Litmus

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 2807 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions were added or changed.
• Whether the changes expand the provider’s rights to use customer data.
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• Whether data may be shared with affiliates, vendors, or third-party model providers.
• Whether the customer can opt out of AI training or revoke consent.
• What confidentiality, security, retention, deletion, or anonymization protections apply.
• Whether the provider obtains rights to use prompts, outputs, usage data, or uploaded content.
• Whether new indemnities, liability exclusions, audit rights, or regulatory obligations were added.

Information Needed

Please provide the full redline or the actual added, deleted, and replacement language using the stated notation:

• Additions: {new text}
• Deletions: [deleted text]
• Replacements: [old text]{new text}

The AI-data provisions should be reviewed particularly closely for language referring to:

• “train,” “fine-tune,” “develop,” “improve,” or “enhance” models;
• customer content, inputs, outputs, prompts, or usage data;
• de-identification, aggregation, or anonymization;
• service providers, affiliates, or third-party AI providers;
• opt-out rights or enterprise controls;
• retention and deletion;
• ownership and licensing rights; and
• confidentiality and security obligations.

Structured Summary of Important Changes

1. Major restructuring and expanded privacy disclosures

The revision replaces the prior short description of data use with a substantially expanded privacy policy. It adds detailed sections on:

• Data sharing and service providers
• Security and international data transfers
• User rights and account deletion
• Cookies
• Data retention
• Children’s privacy
• Data Privacy Framework compliance
• Policy changes and contact procedures

The revised language is generally more comprehensive, but it also creates additional permissions and obligations that customers should review carefully.

2. Use and sharing of customer data

The revised policy permits sharing personal data with:

• Service providers, including payment processors, hosting providers, web-chat providers, email providers, and analytics vendors
• An organization associated with the user’s email address, such as an employer
• Billing contacts
• Affiliates and third-party services involved in transactions
• Buyers or successors in a merger, sale, bankruptcy, or other change of control
• Authorities or other parties where Litmus believes disclosure is legally necessary
• Fraud-prevention and credit-risk organizations

Although service providers are stated not to have rights to use data beyond providing services, the policy permits broad disclosures and contains limited detail regarding specific data categories, retention periods, or vendor controls.

3. Customer content, profiles, and public disclosure

The policy states that profile information and uploaded email, video, image, or other content may be displayed to other users to facilitate interaction, provide examples, or respond to service requests. Content voluntarily posted in public areas may become publicly available and usable by others.

Customers should confirm that account settings and product terms adequately restrict disclosure of confidential business content.

4. AI-model training

No express provision authorizes Litmus to use customer data, email submissions, or other customer content to train artificial-intelligence or machine-learning models. Likewise, the revision does not expressly prohibit such use.

The policy does permit:

• Internal analytics and business-related purposes
• Use of aggregate or de-identified data
• Sharing with analytics and other service providers
• Use of data to improve services and understand usage

These provisions could create ambiguity if AI training is later characterized as analytics, service improvement, or use of de-identified information. Customers seeking protection should obtain a contractual statement that customer content and service data will not be used to train generalized AI models, except with express written consent.

5. Retention and deletion

Retention changes from purposes such as market research and developing features to retaining data while an account exists, or as needed for legal obligations, disputes, or enforcement. Deletion does not necessarily remove:

• Information in backup or business records
• Aggregated or de-identified data
• Information required for legal or operational purposes

6. Other material risks

• The policy can be changed unilaterally; continued use after 10 days constitutes acceptance.
• Data is hosted or processed in the United States and other countries.
• Litmus disclaims any guarantee of complete security.
• Users may lose access to account data after cancellation.
• The under-13 prohibition is expanded to Email Analytics data, unless authorized by a parent.
• DPF, GDPR, CCPA/CPRA, and other rights procedures are added, but practical rights may depend on applicable law and separate forms or policies.

Summary of Important Changes and Risks

1. Expanded purposes for using customer information

The revised policy replaces a relatively limited description of use with substantially broader purposes, including:

• Creating and administering user accounts;
• Providing customer support and troubleshooting;
• Delivering and monitoring the Services;
• Statistical analysis of visitor and User behavior and trends;
• Understanding how the Services are used;
• Improving the Services;
• Conducting market research;
• Developing new features and functionalities;
• Enforcing the Terms of Service and subscription agreement;
• Preventing fraud and illegal, abusive, or undesirable activity;
• Sending transactional communications; and
• Maintaining system and account security.

Risk: The purposes are broader and more operationally detailed. “Improve our Services,” “develop new features,” “market research,” and behavioral analysis could support extensive secondary use of customer information. The policy does not clearly define what information is included, whether it is aggregated or identifiable, or how long such analyses are retained.

2. AI-model training

The diff contains no express reference to artificial intelligence, machine learning, model training, model fine-tuning, prompts, or generative AI.

However, the new language authorizes analysis of “visitor and User behavior and trends” and use of information to “improve our Services” and “develop new features and functionalities.” Depending on how Litmus interprets these terms, they could potentially be relied on to analyze data for AI-related development.

Important ambiguity/risk: The policy does not state:

• Whether customer content, Email Submissions, analytics data, or account information may be used to train AI models;
• Whether data is de-identified before such use;
• Whether third-party AI providers receive the data;
• Whether customer data is used to train shared or product-specific models;
• Whether customers can opt out; or
• Whether trained models or derived data are deleted after account termination.

Customers should seek a specific contractual statement confirming that their data and content will not be used for AI training unless expressly authorized.

3. Broader disclosure and service-provider provisions

The revised policy adds categories of service providers, including payment processors, hosting providers, web-chat providers, email providers, and web-traffic analytics tools. It permits sharing where necessary for Litmus’s general business operations and service delivery.

New language states that providers may not use shared personal data beyond what is necessary to assist Litmus, and that contractual and technical protections will be implemented.

Risk: The provider categories remain broad, and the policy does not identify individual providers, processing locations, retention periods, or audit rights. “General business operations” may permit wider disclosure than a narrowly defined service-provider role.

4. New disclosure scenarios

The revised text adds or clarifies disclosure to:

• Organizations controlling an employee’s account;
• Billing contacts;
• Other Users through profiles and public submissions;
• Affiliates and third-party services;
• Purchasers or successors in a business transfer;
• Authorities responding to legal requests; and
• Organizations involved in fraud protection or credit-risk reduction.

Risk: Public profile information and uploaded content may become publicly available, while organization or billing-contact disclosures may occur without the individual User’s separate approval.

5. International transfers and policy changes

The policy adds detailed Data Privacy Framework, SCC, and onward-transfer provisions. It also preserves Litmus’s right to change the policy, with new terms becoming effective unless the customer terminates within ten days.

Risk: Continued use may constitute acceptance of materially expanded data practices, including potentially future technology-related uses.

Summary of Important Changes

1. Major restructuring of the privacy notice

The prior text described specific purposes for collecting and using information, including:

• Account creation and access
• Customer support
• Service delivery
• Internal evaluations and statistical analysis
• Monitoring service performance
• Market research
• Developing new features and functionality
• Enforcing the Terms of Service

The revised text replaces this with a substantially expanded, numbered privacy policy. Because the diff appears to replace large portions of the document, the final wording and section order should be checked carefully for drafting errors or missing provisions.

2. Broader third-party sharing disclosures

The revised policy provides detailed categories of permitted disclosures, including:

• Service providers and subprocessors
• Organizations controlling a user’s email address, such as an employer
• Billing contacts
• Public user profiles, forums, blogs, and other publicly accessible areas
• Affiliated businesses and third-party services
• Business transfers, acquisitions, bankruptcy, or changes of control
• Legal, fraud-prevention, security, and credit-risk purposes
• Aggregated usage information for marketing and business purposes

This creates greater transparency but also confirms potentially broad sharing and disclosure rights. In particular, organizational or billing contacts may receive account-identifying information, and publicly posted content may be collected and used by others.

3. Retention and deletion

The revised policy states that data is generally retained:

• While the customer has an account; or
• As needed to comply with legal obligations, resolve disputes, or enforce agreements.

It also states that deletion from an account may not remove all information from Litmus’s records, and that Litmus may continue using aggregated or de-identified data. Customers requesting deletion may have their access limited or terminated if the services cannot reasonably be provided without the data.

4. International transfers and privacy frameworks

The revision adds detailed provisions concerning:

• U.S. hosting and processing
• Processing in countries where Litmus, its personnel, or service providers operate
• EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework compliance
• Standard Contractual Clauses and the UK Addendum
• Onward-transfer obligations and dispute-resolution mechanisms

These provisions may expand the recognized locations and mechanisms for international processing.

5. Children’s data

The revised policy expressly prohibits use by or registration of individuals under 13 and prohibits customers using Email Analytics Services from providing data concerning children under 13, subject to limited parental authorization language. Litmus may delete such data without notice.

6. Marketing and profiling

The policy continues consent-based marketing but newly states that Litmus may combine information from or about users obtained from third-party sources with information it holds to create user profiles and make marketing and sales efforts more relevant and personalized.

7. AI-model training

No express provision authorizing or prohibiting use of customer data to train AI models appears in the supplied diff. The revised language does not specifically address AI training, machine learning, model improvement, prompts, Email Submissions, or whether customer content is used as training data.

The broad references to improving services, technology, business purposes, aggregated/de-identified data, and service providers could potentially be relevant to AI-related processing, but they do not clearly authorize model training. Customers should seek express clarification and, if appropriate, require a separate restriction stating that customer data and content will not be used to train generative AI or other models without affirmative consent.

Summary of Important Changes

1. Expanded purposes for using collected information

The policy now describes substantially broader operational and product-improvement uses of information, including:

• Creating and managing user accounts.
• Providing customer support and troubleshooting.
• Performing internal evaluations and statistical analysis.
• Monitoring Service performance, rather than only monitoring websites.
• Analyzing visitor and user behavior and trends.
• Understanding how the Services are used.
• Improving existing Services.
• Conducting market research.
• Developing new features and functionalities.
• Enforcing the Terms of Service and subscription agreements, including fraud prevention and detection of illegal, abusive, or undesirable activity.
• Sending transactional communications, which cannot be opted out of.
• Creating user profiles from information held about the user and third-party information to personalize marketing, sales efforts, and the user experience.

Risk: These purposes are broader and more detailed than the prior language. “Improve our Services,” “develop new features,” “market research,” and “personalize” are potentially open-ended and may permit secondary uses beyond strictly delivering the contracted service.

2. AI model training

The diff does not expressly add or authorize the use of customer data to train artificial-intelligence or machine-learning models. There is no specific reference to “AI,” “machine learning,” “training,” “fine-tuning,” model development, or use of customer content as training data.

However, the new wording creates some indirect ambiguity:

• “Internal evaluations,” “statistical analysis,” “analyze visitor and User behavior,” “improve our Services,” and “develop new features and functionalities” could potentially encompass automated analytics or AI-related development.
• The policy does not clearly distinguish between ordinary usage data, personal information, email content, Email Submissions, and customer-provided business data.
• It does not state whether data used for product improvement is aggregated, de-identified, excluded from model training, or deleted from development datasets.
• It does not identify any opt-out right specifically relating to AI or model training.

Recommended clarification: Obtain a written commitment stating whether Customer Data, email content, submissions, prompts, outputs, or usage data may be used to train, fine-tune, evaluate, or improve AI models, and whether any such use is opt-in, opt-out, aggregated, de-identified, or prohibited.

3. Broader disclosure and service-provider provisions

The policy newly identifies service providers such as payment processors, hosting providers, web-chat providers, email providers, and web-traffic analytics tools. It states that providers may use personal data only as necessary to assist Litmus and must maintain confidentiality and follow the Privacy Policy.

Risk: The permitted sharing is tied to Litmus’s “general business operations,” which may be broader than service delivery. The policy does not provide a complete subprocessors list, advance-notice obligation, audit right, or express prohibition on provider use for AI training.

4. New organizational and account disclosures

Litmus may disclose account email addresses and related information to an organization controlling the account, such as an employer, and to billing contacts upon request.

Risk: Users may have reduced confidentiality where accounts are organization-controlled or billing information differs from user information.

5. International transfers, rights, and policy changes

The policy adds detailed Data Privacy Framework, SCC, UK Addendum, and international-transfer language, plus expanded GDPR/CCPA rights.

The prior ten-day termination mechanism for policy changes is replaced by language allowing revised terms to take effect immediately, with continued use constituting acceptance.

Risk: Customers may have less practical ability to reject materially adverse privacy changes without terminating service.

Summary of Available Changes

The diff states only that approximately 2,807 words were removed. It does not identify which provisions were deleted or provide replacement language. As a result, the legal and AI-related impact cannot be determined reliably.

Potential Legal Risks

The deleted material could have removed important provisions concerning:

• Customer data ownership and usage rights
• Confidentiality and data security obligations
• Data retention, deletion, and return
• Service provider access to customer content
• Subprocessors and third-party disclosures
• Customer audit or compliance rights
• Indemnities, warranties, and liability limits
• Termination rights and post-termination obligations
• Governing law and dispute procedures

The deletion of contractual protections may create ambiguity or shift risk to the customer, particularly if the remaining agreement does not address these subjects elsewhere.

AI Training and Model-Use Issues

The provided diff does not show whether any language about AI models was added, deleted, or changed. Therefore, it is not possible to determine whether:

• Customer data may be used to train, fine-tune, or improve AI models;
• Customer prompts, outputs, files, or other content may be retained for model development;
• Data may be aggregated, de-identified, or combined with other customers’ data;
• Human reviewers or third-party AI providers may access customer data;
• The customer can opt out of AI training or model improvement;
• Customer data is excluded from training by default;
• The provider must delete training data or derived artifacts after termination; or
• The provider claims ownership of model outputs, embeddings, or other AI-generated materials.

If provisions limiting AI training or model improvement were among the deleted 2,807 words, the change could materially expand the provider’s rights to use customer data. Conversely, if broad data-use permissions were deleted, the change could improve customer privacy protections.

Recommended Next Step

Provide the actual redline, including the deleted text and any surrounding sections. At minimum, review the provisions titled or relating to:

1. Customer Data and Content

2. Confidentiality and Privacy

3. Artificial Intelligence or Model Training

4. Data Processing and Subprocessors

5. Retention and Deletion

6. Intellectual Property and License Grants

Without the underlying text, no definitive conclusion can be reached about the legal effect of the deletion or the treatment of customer data for AI training.

Summary

The provided diff does not include the text of the legal changes. It only states:

> “Added approximately 2807 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions were added or changed;
• Whether liability, indemnity, confidentiality, security, payment, termination, or governing-law terms changed;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, subcontractors, service providers, or third parties;
• Whether the customer has any opt-out, deletion, ownership, or audit rights; or
• Whether the provider may retain customer data after termination.

AI-Training Issues Requiring Review

The actual added language should be checked for provisions addressing:

1. Training and model improvement

Whether customer content, prompts, outputs, usage data, or metadata may be used to train or improve artificial intelligence or machine-learning models.

2. Scope of permitted data use

Whether use is limited to providing the services, or extends to product development, analytics, benchmarking, research, advertising, or other commercial purposes.

3. Identifiability and aggregation

Whether the provider may use de-identified, anonymized, aggregated, or pseudonymized data, and whether the contract explains how these terms are defined.

4. Opt-out and consent

Whether the customer must affirmatively consent, may opt out, or is automatically enrolled in data-training activities.

5. Third-party and public-model exposure

Whether data may be provided to third-party AI providers or used to train generally available models, potentially exposing confidential information or making it difficult to delete.

6. Retention and deletion

Whether training data, derived data, embeddings, model weights, logs, or backups remain after termination and whether deletion can be verified.

7. Ownership and confidentiality

Whether the provider receives rights in customer data, outputs, or derivatives, and whether confidentiality obligations continue to protect data used for model development.

Required Information

Please provide the actual redlined text, including the sections marked with {added}, [deleted], and []{replacement}. Without that text, no substantive legal-risk analysis can reliably be performed.

Summary

The provided diff states only that approximately 2,807 words were removed from the document. It does not identify which clauses, definitions, rights, obligations, or limitations were deleted.

Key Legal Implications

Because the deleted text is not included, it is not possible to determine whether the changes affect:

• Customer data ownership or licensing rights
• Permitted uses of customer data
• Confidentiality or security obligations
• Data retention and deletion
• Subprocessors or third-party disclosures
• Intellectual-property ownership
• Liability, indemnification, or warranties
• Audit, compliance, or regulatory rights
• Termination consequences
• Governing law or dispute resolution
• Service levels or commercial obligations

AI Training and Model-Use Provisions

The diff does not provide enough information to determine whether provisions were removed concerning:

• Use of customer data to train, fine-tune, or improve artificial-intelligence or machine-learning models
• Whether customer data may be used for generalized model training
• Whether customer prompts, inputs, outputs, or usage data are retained or reviewed
• Whether data is anonymized, aggregated, or de-identified before model use
• Whether the customer can opt out of AI training or model improvement
• Whether customer data may be disclosed to AI providers or subprocessors
• Ownership or permitted use of model outputs
• Restrictions on using confidential or personal data for training

Risk Assessment

The fact that substantial text was removed may create significant legal changes, but no specific risk can be assessed without the actual deleted language. In particular, deletion of an AI-data-use restriction could expand the provider’s ability to use customer data; deletion of a permission or disclaimer could instead limit that use or create ambiguity.

Please provide the actual redline—including the text inside the deletion brackets—or the “before” and “after” versions. Without that content, a reliable clause-by-clause analysis is not possible.

Summary

The diff only states that approximately 2,807 words were added. It does not include the added contract language or identify any deletions or replacements.

AI Training and Data-Use Changes

• Cannot be determined from the provided diff.
• There is no language showing whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Used to develop products or services;
• Shared with affiliates, vendors, or model providers;
• De-identified, aggregated, or otherwise transformed before use;
• Retained after termination;
• Excluded from training by default or only upon customer request;
• Used to train general-purpose models versus customer-specific models.

Other Legal Risks

These also cannot be assessed without the actual added language:

• Changes to ownership of customer data or model outputs;
• Confidentiality and security obligations;
• Data retention and deletion rights;
• Subprocessor or third-party access;
• Regulatory compliance and cross-border transfers;
• Liability, indemnification, and limitations of liability;
• Audit rights and contractual termination rights;
• Whether new provisions override existing data-use restrictions.

Required Information

Please provide the actual 2,807-word addition, together with any deleted or replacement language. The statement that words were added is not sufficient to identify the legal effect of the amendment or any AI-training-related risks.