears in this diff.

Summary of Important Changes

1. AI Training and Use of Customer Data

• No express provision was added or removed regarding the use of customer data to train, fine-tune, or evaluate artificial-intelligence models.
• The revised text refers to “Artificial Intelligence courses” and ChatGPT courses in website navigation, but this does not itself authorize using customer data for AI training.
• The policy continues to describe general processing activities such as:
• profiling and personalisation;
• analytics and quality surveys;
• fraud prevention;
• service provision through third-party processors.
• Risk: The policy does not clearly explain whether user-generated content, course activity, prompts, uploads, communications, or other customer data may be used in AI systems. If Domestika uses such data for model training, the policy may not provide sufficiently specific transparency about the purpose, legal basis, data categories, retention, recipients, or objection/opt-out rights.

2. Expanded U.S. State Privacy Rights

• The prior Nevada section has been replaced with a broader notice covering residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia, in addition to Nevada-related rights.
• The revised notice lists rights to:
• access and obtain a copy of personal data;
• delete personal data;
• correct inaccurate data;
• opt out of data sales and targeted advertising;
• obtain data portability.
• It also adds that requests generally must be submitted from the email address associated with the user’s Domestika account.
• The revised language states that these rights are subject to exceptions and adds an appeal process if a request is denied.
• Risk: The wording “data sales and targeted advertising” is broader than the previous Nevada-specific opt-out language. This may create additional operational and compliance obligations, particularly concerning advertising technology, cookies, and data sharing.

3. New Layered Privacy Notice

• A new “First Layer Information Notice (Summary)” has been added.
• It summarizes:
• Domestika as controller;
• processing purposes;
• legal bases;
• categories of recipients and processors;
• international transfers;
• retention periods;
• user rights.
• The summary expressly identifies processors for hosting, IT, analytics, CRM, mailing, and payment services.
• Risk: The summary is expressly described as only a summary, so users must still rely on the full policy. Any inconsistency between the summary and detailed provisions could create transparency or interpretation issues.

4. General Drafting and Presentation Changes

• Numerous changes merely correct punctuation, spacing, broken website text, and formatting.
• The updated notice adds references to regulatory guidance on layered notices and clarifies that Domestika may update the policy, obtaining renewed consent where legally required.
• International transfers to the United States and other countries remain contemplated, with safeguards referenced rather than detailed in the new summary.

Summary of Important Changes

1. New cookie notice and consent options

A substantial block of cookie-related language has been added. It states that Domestika uses:

• Its own and third-party cookies and other technologies;
• Technologies necessary to make the website function “correctly and securely”;
• Technologies to personalize content; and
• Technologies to analyze navigation and adjust advertising to users’ tastes and preferences.

Users are offered the ability to:

• Accept all cookies;
• Reject cookies or continue without accepting them; or
• Choose individual settings through “Cookies Settings.”

Legal significance and risks

• The wording indicates use of tracking and advertising technologies beyond strictly necessary cookies.
• “Adjust advertising to your tastes and preferences” suggests behavioral advertising and profiling.
• The notice does not itself explain retention periods, specific third parties, data categories, legal bases, or how to withdraw consent. Those details may be contained in the linked Cookies Policy, but they are not stated here.
• The effectiveness of “reject” or “continue without accepting” may depend on whether non-essential cookies are actually blocked. This should be verified for consent-law compliance.
• The banner appears to include links to the Cookies Policy and settings, but the diff does not show whether those links function correctly.

2. No express change concerning AI-model training

The diff does not add or remove language stating that customer data, user content, personal information, usage data, or interactions may be used to:

• Train, fine-tune, test, or improve artificial-intelligence or machine-learning models;
• Develop generative AI systems;
• Create datasets or derived data; or
• Share data with AI providers for those purposes.

The addition of “Artificial Intelligence” appears only as a website category/navigation item. It does not create an express authorization to use customer data for AI training.

Risk assessment

• The absence of an AI-training provision means this diff does not clearly expand AI data-use rights.
• However, the broader analytics, personalization, and advertising language could potentially involve automated profiling or machine-learning tools. The policy should be reviewed for separate provisions addressing profiling, automated decision-making, service providers, or “improvement” of services.
• If Domestika intends to train AI models using customer data, that purpose should be stated clearly, including the data involved, legal basis, opt-out or consent rights, third-party disclosures, and deletion or retention rules.

3. Other notable changes

• A promotional countdown (“This price won’t last long”) has been added to the page interface.
• Course navigation categories have been rearranged, including “Artificial Intelligence.”
• The displayed privacy-policy heading appears incomplete (“This Privacy Policy was last”), making the document’s effective or update date unclear. This may be a drafting or rendering defect and should be corrected.

No

No

Summary

The diff only states that approximately 152 words were added. It does not provide the actual added language or identify any deletions or replacements.

AI Training and Data-Use Changes

• Cannot be determined from the provided diff.
• The diff does not reveal whether customer data may now be:
• Used to train, fine-tune, or improve AI models;
• Shared with model providers, affiliates, or other third parties;
• Used in aggregated, de-identified, or pseudonymized form;
• Retained for model-training purposes after termination;
• Excluded from training unless the customer opts in or opts out;
• Used to generate products, analytics, or services for other customers.

Legal Risks

Because the added wording is not included, it is not possible to assess:

• Whether the customer has granted a broader license to its data;
• Whether confidential, personal, regulated, or proprietary information may be used for AI development;
• Whether the provider may use customer prompts, inputs, outputs, or usage data for training;
• Whether the contract contains adequate security, confidentiality, deletion, or data-protection safeguards;
• Whether the provider assumes responsibility for unauthorized disclosure or AI-generated results;
• Whether the customer has meaningful control over training-related use.

Information Needed

Please provide the actual 152 words added to the agreement, including any surrounding text. The specific language is necessary to identify changes to data rights, AI training permissions, confidentiality obligations, and related customer risks.

No

Executive Summary

The diff is heavily affected by formatting and website-navigation content, but the substantive privacy-policy changes appear to be:

• A new “first-layer” summary notice has been added.
• U.S. state privacy rights have been expanded beyond Nevada.
• The detailed California/CCPA and Nevada-specific wording has been reorganized or partially replaced.
• No express provision authorizing use of customer data to train AI models appears in the diff.

Important Substantive Changes

1. New layered privacy summary

A new Section 13 provides a summary table of key privacy information, including:

• Domestika as data controller
• Processing purposes
• Legal bases
• Categories of recipients
• International transfers
• Retention periods
• User rights

The listed purposes include contractual administration, commercial communications, profiling and personalisation, fraud prevention, and legal compliance. The summary also refers to processors for hosting, IT, analytics, CRM, mailing, and payment services.

Risk: The summary may make the scope of processing easier to understand, but it does not appear to add a new processing purpose beyond the main policy. Users should rely on the full policy where the summary and detailed provisions differ.

2. Expanded U.S. state privacy rights

The prior text focused specifically on Nevada’s right to opt out of certain data sales and stated that Domestika did not currently sell information under Nevada law.

The replacement recognizes rights under applicable laws for residents of:

• Colorado
• Connecticut
• Montana
• Oregon
• Texas
• Utah
• Virginia

The listed rights include access, deletion, correction, opt-out of data sales and targeted advertising, and data portability. The revised language also states that requests generally must be submitted from the email address associated with the Domestika account and adds an appeal process if a request is denied.

Risk: The earlier CCPA-specific wording appears to have been removed or absorbed into broader state-law language. California residents should verify that the full, current policy still separately explains all applicable CCPA/CPRA rights, including any rights relating to sensitive personal information, sharing, and limitation of use.

3. Legal bases and processing purposes summarized

The new summary expressly identifies contractual or precontractual necessity, consent, legitimate interests, and legal obligations as legal bases.

Risk: Profiling and personalisation remain expressly recognized processing activities. The policy continues to state that platform activity may influence content prioritization and provides rights relating to objection and automated decision-making.

AI Model Training

No new or amended language in the supplied diff expressly states that customer data, user content, course activity, communications, or personal information may be used to train, fine-tune, evaluate, or improve artificial-intelligence models.

The appearance of “Artificial Intelligence courses” and “ChatGPT courses” is website navigation content, not a data-use authorization.

Conclusion: Based solely on this diff, there is no identifiable change permitting AI training. However, the full policy and any terms governing user-generated content should also be reviewed for separate AI-training language.

Summary of Important Changes

1. No express AI-model training provision identified

The diff does not add or revise language expressly stating that customer data, user content, course activity, communications, or other Personal Data may be used to:

• Train, fine-tune, or evaluate AI models;
• Develop generative-AI products or features;
• Create datasets for machine-learning purposes; or
• Permit third-party AI providers to use data for model training.

Although the policy lists “Artificial Intelligence courses” among website categories, that appears to be navigation or website content rather than a data-use authorization. The policy’s existing profiling language allows Domestika to create user profiles based on Platform activity—such as courses viewed or purchased, followed members, and payment methods—and prioritize content. This is personalization, not expressly AI training, but it could support algorithmic or machine-learning systems. The policy should clarify whether such systems use customer data and whether data is shared with AI vendors.

2. Data-protection contact details added or corrected

The revised policy repeatedly adds dataprotection@domestika.org, including for:

• Contacting the Data Protection Officer;
• Privacy complaints and questions;
• Exercising privacy rights;
• Requesting processor information or international-transfer safeguards;
• Objecting to marketing or processing; and
• Requesting human intervention regarding automated decisions.

This improves transparency and gives users a clearer way to exercise rights.

3. New safeguard for automated decision-making

Users may now contact the DPO to obtain human intervention concerning automated decisions. The policy already states that users may express their views, contest decisions, and object to profiling. This addition modestly strengthens GDPR Article 22 safeguards, although the policy still permits activity-based profiling and content prioritization.

4. Expanded U.S. state privacy rights

The revised California/state-law section adds or clarifies rights for residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia, including:

• Access to and a copy of personal data;
• Deletion;
• Correction;
• Opt-out of data sales;
• Opt-out of targeted advertising; and
• Data portability.

Requests must generally be sent from the email associated with the Domestika account, and identity verification may be required.

5. Nevada disclosure changed

The revision states that Nevada residents may opt out of certain sales of personal information, while also stating that Domestika does not currently sell information as defined under Nevada law. This is more specific than the prior wording but could appear internally inconsistent with the broader CCPA statement that data may be “sold” in some circumstances.

6. Drafting and formatting concerns

The diff contains substantial apparent website-navigation text, duplicated fragments, missing spaces, and corrupted section numbering. Before publication, Domestika should conduct a complete editorial and legal review to ensure the final policy is coherent and that no rights, disclosures, or limitations were accidentally displaced.

Summary

The provided diff only states:

> “Removed approximately 156 words from the document”

It does not identify which language was deleted or provide the surrounding contractual text.

AI Training and Customer Data

• No determination is possible as to whether the changes affect the use of customer data to train AI models.
• The deleted text could have:
• Authorized or prohibited training on customer data;
• Defined whether customer content is used to improve models;
• Required consent or provided an opt-out;
• Addressed de-identification, aggregation, or anonymization;
• Limited use of prompts, outputs, metadata, or usage data;
• Applied retention, confidentiality, or deletion obligations to training data; or
• Allocated rights in models or improvements derived from customer data.

Potential Legal Risk

Deleting unidentified language may materially change the agreement, but the direction and significance of the change cannot be assessed without the actual text. In particular, removal of restrictions or consent requirements could expand the provider’s ability to use customer data, while removal of a permission or disclaimer could limit that ability or create ambiguity.

Information Needed

Please provide the actual redlined text, including:

1. The deleted 156 words;

2. Any surrounding provisions or section headings; and

3. Any replacement language, if applicable.

Without that information, no reliable conclusion can be reached about changes to AI training, data rights, confidentiality, privacy, security, or other contractual obligations.

Summary

Information Provided

The diff only states:

> “Added approximately 156 words to the document”

It does not include the actual added language, deleted language, or replacement provisions.

Legal and AI-Data Analysis

Because the substantive wording is missing, it is not possible to determine:

• Whether the customer grants rights to use its data, content, prompts, outputs, or personal information to train, fine-tune, evaluate, or improve AI models.
• Whether any data-use permission is limited to de-identified, aggregated, or anonymized data.
• Whether the customer can opt out of AI training or withdraw consent.
• Whether the provider may share customer data with affiliates, vendors, or third-party model providers.
• Whether the changes expand the provider’s ownership or license rights.
• Whether new retention, confidentiality, security, or regulatory risks are introduced.
• Whether the customer receives notice of automated processing or model-training activities.
• Whether the provider disclaims responsibility for model outputs or data leakage.

Assessment

No specific legal changes or new risks can be identified from the information supplied. The added 156 words should be provided verbatim, using the specified notation for additions, deletions, and replacements, before a meaningful contract analysis can be performed.

Structured Summary of Important Changes

1. Document and contact information

• The privacy policy is now expressly stated to have been updated in March 2026.
• Domestika Inc. is identified as the data controller and Platform owner.
• A Data Protection Officer contact email has been added or standardized: dataprotection@domestika.org.
• The policy now provides this email for privacy inquiries, rights requests, objections, complaints, and requests for processor or international-transfer information.
• The diff contains substantial formatting and webpage-navigation text inserted into the policy, including pricing banners, menus, course categories, and footer content. This creates a risk that the published version is poorly formatted or that non-policy content could create ambiguity.

2. Profiling and automated decision-making

• The policy more clearly explains that Domestika may create user profiles based on Platform activity, including:
• Courses viewed or purchased;
• Members followed; and
• Payment methods.
• Profiling may cause certain content to be prioritized in the user’s Platform experience.
• New safeguards expressly allow users to contact the DPO to request human intervention, express their views, and contest an automated decision.
• The policy continues to state that the profiling is not intended to produce decisions with legally or similarly significant effects under GDPR Article 22. However, this conclusion may be contestable if profiling materially affects access, pricing, recommendations, or services.

3. Commercial communications and objections

• The privacy-policy contact channel for objecting to marketing communications has been clarified to include dataprotection@domestika.org, in addition to unsubscribe tools.
• Consent-based marketing may be withdrawn at any time.
• The policy also clarifies that consent withdrawal does not necessarily affect prior lawful processing.

4. California and other U.S. state privacy rights

• The California section now states that, in some circumstances, personal information could be “sold” under the CCPA, using the CCPA’s broad definition that may include sharing or transferring information.
• The policy says certain service-provider disclosures are not considered sales.
• Nevada residents are given an opt-out right concerning sales of personal information, while Domestika states that it does not currently sell information as defined under Nevada law.
• Residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia are now expressly granted rights including:
• Access and portability;
• Deletion;
• Correction;
• Opt-out of sales and targeted advertising.
• Requests must generally be sent from the email address associated with the Domestika account, and identity verification may be required.

5. AI-model training

• No express provision was added or removed addressing the use of customer data, user content, course activity, communications, or other Personal Data to train, fine-tune, evaluate, or improve AI models.
• References to “Artificial Intelligence courses” appear to be navigation/footer content, not a data-use authorization.
• Accordingly, the revised policy does not clearly authorize or prohibit AI training. If Domestika intends to use customer data or user-generated content for AI purposes, the policy appears insufficiently specific regarding purposes, legal basis, data categories, retention, sharing, opt-out rights, and whether data is anonymized.

Summary of Important Changes

1. No express authorization to train AI models

• The diff does not add language stating that customer data, content, prompts, course activity, or other Personal Data may be used to train, fine-tune, evaluate, or improve AI models.
• References to “Artificial Intelligence courses” and “ChatGPT courses” appear to be website footer/navigation content, not a data-processing purpose.
• The existing profiling language remains focused on using Platform activity—such as courses viewed or purchased, followed members, and payment methods—to personalize or prioritize content. This is not the same as AI-model training, although such activity could potentially be used in automated recommendation systems.
• The policy still describes automated-decision safeguards, including human intervention, the ability to express a view and contest decisions, and a right to object.

2. Expanded U.S. state privacy rights

The revised policy adds or consolidates rights for residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia, including:

• Access to and a copy of Personal Data;
• Deletion;
• Correction of inaccurate data;
• Opt-out of data sales and targeted advertising;
• Data portability;
• Appeal rights if a request is denied.

These rights are subject to exceptions. Requests must be submitted from the email address associated with the Domestika account, which may create practical difficulties for users who cannot access that address.

The Nevada section is substantially reorganized and now refers to rights under “applicable state privacy laws.” The prior statement that Domestika “does not currently sell” information under Nevada law is no longer clearly stated in the revised text. This may create uncertainty about Domestika’s current position on Nevada data sales.

3. New layered privacy summary

A new “First Layer Information Notice (Summary)” provides a high-level table covering:

• Domestika Inc. as controller;
• Processing purposes;
• Legal bases;
• Categories of recipients;
• International transfers;
• Retention periods; and
• User rights.

The summary identifies purposes including contractual administration, commercial communications, profiling/personalization, fraud prevention, and legal compliance. It does not add AI training as a stated purpose.

4. More explicit legal and operational disclosures

The summary identifies processor categories such as hosting, IT, analytics, CRM, mailing, and payment services, and confirms international transfers to the United States and potentially other countries.

The policy also continues to state that Domestika may share data in circumstances characterized as a “sale” under the CCPA, although certain service-provider transfers are excluded from that definition. This wording may signal broader California disclosure obligations, even if it does not necessarily mean Domestika sells data for money.

5. Drafting and presentation concerns

The diff contains extensive apparent formatting and text-corruption changes, including broken punctuation, headings, email-address formatting, and duplicated navigation content. The final published policy should be checked carefully because these defects could create ambiguity about rights, contact procedures, and the scope of processing.

Summary

The provided diff does not include the text of the added provisions. It only states:

> “Added approximately 156 words to the document”

Accordingly, it is not possible to identify the legal effect of the changes or assess any new risks.

AI Training and Customer Data

No actual language is provided addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, files, or usage data are retained;
• Whether data may be shared with affiliates, vendors, or model providers;
• Whether customer data is used to train general-purpose models or only customer-specific systems;
• Whether customers may opt out of AI training or data use;
• How confidential information, personal data, or regulated data is protected;
• Whether data is anonymized, aggregated, or de-identified before use; or
• Whether training-related use continues after termination of the agreement.

Risk Assessment

Because the 156 added words are not shown, no reliable determination can be made about:

• New permissions to use or commercialize customer data;
• Changes to confidentiality, privacy, security, or intellectual-property rights;
• New data-retention or deletion obligations;
• Allocation of responsibility for AI-generated outputs; or
• Changes to customer consent or opt-out rights.

Please provide the actual redline text, including the added and deleted language, for a meaningful legal analysis.