Proofpoint

Summary

The supplied diff only states:

> “Added approximately 129 words to the document”

It does not include the actual added, deleted, or replaced legal language. As a result, the contractual changes and their legal effects cannot be reliably analyzed.

AI Training and Customer Data

• No substantive language is provided addressing whether the customer’s data may be:
• Used to train, fine-tune, or improve AI models;
• Used to create or derive models, embeddings, or other products;
• Shared with affiliates, vendors, or third-party AI providers;
• Retained after termination for model training;
• De-identified, aggregated, or otherwise transformed before use; or
• Excluded from training by default or only upon customer request.

Accordingly, it is not possible to determine whether the document introduces new rights to use customer data for AI training or creates related privacy, confidentiality, intellectual-property, or regulatory risks.

Other Legal Risks

The actual wording is also necessary to assess changes concerning:

• Data ownership and licensing;
• Confidentiality obligations;
• Security and breach responsibilities;
• Subprocessors and third-party disclosures;
• Data retention and deletion;
• Indemnification and liability limits;
• Compliance with privacy laws; and
• Changes to termination or suspension rights.

Required Information

Please provide the full redline or the 129 words that were added, including any surrounding provisions. Without the text of the changes, no meaningful legal comparison can be made.

Summary of Important Changes

1. Expanded purposes for using personal information

The revised statement adds broader purposes for processing customer and other personal information, including:

• Providing Proofpoint products, services, and customer support.
• Improving and enhancing products and services, including threat-detection capabilities.
• Continuing to develop threat intelligence to protect organizational information.
• Advertising and marketing to customers and organizational representatives.
• Delivering the privacy and cybersecurity protection customers expect.

Risk: These purposes are broader than a simple service-delivery description and may allow Proofpoint to use information for product development, threat intelligence, and marketing beyond the immediate customer transaction. The terms “improving,” “enhancing,” and “developing threat intelligence” are not narrowly defined.

2. AI-model training and machine learning

The diff does not expressly state that customer data may be used to train artificial intelligence, machine-learning, or generative-AI models. However, the newly added references to:

• Improving products and threat-detection capabilities; and
• Developing threat intelligence

could potentially encompass automated analytics, machine learning, or model development, depending on how Proofpoint interprets those terms.

The statement does not specify:

• Whether customer content, emails, metadata, or threat data may be used for model training;
• Whether data is de-identified, aggregated, or pseudonymized before such use;
• Whether data may be used to train general-purpose models or only customer-specific security tools;
• Whether customer data is retained for training;
• Whether customers can opt out; or
• Whether trained models or derived intelligence may be shared with other customers.

Risk: Customers should not assume that the policy excludes AI training merely because it does not use that phrase. A separate contract, service-specific notice, DPA, or product terms may govern this issue.

3. Revised access, correction, deletion, and restriction language

The policy now states that customers can request that Proofpoint stop using or sharing data, while retaining rights—subject to applicable law and certain conditions—to access, correct, amend, or delete personal information.

Risk: The rights are qualified and may not apply to all customer data, particularly data processed on behalf of an organization, data needed to provide services, security data, or information subject to legal-retention obligations. The policy does not clearly explain how requests interact with AI models, threat intelligence, backups, or derived data.

4. Marketing and communications

The revised wording expressly includes advertising and marketing to customers and organizational representatives. It provides an unsubscribe option and a privacy email address.

Risk: Marketing purposes are stated broadly, although the policy indicates that consent may be required in some circumstances.

5. Administrative and contact updates

The revision:

• Sets an effective date of October 15, 2026;
• Adds or standardizes privacy@proofpoint.com for privacy-related requests;
• Adds social-media widgets language;
• Corrects references to the Swiss-U.S. and EU-U.S. Data Privacy Frameworks; and
• Adds Proofpoint’s EU contact/controller information.

These changes appear primarily administrative but may affect how complaints and privacy requests are submitted.

Summary

The provided diff only states: “Added approximately 129 words to the document.” It does not include the actual added, deleted, or replaced contract language.

Substantive changes

• No legal terms or provisions are visible for review.
• It is therefore not possible to determine whether the change affects:
• Customer data rights or ownership
• Data processing, sharing, retention, or deletion
• Confidentiality or security obligations
• Liability, indemnification, or warranties
• Intellectual property rights
• Use of customer data to train, fine-tune, evaluate, or improve AI models
• Opt-out, consent, or notice requirements relating to AI training

AI training assessment

The supplied diff contains no language addressing AI models or the use of customer data for AI training. This does not establish that no such change was made; it only means the relevant text was not provided.

Required for review

Please provide the actual 129-word addition and any surrounding replacement or deletion markers. The text should show additions as {...}, deletions as [...], and replacements as []{...}.

Summary of Important Changes

1. Expanded purposes for using personal and customer information

The revised statement expressly says Proofpoint may use information for:

• Providing Proofpoint products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to safeguard an organization’s information;
• Advertising and marketing to customers and their representatives; and
• Delivering Proofpoint’s privacy and cybersecurity protection.

Risk

The purposes are broader and more clearly include product development and threat-intelligence activities. Depending on the type of data supplied to Proofpoint, this language could permit use of customer-related information to improve detection technologies, analytics, or other security capabilities beyond merely providing the contracted service.

2. AI-model training

The diff does not expressly mention “artificial intelligence,” “machine learning,” “training,” “foundation models,” or “generative AI.” Accordingly, it does not create an explicit new right to train AI models.

However, the new references to:

• “Improving and enhancing our products and services”;
• “our threat-detection capabilities”; and
• “Continuing to develop threat intelligence”

could potentially encompass the development, tuning, or evaluation of machine-learning or AI systems. The statement does not specify:

• Whether customer content, emails, telemetry, or threat data may be used;
• Whether data is anonymized, aggregated, or de-identified before such use;
• Whether customer data may be used to train general-purpose models;
• Whether data is retained for model training after service termination; or
• Whether customers can opt out of these uses.

Key issue: The policy does not clearly distinguish between using data to provide the customer’s service and using it for Proofpoint’s broader product or AI development.

3. Changes to data-control rights

The revised language adds that customers can request Proofpoint to stop using or sharing their data by contacting Customer Support. It also retains rights to access, correct, amend, or delete personal data, subject to applicable law and certain conditions.

Risk

The “stop using or sharing” language may appear broader, but the policy does not explain:

• What uses can actually be stopped;
• Whether the request applies to product improvement or threat-intelligence use;
• Whether restrictions affect service functionality;
• How long Proofpoint will take to comply; or
• Whether previously incorporated data, models, or threat intelligence can be withdrawn or deleted.

4. Marketing and communications

The revised statement expressly includes advertising and marketing to customers and their representatives. It also adds or clarifies an unsubscribe process and identifies privacy@proofpoint.com for privacy-related requests.

Risk

Marketing use is stated more directly, potentially increasing promotional communications unless recipients opt out.

5. Other notable changes

• The statement is identified as effective October 15, 2026.
• Contact details and privacy-request procedures are more complete.
• References to Proofpoint’s Trust site, GDPR data-processing agreement, and Standard Contractual Clauses remain.
• Social-media widgets are newly identified, creating potential third-party tracking or data-sharing considerations.

Key Changes and Legal Risks

1. Expanded stated purposes for using information

The revised statement expressly says Proofpoint may use information for:

• Providing products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to safeguard an organization’s information;
• Advertising and marketing to customers and organizational representatives; and
• Delivering expected privacy and cybersecurity protection.

Risk

These additions broaden the stated purposes beyond basic service delivery. Depending on the information involved and applicable law, “improving” services and developing threat intelligence could support secondary uses, analytics, product development, or machine-learning activities. The language does not specify:

• Whether customer content, emails, attachments, telemetry, or threat data may be used;
• Whether data is de-identified, aggregated, or pseudonymized;
• Whether data is shared with affiliates, vendors, or third-party AI providers;
• Whether customer data is used to train, fine-tune, validate, or evaluate AI or machine-learning models;
• Whether models trained using customer data are retained after termination; or
• Whether customers can opt out of such uses.

2. AI-training provisions

The diff contains no express authorization or prohibition concerning AI-model training. However, the new references to product improvement, threat-detection capabilities, and threat intelligence are broad enough that Proofpoint could potentially argue that certain AI or machine-learning development activities fall within those purposes.

Customers should not assume that the revised statement either permits or excludes AI training. The absence of specific limits creates uncertainty, particularly for confidential business information, email content, security events, and personal data processed through Proofpoint services. Contractual terms, a data-processing agreement, service-specific terms, or a trust/security document may provide additional restrictions.

3. Expanded and clarified contact-information collection

The statement reorganizes and expands examples of information individuals may provide, including information supplied when signing up for trials, offers, newsletters, white papers, and responding to communications.

Risk

The changes appear primarily editorial, but the expanded examples may support broader marketing-related collection and processing. The statement also retains marketing purposes where consent has been provided.

4. Changes to data-subject rights and controls

The revised language states that individuals may:

• Request that Proofpoint stop using or sharing their data;
• Access personal data; and
• Correct, amend, or delete information under applicable law and certain conditions.

Requests may be directed to Customer Support or privacy@proofpoint.com.

Risk

The rights are expressly qualified by applicable law and conditions, so they are not absolute. The statement does not clearly explain how stopping use or deletion interacts with security, legal-retention, backup, or model-development purposes.

5. Other notable updates

• The statement is effective October 15, 2026.
• Proofpoint identifies privacy@proofpoint.com as a privacy contact.
• Social-media widgets are expressly addressed.
• The EU-U.S. and Swiss-U.S. Data Privacy Framework language remains, while one internal-complaints contact placeholder appears unresolved.
• The diff contains substantial duplicated and reformatted text, which may create interpretation or drafting ambiguity.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 129 words to the document”

As a result, it is not possible to determine:

• What contractual terms changed;
• Whether any obligations, rights, limitations, or liabilities were added;
• Whether customer data may be collected, processed, shared, retained, or disclosed differently;
• Whether customer data may be used to train, fine-tune, evaluate, or improve artificial intelligence or machine-learning models;
• Whether an opt-out, consent requirement, confidentiality protection, or deletion right was added or removed; or
• Whether the changes affect ownership of data, intellectual property, security obligations, indemnities, or regulatory compliance.

AI-Training Risk Assessment

No specific language concerning AI model training or related uses is included in the supplied diff. Therefore, no conclusion can be drawn about whether the new terms:

• Permit use of customer content or personal data for model training;
• Limit training to de-identified, aggregated, or anonymized data;
• Allow human review or vendor access to customer data;
• Permit use for product improvement beyond providing the contracted services;
• Apply different rules to inputs, outputs, metadata, or usage data; or
• Provide customers with an opt-out or require affirmative consent.

Information Needed

Please provide the actual redline text, including the 129 added words and any surrounding deleted or replaced language. The changes should be marked using the stated notation:

• Additions: {new text}
• Deletions: [deleted text]
• Replacements: [old text]{new text}

Without the substantive wording, the only reliable conclusion is that the diff cannot be legally analyzed.

Summary of Important Changes

1. AI-model training and product-improvement use

• The revised statement expressly adds purposes including:
• “Improving and enhancing our products and services, including our threat-detection capabilities”; and
• “Continuing to develop threat intelligence.”
• It also retains broad language permitting statistical or other analysis of information.
• No provision expressly states whether customer data, message content, telemetry, threat indicators, or personal information may be used to train, fine-tune, evaluate, or improve AI or machine-learning models.
• Accordingly, the revision does not create a clear, express AI-training right, but the new product-improvement and threat-detection language could be interpreted broadly enough to support model development, particularly for data collected through Proofpoint services. Customers should seek confirmation on:
• whether customer content is used for AI training;
• whether data is de-identified or aggregated first;
• whether data is shared with model providers or other subprocessors;
• whether customer data is used to train shared models or only customer-specific systems; and
• retention, deletion, and opt-out controls.

2. Broader stated business purposes

The revised opening adds or emphasizes providing products, services, support, marketing, product improvement, threat intelligence, and cybersecurity protection. This is more expansive and may support additional internal uses beyond basic service delivery.

3. New and clearer data-control rights

• Customers may request that Proofpoint stop using or sharing their data by contacting Customer Support.
• Access, correction, amendment, and deletion rights are now tied to “applicable data privacy laws” and “certain conditions,” which may limit the practical scope of those rights.
• The policy adds an opt-out opportunity if personal data will be used in a way not previously disclosed or shared with external parties not covered by the policy. This is helpful, but it does not clearly cover all product-development or AI-training uses.

4. International transfers and onward transfers

• The policy updates its description of the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks.
• It adds language stating that Proofpoint remains liable for certain processing by third-party agents, while also allowing transfers to the United States without additional safeguards where the DPF is relied upon.
• The revised dispute-resolution language refers to TRUSTe/TrustArc and binding arbitration under certain conditions.
• A serious drafting issue remains: the text contains an unresolved placeholder—“[INSERT contact information for participant's internal complaints mechanism]”—which could undermine compliance and confuse complaint procedures.

5. Website, social-media, and tracking disclosures

The policy reorganizes and clarifies that third-party links, social-media features, cookies, IP addresses, and page-visit information may be collected or disclosed. Third-party privacy policies govern interactions with those features.

6. Other notable changes

• Effective date changes from October 10, 2025 to October 15, 2026.
• Privacy inquiries can be sent to privacy@proofpoint.com.
• Children’s language changes from under 13 to under 18 for site direction, while deletion protections remain specifically focused on children under 13.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 337 words to the document”

Accordingly, it is not possible to identify:

• The specific contractual changes;
• New or expanded customer obligations;
• Changes to liability, indemnification, confidentiality, security, or termination rights;
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, vendors, or third-party AI providers;
• Any limits on retention, deletion, anonymization, or de-identification; or
• Whether the customer has an opt-out, approval right, or other control over AI-related data use.

AI Training and Data-Use Risk

No conclusion can be reached regarding AI-model training because the added 337 words were not provided. The missing language should be reviewed specifically for terms such as:

• “train,” “fine-tune,” “develop,” “improve,” or “evaluate” models;
• “machine learning,” “artificial intelligence,” or “generative AI”;
• “de-identified,” “aggregated,” or “anonymized” data;
• Rights to use “Customer Data,” “Content,” “Usage Data,” or “Feedback”;
• Sharing data with subprocessors or third-party model providers;
• Retention of data after termination; and
• Customer consent, opt-out, or restrictions on model training.

Information Needed

Please provide the full redline or the text of the approximately 337 added words, including the surrounding provisions if available. Without the actual language, any assessment of legal effect or risk would be speculative.

Summary of Important Changes

1. Expanded purposes for using personal information

The revised statement adds broader business and security purposes, including:

• Providing Proofpoint products, services, customer support, and related offerings.
• Improving and enhancing Proofpoint’s products and services, including threat-detection capabilities.
• Continuing to develop threat intelligence to safeguard an organization’s information.
• Advertising and marketing to customers and organizational representatives.
• Delivering the privacy and cybersecurity protection customers expect.

Risk

These additions expand the stated purposes for processing customer and contact information beyond basic service delivery. The language is broad and may permit use of information for product development, analytics, threat intelligence, and security improvement.

2. Potential AI-model training implications

The revised text does not expressly refer to artificial intelligence, machine learning, or training AI models. However, the new references to:

• “improving and enhancing” products;
• improving “threat-detection capabilities”; and
• developing “threat intelligence”

could potentially include using data to develop, test, tune, or validate automated detection systems, including AI or machine-learning models.

The statement does not clarify:

• Whether customer content, emails, telemetry, or threat data may be used for model training;
• Whether data is anonymized, aggregated, pseudonymized, or retained in identifiable form;
• Whether customer data may be combined with data from other customers;
• Whether trained models may retain or reproduce customer information;
• Whether customers can opt out of these development uses; or
• Whether the use applies to service data, customer-submitted information, or only publicly available/threat-related data.

This ambiguity is a material risk for customers whose data includes confidential business information, employee information, communications, or regulated data. The applicable service agreement, data processing agreement, or product-specific terms should be reviewed for more specific restrictions.

3. Changes to individual rights and control

The revised language:

• States that Proofpoint is committed to protecting personal data entrusted to it;
• Allows individuals to request that Proofpoint stop using or sharing their data;
• Retains rights to access, correct, amend, or delete information under applicable law and certain conditions; and
• Provides a dedicated privacy email address: privacy@proofpoint.com.

Risk

The right to stop use or sharing is described generally and may be subject to legal, contractual, operational, or service-related limitations. The statement does not guarantee deletion or cessation of all processing.

4. Marketing and communications

The revision adds clearer unsubscribe options, including emailing privacy@proofpoint.com or using instructions in the communication. Marketing purposes remain permitted where the recipient has consented.

5. Administrative and presentation changes

The revision updates contact details, terminology, and references to Proofpoint’s privacy, security, and regulatory materials. It also adds or clarifies social media widget disclosures.

Diff Analysis

Summary

The diff only states that approximately 129 words were added. It does not include the actual added language, nor any deletions or replacements. As a result, the legal effect of the changes cannot be determined.

AI Training and Data Use

No conclusion can be reached about whether the contract now:

• Permits the customer’s data to be used to train, fine-tune, or improve AI models;
• Allows use of customer prompts, outputs, files, personal information, or usage data for model development;
• Requires customer consent or provides an opt-out;
• Applies data-use permissions to human review, automated systems, affiliates, or service providers;
• Claims ownership or licensing rights over customer data or generated outputs; or
• Provides confidentiality, deletion, retention, or data-isolation protections.

Potential Risks Requiring Review

The missing text should be checked for provisions that:

1. Expand permitted data use beyond providing the services.

2. Grant a broad, perpetual, worldwide, irrevocable, or royalty-free license to customer content.

3. Permit AI training by default, especially where consent is implied or an opt-out is difficult.

4. Include personal, confidential, regulated, or proprietary information in training or analytics activities.

5. Allow retention after termination or use of de-identified, aggregated, or derived data without clear limits.

6. Shift responsibility to the customer for obtaining permissions from data subjects or other third parties.

7. Limit remedies or disclosures if customer data is used contrary to the customer’s expectations.

Conclusion

The supplied diff is insufficient for substantive legal analysis. The actual 129-word addition, together with any deleted or replaced language, is needed to identify changes, particularly those concerning AI-model training and customer-data rights.

Summary of Important Changes

1. Expanded purposes for using personal information

The revised statement adds broader descriptions of why Proofpoint processes information, including:

• Providing Proofpoint products, services, customer support, and related functionality.
• Improving and enhancing products and services, including threat-detection capabilities.
• Continuing to develop threat intelligence to safeguard an organization’s information.
• Advertising and marketing to customers and organizational representatives.
• Delivering the privacy and cybersecurity protection expected from Proofpoint.

Risk

These additions broaden the stated purposes for processing customer and user information beyond merely providing the service. The language concerning product improvement and threat intelligence is relatively open-ended and could support secondary uses of data, including analysis of customer-provided content or service-generated information, depending on the applicable customer agreement and data-processing terms.

2. AI-model training

The revised text does not expressly mention:

• Training, fine-tuning, or evaluating artificial-intelligence or machine-learning models;
• Generative AI;
• Use of customer data to improve AI models;
• Whether data is anonymized, aggregated, or de-identified before such use;
• Whether customer content, email data, telemetry, or threat data may be retained for model development; or
• Any opt-out, consent, or contractual restriction specifically addressing AI training.

The new references to “improving and enhancing” products and “developing threat intelligence” could potentially encompass machine-learning development, but they do not clearly authorize or prohibit AI training. Customers should therefore review the applicable service agreement, data-processing agreement, product terms, and Trust documentation for more specific restrictions or permissions.

3. Expanded and clarified contact methods

The statement now identifies privacy@proofpoint.com for various requests, including:

• Marketing opt-outs;
• Requests concerning use or removal of information;
• Privacy and security inquiries;
• Access, correction, amendment, or deletion requests; and
• General customer-support privacy requests.

This makes the process more practical, although the statement still qualifies certain rights by applicable law and “certain conditions.”

4. Changes to data-subject rights language

The revised section adds that individuals may request Proofpoint to stop using or sharing their data and confirms rights to access, correct, amend, or delete information under applicable privacy laws.

Risk

These rights remain subject to legal exceptions and conditions. The revised wording does not guarantee deletion or cessation of processing, particularly where Proofpoint must retain information to provide services, meet legal obligations, or protect security.

5. Other changes

• Adds a “Social Media Widgets” section.
• Updates terminology and punctuation, including references to the UK Information Commissioner’s Office.
• Clarifies that customers can find GDPR data-processing agreements and Standard Contractual Clauses on the Trust site.
• Adds a privacy email address and updated closing/copyright language.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 129 words to the document”

As a result, it is not possible to determine what provisions changed or whether any new legal risks were introduced.

AI Training and Data Use

No language addressing any of the following is included in the provided diff:

• Use of customer data to train, fine-tune, or improve AI models
• Whether customer data is used for product development or analytics
• Whether prompts, inputs, outputs, or usage data are retained
• Whether data is anonymized, aggregated, or shared with third parties
• Whether the customer can opt out of AI training
• Ownership or licensing rights in customer data or AI-generated outputs
• Security, confidentiality, or deletion obligations relating to AI systems

Accordingly, no conclusion can be reached about changes to AI training or data-use rights.

Risk Assessment

The diff is insufficient to assess:

• New permissions to use customer data
• Expanded intellectual-property licenses
• Changes to confidentiality or privacy obligations
• New third-party processing rights
• Changes to liability, indemnity, or regulatory compliance
• Whether the customer has any contractual control over AI-related processing

Information Needed

Please provide the actual 129 added words and, if applicable, the surrounding deleted or replaced language. The additions should be marked using the stated notation:

• {added text}
• [deleted text]
• [old text]{new text}

Once the substantive text is provided, it can be reviewed for specific legal and AI-data risks.

Executive Summary

The revised Privacy Statement, effective October 10, 2025, makes substantial editorial and substantive changes. It expands the stated purposes for processing information, adds clearer contact and rights procedures, and introduces language supporting product improvement and threat intelligence. However, it does not expressly state that customer data will be used to train AI models, nor does it define whether such data may be used for machine-learning development.

Key Changes and Risks

1. Expanded purposes for using information

The revised statement expressly says Proofpoint may use information for:

• Providing products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to safeguard an organization’s information;
• Advertising and marketing to customers and organizational representatives; and
• Delivering the privacy and cybersecurity protection expected from Proofpoint.

Risk: These purposes are broader than a narrowly defined service-delivery purpose. “Improving and enhancing” products and “developing threat intelligence” could potentially include analytics, model development, or machine-learning activities, depending on how Proofpoint interprets the language.

2. AI and model-training implications

The diff contains no express reference to artificial intelligence, machine learning, training models, generative AI, model improvement, or use of customer content to train systems.

Accordingly:

• The revision does not clearly grant or prohibit a right to use customer data for AI training.
• The broad product-improvement and threat-intelligence language could be relied upon to support some AI-related processing, particularly if data is aggregated, de-identified, or derived from threat activity.
• The statement does not specify whether customer emails, attachments, telemetry, threat data, or other service content may be used.
• It does not identify retention periods, de-identification standards, opt-out rights, human review, or restrictions on using data to train general-purpose models or models benefiting other customers.

Recommended clarification: The customer should seek a written commitment stating whether customer data or service content may be used to train or fine-tune AI models, whether only de-identified or aggregated data is used, and whether the customer can opt out.

3. Marketing and communications

The revised text expressly includes advertising and marketing to customers and representatives. It also adds a specific privacy email address and confirms that recipients may unsubscribe by contacting Proofpoint or using the instructions in communications.

Risk: Marketing use is stated more directly, although the text indicates consent may be relevant in some circumstances. Customers should confirm whether business-contact information will be used for marketing and what controls apply.

4. Data-subject rights and controls

The revised statement adds that individuals can request Proofpoint to stop using or sharing their data and can request access, correction, amendment, or deletion, subject to applicable law and certain conditions.

Risk: The rights remain qualified by legal exceptions and conditions. The statement does not guarantee deletion from backups, derived data, threat-intelligence databases, or trained models.

5. Administrative updates

The revision adds or standardizes privacy@proofpoint.com, updates terminology and regulatory references, identifies an EU controller, and adds social-media-widget language and copyright text.

Summary

Insufficient Information

The provided diff states only:

> “Added approximately 129 words to the document”

It does not include the actual added, deleted, or replaced legal language. As a result, it is not possible to identify:

• Changes to the parties’ rights or obligations;
• New liability, indemnity, confidentiality, or termination risks;
• Changes to ownership or permitted use of customer data;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data is anonymized, aggregated, retained, disclosed to third parties, or transferred internationally;
• Any opt-out, consent, deletion, or security provisions.

AI Training Review

No conclusion can be reached about AI-model training because the relevant contractual wording is not included. The added language should be reviewed specifically for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “evaluate” models;
• “customer data,” “inputs,” “content,” “usage data,” or “feedback”;
• Rights to use data for “service improvement” or “research”;
• Aggregation, de-identification, anonymization, or derivative data;
• Data retention and deletion after termination;
• Sharing data with affiliates, vendors, or model providers;
• Customer consent or opt-out rights.

Required for Analysis

Please provide the actual 129-word addition and any corresponding deletions or replacements. Without the operative text, a legal-risk analysis would be speculative.

Summary of Important Changes

1. Expanded purposes for using customer information — high importance

The revised statement adds broad purposes for processing information, including:

• Providing Proofpoint products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to safeguard the customer organization’s information;
• Advertising and marketing to customers and their representatives; and
• Delivering expected privacy and cybersecurity protection.

These purposes appear broader than the prior language, which primarily described how users supplied contact information. The new wording could permit broader internal use of customer-provided information, including information associated with an organization’s systems, threats, or communications.

2. AI model training — important ambiguity/risk

The revised statement does not expressly use the terms “artificial intelligence,” “machine learning,” “training,” or “AI models.” However, the added references to:

• “Improving and enhancing” threat-detection capabilities; and
• Developing “threat intelligence”

could potentially encompass using customer data to develop, tune, validate, or train automated detection systems, including AI or machine-learning models.

The statement does not clarify:

• Whether customer content, emails, attachments, telemetry, or threat samples may be used for model training;
• Whether data is anonymized, aggregated, de-identified, or retained in identifiable form;
• Whether data from one customer may benefit models used for other customers;
• Whether customers can opt out or restrict such use;
• Whether human reviewers or third-party AI providers may access the data; or
• Whether trained models retain or allow reconstruction of customer information.

Customers should seek a specific contractual commitment addressing AI training and secondary use, particularly for confidential communications, regulated data, trade secrets, and security-sensitive information.

3. New or clarified contact and rights process

The revised statement repeatedly adds privacy@proofpoint.com as the contact for:

• Marketing opt-outs;
• Requests to remove or correct information;
• Customer-support privacy requests; and
• Security and privacy inquiries.

The policy now states that customers can request Proofpoint to stop using or sharing data, while retaining access, correction, amendment, and deletion rights only where available under applicable law and subject to conditions. This may improve the practical process but does not create an unrestricted deletion or opt-out right.

4. Marketing and third-party features

The revised text expressly addresses advertising and marketing to customers or organizational representatives and adds a “Social Media Widgets” section. These features may involve third-party tracking or collection governed by those providers’ privacy policies.

5. Administrative updates

The statement is identified as effective October 10, 2025, updates terminology and punctuation, adds a privacy email address, and makes minor changes concerning international privacy authorities and Proofpoint’s Trust site and GDPR documentation.

Summary

The provided diff does not include the actual added, deleted, or replaced contractual language. It only states that approximately 129 words were added.

AI Training and Data-Use Changes

• No substantive wording is available to determine whether the customer’s data may be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Combined with other customers’ data;
• Reviewed by humans for model development or quality assurance;
• Retained after the customer relationship ends; or
• Shared with affiliates, service providers, or third parties for AI-related purposes.

Risk Assessment

Because the added language is not provided, it is not possible to assess:

• Whether customer data remains subject to confidentiality and security obligations;
• Whether use for AI training requires customer consent or is permitted automatically;
• Whether the provider may use identifiable, pseudonymized, or aggregated data;
• Whether the customer can opt out of AI training;
• Whether the provider claims ownership of outputs, derivatives, or trained models;
• Whether data deletion obligations apply to model weights, embeddings, logs, or backups; or
• Whether the change expands the provider’s rights beyond the original agreement.

Required Information

Please provide the actual redline text, including the approximately 129 added words and any surrounding provisions. Without the language itself, no reliable legal comparison or identification of new data-use risks can be made.

Summary of Important Changes

1. Expanded stated purposes for processing

The revised statement adds broader purposes for using personal information, including:

• Providing Proofpoint products, services, customer support, and related services;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to safeguard organizational information;
• Advertising and marketing to customers and their representatives; and
• Delivering the privacy and cybersecurity protection customers expect.

Risk: These purposes are significantly broader than a simple description of collecting contact information. “Improving,” “enhancing,” and developing “threat intelligence” could permit additional analysis and reuse of customer-provided information. The language does not clearly define what data may be used, whether it will be de-identified, or how long it will be retained.

2. Potential implications for AI model training

The revision does not expressly state that customer data may be used to train artificial intelligence or machine-learning models. However, the new references to:

• “Improving and enhancing” products;
• Improving “threat-detection capabilities”; and
• Developing threat intelligence

could potentially be interpreted as covering the development, testing, tuning, or training of AI-based security tools.

Key risk: The policy does not distinguish between:

• Customer content or service data;
• Personal information;
• Threat indicators or telemetry;
• De-identified or aggregated data; and
• Data used to train or improve AI models.

It also provides no express limits on model training, no statement that customer content will be excluded, and no explanation of whether trained models may retain or reproduce information. Customers seeking assurance that their data will not be used for AI training should obtain a contractual commitment or written clarification.

3. Expanded data-subject controls

The revised language states that individuals can request that Proofpoint stop using or sharing their data by contacting Customer Support at privacy@proofpoint.com. It also preserves rights to access, correct, amend, or delete personal data under applicable laws.

Risk: The right to stop use or sharing is qualified by applicable law and “certain conditions.” The statement does not explain exceptions, processing necessary to provide the service, or whether the request would affect security, fraud prevention, or AI/model-improvement activities.

4. Marketing and communications

The statement more clearly identifies advertising and marketing to customers and their representatives as a processing purpose. It adds or confirms unsubscribe and privacy-contact procedures.

Risk: Marketing may involve representatives of customer organizations, potentially extending use beyond the individual who initially provided information.

5. Other notable updates

• The statement is identified as effective October 10, 2025.
• Privacy inquiries, removal requests, and access requests are directed to privacy@proofpoint.com.
• Social media widgets are expressly mentioned.
• EU/UK/Gibraltar/Swiss regulatory references and terminology were updated.
• The statement emphasizes privacy and security commitments but does not add specific technical or contractual protections for customer data.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 129 words to the document”

As a result, it is not possible to identify:

• Changes to data ownership, licensing, confidentiality, or permitted uses
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether such use is optional, automatic, or subject to opt-out/consent
• Whether customer data is anonymized, aggregated, or de-identified before use
• Whether prompts, outputs, usage data, or personal information are included
• Data-retention, deletion, security, or subprocessors-related changes
• New customer obligations, warranties, indemnities, or liability limitations
• Whether the provider may use data for commercial model development or share it with affiliates or third parties

Please provide the full redlined text, including the additions, deletions, and replacements. Once provided, the changes can be analyzed in a structured format, including a specific section addressing AI-model training and related risks.

Key Changes and Risks

1. Expanded purposes for using information

The revised statement adds broader purposes for processing personal information, including:

• Providing Proofpoint products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence;
• Advertising and marketing to customers and their representatives; and
• Delivering Proofpoint’s privacy and cybersecurity services.

Risk: These purposes are broader than merely providing the service. “Improving,” “enhancing,” and “developing threat intelligence” could permit use of data for product development, analytics, security research, and potentially machine-learning or AI development.

2. AI-model training and customer data

The diff does not expressly state that customer data will be used to train AI models, nor does it define:

• Whether customer content, emails, attachments, metadata, or threat data may be used for AI training;
• Whether data will be anonymized, aggregated, or de-identified first;
• Whether data may be used to train third-party or general-purpose AI models;
• Whether customer data will be retained for model training after termination;
• Whether customers can opt out; or
• Whether trained models may contain or reproduce customer-derived information.

However, the new references to improving threat-detection capabilities and developing threat intelligence could be interpreted broadly enough to include machine-learning model training. Customers should seek a specific contractual commitment clarifying whether their data may be used for AI training and imposing limits on that use.

3. New or clarified contact and communications provisions

The statement adds or consistently identifies privacy@proofpoint.com for:

• Opting out of newsletters and other communications;
• Requests to remove personal data;
• Customer-support privacy requests;
• Access, correction, or deletion requests;
• Security questions; and
• General privacy inquiries.

This provides a clearer process, although it does not establish response deadlines beyond stating that access requests will be handled within a “reasonable timeframe.”

4. Changes to data-subject rights

The revised language states that individuals can request that Proofpoint stop using or sharing their data and can exercise access, correction, amendment, or deletion rights under applicable privacy laws.

Risk: These rights remain qualified by “applicable” law and “certain conditions.” The policy does not guarantee deletion or cessation of processing where Proofpoint has legal, contractual, security, or operational grounds to retain or use the information.

5. Marketing and third-party features

The policy continues or clarifies marketing-related processing where consent has been provided. It also adds a “Social Media Widgets” section addressing features such as Facebook Like buttons.

Risk: Social-media widgets may allow third parties to collect information about website visits, potentially through cookies or similar technologies, subject to those providers’ own privacy policies.

6. Other updates

• The statement is effective October 10, 2025.
• References to the UK ICO and related international privacy-transfer frameworks have been updated.
• Proofpoint’s privacy contact details and corporate notices have been expanded.
• The policy emphasizes Proofpoint’s commitment to protecting customer data but does not materially expand security guarantees.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 129 words to the document”

Accordingly, it is not possible to determine what provisions changed or whether the changes create new legal, commercial, privacy, or security risks.

AI Training and Customer Data

No substantive language addressing any of the following is included in the diff:

• Whether customer data may be used to train, fine-tune, validate, or improve AI models
• Whether prompts, inputs, outputs, usage data, or personal information are retained
• Whether customer data may be shared with affiliates, vendors, or model providers
• Whether data is anonymized, aggregated, or de-identified before use
• Whether the customer can opt out of AI training or withdraw consent
• Whether data may be used to train general-purpose models serving other customers
• Ownership or licensing rights in customer data, model outputs, or trained models
• Security, deletion, retention, or confidentiality obligations relating to AI training

Risk Assessment

Because the inserted 129 words are not provided, the following risks cannot be assessed:

1. Expanded data-use rights: The amendment might authorize broader use of customer data beyond providing the contracted services.

2. AI-training rights: It might permit use of customer content or personal data to train or improve models, potentially for the provider’s general commercial purposes.

3. Loss of control: The customer might lack an opt-out right, deletion mechanism, or visibility into which data is used.

4. Third-party disclosure: The amendment might allow data to be transferred to subprocessors or external AI providers.

5. Confidentiality and regulatory exposure: AI-related use could conflict with confidentiality obligations, privacy laws, sector-specific requirements, or the customer’s own commitments to its users.

6. Intellectual-property uncertainty: The amendment might grant broad rights to use customer materials or fail to clarify ownership of outputs and derived models.

Information Needed

Please provide the actual added, deleted, and replacement language. Without the text of the changes, no reliable legal comparison or determination regarding AI-model training can be made.

Summary of Important Changes

1. Expanded purposes for using personal information

The revised statement adds broader business and product-development purposes, including:

• Providing Proofpoint products, services, and customer support.
• Improving and enhancing products and services, including threat-detection capabilities.
• Continuing to develop threat intelligence to safeguard an organization’s information.
• Advertising and marketing to customers and their representatives.
• Delivering Proofpoint’s privacy and cybersecurity protection.

Risk

These additions expand the stated purposes for processing data beyond simply providing the service. The language may allow Proofpoint to use information collected through customer interactions or services for product improvement and threat-intelligence development. The statement does not clearly define:

• Which categories of customer data may be used;
• Whether customer email content, attachments, metadata, telemetry, or threat samples are included;
• Whether data is aggregated, de-identified, or retained in identifiable form;
• Whether data is shared with affiliates or service providers for these purposes; or
• Whether customers can opt out.

2. Potential AI-model training implications

The revised text does not expressly use the terms “artificial intelligence,” “AI,” “machine learning,” or “training models.” However, the new references to “improving and enhancing” products, “threat-detection capabilities,” and developing “threat intelligence” could encompass the use of data to train, tune, evaluate, or improve automated detection systems, including AI or machine-learning models.

Key concern

Because the policy does not expressly exclude customer content or identify limits on AI-related use, customers may face uncertainty about whether their data can be used to develop models benefiting Proofpoint or other customers. The policy also does not state whether information used for model development can later be deleted or isolated from trained models.

Customers should review the applicable service agreement, data processing agreement, product-specific terms, and any Trust-site documentation for more specific restrictions.

3. Revised data-control rights

The statement now says customers can request that Proofpoint stop using or sharing data by contacting Customer Support at privacy@proofpoint.com. It also retains rights to access, correct, amend, or delete personal data, subject to applicable law and certain conditions.

Risk

The new “stop using or sharing” language is potentially helpful, but it is qualified by legal conditions and does not expressly address data already incorporated into analytics, threat intelligence, or AI/ machine-learning models.

4. Administrative and contact changes

• The statement is identified as effective October 10, 2025.
• Privacy-related requests now consistently direct users to privacy@proofpoint.com.
• The statement adds or clarifies references to social-media widgets and Proofpoint’s EU/UK privacy contacts.
• The wording concerning service providers and GDPR-related documentation is updated but does not materially explain the scope of product-improvement data use.

Overall assessment

The most significant substantive change is the broader authorization to use information for product enhancement and threat intelligence. Although AI training is not expressly stated, the language is broad enough that AI/ machine-learning development may be included.

Summary

The supplied diff contains only the statement:

> “Added approximately 129 words to the document”

It does not include the actual added, deleted, or replaced legal language. As a result, the substantive changes and risks cannot be analyzed.

AI Training and Customer Data

No conclusions can be drawn about whether the document now:

• Permits or restricts using customer data to train AI models;
• Allows use of customer data to improve, fine-tune, or evaluate models;
• Uses customer data for service-specific models or shared/general models;
• Requires customer consent or provides an opt-out;
• Anonymizes, de-identifies, aggregates, or otherwise processes customer data before training;
• Allows retention of prompts, outputs, or other customer content;
• Permits human review or disclosure to third-party AI providers; or
• Limits the provider’s liability or security obligations for AI-related processing.

Required Information

Please provide the actual redlined text, using the stated notation:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

Without the underlying language, any assessment of legal effect—particularly regarding AI training and customer-data rights—would be speculative.

Summary of Important Changes

1. Broader stated purposes for using personal information

The revised statement adds or emphasizes that Proofpoint may use information for:

• Providing Proofpoint products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to protect an organization’s information;
• Advertising and marketing to customers and organizational representatives; and
• Delivering the expected privacy and cybersecurity protection.

Risk: These purposes are broader and more operationally focused than the prior wording. “Improving,” “enhancing,” and “developing threat intelligence” are relatively open-ended and may permit additional analysis or reuse of customer-related information beyond simply providing the contracted service.

2. AI and model-training implications

The diff does not expressly mention artificial intelligence, machine learning, training models, generative AI, or de-identification. However, the new references to:

• Improving threat-detection capabilities; and
• Developing threat intelligence;

could potentially encompass automated analysis, machine-learning development, or training and tuning AI models.

Key risk: Because there is no express statement limiting whether customer data, customer content, emails, telemetry, or derived data may be used to train or improve AI models, the policy leaves that issue unclear. It also does not specify:

• Whether customer data is used for model training;
• Whether data is aggregated, anonymized, or de-identified first;
• Whether customer data is used to train models shared across customers;
• Whether customers can opt out;
• How long training data or model-derived information is retained; or
• Whether the use applies to customer content processed under a separate service agreement or data processing agreement.

Customers should check the governing service terms, product-specific terms, security documentation, and data processing agreement for more precise restrictions. The privacy statement alone does not appear to create a clear prohibition on AI-model training.

3. Revised data-subject rights language

The revised section states that individuals can request that Proofpoint stop using or sharing their data and can access, correct, amend, or delete information under applicable law and certain conditions.

Risk/benefit: This adds a clearer mechanism to request restriction of use or sharing, but the rights remain qualified by applicable law and unspecified conditions. It does not expressly provide an AI-training opt-out or explain whether deletion or restriction would affect already-trained models or derived threat intelligence.

4. Contact and administrative updates

The statement adds or standardizes privacy@proofpoint.com for privacy, deletion, marketing, and access requests. It also adds social-media-widget language and minor terminology, formatting, and contact-detail changes.

Overall assessment

The principal substantive change is the broader description of product improvement and threat-intelligence purposes. Although AI training is not expressly authorized, it is not expressly excluded. Customers requiring limits on use of their data for AI or machine-learning purposes should seek an explicit contractual restriction and clarification of treatment of customer content, telemetry, derived data, and trained models.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 129 words to the document”

Because the specific additions, deletions, and replacements are missing, it is not possible to determine:

• What contractual terms changed;
• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether data may be shared with affiliates, vendors, or model providers;
• Whether customer data is de-identified, aggregated, or retained;
• Whether the customer can opt out of AI training or other secondary uses;
• Whether confidentiality, security, ownership, or intellectual-property rights were modified; or
• Whether any new indemnity, liability, compliance, or termination risks were introduced.

AI Training Risk

No conclusion can be reached about AI-model training from the information supplied. The actual added language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models;
• “inputs,” “outputs,” prompts, or usage data;
• “de-identified,” “aggregated,” or “anonymized” data;
• rights granted to affiliates, subprocessors, or third-party AI providers;
• perpetual, irrevocable, worldwide, royalty-free, or sublicensable licenses;
• customer opt-out, deletion, retention, or audit rights; and
• restrictions on using confidential or personal information.

Required Information

Please provide the full redline or the actual 129 added words, using the stated notation:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

Without the underlying text, any legal-risk analysis would be speculative.

Analysis Summary

The diff does not include the actual amended language. It only states:

> “Added approximately 129 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added, deleted, or replaced;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use is subject to consent, opt-out, anonymization, or security restrictions;
• Whether the customer’s data may be shared with affiliates, vendors, or model providers;
• Whether the provider obtains ownership or broad usage rights in customer data or generated outputs;
• Whether confidentiality obligations, retention periods, or deletion rights have changed; or
• Whether the customer bears additional compliance, indemnity, or liability risks.

AI Training Risk

No conclusion can be drawn about AI-model training because the substantive added language is missing. The statement that approximately 129 words were added does not reveal whether the changes:

• Permit training on customer content by default;
• Allow use of data for generalized product improvement;
• Restrict training to de-identified or aggregated data;
• Provide an opt-out or require affirmative consent;
• Permit human review or vendor access; or
• Apply protections only to certain categories of customer data.

Required Information

Please provide the full redline or the exact 129 added words, including any surrounding provisions needed to interpret them. Once provided, the changes can be assessed for legal effect, including data ownership, confidentiality, AI training permissions, third-party disclosures, retention, security, and customer remedies.

Summary of Important Changes

1. Broader stated purposes for using information

The revised statement adds or emphasizes that Proofpoint may use information for:

• Providing Proofpoint products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to protect an organization’s information;
• Advertising and marketing to customers and organizational representatives; and
• Delivering the expected privacy and cybersecurity protection.

Risk: These purposes are broader and more operationally focused than the prior language. “Improving” services and “developing threat intelligence” could support secondary uses of customer-related data beyond merely providing the contracted service. The statement does not clearly define what data may be used, whether it is aggregated or de-identified, or whether customer content, email data, threat telemetry, or derived data is included.

2. AI-model training implications

The changes do not expressly state that customer data will be used to train, fine-tune, evaluate, or improve artificial-intelligence or machine-learning models.

However, the new references to:

• “Improving and enhancing” products;
• Improving “threat-detection capabilities”; and
• “Continuing to develop threat intelligence”

could potentially encompass machine-learning development or AI model training.

Key risk: The policy does not provide a clear limitation stating that customer data will not be used for AI training, nor does it provide a specific consent mechanism, contractual restriction, opt-out, retention limit, or commitment to use only aggregated/de-identified data for those purposes. Customers should confirm through the agreement, data-processing addendum, product terms, or written clarification whether service data or customer content may be used to train or improve AI systems.

3. Expanded and clarified collection channels

The revised text more clearly lists ways individuals may provide contact information, including:

• Free trials;
• Offers on the website;
• Newsletters;
• White-paper downloads; and
• Responses to newsletters or other communications.

This may expand the practical scope of information collected for marketing and lead-generation purposes.

4. Marketing and unsubscribe process

The revised language adds a specific privacy email address—privacy@proofpoint.com—and refers to unsubscribe instructions. Marketing remains permitted where the individual has consented.

Risk: The statement does not clearly explain how organizational contacts, representatives, or business users can withdraw consent or object to marketing across all channels.

5. Data-subject rights and control

The revised section:

• Adds a commitment to privacy and security;
• Provides the privacy email for requests;
• States that individuals may request that Proofpoint stop using or sharing their data; and
• Retains rights to access, correct, amend, or delete data under applicable laws and certain conditions.

This is generally favorable, but the rights remain qualified by applicable law and unspecified conditions.

6. Administrative and presentation changes

The statement is dated October 10, 2025, updates terminology and contact details, adds social-media-widget language, and clarifies Proofpoint’s EU controller information and privacy resources. Some formatting and wording appear duplicated or corrupted in the diff; the final published version should be checked for accuracy.

Executive Summary

The revised Privacy Statement is effective October 10, 2025 and substantially rewrites the description of Proofpoint’s purposes for processing information. It provides broader, more business-oriented purposes and clearer privacy contact details, but does not expressly explain whether customer data is used to train artificial-intelligence or machine-learning models.

Important Changes and Risks

1. Broader purposes for using information

The revised language expressly states that Proofpoint may use information for:

• Providing Proofpoint products, services, and customer support;
• Improving and enhancing products and services, including threat-detection capabilities;
• Continuing to develop threat intelligence to protect an organization’s important information;
• Advertising and marketing to customers and their representatives; and
• Delivering privacy and cybersecurity protection.

These purposes are broader than the prior wording, which primarily described collecting contact information and providing the service. The terms “improving,” “enhancing,” and “developing threat intelligence” are not narrowly defined and could permit additional internal analysis or product development uses.

2. AI/model-training implications

The revisions do not expressly state that customer data, customer content, emails, telemetry, or threat data may be used to train AI or machine-learning models. They also do not expressly prohibit such use.

However, the new references to improving threat-detection capabilities and developing threat intelligence could potentially encompass:

• Training, testing, or fine-tuning AI or machine-learning systems;
• Creating threat-detection models from customer-related data;
• Combining data across customers to improve Proofpoint’s products; or
• Using derived threat indicators or analytical results for broader commercial purposes.

The statement does not clarify whether customer data is anonymized, aggregated, de-identified, retained for model training, shared with affiliates or vendors for that purpose, or excluded from generative-AI training. Customers should seek a specific contractual commitment addressing these issues.

3. Customer control and deletion rights

The revised statement adds that individuals can request Proofpoint to stop using or sharing their data by contacting Customer Support. It also retains rights to access, correct, amend, or delete information under applicable law.

This is helpful, but the rights remain subject to “certain conditions,” and the statement does not explain whether stopping use or deletion would affect already-created models, derived threat intelligence, backups, or aggregated data.

4. Marketing and communications

The revised language expressly includes advertising and marketing to customers and organizational representatives. It adds an unsubscribe route through privacy@proofpoint.com and communication-specific unsubscribe instructions.

5. Other clarifications

• Privacy-related requests and inquiries may be sent to privacy@proofpoint.com.
• The policy refers to service providers supporting functions such as analytics, database management, and site improvement.
• It clarifies Proofpoint’s EU controller and adds the privacy email address to the contact section.
• Social-media widgets are expressly identified.

Recommended Follow-Up

Request confirmation of whether any customer data or service-generated data is used for AI/model training, the applicable opt-out or deletion mechanism, retention of trained models, and whether the use is governed by the customer’s data-processing agreement rather than this public privacy statement.

Summary

The diff only states that approximately 129 words were added; it does not include the added legal language itself.

AI Training and Customer Data

• No conclusions can be drawn about whether customer data may be used to train, fine-tune, evaluate, or otherwise improve AI models.
• The diff does not reveal whether any new rights were granted to the provider, such as:
• Using customer content or prompts for model training;
• Retaining data for training or service improvement;
• Combining customer data with other users’ data;
• Creating or commercializing derivatives, aggregated data, or model outputs;
• Opting customers in or out of training;
• Applying different rules to personal data, confidential information, or de-identified data.

Other Legal Risks

The added language is not provided, so it is not possible to assess changes involving:

• Ownership or licensing of customer data;
• Confidentiality and privacy obligations;
• Data retention and deletion;
• Security and breach responsibilities;
• Intellectual-property rights;
• Liability, indemnities, or warranties;
• Compliance with applicable data-protection laws;
• Changes to termination rights or post-termination data use.

Conclusion

The actual 129-word addition is required for a meaningful legal analysis. Based on the information provided, no specific contractual change or AI-training risk can be identified.

Summary

The provided diff does not include the actual contractual language that was added, deleted, or replaced. It only states:

> “Added approximately 129 words to the document”

Accordingly, it is not possible to identify:

• Changes to customer data rights or permitted uses
• Whether customer data may be used to train, fine-tune, validate, or improve AI models
• Any new consent, opt-out, or data-retention provisions
• Changes to confidentiality, security, or privacy obligations
• Whether data may be shared with affiliates, subprocessors, or third-party AI providers
• Ownership or licensing rights in customer inputs, outputs, or derived data
• New limitations of liability, indemnities, or compliance obligations

AI Training Risk

No determination can be made regarding AI-model training because the relevant added language is not included. The statement that approximately 129 words were added does not reveal whether those words:

• Authorize training on customer content by default;
• Permit use of de-identified, aggregated, or pseudonymized data;
• Allow human review or disclosure to model providers;
• Grant the provider broad rights to retain or reuse data;
• Restrict training to service improvement; or
• Provide the customer with an opt-out or deletion right.

Information Needed

Please provide the full redline text, including:

• Additions in {braces};
• Deletions in [brackets]; and
• Replacements in []{}

Once the actual language is provided, the changes can be assessed for legal effect and specific risks, particularly concerning customer-data use in AI training.