Sketch

Key Changes and Risks

1. AI-model training

• The revised statement does not expressly refer to AI, machine learning, generative AI, or training AI models.
• It continues to permit recording and monitoring communications with support for purposes including “training and quality control purposes.” In context, this appears to mean employee/support training and service quality, not necessarily AI-model training.
• Earlier wording linked consent to processing data to “analyse, assess and improve our services, and for training and quality control purposes.” The revised wording places this within a broader description of support, service improvement, and quality-control processing.
• Risk: Because “training” is not defined, customers may be uncertain whether communications, uploaded content, prompts, designs, or other service data could be used to train automated systems or AI models. The statement should expressly state whether customer content and communications are—or are not—used for AI training, whether data is anonymized, and whether customers can opt out.

2. Expanded data collection

The revised statement more clearly covers the website, Mac app, Web app, and iOS app and expands or clarifies the categories of data collected, including:

• Email, phone number, language, account credentials, usernames, avatars, and license keys.
• Payment details, including card-related information and issuing bank/country.
• Support records, student-status documentation, and potentially date of birth.
• IP address and inferred country.
• Device information, including computer name, model, GPU/CPU, UDID/Mac identifier, operating-system version, timestamps, and license identifier.
• Information from employers, resellers, agents, or other customer organizations.

Risk: The revised language includes a broad catch-all allowing collection of other personal data where required by law or necessary for stated purposes. This may reduce predictability and create data-minimization concerns.

3. Broader and revised purposes/legal bases

• Purposes are reorganized and broadened to include service provision, support, product improvement, fraud prevention, legal compliance, communications, analytics, and marketing.
• The revised legitimate-interest language expressly includes commercial interests, product/service improvement, fraud prevention, and reporting suspected criminal conduct.
• Communications may be recorded and monitored, subject to a “reasonable” and human-rights balancing qualification.

Risk: Reliance on legitimate interests may permit processing without consent, including analysis of usage and support communications. The scope and retention period for recordings are not specified in the diff.

4. Sharing and transfers

• Third-party categories are clarified to include IT/data-hosting providers, payment providers, communications providers, subprocessors, authorities, and business transferees.
• International transfers may rely on European Commission Standard Contractual Clauses.

Risk: Data may be transferred in a sale of the business or assets, with limited customer control beyond contacting the transferee.

5. Customer rights/contact

The revision adds a specific privacy email address and more clearly describes rights requests and complaints to a supervisory authority.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 338 words to the document”

Accordingly, it is not possible to identify:

• The substantive legal changes;
• New obligations, rights, or liabilities;
• Changes to data ownership, confidentiality, or permitted use;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Any opt-out, consent, retention, security, or deletion provisions; or
• Any changes to warranties, indemnities, intellectual property, or compliance obligations.

AI Training and Customer Data

No conclusion can be drawn about AI model training from the information provided. The actual added language is required to determine whether it:

• Authorizes use of customer data or prompts for model training or improvement;
• Permits use of aggregated, anonymized, de-identified, or derived data;
• Applies automatically or requires the customer’s consent;
• Allows data to be shared with affiliates, vendors, or third-party AI providers;
• Imposes retention periods or permits indefinite retention;
• Gives the customer an opt-out or deletion right; or
• Grants the provider rights to use customer content beyond providing the services.

Information Needed

Please provide the full diff, including the text inside the addition markers {}, deletion markers [], and replacement markers []{}. With the actual language, the changes can be assessed for legal significance and customer risk.

Key Changes and Risks

1. AI-model training and communications

• The revised statement expressly says Sketch may record and monitor communications with users to:
• maintain records;
• check instructions;
• analyse, assess and improve services; and
• conduct “training and quality control purposes.”
• The earlier wording referred generally to recording or monitoring communications and did not expressly identify training as a purpose.
• The revised text places this processing under consent, stating that Sketch relies on consent where users have given explicit consent to process personal data for a specific purpose.

Risk and interpretation:

• “Training” is not defined. It could mean employee/support-agent training, AI-model training, or both. Because the requested comparison concerns AI, the wording creates a potential ambiguity about whether support tickets, chats, calls, or other communications may be used to train AI systems.
• The statement does not expressly say that customer designs, files, project content, prompts, or other Platform data will be used to train AI models. However, it also does not expressly exclude that use.
• It does not specify whether training data is anonymised, how long it is retained, whether third-party AI providers receive it, whether models retain or reproduce content, or how consent can be withdrawn.
• Customers should seek confirmation that customer content and confidential information are excluded from model training unless separately and expressly authorised.

2. Broader and more detailed data collection

The revised statement reorganises and expands the categories of data collected, including:

• account details, such as profile images, aliases, usernames and licence keys;
• payment details, including card-owner information, card metadata, issuing bank and country of origin;
• proof of student status, potentially including date of birth;
• IP address and country information;
• device identifiers and technical data, including Mac UDID, device model, GPU/CPU type, operating-system version, timestamps and licence identifiers; and
• information from employers, resellers, agents and other customer organisations.

This may increase the types of personal and potentially confidential business information covered by the notice.

3. Purposes and legal bases

• The revised statement provides a more structured list of purposes and legal bases.
• “Legitimate interests” are broadened to include improving products and services, fraud prevention and reporting possible criminal acts.
• Marketing and product communications are described more clearly, with an opt-out mechanism and consent where legally required.
• Analytics and product-use analysis remain identified purposes.

4. Sharing and transfers

• Sharing categories are clarified to include IT/data-hosting providers, payment providers, communication providers, subprocessors, authorities and potential business transferees.
• The revised language directs transferees to use data consistently with the statement but does not materially limit transfer risk.
• International-transfer safeguards, including EU Standard Contractual Clauses, remain relevant.

5. Customer action points

• Confirm whether “training” includes AI-model training.
• Request contractual limits excluding customer content, confidential information and personal data from AI training.
• Ask about anonymisation, retention, subprocessors, model providers, deletion and consent withdrawal.
• Review enterprise data-processing terms, which may provide stronger protections than this privacy statement.

Summary

The provided diff only states: “Added approximately 338 words to the document.” It does not include the actual added language or identify any deleted or replaced terms.

Key legal changes

• Cannot be determined: The substantive changes, including modifications to liability, confidentiality, data rights, intellectual property, security, or termination provisions, cannot be assessed without the text of the 338 added words.
• AI-model training provisions: No conclusion can be reached about whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• Risk assessment: Any risks associated with the additions—including broader data-use rights, reduced confidentiality protections, lack of opt-out rights, indefinite retention, or sharing with affiliates and service providers—remain unknown.

Information needed

Please provide the actual diff, including the added text and any deleted or replacement language. Without that text, it is not possible to identify the important legal changes or new risks.

Key Changes and Risks

1. AI-model training and service-improvement use

• The revised statement expressly adds processing of personal data for “training and quality control purposes” in connection with support communications.
• This replaces or expands the former wording, which referred mainly to recording or monitoring communications, maintaining records, checking instructions, and improving services.
• The revised legal-basis language states that this processing occurs where the customer has given “explicit consent” to process personal data for “a specific purpose.”
• Important limitation: the text does not clearly say whether “training” means:
• training or fine-tuning AI models;
• human-agent or support-staff training;
• automated quality-assurance systems; or
• general product and service improvement.
• It also does not specify whether customer content, uploaded designs, prompts, support tickets, or other service data may be included, whether data will be anonymised or pseudonymised, how long training data is retained, whether trained models can retain or reproduce customer information, or whether customers can withdraw consent and have previously used data removed.
• The statement does not appear to provide a clear customer-data opt-out mechanism specifically for AI training. Customers should seek clarification or contractual limits if their data is confidential, proprietary, regulated, or subject to client restrictions.

2. Broader and more detailed data collection

The revised statement:

• Clearly identifies Sketch B.V. as the controller and identifies the Sketch website and Platform, including Mac, Web, and iOS applications.
• Expands or clarifies categories of data collected, including:
• contact and account information;
• payment details;
• support and other communications;
• proof of student status, potentially including date of birth;
• IP address and estimated country;
• browser, device, hardware, unique-device identifiers, timestamps, and license identifiers.
• Adds broader wording allowing collection of other personal data where required by law or necessary for the purposes listed in the statement. This is potentially open-ended.

3. Legal bases and monitoring

• The revised statement provides a more structured list of legal bases: contract, legal obligation, legitimate interests, and consent.
• Legitimate interests now expressly include improving products and services, fraud prevention, and reporting possible criminal conduct.
• Communications may be recorded and monitored, subject to reasonableness and balancing against individual rights. The scope, retention period, and notice process remain unclear.

4. Cookies and analytics

• The revised wording clarifies that analytics, advertising, and functionality cookies are used only after consent.
• It states that certain necessary cookies may be used for website and application operation.

5. Sharing, transfers, and business sales

• Sharing categories are reorganized and include service providers, IT and hosting providers, payment providers, communications providers, subprocessors, and authorities.
• Personal data may be transferred with a business or asset sale, with reasonable efforts to require consistent use.
• International transfers may rely on European Commission Standard Contractual Clauses.

Overall assessment

The revision is more comprehensive, but the new training-related language creates a material ambiguity and potential risk. Customers should request a precise definition of “training,” confirmation of whether AI models are involved, the data covered, retention and deletion rules, and a practical opt-out or consent-withdrawal process.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 294 words to the document”

As a result, it is not possible to identify:

• The legal or commercial effect of the additions;
• New obligations, rights, limitations, or liabilities;
• Changes to data ownership, confidentiality, privacy, or security;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether such use requires consent, can be opted out of, or applies automatically;
• Whether the provider may use customer data for model training after termination;
• Whether data may be shared with affiliates, subprocessors, or third-party AI providers; or
• Any changes to indemnities, warranties, audit rights, intellectual-property rights, or liability caps.

AI-Training Review

No conclusion can be drawn about AI-model training because the added wording is not provided. The relevant language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “evaluate” models;
• “customer data,” “content,” “inputs,” “outputs,” or “usage data”;
• Rights granted to use data in aggregated, de-identified, anonymized, or identifiable form;
• Opt-in or opt-out mechanisms;
• Retention and deletion periods;
• Use by affiliates, contractors, subprocessors, or public/commercial models; and
• Ownership or licensing of data, inputs, outputs, and model improvements.

Information Needed

Please provide the actual 294-word addition and, ideally, the surrounding original language. The complete diff should show:

• Added text in {braces};
• Deleted text in [brackets]; and
• Replacement text in []{braces}.

Without the substantive text, any assessment of legal risk would be speculative.

Structured Summary of Important Changes

1. New Data-Processing Materials and AI-Related References

• The EULA now appears connected to a Data Processing Addendum, including:
• Annex 1 – Details of Processing
• Annex 2 – Security Measures
• References to subprocessors, privacy statements, and security policies.
• The document’s navigation includes references to “LLMs” and “Processing,” suggesting the materials may address large language models or AI processing.
• However, in the substantive wording provided, there is no express authorization to use customer content, designs, files, prompts, or other customer data to train AI models.
• The new “Use of data” clause authorizes Sketch and its subsidiaries to collect and use technical and related data, including:
• The Sketch App version installed; and
• Information about the system on which it is installed.
• Permitted purposes include maintenance, support, product improvement, and providing further services or technologies.
• Sketch may process personal data where necessary to provide the License Key, maintain/support the App, and comply with data-protection law, with further details deferred to the Privacy Statement.

AI/Data Risk

• The language is broad enough to permit use of telemetry and potentially personal data for product improvement, but it does not clearly define whether such data may be used for:
• Training or fine-tuning AI models;
• Evaluating AI systems;
• Developing generative-AI features; or
• Sharing with AI vendors or subprocessors.
• The EULA should be reviewed together with the referenced DPA, Annexes, Privacy Statement, and Subprocessor list. Those documents may contain the operative AI-training permissions.
• Customers should seek explicit clarification that customer content and confidential information will not be used to train general-purpose or third-party AI models, unless expressly authorized.

2. Acceptance and Authority

• Acceptance is expanded and clarified for companies and other legal entities.
• A person accepting on behalf of an organization warrants that they have full authority to bind it.
• Users must be legally capable of entering a binding contract.

Risk: The authority warranty places responsibility on the individual accepting the EULA and may create internal liability if they lack authorization.

3. Definitions and Contract Structure

• “Sketch” is newly identified as Sketch B.V., including its Dutch registration and VAT details.
• Definitions for the Sketch Mac App, License Key, Open Source Software, Updates, Use, and Documentation are reorganized or expanded.
• Documentation and license terms may be determined by Sketch’s website, store webpage, or another applicable purchase agreement.

Risk: Incorporating changing website materials may allow important operational or license terms to change outside the signed EULA.

4. Liability and Warranty Changes

• The liability cap is restated as the total amount paid to Sketch in the preceding 12 months.
• The exclusion of consequential and indirect damages is retained, including lost profits, business interruption, and loss of data.
• Exceptions now address death or physical injury caused by negligence and damages arising from intentional misconduct or gross negligence.
• “As is” and “as available” warranty disclaimers remain.

Risk: The revised wording may provide Sketch with a broad limitation of liability, particularly for data loss, service interruption, and third-party involvement. The precise interaction between the cap and exceptions should be checked in the final formatted version.

5. Termination

• The EULA remains in force until expiry or termination of the Sketch Mac License.
• The license automatically terminates in specified circumstances, with loss of access to the Mac App.

Overall assessment: The most material change is the introduction of a broader data-use and processing framework. It improves transparency regarding technical telemetry and legal compliance but does not clearly resolve whether customer data may be used for AI training.

Executive Summary

The revision appears to replace or substantially restructure the EULA, adding links and references to a Data Processing Addendum, Annex 1 (Details of Processing), Annex 2 (Security Measures), subprocessors, and privacy materials. The provided diff is heavily interleaved and does not show the full new annex text, so important obligations—particularly regarding customer content and AI—cannot be confirmed from this extract alone.

AI and Data-Use Changes

• No express authorization to use customer content to train AI models is shown. The diff does not expressly state that Sketch may use designs, files, workspace content, prompts, outputs, or other customer-provided content to train, fine-tune, evaluate, or improve AI models.
• The new “Use of data” provision expressly allows Sketch and its subsidiaries to collect and use “technical and related data” concerning the licensed app, including:
• the app version installed; and
• information about the system on which it is installed.
• The stated purposes expand beyond maintenance to include:
• maintenance and support;
• improving products;
• providing further services; and
• providing further technologies.
• Sketch may process personal data “to the extent necessary” to provide the license, support, and comply with legal obligations, subject to applicable data-protection law and the privacy statement.
• Risk: “Technical and related data,” “improve its products,” and “further technologies” are broad and could potentially encompass usage analytics or product-development data. The EULA does not clearly state whether such data may be used for AI training, whether it is anonymized, or whether customers can opt out.
• The new DPA and annexes may contain the operative rules on customer data, subprocessors, security, retention, and AI processing. Those documents should be reviewed together with the EULA.

Other Material Changes

Contract Formation and Authority

• Acceptance is now expressly permitted on behalf of a company or legal entity, with a warranty that the individual has authority to bind it.
• Minors may not accept the EULA.
• Agreement is formed through purchasing a license and/or downloading or using the app.

Definitions and Documentation

• “Sketch” is newly identified as Sketch B.V., including its Dutch registration and VAT details.
• Documentation is now tied to information on Sketch’s website, as amended from time to time, rather than solely the store page or purchase agreement.
• The Sketch Mac License is linked to the term stated on the purchase webpage or applicable purchase agreement.

Liability

• Liability is recast as a cap generally limited to amounts paid to Sketch in the preceding 12 months.
• The revised wording retains broad exclusions for consequential and indirect loss, including loss of profits, business interruption, and data loss.
• Exceptions are stated for death or physical injury caused by negligence and damages arising from intent, wilful misconduct, or gross negligence.
• Risk: The revised cap and exclusions may materially restrict recovery for data loss, service disruption, or confidentiality/privacy incidents.

Termination

• The EULA continues until expiry or termination of the Sketch Mac License.
• The license may terminate automatically when the user loses the relevant Workspace Editor role, causing loss of app access.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 294 words to the document”

Without the specific additions, deletions, or replacement text, it is not possible to reliably identify:

• Changes to customer-data rights or permitted uses
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Any new consent, opt-out, or objection rights
• Whether data is anonymized, aggregated, or retained
• New data-sharing, confidentiality, or security obligations
• Changes to intellectual-property ownership
• Liability, indemnity, audit, or regulatory risks

AI-Training Review

No conclusion can be drawn about AI-model training from the information provided. The 294 added words could potentially introduce important rights for the provider, such as permission to use customer content, prompts, outputs, usage data, telemetry, or derived data to train or improve artificial-intelligence systems. However, the actual wording is required to determine whether such use is:

• Allowed automatically or only with customer consent
• Limited to de-identified or aggregated data
• Applicable to human review or third-party providers
• Subject to an opt-out mechanism
• Permitted after termination
• Covered by confidentiality and security protections

Required Information

Please provide the full diff, including the text marked with:

• {additions}
• [deletions]
• []{} replacements

A comparison showing only the number of added words is insufficient for legal analysis.

Summary

The provided diff does not include the text of the added language. It only states:

> “Added approximately 294 words to the document”

Because the actual additions, deletions, and replacements are not shown, it is not possible to determine what legal terms changed or whether the changes create new risks.

AI Training and Customer Data

The diff does not provide enough information to assess whether:

• Customer data may be used to train, fine-tune, or improve AI models;
• Customer data may be combined with other customers’ data for model development;
• De-identified, aggregated, or pseudonymized data may be used for AI training;
• Human reviewers or third-party service providers may access customer data;
• Customer data may be retained after termination for model training or other purposes;
• The customer can opt out of AI training or require prior consent;
• The provider owns models, outputs, or derivatives developed using customer data; or
• Confidentiality, security, deletion, or data-location commitments have changed.

Risk Assessment

No specific new legal risks can be identified from the information supplied. The statement that approximately 294 words were added does not reveal:

• The scope of any new rights granted to the provider;
• Any expansion of permitted data uses;
• Changes to confidentiality or privacy obligations;
• New liability exclusions or indemnity obligations; or
• Changes to termination, deletion, audit, or compliance rights.

Information Needed

Please provide the actual redline text, including the added language in {}, deleted language in [], and replacement language in []{}. The AI-training provisions and related data-use terms can then be analyzed for scope, consent requirements, ownership, confidentiality, retention, opt-out rights, and liability exposure.

Executive Summary

The diff appears to replace substantial portions of the EULA with a reorganized version dated 6 March 2025, while also adding references to a Data Processing Addendum (DPA) and an Annex 1/Annex 2 concerning processing details and security. Because the diff is heavily interleaved with website-navigation text, the complete operative wording should be verified against the rendered agreement.

Important Changes and Risks

1. New data-use clause

A new “Use of data” provision states that Sketch and its subsidiaries may collect and use:

• Technical and related data concerning the Sketch Mac App;
• The version of the App installed; and
• Information about the system on which it is installed.

The stated purposes include:

• Maintenance and support;
• Improving Sketch products; and
• Providing further services and technologies.

Risk: The new language expressly authorizes product-improvement use and is broader than a purely operational telemetry provision. It does not clearly specify data minimization, retention, aggregation, anonymization, or whether the data may be shared with affiliates or service providers.

2. Personal-data processing is expressly acknowledged

The revised clause states that Sketch may process personal data and will comply with applicable data-protection law, directing users to the privacy statement for details.

Risk: The EULA itself provides few substantive limits. Customers must review the privacy statement and the newly referenced DPA/annexes to determine the legal basis, roles of the parties, international transfers, retention, subprocessors, deletion rights, and security commitments.

3. AI-model training

No express language in the supplied diff authorizes Sketch to use customer content, designs, files, prompts, outputs, telemetry, or personal data to train, fine-tune, or evaluate AI models.

However:

• The new permission to use technical and related data to “improve” products and provide technologies is potentially broad.
• References to “Details of Processing for LLMs” appear to be navigation or document links, rather than a clear substantive training grant.
• The diff does not establish whether customer content is excluded from AI training.

Recommended action: Obtain and review the referenced DPA, privacy statement, and LLM-processing annex. Seek an express contractual statement that customer content and personal data will not be used for AI training without prior written consent, or identify the precise opt-out mechanism.

4. Corporate acceptance and authority

The revised EULA adds an express warranty that a person accepting on behalf of a company or legal entity has authority to bind it.

Risk: Unauthorized acceptance could create internal liability for the individual or uncertainty about enforceability.

5. Liability and warranty restructuring

The revised text restores/reorganizes the “as is/as available” disclaimers and sets liability at no more than amounts paid to Sketch in the preceding 12 months. It also preserves broad exclusions for consequential and indirect losses, including loss of data.

Risk: The revised cap and data-loss exclusion may materially limit recovery for outages, security incidents, or data loss, particularly where the subscription has low fees or is free. The treatment of negligence, willful misconduct, and third-party conduct should be checked in the final text.

6. Termination

The EULA remains in force until expiry or termination of the Sketch Mac License, which terminates automatically upon expiry or termination.

Risk: Access to the App may end automatically, potentially affecting business continuity and access to work product.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 338 words to the document”

Accordingly, it is not possible to identify the legal effect of the changes or assess whether customer data may be used to train AI models.

AI Training and Data Use

No specific language is provided addressing:

• Whether customer data may be used to train, fine-tune, test, or improve AI or machine-learning models;
• Whether prompts, inputs, outputs, metadata, or usage information may be retained for those purposes;
• Whether customer data is anonymized, aggregated, or de-identified before use;
• Whether data may be shared with affiliates, vendors, or third-party AI providers;
• Whether the customer can opt out of AI training or request deletion of training data; or
• Whether the provider claims ownership or broad usage rights over customer content or generated outputs.

Risk Assessment

The risk cannot be determined from the supplied material. The statement that approximately 338 words were added does not reveal whether the additions:

• Expand the provider’s license to use customer content;
• Permit use of confidential or personal information for model training;
• Create broader data-retention or disclosure rights;
• Limit the provider’s liability for AI-related use of data; or
• Add restrictions, safeguards, or customer opt-out rights.

Information Needed

To complete the analysis, provide the actual text of the additions and any deleted or replaced language, using the stated notation:

• Additions: {new text}
• Deletions: [deleted text]
• Replacements: [old text]{new text}

The full diff is necessary to identify material legal changes and any new risks concerning AI model training or other uses of customer data.

Summary of Important Changes

1. AI/model-training-related use of data

• The revised statement expressly says Sketch may process customer personal data, including communications with Sketch, “for training and quality control purposes.”
• This appears in the section concerning technical support and communications. The surrounding language allows Sketch to record and monitor communications to maintain records, check instructions, analyze and improve services, and conduct training and quality control.
• The revised text places this processing under consent, stating that Sketch relies on consent where the user has given “explicit consent” to process personal data for a specific purpose.
• The language does not expressly state that customer files, designs, project content, or other Sketch Platform content will be used to train AI models. It also does not identify:
• whether training involves generative AI or other machine-learning systems;
• whether data is anonymized or de-identified;
• whether human reviewers or third-party AI providers receive the data;
• retention periods or deletion from training datasets; or
• whether users can withdraw consent and have already-used data removed from models.
• Risk: “Training” is broad and could encompass internal staff training, service-quality training, or machine-learning model training. Customers should seek clarification or a contractual restriction if their content or support communications are confidential.

2. Broader and more specific data collection

The revised statement reorganizes and expands the description of information collected, including:

• account and contact details;
• payment information;
• support and other communications;
• proof of student status, potentially including date of birth;
• IP address and estimated country;
• browser, device, hardware, unique device identifiers, operating-system versions, timestamps, and license identifiers; and
• information collected through the Mac, Web, and iOS applications.

The prior statement was more general in places. The revised wording also permits collection of “other types of personal data” where required by law or necessary for the purposes listed in the statement, creating a potentially broad residual category.

3. Legal bases and purposes

• The revised text more clearly identifies contractual necessity, legal obligation, legitimate interests, and consent as legal bases.
• Legitimate interests now expressly include improving products and services, fraud prevention, and reporting possible criminal acts or threats to authorities.
• Support communications may be recorded and monitored, subject to a reasonableness and rights-balancing qualification.

4. Sharing and transfers

• Sharing categories are consolidated and expressly include service providers, IT and hosting providers, payment providers, and communications providers.
• The statement adds or clarifies sharing with subprocessors and authorities, and transfers in connection with a sale or transfer of business or assets.
• The transferee is to use transferred data consistently with the statement, but this is not a detailed contractual guarantee.
• International transfers may rely on European Commission Standard Contractual Clauses.

5. Customer action points

Customers should confirm whether “training” includes AI-model training, whether Platform content is excluded, what consent mechanism applies, and what deletion, opt-out, confidentiality, and subprocessors protections are available.

Summary

The provided diff states only: “Added approximately 338 words to the document.” It does not include the actual added, deleted, or replaced contractual language.

Key Changes

• Not determinable: The substantive changes cannot be identified without the text of the 338 added words.
• No confirmed legal changes: It is not possible to assess whether the additions change liability, confidentiality, intellectual property, data protection, security, termination, pricing, or other contractual obligations.
• No confirmed AI-related changes: The available diff does not reveal whether customer data may be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Retained or reused for model development;
• Combined with other customer data;
• Shared with affiliates, vendors, or AI providers;
• De-identified or anonymized before use;
• Excluded from training by default or only upon customer request; or
• Subject to opt-out, consent, deletion, or audit rights.

Potential Risks Requiring Review

The actual added language should be checked for provisions that:

1. Grant the provider a broad or perpetual license to customer data.

2. Permit use of data for “product improvement,” “analytics,” or similar terms that may include AI training.

3. Allow use of customer prompts, outputs, personal data, confidential information, or usage data to train models.

4. Permit disclosure to subprocessors or third-party AI/model providers.

5. Make customer responsible for obtaining consent from individuals whose data is submitted.

6. Limit the provider’s deletion obligations after termination.

7. Exclude training-related use from confidentiality, security, or data-processing restrictions.

8. Provide no clear opt-out, deletion, verification, or indemnity protections.

Information Needed

Please provide the actual redlined text, including the words shown in {additions}, [deletions], and []{replacements}. Without that text, no reliable legal analysis—particularly regarding AI-model training or customer-data usage—is possible.

Summary of Important Changes

1. AI-model training and service improvement

• The revised statement expressly adds that Sketch may record and monitor communications with customers to:
• maintain records;
• check instructions;
• analyse, assess and improve services; and
• conduct “training and quality control purposes.”
• An earlier formulation appears to have referred to processing communications for “training and quality control purposes” with consent and for a specific purpose. The final wording appears to place this activity under legitimate interests, although the diff is heavily disordered and should be verified against the clean document.
• Risk: The statement does not clearly define:
• whether “training” means training employees, improving internal processes, or training AI/ machine-learning models;
• whether customer communications, support tickets, uploaded designs, prompts, or other customer content are used;
• whether data is anonymised or pseudonymised before training;
• whether third-party AI providers receive the data;
• how long training data is retained; or
• whether customers can object or opt out.

Important limitation: The diff does not clearly add an express right to use all customer content or Sketch files to train AI models. However, the new references to “training,” service improvement, and monitoring communications create a potential basis for such use—particularly for support communications—and should be clarified contractually.

2. Broader and more detailed data collection

The revised statement reorganises and expands the categories of data collected, including:

• contact details and language spoken;
• account information, including passwords, profile images, aliases, usernames, and licence keys;
• payment information;
• student-status evidence, potentially including date of birth;
• IP address and estimated country;
• browser, device, computer, hardware, operating-system and identifier data;
• timestamps and licence identifiers; and
• information from employers, resellers, agents, or other Sketch customers.

Risk: The expanded categories may increase privacy, security, and data-minimisation exposure, particularly for government identifiers, device identifiers, and proof-of-status documents.

3. New or revised processing purposes and legal bases

The statement more specifically relies on:

• contractual necessity;
• legal obligations;
• legitimate interests, including improving products, preventing fraud, and reporting criminal conduct; and
• consent where legally required.

The former wording concerning monitoring communications and marketing is replaced with broader service-improvement, support, and training language.

Risk: Reliance on legitimate interests for monitoring and training may be challenged if communications contain confidential or sensitive information, especially where customers reasonably expect support conversations to remain limited to support.

4. Sharing and transfers

The statement adds or clarifies sharing with service providers, hosting and IT providers, payment and communications providers, authorities, and transferees in a business sale. It also refers to subprocessors and international transfer mechanisms such as Standard Contractual Clauses.

Risk: Customers should review the subprocessors list and confirm whether any AI vendors process or retain customer data.

Summary

The provided diff does not include the text of the added approximately 338 words. It only states that words were added, without showing their substance.

AI Training and Data Use

• No determination can be made about whether the customer’s data may be used to:
• Train, fine-tune, or improve AI models;
• Develop products or services;
• Create aggregated, anonymized, or de-identified datasets;
• Share data with affiliates, vendors, or AI providers; or
• Retain inputs or outputs for model-training purposes.

Other Legal Risks

The missing language may affect important issues such as:

• Ownership of customer data and generated outputs;
• Confidentiality and permitted disclosures;
• Data retention and deletion;
• Use of personal information;
• Security obligations and breach responsibilities;
• Subprocessor or third-party access;
• Warranties, indemnities, and liability limits; and
• Customer rights to opt out of model training.

A substantive legal analysis requires the actual added, deleted, and replacement language.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 294 words to the document”

Because the added, deleted, and replaced terms are not shown, it is not possible to reliably identify:

• Changes to customer data rights or permitted uses
• Whether customer data may be used to train, fine-tune, test, or improve AI models
• Whether data is anonymized, aggregated, or de-identified before such use
• Whether customer consent is required
• Ownership or licensing changes
• New disclosures, confidentiality obligations, or security requirements
• Changes to retention, deletion, subprocessors, or data-transfer provisions
• New liability limitations, indemnities, or audit rights

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training because the relevant contractual text is missing. In particular, the analysis requires the exact wording of any provisions addressing:

• “Customer Data,” “Inputs,” “Outputs,” or similar terms
• Model training, fine-tuning, machine learning, analytics, or product improvement
• Use of aggregated, anonymized, or de-identified information
• Service-provider or vendor rights to access or reuse data
• Opt-out, consent, or deletion mechanisms
• Whether customer data is used to train models available to other customers

Information Needed

Please provide the full marked-up text showing the additions, deletions, and replacements—for example:

• Additions in {curly braces}
• Deletions in [square brackets]
• Replacements in [old text]{new text}

Without the underlying language, any assessment of legal effect or risk would be speculative.