Lusha

Key Changes and Risks

1. Broader data access and collection

The revised terms substantially expand the information Lusha may access through connected accounts:

• Email accounts: contacts and phone numbers appearing in email headers and signatures.
• Calendars: meeting titles, attendee lists, and attendee email addresses.
• CRM systems: all contacts, including names, email addresses, job titles, company names, and phone numbers.
• Access appears to apply to all contacts in the connected email database, with no ability to exclude individual contacts.
• Lusha may conduct a validity check on the connected email account and other integrations each month.

Although the terms state that Lusha will not read email correspondence, the scope of metadata and contact information is extensive and may include third-party personal data.

2. Extensive rights to use and disclose collected data

The new language allows Lusha to:

• Enrich its database and contribute to its expansion;
• Reproduce, distribute, publish, or display collected information;
• Sell, transfer, disclose, or otherwise make the information available to third parties, including Lusha customers.

This is materially broader than the prior description of sharing professional contact details in exchange for credits. The language also appears to permit commercial use of information relating to contacts who have not directly agreed to the terms.

3. Retention after cancellation

The prior language indicated that shared data would not be sold after cancellation, subject to certain limitations. The revised terms expressly provide that:

• Information accessed before cancellation will not be deleted from the Lusha Database.
• Information from connected accounts may continue to be used for research purposes.
• Individuals may request removal of contacts from the database, but removal is not automatic and the terms do not establish a clear timeframe or guaranteed process.

Cancellation therefore stops or ends benefits, but does not meaningfully stop Lusha’s ongoing use of previously collected data.

4. AI-model training

The diff does not expressly state that customer or Community data may be used to train, fine-tune, evaluate, or improve AI models.

However, the new permissions to use data for “research purposes,” database expansion, and disclosure to customers are broad enough to create ambiguity about whether data could be used in AI development or model training. The added marketing content references “AI agents and workflows,” but does not create a clear contractual restriction or authorization concerning AI training.

Risk: Customers may be unable to determine whether their data, or derived data, may be incorporated into training datasets, embeddings, evaluation systems, or other AI products. A specific AI-use clause should clarify permitted purposes, opt-out rights, anonymization, retention, and whether data may be used to train third-party or general-purpose models.

5. Other important changes

• The agreement now covers Lusha affiliates and binds the legal entity on whose behalf the user subscribes.
• Users represent that they have all necessary rights and authorizations to provide the data.
• Lusha may change or replace benefits at its sole discretion.
• Lusha may remove a Community Member at any time, without explanation or compensation.
• The General Terms are incorporated broadly, including intellectual property, warranties, indemnification, and liability provisions.

No

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 845 words to the document”

Accordingly, it is not possible to identify:

• New or changed contractual obligations
• Changes to liability, indemnity, confidentiality, or termination rights
• New data-use permissions or restrictions
• Whether customer data may be used to train, fine-tune, test, validate, or improve AI models
• Whether customer data may be shared with affiliates, service providers, or third parties
• Any opt-out, consent, deletion, retention, or security provisions
• Whether the changes apply retroactively or to previously collected data

AI-Training Issues Requiring Review

The actual added text should be checked for language permitting the provider to:

1. Use customer data for AI training or model improvement, including prompts, outputs, files, metadata, or usage data.

2. Use de-identified, aggregated, or anonymized data, particularly because those terms may allow broad reuse.

3. Retain data after termination for training, analytics, safety, or product development.

4. Share data with subprocessors or affiliates involved in model development.

5. Use customer content by default, unless the customer opts out.

6. Claim rights to model inputs or outputs, including derivative data, embeddings, or model weights.

7. Combine customer data with other datasets, potentially making customer information harder to isolate or delete.

8. Avoid responsibility for outputs generated through models trained using customer data.

Information Needed

Please provide the complete redline or the text of the additions, deletions, and replacements. Without the actual language, no reliable legal-risk analysis or comparison can be performed.

Key Changes and New Risks

1. Much broader access to customer-connected data

The revised terms authorize Lusha to access information through:

• Email accounts, including Outlook/G Suite;
• Email headers and signatures, including names, email addresses, phone numbers, job titles and company names;
• Calendar permissions, including meeting titles, attendee lists and attendee email addresses; and
• Connected CRM accounts, including contacts and related professional information.

The authorization appears to apply to all contacts in the connected email database, with no ability to remove individual contacts. Contacts may request removal from Lusha’s database, but the customer is not given a direct granular opt-out mechanism.

Risk: This substantially expands the data collected beyond information voluntarily submitted by the Community Member. It may include third-party personal data, confidential business information and data belonging to the customer’s employer or other organizations.

2. Broad commercial rights over collected information

Lusha may use relevant information to enrich and expand its database. It may also:

• Reproduce, distribute, publish or display the information;
• Sell, transfer, disclose or make it available to third parties, including Lusha customers.

This is materially broader than the prior language, which focused on contributing professional contact details to the database and stated that shared data would not be sold.

Risk: The revised terms create a broad, effectively perpetual commercialization right over data obtained from connected accounts. They do not clearly limit use to business contact information or exclude confidential, proprietary or regulated data.

3. New “research purposes” language

After cancellation or opting out, information from connected accounts may still be used for research purposes. Information already accessed will not be deleted from the Lusha database.

AI-training implications: The diff does not expressly state that customer data will be used to train artificial-intelligence or machine-learning models. However, “research purposes” is undefined and could potentially encompass AI development, model evaluation, analytics or related product research. The terms should expressly state whether data may be used for AI training, whether it will be anonymized or aggregated, and whether customer data or personal data may be included in model inputs or outputs.

4. Persistence after cancellation

Cancellation stops renewal of benefits, but:

• Previously accessed information remains in the database;
• Connected-account information may continue to be used for research;
• Data may remain available to Lusha customers and other third parties.

This materially weakens the practical effect of opting out.

5. Expanded authority and unilateral discretion

The terms now cover Lusha Systems Inc. and its affiliates and bind the legal entity on whose behalf the user subscribes. Lusha may change benefits at any time and remove a Community Member at its sole discretion, without explanation or compensation.

6. Customer warranties and compliance burden

The customer represents that it has all rights, permissions and authorizations required to join and provide access. This may shift responsibility to the customer for obtaining employer consent, third-party permissions and lawful authority to disclose contact, calendar and CRM data.

Overall assessment: The revision significantly increases Lusha’s data-access, commercialization and retention rights. The absence of clear AI-training language is an important ambiguity requiring clarification before acceptance.

No

No

No

No

Summary

The supplied diff only states that approximately 845 words were added. It does not include the actual added contractual language or identify the sections affected.

AI Training and Customer Data

Because the text of the additions is not provided, it is not possible to determine whether the agreement now:

• Permits the provider to use customer data, prompts, inputs, outputs, or usage information to train, fine-tune, or improve AI models;
• Allows such use for the provider’s affiliates, contractors, or third-party model providers;
• Uses customer data for aggregated, anonymized, or de-identified training;
• Makes training use automatic, optional, or subject to an opt-out;
• Retains customer data for training after termination;
• Claims ownership of model weights, derivatives, or learnings based on customer data;
• Imposes confidentiality, security, deletion, or data-retention limits relevant to AI training; or
• Distinguishes between customer content, personal data, metadata, and feedback.

Other Legal Risks

The additions cannot be evaluated for changes to:

• Intellectual-property ownership and license rights;
• Confidentiality obligations;
• Data protection and privacy compliance;
• Security commitments and breach liability;
• Indemnities, warranties, and liability caps;
• Subcontractor or third-party service-provider rights;
• Data retention and deletion;
• Customer audit or termination rights; or
• Changes to governing law, dispute resolution, or other commercial terms.

Required Information

Please provide the actual redline text, including the 845 added words and any surrounding provisions. Without the wording, no reliable legal comparison or risk assessment can be made.

No

No

No

No

No

No

No

No

No

No

No