Gremlin

Summary

Scope of the Change

• The diff states that approximately 659 words were removed, but it does not identify which provisions were deleted.
• Because the deleted text is not provided, it is not possible to determine the precise legal or commercial effect of the amendment.

Potential Legal and Commercial Risks

Deleting approximately 659 words could materially affect:

• Customer rights and provider obligations
• Data ownership, licensing, and permitted uses
• Confidentiality and security commitments
• Data retention and deletion requirements
• Liability, indemnification, and limitation-of-liability provisions
• Audit, compliance, or regulatory obligations
• Termination rights and post-termination data handling
• Warranties, service levels, or remedies

The removal may benefit either party depending on the deleted language. For example, deleting restrictions or obligations could expand the provider’s discretion, while deleting permissions or disclaimers could reduce the provider’s rights or protections.

AI Training and Data Use

• The supplied diff contains no visible language addressing AI, machine learning, model training, model improvement, or use of customer data.
• Accordingly, it is not possible to determine whether the amendment:
• Permits or prohibits training AI models on customer data;
• Changes whether customer data may be used to improve services;
• Changes treatment of prompts, inputs, outputs, metadata, or usage data;
• Removes consent, opt-out, anonymization, or aggregation requirements;
• Changes ownership or licensing of data used for training; or
• Affects deletion of customer data from training datasets or trained models.

Recommended Review

The complete before-and-after text should be obtained, especially any deleted provisions containing terms such as:

• “train,” “training,” “machine learning,” “artificial intelligence,” “model improvement,” or “サービス improvement”;
• “customer data,” “content,” “inputs,” “outputs,” “usage data,” or “telemetry”;
• “license,” “ownership,” “aggregate,” “de-identify,” “anonymize,” “retain,” or “delete.”

Bottom line: The deletion is potentially material, but no reliable conclusion about its legal effect—particularly AI-training rights—can be made from the information provided.

Summary of Important Changes and Risks

1. Expanded purposes for using customer information

The revised policy replaces a broad statement allowing disclosure of “Non-Personal Information” for any purpose with a more detailed list of permitted uses, including:

• Responding to requests and customer-service inquiries.
• Creating and administering online accounts.
• Developing, maintaining, protecting, and improving the Services.
• Analyzing usage, trends, and user activity.
• Managing security, fraud prevention, abuse investigations, and technical issues.
• Managing billing, accounts, communications, surveys, promotions, and advertising campaigns.
• Understanding users and improving content, navigation, functionality, and customer support.

Risk: The permitted-use language remains broad and is not limited to providing the Services. “Improve our Services,” “understand our users,” and “generally manage our business” could support analytics, profiling, product development, and potentially automated or AI-related processing.

2. AI assistants and MCP tools added

The new language addresses connections to an AI assistant:

> “When you connect our Services to an AI assistant, responses to your MCP tool calls are returned to the AI assistant provider you selected, which handles them under its own privacy policy.”

Risks:

• Customer data and tool-call responses may be disclosed to the selected AI provider.
• The AI provider’s privacy policy—not solely Gremlin’s policy—governs its handling of the information.
• The policy does not identify specific AI providers, describe data categories shared, or state whether providers retain prompts, responses, or tool-call data.
• There is no express restriction stating that the AI provider may not use customer data to train, fine-tune, evaluate, or improve AI models.
• There is also no clear statement that Gremlin itself will not use customer information to train AI models. The general “improve our Services,” usage-analysis, and product-development purposes could potentially be interpreted to permit such use, depending on the data and applicable law.
• The customer is directed to the AI provider for privacy handling, which may reduce practical control and available remedies.

3. Broader sharing and disclosure rights

The revised policy permits sharing with cloud hosting, backup, email, and other service providers, and allows disclosure where Gremlin believes it is legally necessary or appropriate, including for legal process, government requests, security, enforcement, and corporate transactions.

Risk: The new corporate-transaction language expressly permits personal information to be transferred, sold, or disclosed in a merger, sale, reorganization, or similar event.

4. Non-Personal Information treatment

The policy continues to allow Non-Personal Information to be used and disclosed for any purpose. It also states that information becomes subject to the personal-information rules if combined with identifying information.

Risk: “Anonymized,” “aggregated,” or “de-identified” data may still create re-identification or model-training concerns if combined with account, usage, or other identifying data.

5. Retention and international transfers

Retention periods are expanded or clarified to include account administration, billing, legal obligations, and other business purposes. Information is stated to be stored and processed in the United States.

Risk: Customers outside the United States may receive fewer protections, and the revised language does not impose a specific deletion deadline after account termination.

Summary of Important Changes

1. Broader use and disclosure of “Non-Personal Information”

• The policy replaces specific permitted uses—such as responding to requests, administering accounts, improving services, and analyzing usage—with a broad authorization to use and disclose Non-Personal Information for any purpose, subject only to applicable law.
• “Non-Personal Information” is defined to include information that does not identify a natural person, including location, demographic information, ZIP codes, and information that has been anonymized, aggregated, or de-identified.
• The policy states that information may be treated as personal information if it is combined with personal information or if applicable law requires that treatment.
• Risk: The “any purpose” language substantially expands permitted secondary uses and disclosures. De-identification may not be irreversible, and combining supposedly non-personal data with identifying information could create re-identification and privacy risks.

2. AI assistant and model-related disclosure removed

• The prior language stated that, when a user connects an AI assistant, responses to MCP tool calls are returned to the AI assistant provider, which handles them under its own privacy policy.
• That language is deleted and replaced with general security statements.
• The revised policy therefore no longer clearly explains:
• Which AI provider receives MCP responses;
• Whether customer prompts, tool outputs, or other data are shared with that provider;
• Whether the provider may retain or use the data;
• Whether data may be used to train, fine-tune, evaluate, or improve AI models; or
• Whether customers can opt out of such uses.
• Important limitation: The diff does not add an express authorization to train AI models. However, removing the AI-provider disclosure reduces transparency, while the broad authorization to use and disclose Non-Personal Information “for any purpose” could arguably cover model development or training if the data is considered anonymized or de-identified.

3. Expanded international-transfer disclosure

• The policy now expressly states that information passing through the Services is stored and processed in the United States, regardless of where it originates or is sent.
• It warns that U.S. protections may be less comprehensive than those in the user’s home country.
• Risk: This creates clearer notice of cross-border transfer but may increase compliance concerns for customers subject to GDPR or other localization and transfer requirements.

4. Third-party processing clarified

• The policy identifies Gremlin as controller of information collected through the Services and describes third-party providers such as Salesforce and Google Analytics.
• Third-party sites and providers may process information under their own privacy policies, and Gremlin disclaims responsibility for linked sites.
• Risk: Customers receive less assurance that third parties provide equivalent privacy protections.

5. Rights and retention changes

• EEA rights are expanded or stated more explicitly, including access, correction, deletion, objection, restriction, portability, withdrawal of consent, and complaints to regulators.
• Retention is permitted while an account exists, as necessary for stated purposes, and for additional legal, tax, or regulatory periods.
• Gremlin reserves the right to retain information it considers necessary for legal obligations, disputes, or enforcement, which may limit deletion requests.

Key Changes and Risks

1. AI and model-training implications

• The revised policy adds functionality for connecting the Services to an AI assistant through MCP/tool calls. Responses to the customer’s calls are returned to the AI assistant provider selected by the customer, and that provider handles the interaction under its own privacy policy.
• The policy does not expressly state whether customer Information is used to train, fine-tune, evaluate, or improve AI models—either by Gremlin or by the selected AI-assistant provider.
• Because Information may be sent to the AI-assistant provider, customers may be subject to that provider’s separate retention, disclosure, and model-training practices. The revised language does not impose a clear contractual prohibition on training or require the provider to delete prompts, outputs, or tool-call data.
• The new permission to use Information to “analyze your usage” and improve Services is broad enough to create uncertainty about whether AI interactions, prompts, outputs, usage logs, or tool-call metadata could be used for product improvement or model development.
• Recommended clarification: expressly state whether customer data, prompts, outputs, and metadata may be used for AI training; identify the responsible parties; provide an opt-out or consent mechanism; and specify retention, deletion, confidentiality, and no-training commitments where applicable.

2. Broader permitted uses

• The former broad authorization to use and disclose “Non-Personal Information” for any purpose is retained in substantially similar form.
• The policy continues to treat anonymized, aggregated, or de-identified information as Non-Personal Information. However, it states that if such data is combined with Personal Information, it will be treated as Personal Information. This is helpful, but the policy does not explain the technical standard for irreversible de-identification or re-identification safeguards.
• New or expanded purposes include:
• analyzing usage and trends;
• improving content, navigation, functionality, and advertising;
• managing accounts, billing, security, fraud prevention, and abuse investigations;
• sending service, technical, administrative, and promotional communications.

3. Third-party sharing and AI providers

• The policy replaces some older, more specific third-party descriptions with broader language permitting disclosure to trusted providers for cloud hosting, backups, email, and other services.
• It adds disclosures for legal process, government authorities, protection of rights, prevention of wrongdoing, enforcement of the Terms, and corporate transactions.
• Customers bear increased responsibility for reviewing third-party privacy policies, particularly AI-assistant providers and analytics providers.

4. Retention and deletion

• Retention periods remain flexible and may extend while an account exists, while Services are used, or as necessary for legal, billing, account-management, security, and business purposes.
• The revised language does not provide a specific deletion period for AI prompts, outputs, tool calls, or model-related data.

5. International transfers and security

• U.S. storage and processing are reaffirmed, with a warning that U.S. protections may differ from those in the customer’s home country.
• Security language is modernized but remains generally descriptive rather than guaranteeing particular controls or outcomes.

Key Changes and Risks

AI and Model-Training Terms

• The prior language specifically addressed an AI assistant: responses to selected MCP tool calls were returned to the AI assistant provider and handled under that provider’s privacy policy.
• That AI-specific language appears to have been deleted and replaced with general security language. The revised text does not expressly state:
• whether customer prompts, tool calls, outputs, or other data are sent to an AI provider;
• whether an AI provider may retain or use that data;
• whether the data may be used to train, fine-tune, evaluate, or improve AI models; or
• whether customers can opt out of AI-related processing.
• This is a material ambiguity, not necessarily a prohibition on AI training. The revised privacy policy’s broad permissions to use and disclose “Non-Personal Information” could potentially cover anonymized, aggregated, or de-identified data for AI development or model improvement. The policy does not define the anonymization standard or explain whether re-identification is prohibited.
• Customers should seek a contractual statement addressing AI training directly, including a prohibition or opt-in requirement, limits on provider retention, deletion obligations, human review, and restrictions on use of customer confidential information.

Broader Use of Non-Personal Information

• “Non-Personal Information” is newly defined to include information that does not identify a specific natural person, including location, demographic, ZIP-code, anonymized, aggregated, or de-identified information.
• Gremlin may use and disclose this information for any purpose, notwithstanding other policy provisions, unless applicable law requires otherwise.
• If Non-Personal Information is combined with personal information, it will be treated and used as personal information. However, Gremlin reserves the right to retain information it considers necessary for legal, dispute-resolution, and contract-enforcement purposes.

Sharing and Service Providers

• The policy now identifies Gremlin as the controller of information collected through the Services and states that Services and certain provider-held data are hosted in the United States.
• Third-party providers, including Google Analytics and Salesforce, may process or host information under their own roles and policies. The revised language removes assurances that providers offer the same privacy protections as Gremlin and disclaims responsibility for linked third-party sites.
• The policy permits disclosures to contractors and service providers subject to confidentiality and comparable-protection obligations, but does not identify all providers or impose detailed data-use restrictions.

International Transfers and Rights

• U.S. storage and processing are expressly stated, with a warning that U.S. protections may be weaker than those in the customer’s home country.
• EEA residents receive expanded rights, including access, correction, deletion, objection, restriction, portability, consent withdrawal, and complaints to a supervisory authority.
• Retention is broadened to continue while the customer uses the Services or has an account, plus additional periods required for legal, tax, or regulatory purposes.

Overall Risk

The revision materially broadens Gremlin’s rights over de-identified data while removing transparency about AI-provider handling. The absence of an express AI-training rule creates significant uncertainty for confidential, regulated, or customer-submitted data.

Summary of Changes

1. Removal of cookie-category disclosures

The following text was deleted:

• Essential cookies — described as required for basic website functionality.
• Marketing cookies — described as providing more relevant content and a personalized experience.
• Analytics cookies — described as helping understand website performance, visitor behavior, and technical usability issues.

No replacement language appears in the diff.

2. Potential legal and privacy risks

• Reduced transparency: Removing the explanations may make it less clear to visitors what categories of cookies are used and why.
• Consent-compliance risk: Depending on the applicable law—such as the GDPR, UK GDPR, ePrivacy rules, or certain U.S. state privacy laws—the website may need to provide clear information about non-essential cookies before obtaining consent.
• Marketing and analytics ambiguity: Without the category descriptions, users may have difficulty distinguishing advertising/personalization cookies from analytics technologies.
• Weaker user-choice disclosures: If the deleted language was part of a cookie-consent interface, its removal could make consent less informed, particularly if the interface still enables marketing or analytics cookies.
• Documentation inconsistency: The change could create inconsistencies between the website interface, cookie policy, privacy notice, and any consent-management records.

3. Customer data and AI-model training

• No AI-training language is added, removed, or changed in the provided diff.
• The deleted text concerns cookie categories and website tracking purposes only. It does not expressly authorize or prohibit using customer data to train AI models.
• Any AI-training rights would need to be assessed in the applicable privacy policy, terms of service, data-processing agreement, or other product-specific terms.

Summary of Important Changes

1. Cookie-consent language added

The revised text adds a substantially more detailed cookie-consent notice. It now states that:

• Clicking “Accept” constitutes consent to the use of cookies.
• Users can view the Privacy Policy for further information.
• Users may choose “Reject” or adjust Preferences.
• Non-essential cookies can be disabled, although doing so may negatively affect the browsing experience.
• Users can save their preferences.

This is a material change because it creates a more explicit consent mechanism and documents user choices.

2. Cookie categories and purposes clarified

The revised notice identifies three cookie categories:

• Essential / Required: Necessary for basic website functionality.
• Marketing: Used to provide more relevant content and a more personalized experience.
• Analytics: Used to understand website performance, visitor behavior, and technical issues affecting usability.

The prior language referred more generally to analyzing traffic, serving personalized content, and improving the browsing experience. The new wording is more specific but also expressly links marketing cookies to personalization.

3. Potential compliance and consent risks

• The language that clicking “Accept” constitutes consent may be insufficient in jurisdictions requiring separate, affirmative consent for non-essential cookies, particularly where marketing and analytics cookies are enabled together.
• The notice should be checked to ensure that non-essential cookies are not activated before consent is given.
• The preference controls should work as described, including the ability to reject or disable marketing and analytics cookies.
• The notice references a Privacy Policy, but the diff does not show whether that policy adequately explains cookie providers, retention periods, tracking technologies, international transfers, or withdrawal of consent.
• Repeated or duplicated cookie-banner text appears in the revised content, which may indicate a website implementation or presentation issue.

4. AI training and customer data

The diff contains no express change addressing:

• Use of customer or visitor data to train AI models;
• Use of submitted content, prompts, telemetry, or account data for model development;
• Whether data is used to improve Gremlin’s products or third-party AI systems;
• Opt-out rights, anonymization, retention, or restrictions on AI training.

Accordingly, no new AI-training authorization or restriction can be identified from this diff. The Privacy Policy and any applicable customer agreement should be reviewed separately for such terms.

Summary of Important Changes

1. Expanded uses of customer information

The revised policy replaces a narrow reference to using Non-Personal Information with broader permission to use “your Information” for purposes including:

• Responding to requests and customer-service inquiries;
• Creating and administering online accounts;
• Developing and providing tools and features;
• Analyzing usage and user behavior;
• Improving navigation, content, functionality, and Services;
• Understanding users and managing the business;
• Security, fraud prevention, abuse investigation, and system administration;
• Advertising, communications, account management, billing, and technical support.

This is a material expansion because “your Information” appears broader than anonymized, aggregated, or de-identified data.

2. AI and model-training implications

The revision does not expressly state that customer information may be used to train, fine-tune, or improve artificial-intelligence or machine-learning models. However, several provisions create potential AI-related risk:

• The broad rights to analyze usage, understand users, improve Services, and use Non-Personal Information “for any purpose” could potentially be interpreted to permit AI development or model training, particularly where information is de-identified or aggregated.
• The policy adds functionality for connecting the Services to an AI assistant using MCP (Model Context Protocol) tool calls. Responses to calls are returned to the AI-assistant provider selected by the user, and that provider handles the information under its own privacy policy.
• The policy does not clearly state whether MCP prompts, tool calls, responses, account data, or other customer content are retained by the AI provider or used to train its models.
• There is no clear customer right to opt out of AI processing or model training, no stated prohibition on using customer content for training, and no retention or deletion commitment specific to AI data.

Customers should seek contractual clarification that customer content, prompts, outputs, and service data will not be used for AI training except with express authorization.

3. Broader disclosure and third-party sharing

The former statement that Personal Information was not sold or traded is replaced or supplemented with broader disclosures:

• Information may be shared with cloud hosting, backup, email, analytics, advertising, and other service providers.
• Information may be disclosed where Gremlin believes disclosure is legally necessary or appropriate.
• Information may be transferred or disclosed in a sale, merger, reorganization, or similar transaction.
• AI-assistant providers receive information generated through connected MCP tools and apply their own privacy policies.

The “necessary to perform these functions” limitation is helpful, but the overall third-party framework is broader and less specific than the prior language.

4. International transfers

The revised policy expressly states that information is stored and processed in the United States, including information passing through the Services, and warns that U.S. protections may differ from those in the customer’s home country.

5. Retention and customer rights

Retention is described more specifically for account administration, billing, legal obligations, and business purposes, but there remains no fixed deletion period. Rights language is reorganized and largely restored, including access, correction, deletion, objection, restriction, and portability, subject to legal exceptions. Withdrawal of consent does not affect prior processing or processing based on other legal grounds.

Overall risk

The revision substantially broadens permitted data uses and third-party disclosures. Its AI provisions are especially incomplete: they permit AI-assistant integrations without clearly addressing training, retention, confidentiality, or opt-out rights.

Summary

The provided diff does not include the actual added, deleted, or replaced legal language. It only states:

> “Added approximately 903 words to the document”

Accordingly, it is not possible to determine what substantive contractual changes were made or whether the customer’s data may be used to train AI models.

AI-Training and Data-Use Review

No conclusions can be drawn about whether the revised terms:

• Permit the provider to use customer data, prompts, outputs, or uploaded content to train, fine-tune, or improve AI models;
• Allow such use by default or only with customer consent;
• Apply training rights to personal data, confidential information, or customer content;
• Permit use of data in aggregated, anonymized, or de-identified form;
• Allow subcontractors, affiliates, or third-party AI providers to use the data;
• Retain data after termination for model training or product improvement;
• Provide an opt-out mechanism or require an enterprise-level written agreement;
• Limit use to delivering the services, security, abuse prevention, or support; or
• Address ownership, confidentiality, deletion, or regulatory obligations relating to training data.

Important Limitation

Because the operative contractual text is missing, no reliable assessment can be made of:

• New customer obligations or provider rights;
• Changes to liability, indemnity, confidentiality, or intellectual-property provisions;
• New data-retention or disclosure rights;
• Whether the changes are favorable or unfavorable to the customer; or
• Any conflict with existing data-processing or privacy terms.

Please provide the full marked-up text, including the words shown in braces, brackets, and replacement notation, to permit a substantive legal comparison.

Summary

The diff only states that approximately 199 words were removed; it does not identify the deleted language. As a result, the specific legal and commercial impact cannot be determined.

AI Training and Data Use

• There is insufficient information to determine whether the deleted text addressed:
• Use of customer data to train, fine-tune, or improve AI models;
• Whether customer data may be used for general or third-party model development;
• De-identification, aggregation, or anonymization requirements;
• Customer consent or opt-out rights;
• Restrictions on retaining prompts, outputs, or uploaded content;
• Human review or use of data for safety and quality purposes; or
• Ownership and permitted use of model inputs and outputs.

• If the deleted language previously restricted AI training or required customer consent, its removal could materially expand the provider’s rights to use customer data.

• If the deleted language previously authorized AI training, its removal could instead limit or eliminate those rights, potentially affecting the provider’s ability to improve its services.

Other Potential Risks

Because the deleted wording is unavailable, the removal may also affect:

• Confidentiality and data-security obligations;
• Data retention and deletion periods;
• Privacy-law compliance and processor/controller responsibilities;
• Intellectual-property ownership or license grants;
• Liability, indemnification, or warranty protections;
• Subcontractor or third-party access;
• Data transfer and regulatory provisions; or
• Termination and post-termination data handling.

Recommended Action

Obtain the actual deleted text and compare it with the current version before approving the change. Particular attention should be given to any deleted terms containing “train,” “training,” “improve,” “develop,” “machine learning,” “artificial intelligence,” “model,” “prompt,” “content,” “aggregate,” “de-identify,” “retain,” or “customer data.”

Summary

The provided diff states only:

> “[Removed approximately 45 words from the document]”

It does not identify the deleted language or show any replacement text.

AI Training and Customer Data

• No determination is possible regarding whether the deleted language addressed:
• Use of customer data to train, fine-tune, or evaluate AI models;
• Use of customer content, prompts, inputs, outputs, or metadata for machine learning;
• Whether customer data is used for service improvement or product development;
• Opt-out or consent rights;
• Ownership of AI-generated outputs;
• Confidentiality protections for data used in model training; or
• Data retention, deletion, anonymization, or third-party sharing.

• Because the deleted wording is unavailable, it is also impossible to determine whether the amendment:
• Expands the provider’s rights to use customer data;
• Restricts those rights;
• Removes a customer protection or opt-out mechanism; or
• Merely makes a non-substantive wording change.

Legal and Commercial Risk

The principal risk is uncertainty. A deletion of approximately 45 words could materially alter the parties’ rights and obligations, particularly if the removed language contained limitations on data use, confidentiality, privacy, or AI training.

Before accepting the amendment, obtain the actual deleted text and compare it with the surrounding provisions. Particular attention should be given to terms such as “customer data,” “content,” “inputs,” “outputs,” “improve,” “develop,” “train,” “machine learning,” “models,” “de-identified,” “aggregated,” “service improvement,” and “opt out.”

Conclusion

No reliable substantive change analysis can be performed from the information provided. The actual 45 deleted words—and the clause in which they appeared—are required to assess any new or increased risk, including risks concerning the use of customer data to train AI models.

Summary

Scope of the Diff

The provided diff states only:

> “Added approximately 876 words to the document”

It does not include the actual added, deleted, or replaced legal language. As a result, the substantive changes and associated legal risks cannot be evaluated.

Customer Data and AI Training

No language is provided addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether prompts, inputs, outputs, personal information, or confidential information are retained;
• Whether data is shared with model providers, affiliates, or other third parties;
• Whether customer data is used for service-specific models or generally available models;
• Whether customers can opt out of AI training or data retention;
• Whether de-identification, aggregation, or anonymization is required;
• Ownership or licensing rights in data, outputs, or model improvements; or
• Security, deletion, audit, or confidentiality protections for AI-related processing.

Accordingly, no conclusion can be reached about changes to AI training rights or risks.

Other Legal Risks

The added 876 words may affect important provisions such as:

• Data protection and privacy;
• Confidentiality;
• Intellectual property ownership and licenses;
• Liability and indemnification;
• Security obligations;
• Subcontracting and third-party disclosures;
• Data retention and deletion;
• Service warranties and disclaimers; or
• Termination rights.

However, the actual impact cannot be assessed without the text of the additions and any related deletions or replacements.

Information Needed

Please provide the full marked-up language using the stated notation:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

Once provided, the changes can be reviewed for legal significance, including any provisions permitting customer data to be used to train or improve AI models.

Key Changes and Risks

1. No express AI-training authorization

• The revised language does not expressly state that customer data may be used to train, fine-tune, evaluate, or improve AI or machine-learning models.
• It does add broad rights to use information to:
• Analyze usage;
• Improve services, navigation, content, functionality, and user understanding;
• Monitor usage and trends;
• Address errors and technical issues; and
• Conduct general business activities.
• These provisions could arguably support analytics or product-improvement activities involving automated tools, but they do not clearly authorize AI model training. They also do not address:
• Whether customer prompts, inputs, outputs, or uploaded content are training data;
• Whether data is shared with AI providers;
• Whether data is retained in model weights;
• Opt-out rights for AI training;
• Human review; or
• Customer ownership and confidentiality of AI-generated outputs.

Risk: The absence of a specific AI-training provision creates ambiguity and potential disputes, particularly if “improve our Services” is later interpreted to include training models on customer data. A separate, explicit AI-data-use clause is advisable.

2. Broader use of “Non-Personal Information”

The prior policy described anonymized, aggregated, or de-identified information and permitted broad disclosure. The revised language states that information that does not identify a specific natural person may be used and disclosed “for any purpose,” notwithstanding the Privacy Policy, unless otherwise required by law.

The revised text also permits combining non-personal information with personal information—such as a ZIP code with a name—and then treating the combined information as personal information.

Risks:

• “Non-personal” and “de-identified” information may be re-identifiable, especially when combined with other datasets.
• “Any purpose” is significantly broader than the prior stated business purposes.
• The clause could be relied on to support data analytics, commercial exploitation, or potentially AI development without a separate consent mechanism.

3. Expanded purposes for personal information

New or more detailed purposes include:

• Account administration and billing;
• Service delivery, maintenance, security, and fraud prevention;
• Customer support;
• Advertising and campaign improvement;
• Website contests, surveys, and promotions;
• Product and marketing communications;
• Usage, trend, and performance analysis; and
• General business management.

Marketing emails are now expressly described as optional, while service, technical, security, and account communications cannot be opted out of.

4. Broader sharing and disclosure

The revised policy permits sharing with trusted providers for hosting, backups, email, technical services, analytics, and other functions. It also adds disclosures for:

• Corporate sales, mergers, reorganizations, or similar transactions;
• Legal process and government requests;
• National security and law enforcement;
• Fraud, wrongdoing, or enforcement of the Terms of Service.

The policy states that third parties will provide at least the same level of privacy protection, but it does not provide detailed contractual, audit, deletion, or subprocessor controls.

5. International transfers

The policy continues to state that services and third-party providers may be hosted outside the EEA, including in the United States. It emphasizes that foreign privacy protections may differ from those in the user’s home country.

Risk: The language does not identify a specific transfer mechanism, such as Standard Contractual Clauses or an adequacy decision.

6. Retention and user rights

Retention is framed around continuing service use, account administration, legal obligations, billing, and other stated purposes, with additional retention permitted for legal, tax, or regulatory reasons.

EEA-related rights are preserved or expanded, including access, correction, deletion, objection, restriction, portability, and complaints to regulators. However, deletion and other rights remain subject to legal, dispute-resolution, and enforcement exceptions.

7. Security and tracking

The revised language refers to secure servers, SSL transmission, tracking technologies, fraud prevention, analytics, and cookie preference controls. It also permits access by authorized personnel and contractors with a business need.

Risk: The policy describes security measures generally but does not promise specific technical standards, breach notification procedures, or encryption at rest.

Key Changes and Risks

1. Expanded purposes for using customer information

The revised policy replaces a narrow statement permitting use of Non-Personal Information for any purpose with a much broader list of purposes for using “your Information,” including:

• Analyzing usage, trends, and user behavior.
• Improving website navigation, content, functionality, tools, and features.
• Understanding users and managing the business.
• Customer-service and account administration.
• Security, fraud prevention, abuse detection, and technical troubleshooting.
• Advertising, marketing, surveys, contests, and website administration.

Risk: “Your Information” is broader than anonymized or aggregated data and may include personal information, account information, usage data, and customer-service communications. The purposes are broadly worded and provide limited restrictions on how information may be reused.

2. AI-model training

The diff does not expressly state that customer data may be used to train, fine-tune, evaluate, or improve generative-AI or machine-learning models. It also does not expressly prohibit such use.

However, the new language allowing use of information to:

• “improve our Services,”
• analyze usage and trends,
• better understand users, and
• improve content and functionality

could arguably be interpreted to include AI or machine-learning development, depending on how the company operates those systems.

AI-related risk: Customers do not receive clear notice about:

• Whether prompts, inputs, outputs, logs, or support communications may be used for model training.
• Whether data is used to train company-owned models or third-party models.
• Whether customer data is aggregated, de-identified, or retained in training datasets.
• Whether customers can opt out of AI training.
• Whether trained models or derived insights are deleted when data is deleted.
• Whether confidential or proprietary customer information is excluded.

A separate, explicit AI-data-use provision would be preferable.

3. Broader disclosure and third-party access

The prior broad “disclose for any purpose” language is removed, but the replacement authorizes sharing with trusted providers for hosting, backups, email, analytics, advertising, and other services. Information may also be disclosed for legal, governmental, security, fraud-prevention, or corporate-transaction purposes.

The policy now states that information may be transferred, sold, or disclosed in a merger, sale, reorganization, or similar transaction.

Risk: Customer data may be accessible to more vendors and successors, including analytics and advertising providers. The policy does not identify specific AI vendors or impose detailed restrictions on secondary use.

4. International transfers

The policy continues to state that services and third-party providers may operate in the United States and outside the EEA, with potentially weaker privacy protections than the customer’s home country.

5. Retention and deletion

Retention is reframed around account administration, billing, legal obligations, and business purposes. The company may retain information for additional legally required periods.

Risk: There is no specific retention period for usage data, analytics data, or any data potentially incorporated into AI models.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 876 words to the document”

Accordingly, it is not possible to identify:

• New or deleted legal rights and obligations
• Changes to liability, indemnification, confidentiality, termination, or governing law
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data may be shared with vendors or other third parties
• Data-retention, deletion, security, or anonymization requirements
• Whether the customer has an opt-out or approval right
• Whether the provider may use prompts, outputs, metadata, or derived information for model development

AI Training and Data-Use Risk

No conclusions can be drawn about AI-model training from the information supplied. The statement that approximately 876 words were added does not reveal whether the additions:

• Permit use of customer content for training or improving artificial-intelligence models
• Restrict training to de-identified, aggregated, or non-sensitive data
• Allow use of customer data by affiliates, subprocessors, or third-party model providers
• Grant the provider ownership or broad licenses over customer inputs or outputs
• Make customer data available for human review or quality assurance
• Apply different rules to consumer-facing, enterprise, or confidential data
• Preserve the customer’s ability to opt out or require deletion

Information Needed

Please provide the full marked-up text, including:

1. Additions shown in {braces};

2. Deletions shown in [brackets]; and

3. Replacements shown as [deleted text]{new text}.

Without the actual wording, a legal-risk analysis would be speculative and could miss material changes.

Summary of Important Changes

1. Expanded permitted uses of customer information

The revised policy adds numerous purposes for collecting and using information, including:

• Responding to customer requests and support inquiries.
• Creating and administering online accounts.
• Developing and providing tools and features.
• Analyzing usage, trends, and user behavior.
• Improving website navigation, content, functionality, customer service, and the Services generally.
• System administration, security, fraud prevention, abuse prevention, and investigation of technical issues.
• General business administration, billing, account management, communications, recruitment, contests, surveys, and advertising improvement.

Risk: The permitted-use language is substantially broader and more operationally detailed. Some purposes—particularly analytics, advertising optimization, trend analysis, and general business purposes—could support profiling or secondary uses beyond merely providing the Services.

2. Broader treatment of “Non-Personal Information”

The previous language focused on information that did not identify a specific natural person and described examples such as location, demographics, ZIP codes, and anonymized or aggregated information. The revised policy states that Non-Personal Information may be used and disclosed “for any purpose,” notwithstanding anything else in the policy, unless applicable law requires otherwise.

The policy also states that information may become personal information if combined with identifying data, such as combining a ZIP code with a name.

Risk: The “any purpose” authorization is very broad and may permit commercialization, analytics, sharing, or other secondary uses. The policy does not clearly explain the technical standards used to determine when information is sufficiently anonymized or de-identified.

3. No express authorization to train AI models

The diff does not expressly add language allowing customer information, prompts, outputs, account data, or other customer content to be used to train, fine-tune, or improve artificial-intelligence or machine-learning models.

However, the new permissions to:

• analyze usage and trends;
• improve Services, content, and functionality;
• develop tools and features; and
• use Non-Personal Information for any purpose

could potentially be interpreted as allowing use of de-identified or aggregated data for model development, depending on the definitions elsewhere in the policy and the actual data practices.

The appearance of “AI-driven development” in website/footer content is marketing language, not an express data-training provision.

Recommended clarification: Add a direct statement specifying whether customer data, prompts, outputs, telemetry, or de-identified data may be used for AI training, whether third-party model providers receive it, whether customers can opt out, and how deletion requests affect retained training data.

4. Expanded sharing and disclosure provisions

The revised policy identifies cloud hosting, backups, email providers, analytics providers, Salesforce, Google Analytics, and other service providers. It also permits disclosure for corporate transactions, legal demands, law enforcement, security, fraud prevention, and enforcement of the Terms of Service.

The policy now states that personal information may be transferred, sold, or disclosed as part of a merger, reorganization, dissolution, or similar transaction.

5. International transfers and retention

The revision more clearly states that data may be hosted or processed outside the EEA, including in the United States, where protections may differ from the customer’s home country.

Retention language changes from a general “as long as necessary” standard to retention for account administration, billing, legal, regulatory, and other stated purposes, including additional retention where legally required.

6. Customer rights and marketing

The revised language provides or reiterates rights to access, correct, delete, restrict, object to processing, and request portability, subject to legal exceptions. Marketing opt-out rights remain available, while operational and administrative communications may not be optional.

Summary

The provided diff states only:

> “Added approximately 876 words to the document”

It does not include the actual added language, deleted language, or replacement text. As a result, the substantive legal changes cannot be analyzed.

Customer Data and AI Training

There is insufficient information to determine whether the added terms:

• Permit the customer’s data to be used to train, fine-tune, or improve AI models;
• Allow use of customer data for product development, analytics, benchmarking, or service improvement;
• Permit retention of customer data after termination;
• Allow use of de-identified, aggregated, or pseudonymized data;
• Give the provider rights to use inputs, outputs, prompts, files, or personal information;
• Restrict the provider from using customer data to train general-purpose or third-party models; or
• Create obligations concerning confidentiality, security, data protection, or deletion.

Potential Risks to Review

The missing text should be reviewed for provisions that:

1. Expand the provider’s license to customer data beyond delivering the services.

2. Authorize model training or improvement using customer content by default, without a clear opt-out.

3. Permit broad de-identification or aggregation, particularly if the resulting data may still reveal confidential information.

4. Allow disclosure to affiliates, contractors, or AI subprocessors without adequate confidentiality and security obligations.

5. Retain data indefinitely or use it after termination.

6. Override existing data-protection terms or conflict with confidentiality, ownership, or regulatory requirements.

7. Make the customer responsible for obtaining consent for all data submitted to AI systems.

Conclusion

No reliable assessment of the legal impact can be made from the information provided. The full redline or the approximately 876 added words are required, especially any provisions addressing data rights, content use, model training, service improvement, retention, subprocessors, or confidentiality.

Summary

The provided diff does not include the actual contractual language that was added, deleted, or replaced. It only states:

> “Added approximately 876 words to the document”

Accordingly, it is not possible to determine:

• What contractual rights or obligations changed;
• Whether liability, confidentiality, indemnity, termination, or data-processing provisions were modified;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is subject to consent, opt-out rights, anonymization, aggregation, or other restrictions; or
• Whether the customer’s data may be shared with affiliates, vendors, or third-party AI providers.

AI-Training Review

No specific language concerning AI models or training is included in the diff. The available information therefore does not establish whether:

• Customer data may be used for model training or product improvement;
• Customer prompts, inputs, outputs, or usage data are retained;
• Data is used to train models for other customers or the provider generally;
• The provider claims ownership or broad licenses over customer data or outputs;
• Customer data is anonymized, de-identified, aggregated, or otherwise protected;
• The customer can opt out of AI training or request deletion; or
• Human reviewers or third-party service providers may access the data.

Risk Assessment

No substantive legal risks can be reliably identified from the information provided. The added 876 words could contain material changes, but the actual wording is necessary to assess their effect.

Please provide the full diff, including the text within the addition, deletion, and replacement markers.

Summary

Scope of the Change

• The diff indicates that approximately 759 words were removed from the document.
• No text showing the deleted provisions or the surviving document is provided.
• Because the actual language is unavailable, the legal and commercial effect of the deletions cannot be determined reliably.

Potential Legal Significance

Deleting contractual language may:

• Remove customer protections, warranties, limitations, or compliance obligations.
• Eliminate restrictions on the provider’s use or disclosure of information.
• Change ownership, licensing, confidentiality, security, or data-retention rights.
• Create ambiguity if related provisions remain elsewhere in the agreement.
• Shift risk to the customer if indemnities, liability limits, audit rights, or termination rights were removed.

AI Training and Customer Data

• The provided diff contains no identifiable language concerning AI, machine learning, model training, prompts, outputs, or customer data.
• It is therefore not possible to determine whether the revisions:
• Permit or prohibit using customer data to train or improve AI models;
• Limit training to de-identified, aggregated, or non-personal data;
• Require customer consent or provide an opt-out;
• Allow human review of customer inputs or outputs;
• Permit retention of data for training after termination; or
• Address ownership and use of AI-generated outputs.

Recommended Review

To complete the analysis, provide either:

1. The full redline showing the deleted and remaining language; or

2. The approximately 759 deleted words, together with the surrounding provisions.

Particular attention should be given to deleted sections titled Data Use, Privacy, Confidentiality, Security, Artificial Intelligence, Machine Learning, Service Improvement, License, Intellectual Property, Retention, or Termination.

Summary

The supplied diff does not include the actual contractual language. It only states:

> “Added approximately 757 words to the document”

Accordingly, it is not possible to identify:

• Changes to the customer’s rights or obligations;
• New data collection, processing, sharing, retention, or security terms;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use requires consent or allows an opt-out;
• Ownership or licensing rights in customer data, outputs, prompts, or derived data;
• New liability limitations, indemnities, warranties, or compliance obligations; or
• Any material changes to termination, confidentiality, or audit rights.

AI Training/Data-Use Risk

No conclusion can be drawn about AI-model training from the information provided. The added 757 words could contain significant permissions for the provider to use customer data, including for model training or service improvement, but the relevant wording is not present.

The full redlined text—using {additions}, [deletions], and []{replacements}—is required for a meaningful legal-risk analysis.

Summary

The diff only states that approximately 754 words were removed; it does not identify which clauses or language were deleted.

AI Training and Data Use

• It is not possible to determine whether the changes:
• Permit or restrict using customer data to train, fine-tune, or improve AI models;
• Remove consent requirements or opt-out rights;
• Expand the definition of “customer data” or “content” that may be used for training;
• Allow use of data in aggregated, de-identified, or anonymized form;
• Permit human review or access to data for model development;
• Change retention, deletion, or isolation requirements for training data; or
• Affect ownership of customer inputs, outputs, or model improvements.

Potential Legal and Commercial Risks

Because the deleted language is unavailable, the deletion could have removed important protections, including:

• Confidentiality and data-security obligations;
• Restrictions on secondary use of customer data;
• Data-processing, privacy, or regulatory compliance terms;
• Customer indemnities or provider liability limits;
• Audit, deletion, or data-return rights;
• Intellectual-property ownership provisions; or
• Specific limitations on using data to train AI systems.

A deletion could either reduce the provider’s rights—for example, by removing a training license—or reduce the customer’s protections—for example, by removing an express prohibition on AI training.

Required Information

A reliable legal analysis requires:

1. The actual deleted text;

2. Any replacement language, if applicable;

3. The surrounding provisions and defined terms; and

4. The prior and revised versions of the relevant section.

Conclusion: No definitive change to AI-training rights or customer-data use can be identified from the supplied diff alone. The deletion should be treated as potentially material until the missing text is reviewed.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 754 words to the document”

Accordingly, it is not possible to determine:

• Which contractual provisions changed;
• Whether new obligations, limitations of liability, fees, warranties, or termination rights were added;
• Whether customer data may be collected, retained, disclosed, or shared differently;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether the customer can opt out of AI training or model-improvement activities;
• Whether data is anonymized, aggregated, de-identified, or otherwise protected before such use;
• Whether customer prompts, outputs, personal information, confidential information, or uploaded files are included in any permitted training data;
• Whether the provider may use data for its affiliates, contractors, or third-party AI providers; or
• Whether the provider makes any commitment to delete data or stop using it after termination.

Information Needed

Please provide the full redline using the stated notation:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

The analysis should particularly focus on provisions containing terms such as:

• “train,” “training,” “fine-tune,” “machine learning,” “AI,” or “モデル improvement”;
• “improve,” “develop,” or “enhance” services;
• “customer data,” “content,” “inputs,” “outputs,” or “usage data”;
• “aggregate,” “anonymize,” or “de-identify”;
• “retain,” “store,” “delete,” or “subprocessors”; and
• “opt out,” “consent,” or “license.”

Without the actual added language, no reliable legal risk assessment can be made.

Executive Summary

The revised privacy policy materially broadens Gremlin’s rights to use and disclose information classified as “Non-Personal Information,” while adding more detail about international transfers, data processors, retention, data-subject rights, and security. The draft also appears to contain substantial duplicated and poorly integrated text, which may create interpretation and compliance risks.

AI-Training Implications

• No express AI-training language was added. The revision does not specifically state that customer data will—or will not—be used to train, fine-tune, evaluate, or improve artificial-intelligence or machine-learning models.
• Broad “any purpose” permission: Gremlin may use and disclose Non-Personal Information “for any purpose,” notwithstanding other provisions of the policy, except where applicable law requires otherwise. This wording could arguably cover:
• training or improving AI models;
• creating datasets, analytics, or derived products; and
• sharing data with AI vendors or other service providers.
• Expanded Non-Personal Information definition: Examples now include information that has been anonymized, aggregated, or de-identified, in addition to location and demographic information. The policy does not explain the anonymization or de-identification standard, leaving uncertainty about re-identification risk.
• Re-identification/combination rule: If Non-Personal Information is combined with personal information, it will be treated as personal information and used and disclosed under the policy. This provides some protection, but does not expressly prohibit using combined or derived data for AI development.
• Customer-content gap: The policy does not clearly distinguish ordinary website information from customer-submitted Service data, logs, prompts, outputs, telemetry, or confidential business information. A separate contractual restriction should be considered if customers expect their data to be excluded from AI training.

Other Important Changes and Risks

Broader data use and sharing

• The former specific purposes—such as responding to requests, administering accounts, improving services, and security—are replaced or supplemented by broader permissions.
• Sharing language now refers generally to third parties, processors, advertising partners, Google Analytics, Salesforce, hosting providers, contractors, and corporate transactions.
• The policy states Gremlin does not sell or trade Personal Information, but broad disclosure rights remain.

International transfers

• Data is expressly hosted or processed in the United States and potentially outside the EEA.
• The policy warns that U.S. protections may be weaker than those in the user’s home country. It does not identify a specific transfer mechanism, such as standard contractual clauses.

Retention and rights

• Retention may continue while the user has an account, as necessary for stated purposes, or longer for legal, tax, and regulatory reasons.
• EEA rights are expanded or clarified, including access, deletion, objection, restriction, portability, consent withdrawal, and complaints to regulators.
• Gremlin reserves the right to retain archived information needed for legal obligations, disputes, or agreement enforcement.

Drafting/compliance concern

• The diff contains extensive duplicated text and apparent formatting errors. The final policy should be consolidated and reviewed before publication to avoid ambiguity and inconsistent obligations.

Summary

The supplied diff does not include the text of the approximately 754 added words. It only states that words were added, so the legal changes and risks cannot be reliably analyzed.

AI Training and Customer Data

• No language is provided showing whether the customer’s data may be:
• Used to train, fine-tune, or improve AI models;
• Used to develop products or services;
• Shared with affiliates, vendors, or model providers;
• Retained after termination;
• De-identified or aggregated before use; or
• Excluded from model training by default or only upon opt-out.
• Accordingly, it is not possible to determine whether the new terms expand the provider’s rights to use customer data or create new confidentiality, privacy, intellectual-property, or regulatory risks.

Other Legal Risks

The missing text also prevents analysis of possible changes concerning:

• Ownership and licensing of customer data and outputs;
• Confidentiality obligations;
• Data security and breach responsibilities;
• Subprocessors and international data transfers;
• Data retention and deletion;
• Warranties, indemnities, and liability limits;
• Suspension or termination rights; and
• Governing law and dispute resolution.

Needed Information

Please provide the actual redlined language, including the additions and any surrounding provisions. Without the added text and the corresponding context, no substantive comparison or risk assessment can be made.

Summary of Available Change

Scope of the Diff

The diff only states:

> “[Removed approximately 751 words from the document]”

It does not identify which provisions were deleted or provide the replacement language. As a result, the legal and commercial impact cannot be reliably determined.

AI Training and Customer Data

• No specific information is provided about whether the deleted language addressed:
• Use of customer data to train, fine-tune, or improve AI models;
• Use of customer prompts, inputs, outputs, or usage data for model development;
• Whether training use was permitted by default or required customer consent;
• Whether data was anonymized, aggregated, or de-identified;
• Whether customers could opt out;
• Ownership or licensing rights in data, inputs, or outputs;
• Retention, deletion, or segregation of customer data; or
• Disclosure of data to subprocessors or third-party model providers.
• Accordingly, it is not possible to determine whether the deletion narrows or expands the provider’s rights to use customer data for AI training.

Potential Risks of an Unspecified Deletion

Depending on the deleted provisions, removing approximately 751 words could potentially:

• Eliminate customer protections, restrictions, or consent requirements;
• Remove confidentiality, data-security, retention, or deletion obligations;
• Remove limitations on use of customer data for advertising, analytics, or AI training;
• Remove warranties, indemnities, audit rights, or remedies;
• Alter intellectual-property ownership or licensing terms;
• Remove compliance commitments relating to privacy or data-protection laws; or
• Create ambiguity if related provisions still refer to deleted definitions or obligations.

Conversely, the deletion could benefit the customer if it removed broad provider rights or unfavorable disclaimers. The direction of the change cannot be established from the available information.

Information Needed for a Reliable Analysis

Please provide either:

1. The full before-and-after contract language; or

2. The specific deleted and replacement text, particularly provisions concerning:

• Customer data;
• Machine learning or AI;
• Confidentiality;
• Intellectual property;
• Privacy and security; and
• Data retention and deletion.

Without the actual text, no definitive legal-risk assessment or conclusion about AI-model training rights is possible.

Summary

The provided diff states only:

> “Added approximately 751 words to the document”

No actual added, deleted, or replacement contract language is included. As a result, it is not possible to determine:

• What legal terms changed;
• Whether the customer’s rights or obligations changed;
• Whether liability, confidentiality, security, or termination provisions were modified;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, service providers, or third parties;
• Whether the customer can opt out of AI training or revoke consent;
• Whether customer prompts, outputs, personal information, or usage data are covered;
• Whether the provider obtains rights to retain, anonymize, aggregate, or commercialize customer data; or
• Whether new indemnity, compliance, audit, or data-deletion risks were introduced.

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training because the substantive language describing data use is missing. The fact that approximately 751 words were added does not itself establish whether the additions are favorable, unfavorable, or material.

Information Needed

Please provide the actual diff, including:

• Added text in {curly braces};
• Deleted text in [square brackets]; and
• Replacements in the stated []{} format.

The relevant sections should include provisions concerning customer data, content, prompts, inputs, outputs, usage data, model training, artificial intelligence, machine learning, service improvement, confidentiality, retention, deletion, and third-party providers.

Summary

The provided diff only states: “Removed approximately 751 words from the document.” It does not identify which provisions were deleted or provide replacement language.

AI Training and Customer Data

• It is not possible to determine whether the changes affect:
• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether customer prompts, inputs, outputs, files, or usage data are retained;
• Whether data may be shared with affiliates, vendors, or other third parties for AI development;
• Whether the customer can opt out of AI training or request deletion;
• Whether de-identified, aggregated, or derived data may be used;
• Ownership or licensing rights in customer data, outputs, or trained models; or
• Security, confidentiality, or notice obligations relating to AI processing.

Potential Legal Significance

Deleting approximately 751 words could materially change the agreement, particularly if the removed text contained:

• Restrictions on using customer data for model training;
• Confidentiality or data-protection commitments;
• Customer consent, opt-out, or deletion rights;
• Limitations on provider licenses to customer content;
• Disclaimers or liability allocations concerning AI-generated outputs; or
• Disclosure, audit, or compliance obligations.

However, the direction and effect of the change cannot be reliably assessed from the information provided. The deletion could either reduce the provider’s rights—for example, by removing a broad data-use authorization—or reduce customer protections—for example, by removing an express training opt-out or confidentiality restriction.

Information Needed

To perform a substantive legal analysis, please provide:

1. The full before-and-after text; or

2. The actual redline showing the deleted and added language; and

3. Any surrounding headings or section numbers, especially provisions concerning data use, artificial intelligence, confidentiality, privacy, security, or intellectual property.

No specific conclusion about AI-training rights or customer-data risks can be reached from the current diff alone.

Key Changes and Legal Risks

1. Expanded and more detailed permitted uses

The revised policy replaces a broad statement allowing use of non-personal information for “any purpose” with a longer list of purposes, including:

• Responding to requests and administering online accounts.
• Developing, maintaining, and improving services, navigation, content, and functionality.
• Analyzing usage, trends, and user behavior.
• Security, fraud prevention, abuse detection, and technical troubleshooting.
• Customer support, business administration, advertising campaigns, surveys, contests, and communications.
• Billing, account administration, and legal or regulatory compliance.

Risk: Although the purposes are more specific, the policy still states that non-personal information may be used and disclosed “for any purpose,” notwithstanding the policy, unless applicable law requires otherwise. This substantially preserves broad discretion and may undermine the apparent limitation created by the more detailed list.

2. AI model training

The diff contains no express reference to artificial intelligence, machine learning, foundation models, model training, model fine-tuning, prompts, outputs, or using customer data to train AI systems.

However, the new permissions to:

• “analyze your usage,”
• “better understand our users,”
• “improve our Services,” and
• use or disclose non-personal information “for any purpose”

could potentially be argued to cover analytics or development of AI-enabled features, particularly where information is anonymized, aggregated, or de-identified.

Risk: The policy does not clearly state whether customer content, account data, prompts, usage data, or service outputs may be used for AI training. It also does not provide an AI-specific opt-out, deletion mechanism for training data, restriction on human review, or commitment that customer data will not be used to train models. Customers seeking certainty should request an express contractual restriction.

3. Broader third-party sharing

The revised language authorizes sharing with trusted providers performing hosting, backups, email, technical, cloud, and other service functions. It also permits disclosure in connection with corporate sales, mergers, legal demands, law enforcement, security, and enforcement of the Terms of Service.

Risk: The policy does not identify all providers, impose detailed processing instructions, or clearly address whether third parties may independently use data for analytics or AI development.

4. Retention and deletion

Retention is reframed around continued service use, account status, billing, legal obligations, and fulfillment of stated purposes. Non-personal information may be retained and used broadly.

Risk: There is no firm deletion deadline, and de-identified or aggregated information may remain indefinitely. Combining supposedly non-personal information with personal information causes it to be treated as personal information, but the standard for effective de-identification is not defined.

5. International transfers and reduced commitments

The revised text states that data may be hosted or processed outside the EEA, including in the United States, and that foreign protections may differ from those in the user’s home country.

Risk: The wording provides limited detail regarding transfer mechanisms, safeguards, or government-access protections.

6. Marketing and communications

Marketing messages may be sent but may be unsubscribed from. Service, technical, security, fraud, and account communications are generally non-optional.

Overall assessment: The revision adds transparency and operational detail but retains broad rights to use, retain, disclose, and transfer data. The absence of an explicit AI-training provision creates significant ambiguity rather than a clear prohibition.

Summary

The supplied diff only states: “Removed approximately 739 words from the document.” It does not identify which clauses were deleted or provide the replacement text.

Key implications

• Unable to determine substantive changes: The deleted language could concern data rights, confidentiality, liability, security, intellectual property, termination, governing law, or other important terms.
• Potential AI-training changes cannot be assessed: The diff does not show whether provisions were added, removed, or modified regarding:
• Use of customer data to train, fine-tune, evaluate, or improve AI models;
• Whether customer data, prompts, outputs, or usage data may be used for those purposes;
• Whether training is permitted by default or only with customer consent;
• Opt-out or deletion rights;
• Use of data for model safety, analytics, or service improvement;
• Human review or access to customer data;
• Restrictions on using confidential or personal information;
• Ownership of model improvements or derived data; or
• Retention and deletion of training data.

Risk assessment

The removal of approximately 739 words may materially alter the agreement, but the direction and severity of the risk cannot be determined without the actual deleted and replacement language. If the deleted provisions limited the provider’s use of customer data, their removal could expand the provider’s rights to use that data—including for AI training—or eliminate customer protections. Conversely, the deletion could remove broad provider rights or improve customer protections.

Information needed

Please provide the actual redlined text, including:

1. The words or clauses marked as deleted;

2. Any replacement or newly added language; and

3. The surrounding section headings or clauses.

Without that text, no reliable legal comparison or conclusion about AI-training rights is possible.

Summary of Important Changes

1. Expanded and More Specific Uses of Information

The revised policy replaces a broad statement allowing use and disclosure of Non-Personal Information “for any purpose” with a detailed list of permitted purposes, including:

• Responding to requests and customer-service inquiries.
• Creating and administering online accounts.
• Developing tools and features.
• Analyzing usage and improving website navigation, content, functionality, and services.
• System administration, security, fraud prevention, abuse prevention, and technical support.
• Business administration, billing, account management, advertising, recruitment, surveys, contests, and communications.

Although the list is more transparent, it is still broad and permits use of customer information for analytics, service improvement, advertising optimization, trend analysis, and general business purposes.

2. AI Training / Machine Learning

No express reference to training AI models, machine learning models, generative AI, foundation models, or using customer content as training data appears in the revised language.

However, the new permission to use information to:

• “analyze your usage,”
• “better understand our users,”
• improve services and functionality, and
• analyze trends,

could potentially support analytics or model development unless other provisions restrict that use. The policy does not state:

• Whether customer-submitted content or service data may be used to train AI models.
• Whether data is anonymized before model training.
• Whether prompts, outputs, logs, or account data are retained for AI purposes.
• Whether customers can opt out of AI training.
• Whether third-party AI providers receive customer data.
• Whether trained models will be treated as derived from customer data.

Risk: The absence of an explicit AI-training restriction leaves uncertainty and may permit arguments for secondary use of data for model development under the broad service-improvement language.

3. Sharing and Third-Party Providers

The revision adds clearer categories of third-party recipients, including cloud hosting, backups, email providers, analytics providers, and other service providers. It states sharing will be limited to what is necessary for those functions and subject to the policy and applicable law.

It also adds disclosure rights for:

• Corporate sales, mergers, reorganizations, or similar transactions.
• Legal process, government requests, national security, and law enforcement.
• Protecting rights, property, users, customers, and enforcing the Terms of Service.

The “do not sell or trade” statement is retained, but transfer or disclosure during a corporate transaction is expressly permitted.

4. International Transfers

The revised text more directly states that services and third-party business systems may be hosted outside the EEA, including in the United States. It warns that foreign privacy protections may differ from those in the customer’s home country.

5. Retention and Customer Rights

Retention is described as lasting while the customer uses the Services or has an account, and as necessary for legal, regulatory, billing, administrative, and dispute-related purposes.

The revised policy preserves rights to access, correction, deletion, restriction, portability, objection, and complaints, subject to applicable law. It also clarifies that withdrawal of consent does not affect prior processing or processing based on other lawful grounds.

6. Drafting Risk

The diff is highly repetitive and appears to splice together substantial sections of the policy. The final consolidated text should be checked carefully for inconsistencies, duplicated provisions, and unintended omissions—particularly concerning AI use, data retention, security commitments, and third-party processing.