Squareup

Summary

Scope of the Diff

The diff indicates that approximately 605 words were removed, but it does not identify which provisions were deleted or provide the replacement text.

Important Legal Implications

Because the deleted language is not shown, it is not possible to determine reliably:

• Which contractual rights or obligations were removed;
• Whether liability, indemnity, confidentiality, security, or data-protection terms changed;
• Whether pricing, termination, service levels, warranties, or audit rights were affected;
• Whether customer protections were weakened or provider obligations were reduced; or
• Whether any deleted terms were replaced elsewhere in the agreement.

The deletion itself is potentially significant. Removing approximately 605 words could eliminate limitations, commitments, definitions, or safeguards without making the effect apparent from the supplied diff.

AI Training and Customer Data

The available diff does not contain enough information to determine whether the agreement changed how customer data may be used to train AI models.

In particular, it is not possible to tell whether the deleted language addressed:

• Use of customer data, prompts, inputs, outputs, or usage data for model training or improvement;
• Whether training use required customer consent or was allowed by default;
• Whether the provider could use data in aggregated, de-identified, or identifiable form;
• Opt-out, deletion, or data-retention rights;
• Ownership of inputs, outputs, or models trained using customer data;
• Human review or disclosure of customer content; or
• Restrictions on using confidential or personal data for AI development.

Risk Assessment

The principal risk is lack of visibility into the deleted provisions. If the removed language limited AI training, the deletion could broaden the provider’s ability to use customer data. Conversely, if the deleted language imposed broad usage rights, its removal could improve customer protection. The direction of the risk cannot be determined without the actual text.

Recommended Next Step

Obtain the complete before-and-after versions, or at least the 605 deleted words and any replacement language. Review especially the sections titled:

• Data use and ownership;
• Artificial intelligence or machine learning;
• Confidentiality;
• Privacy and security;
• Service data and telemetry;
• Subprocessors; and
• Data retention and deletion.

Key Changes and Risks

1. AI and customer-data use

• The revised notice expressly identifies “where relevant artificial intelligence technologies” as technologies or programs that Square and its service providers may use to provide, maintain, and improve the Services.
• This is a new or clearer disclosure that AI systems may be involved in Square’s operations and service delivery.
• The notice does not expressly say that customer data will be used to train, fine-tune, or improve general-purpose AI models. It also does not state:
• whether seller data or customers’ data is used as training data;
• whether data is de-identified before AI use;
• whether prompts, outputs, transaction data, or support interactions are retained;
• whether third-party AI providers may use the data for their own model training; or
• whether customers can opt out of AI-related processing.
• Nevertheless, the wording “provide, maintain and improve the Services” is broad and could potentially cover model development or improvement. This creates ambiguity and a potentially significant data-use risk, particularly for transaction, identity, financial, biometric, and customer data.
• The notice also broadens the description of Your Customers’ Data, which may include device information, transaction-related information, and information sellers provide or enter into Square systems. Sellers may need to ensure they have appropriate authority and notices for sharing this data with Square.

2. Expanded and clarified data collection

• Square now describes processing in three categories: information provided directly, information collected during use of the Services, and information obtained from other sources.
• The revised examples more clearly include sensitive information such as:
• bank-account and payment-card information;
• tax information and filing status;
• government identification numbers;
• photo identification;
• facial scans and extracted biometric information;
• precise geolocation;
• device, usage, commercial, and online-tracking data.
• Processing purposes are linked more explicitly to legal bases, including contract performance, legal obligations, and legitimate interests. However, the bases remain broadly stated and may not identify a separate basis for each AI or analytics use.

3. Location tracking and service consequences

• Square adds detailed disclosure of precise geolocation collection.
• Users may disable location access through device settings or uninstall applications, but some mobile applications or Services may no longer function. This increases the practical impact of refusing location collection.

4. Retention, communications, and children

• The prior general retention language is largely replaced with more specific account and operational statements, but no comprehensive retention periods are provided.
• Promotional opt-outs are clarified, while Square may continue sending operational communications, including receipts and account messages.
• Square now states that it does not knowingly collect, share, or sell information from children under 18 and will promptly delete it if discovered.

5. International transfers and rights

• International processing locations are expressly listed, including the United States, Japan, the UK, and EU.
• EU/UK transfer safeguards are described using EU Standard Contractual Clauses, the UK Addendum, and the UK International Data Transfer Agreement.
• EU/UK rights are consolidated and include objection to profiling, limits on solely automated decisions, portability, and withdrawal of consent.

6. Notice changes

• Square may amend the notice with reasonable prior notice of material changes and allows cancellation if users disagree. This creates an ongoing risk that future AI-related uses may be introduced through notice updates rather than a separately negotiated amendment.

Structured Summary of Important Changes

1. AI and Customer-Data Use

• The revised notice adds disclosure that Square may use third-party service providers involving “where relevant artificial intelligence technologies” to help provide, maintain, and improve the Services.
• This is a new and important category of vendor/use disclosure. It could permit customer, seller, usage, transaction, or other data to be processed by AI providers, depending on the underlying service arrangements.
• The diff does not expressly state that customer data will be used to train, fine-tune, or improve general-purpose AI models, nor does it say whether data will be de-identified, retained by AI vendors, or excluded from model training.
• However, the notice separately describes uses such as internal research, measuring and analyzing trends, and improving or personalizing Services. Read together with the AI-provider language, this creates ambiguity and a potential risk that data may be used for AI development or model improvement beyond merely delivering the customer-requested service.
• The notice also covers “Your Customers’ Data,” meaning sellers should assess whether data about their own customers could be processed by AI providers and whether additional notices, consents, contractual restrictions, or data-processing terms are required.

2. Broader and More Detailed Data Collection

• The notice is reorganized to identify three collection sources: information provided directly, information collected during use of the Services, and information obtained from other sources.
• It expressly categorizes Square Account Data, Usage Data, External Data, and customer data.
• Financial, tax, identity, biometric, device, commercial, transaction, browsing, IP, cookie, and employment-related information remain within scope. Identity-verification information may include facial scans and extracted biometrics.

3. New or Expanded Location-Data Disclosure

• Square may request precise geolocation from a device.
• Refusing access may prevent use of certain Services, and mobile applications may stop functioning.
• Users may disable collection through device settings or uninstalling the applications. This is a clearer statement of the operational consequences of refusal.

4. Retention and Deletion

• The prior language described retaining data for the lifetime of the account and for legal reasons. The revised text is less focused on specific retention periods and instead provides broader operational and legal explanations.
• Children’s data language changes from retention for legal obligations to a statement that Square does not knowingly collect, share, or sell information from children under 18 and will promptly delete it if discovered.

5. International Transfers and Individual Rights

• The revised notice gives more detail about processing in the United States, Japan, the UK, EU, and other countries.
• It identifies EU Standard Contractual Clauses, the UK Addendum, and the UK International Data Transfer Agreement as safeguards.
• EU/UK rights are presented more fully, including objection to profiling, objection to solely automated decisions, portability, restriction, erasure, and withdrawal of consent.

6. Changes and Practical Risks

• Square may amend the notice, with reasonable prior notice for material changes and cancellation as the stated remedy.
• The notice permits continued non-promotional communications, including receipts and account messages, after marketing opt-out.
• The AI language should be clarified before acceptance, particularly regarding training, vendor retention, use of customer data, opt-out rights, and deletion.

Summary of Legal Changes

Information Provided

The diff states only:

> [Removed approximately 605 words from the document]

It does not identify which clauses, sentences, or topics were deleted. As a result, the specific legal effect of the changes cannot be reliably determined.

Potential Significance of the Deletion

Removing approximately 605 words could materially change the agreement, particularly if the deleted text addressed:

• Customer data ownership or permitted uses
• Data retention, deletion, or security obligations
• Confidentiality
• Intellectual-property rights
• Artificial-intelligence or machine-learning model training
• Liability, indemnification, or warranties
• Subprocessors or third-party data sharing
• Compliance with privacy laws
• Termination rights or post-termination data handling

The deletion could either reduce the customer’s obligations or remove protections previously provided to the customer. Without the deleted language, it is not possible to determine which party benefits.

AI Training and Customer Data

No specific change concerning the use of customer data to train AI models can be identified from the supplied diff.

However, if the deleted 605 words included provisions stating that the provider may use customer data, prompts, outputs, or usage information to:

• Train, fine-tune, or improve AI models;
• Develop products or services;
• Create aggregated or de-identified datasets; or
• Share data with affiliates, contractors, or model providers,

then deleting those provisions could restrict or eliminate that permission.

Conversely, if the deleted text prohibited or limited AI training, its removal could expand the provider’s rights by leaving broader data-use permissions elsewhere in the agreement or by eliminating an express restriction.

Key Risk

The principal risk is uncertainty. A word-count-only diff does not show whether customer-data protections, AI-training permissions, or other important obligations were removed. Relying on this diff alone could result in overlooking a material change.

Recommended Next Step

Obtain either:

1. The full before-and-after versions; or

2. The exact 605 words that were deleted.

The deleted text should be reviewed specifically for terms such as “train,” “improve,” “machine learning,” “artificial intelligence,” “models,” “prompts,” “inputs,” “outputs,” “customer data,” “aggregated,” “de-identified,” and “usage data.”

Summary

The provided diff only states that approximately 605 words were removed. It does not identify which provisions, definitions, or clauses were deleted.

Key Legal Implications

• Substantive review is not possible: Without the deleted text or a redline showing the specific changes, it is impossible to determine whether the amendment affects liability, confidentiality, intellectual property, data protection, termination, warranties, or other rights.
• Potential loss of protections: Deleted language could remove customer safeguards, restrictions on the provider, notice obligations, audit rights, indemnities, security commitments, or remedies.
• Interpretation risk: If the deleted language qualified or limited another provision, its removal may broaden the provider’s rights or the customer’s obligations—even if no replacement language was added.
• Cross-reference risk: Removing text may leave undefined terms, broken cross-references, or provisions that operate differently in context.

AI Training and Data Use

No conclusion can be reached about changes to the use of customer data to train AI models because the diff does not include the deleted wording.

The removed provisions could potentially have addressed:

• Whether customer data, prompts, outputs, or usage data may be used to train or improve AI models;
• Whether use is permitted by default or requires customer consent or an opt-in;
• Whether data is anonymized, aggregated, de-identified, or retained;
• Whether human reviewers or service providers may access the data;
• Whether customer data may be used to train models for other customers or the provider generally;
• Whether the provider must delete or return data; and
• Whether restrictions apply to personal, confidential, regulated, or customer-specific data.

Required Information

To perform a reliable legal analysis, provide either:

1. The full redline showing the deleted text; or

2. The approximately 605 words that were removed, together with any replacement language.

Until then, the principal risk is unknown change in the provider’s rights and the customer’s protections, including potentially significant changes to AI training and data-use permissions.

Summary

Key limitation

The provided diff does not include the actual amended language. It only states:

> “Added approximately 5861 words to the document”

Without the added, deleted, or replacement text, it is not possible to identify:

• Specific legal changes
• New customer obligations or provider rights
• Changes to liability, indemnity, confidentiality, or termination
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data is shared with affiliates, subprocessors, or third parties
• Any changes to data retention, deletion, security, or privacy commitments

AI-training-related review needed

The added language should be checked specifically for provisions addressing whether customer data, prompts, inputs, outputs, usage information, or derived data may be:

• Used to train or fine-tune artificial-intelligence or machine-learning models
• Used to improve products, services, algorithms, or safety systems
• Combined with other customers’ data
• Reviewed by humans or accessed by contractors
• Shared with model providers, affiliates, subprocessors, or other third parties
• Retained after termination or deletion requests
• Used in anonymized, aggregated, de-identified, or pseudonymized form
• Used to create “derived data,” benchmarks, analytics, or commercial products
• Excluded from training only if the customer opts out or purchases a particular plan

Important risk indicators include broad language such as “improve our services,” “develop new products,” “aggregate,” “de-identify,” or “use for business purposes,” particularly if the agreement does not expressly exclude customer content or confidential information from model training.

Required information

Please provide the full diff, including the text marked with:

• {additions}
• [deletions]
• []{} replacements

Alternatively, provide the original and revised versions of the relevant sections. Once supplied, the changes can be analyzed for legal effect, risk level, and recommended revisions.

Summary of Important Changes

1. Major restructuring of the notice

The diff replaces a seller-focused privacy notice with a substantially expanded notice covering:

• Square account holders and sellers;
• Website and service users;
• Customers of Square sellers;
• Cookies, analytics, advertising, and tracking;
• Data collected from third parties;
• AI-supported features and profiling.

The revised notice also introduces detailed categories of personal, financial, identity, transaction, location, device, employment, and customer data.

2. Expanded cookie and advertising practices

The revised language adds a formal cookie banner and preference-management system with:

• Strictly necessary cookies, which cannot be disabled;
• Performance/analytics cookies;
• Functional cookies;
• Targeting or advertising cookies;
• “Accept all,” “Reject all,” and granular preference controls;
• The ability to revoke consent through cookie settings.

Square may disclose site-use information, including IP addresses and online activity, to analytics providers such as Google Analytics, Facebook, BugSnag, and Crashlytics. It may also share information with advertising partners for interest-based advertising, cross-site tracking, ad measurement, conversion tracking, and ad personalization.

Risk: This materially broadens disclosure to analytics and advertising partners. Consent and opt-out mechanisms may vary by jurisdiction, and the notice states that disabling certain technologies may impair service functionality.

3. New or expanded AI-related processing

The revised notice expressly states that Square may use AI technologies:

• To support sales teams in managing and following up with prospective sellers;
• To operate automated systems used to provide, maintain, and improve services;
• In connection with commercial information, written communications, and call recordings or transcripts;
• To generate personalized business features and insights;
• To understand and respond to sellers’ needs;
• To improve and personalize services;
• For identity verification, fraud prevention, profiling, and financial-product eligibility decisions.

The notice also permits automated processing and profiling, including assessment of eligibility for loans and other financial products.

Customer-data training: The diff does not expressly state that customer data will be used to train general-purpose AI models, nor does it grant a clearly worded model-training license. However, the language is broad enough to permit seller and transaction data to be processed by AI systems and technology providers for service delivery, personalization, improvement, and development of new services. The reference to AI-operating technology providers creates potential ambiguity about whether data may be used to train or improve provider models.

4. Seller responsibility for customer data

Square states that it processes “Your Customers’ Data” as the seller’s service provider, as required to provide services, as described in another privacy notice, or as instructed by customers. Sellers are made responsible for obtaining necessary permissions.

Risk: Sellers may bear compliance responsibility for customer data used in AI-enabled features, analytics, personalization, and related disclosures, without a precise limitation on secondary use or model training.

5. Profiling and financial decisions

The revised notice expressly allows profile creation, identity verification, fraud-risk assessment, and eligibility decisions for financial products. EU/UK users receive rights to object to profiling and solely automated decisions, but the practical scope of human review is not specified.

Summary

The diff indicates that approximately 5,861 words were removed from the document, but it does not identify which provisions were deleted. Because no replacement text or section-level comparison is provided, the specific legal and commercial effects cannot be determined.

Key Risks

• Loss of important protections: The deleted material may have included provisions concerning confidentiality, data security, privacy, intellectual property, warranties, indemnities, liability limits, audit rights, or termination.
• Changed allocation of risk: Removing limitations, disclaimers, or customer protections could materially increase the customer’s exposure.
• Reduced operational clarity: Deleted definitions, procedures, or service obligations may create ambiguity about each party’s responsibilities.
• Potential regulatory impact: If privacy, data-processing, security, or compliance provisions were removed, the agreement may no longer clearly address applicable legal requirements.

AI Training and Customer Data

The available diff does not show whether any provisions relating to AI training were added, removed, or changed. It is therefore impossible to determine whether:

• The provider may use customer data, prompts, outputs, or usage data to train or improve AI models;
• Such use is permitted by default or only with the customer’s consent;
• Customer data is de-identified, aggregated, or retained before being used;
• human reviewers or third-party AI providers may access the data;
• the customer can opt out of AI training or revoke permission;
• ownership or licensing rights apply to data, inputs, outputs, or model improvements; or
• deleted privacy or confidentiality provisions previously restricted AI-related data use.

Recommended Review

A complete comparison is needed, including the deleted text and any replacement language. Particular attention should be given to provisions containing terms such as:

• “train,” “fine-tune,” “improve,” or “develop” models;
• “customer data,” “content,” “inputs,” “outputs,” or “usage data”;
• “aggregated,” “de-identified,” or “anonymized” data;
• “service improvement” or “product improvement”;
• confidentiality, data retention, deletion, subprocessors, and security; and
• intellectual property, licenses, and customer opt-out rights.

Until the deleted provisions are reviewed, the change should be treated as a potentially material reduction in contractual protections, including possible uncertainty about the use of customer data for AI training.

Summary of Important Changes

1. Major document and audience change

• The notice changes from a cookie-consent notice for website visitors to a broad Privacy Notice for Square Sellers and business users.
• It now covers individuals acting for themselves or on behalf of a business, Square account applicants, sellers, and certain consumers using Square-related services.
• Consumers shopping at Square merchants are directed to a separate privacy notice.
• The revised notice identifies applicable Square entities and, for EU/UK residents, identifies data-controller responsibilities.

Risk: The new notice governs substantially more processing activities and may apply to business representatives, employees, customers, and other individuals whose data is supplied through Square.

2. Significant expansion of data collected

The notice newly or more clearly covers:

• Bank-account and payment-card information.
• Tax and identity information, including Social Security, tax-identification, passport, and driver’s-license numbers.
• Photographs, facial scans, and extracted biometrics for identity verification.
• Precise geolocation, device identifiers, cookies, browsing activity, IP addresses, and profiles or inferences.
• Employee, payroll, staffing, appointment, and timecard information.
• Customer transaction, contact, device, location, and interaction data.
• Information from credit agencies, fraud-prevention agencies, wireless carriers, partners, public sources, and other third parties.
• Information voluntarily provided to Square chatbots, surveys, contests, referrals, and support channels.

Risk: The scope includes sensitive or high-risk information, particularly identity documents, biometrics, financial information, employee data, and customer data. Customers may need to provide additional notices or obtain permissions before submitting this information to Square.

3. AI and model-related changes

The revised notice introduces several express references to artificial intelligence:

• Square may use AI technologies to support sales teams in managing and following up with prospective sellers.
• Technology providers may operate automated systems, including AI technologies, to help provide the Services.
• Square may use commercial information, other personal information, written communications, and call recordings or transcripts with AI technologies to generate personalized business features and insights and understand or respond to user needs.
• Information provided to Square chatbots may be collected.
• Square uses profiling and automated processing for identity verification, fraud prevention, eligibility assessments, and financial-product or loan offers.

Important limitation

The notice does not expressly say that customer or seller data is used to train general-purpose AI models, nor does it clearly state:

• Whether data is used to train, fine-tune, or evaluate models.
• Whether data is anonymized before training.
• Whether third-party AI providers may retain or use the data for their own model training.
• How long prompts, outputs, recordings, or training data are retained.
• Whether users can opt out of AI-related processing.
• Whether AI decisions are solely automated or subject to human review.

Risk: Although “training” is not expressly authorized, the broad AI, service-improvement, personalization, and provider language could permit significant secondary use unless restricted elsewhere in the agreement or vendor terms. This ambiguity should be clarified contractually.

4. Expanded sharing and international processing

• Data may be shared with AI/technology providers, analytics providers, identity-verification vendors, fraud agencies, financial partners, advertisers, affiliates, and potential business partners.
• Data may be transferred to the United States, Japan, the UK, EU, and other countries using stated contractual safeguards.

Risk: The expanded vendor and affiliate sharing creates additional confidentiality, security, regulatory, and cross-border-transfer exposure.

5. Other notable changes

• Processing purposes now rely on contract performance, legitimate interests, consent, and legal obligations.
• Square may use profiling to assess eligibility for loans and other financial products.
• Square reserves the right to amend the notice, with cancellation presented as the remedy for disagreement.
• Retention periods remain broadly defined and are determined case by case, without specific deletion periods.

Summary of Important Changes

1. Major restructuring of the notice

The prior privacy-notice content appears to be replaced by a cookie-consent interface and an expanded privacy notice. The revised text:

• Applies more broadly to Square’s “services,” rather than only the website.
• Covers sellers, website visitors, and information about sellers’ customers.
• Adds detailed categories of collected data, purposes, legal bases, sharing recipients, retention, rights, and international transfers.
• Replaces a general “contact us/read the Privacy Notice” presentation with detailed cookie controls and preference-management tools.

Risk: The diff appears technically corrupted or concatenated in places. The published version should be checked carefully to ensure the legally operative notice is complete, internally consistent, and not displaying interface text as substantive legal terms.

2. Expanded cookie, analytics, and advertising use

The revised notice expressly describes:

• Strictly necessary cookies, performance/analytics cookies, functional cookies, and targeting/advertising cookies.
• Sharing site-use information, including IP addresses, with analytics providers such as Google Analytics, Facebook, BugSnag, and Crashlytics.
• Disclosure to analytics partners for purposes described in the Privacy Notice.
• Sharing with advertising partners to track activity across websites, personalize ads, measure campaigns, track conversions, and support ad billing.
• “Accept all,” “Reject all,” and category-level controls, including the ability to revoke consent.

Risk: The revised language creates clearer authorization for behavioral advertising and third-party disclosures. Users who accept optional cookies may permit cross-site tracking and sharing beyond Square’s own systems. Square should ensure consent is freely given, granular, and properly recorded under applicable EU/UK requirements.

3. New or expanded AI-related processing

The revised notice adds express references to artificial intelligence:

• Square may use AI technologies to support sales teams in managing and following up with prospective sellers.
• Technology providers may operate automated systems, including AI technologies, to provide the services.
• Commercial information, other personal information, written communications, and call recordings or transcripts may be used with AI technologies to generate personalized business features and insights and to understand and respond to users’ needs.

AI training finding: The diff does not expressly state that customer data will be used to train general-purpose AI models, nor does it clearly grant Square a perpetual or unrestricted model-training license. However, the broad language concerning “improving” and “personalising” services, developing products, automated systems, and AI-generated insights could permit use of data for AI development or model improvement, depending on implementation.

Risk: Customers may not be able to determine whether their data, communications, transaction information, or customer data is used for model training, fine-tuning, evaluation, or human review. The notice should separately identify training uses, data categories, opt-out rights, retention, de-identification, and whether third-party AI providers receive the data.

4. Broader profiling and automated decision-making

Square adds or clarifies profiling to verify identity, assess eligibility for financial products and loans, improve services, and make offers.

Risk: This may affect access to financial products or pricing. EU/UK users receive rights to object to profiling and solely automated decisions, but the operational process and safeguards are not detailed.

5. Customer data responsibilities

Square states that sellers are responsible for obtaining necessary permissions to use customers’ data as contemplated by the notice.

Risk: This shifts compliance responsibility to the customer, particularly for marketing, analytics, AI personalization, and customer-data processing.

Summary of Available Changes

Scope of the Diff

The supplied diff states only:

> “Removed approximately 5,861 words from the document”

It does not identify which clauses, definitions, rights, obligations, or limitations were deleted. Accordingly, a reliable legal analysis is not possible from the information provided.

AI Training and Customer Data

• The diff does not show whether any provision concerning the use of customer data to train, fine-tune, evaluate, or improve AI models was added, deleted, or changed.
• It is therefore impossible to determine whether:
• Customer data may be used for model training;
• Use is limited to de-identified, aggregated, or anonymized data;
• Customer consent is required;
• the provider may share data with affiliates or third-party AI providers;
• customer opt-out rights exist;
• prompts, outputs, usage data, or personal information are retained for training;
• training use is prohibited for confidential or regulated data; or
• deletion, retention, or audit obligations apply.

Potential Legal Risks

The deletion of approximately 5,861 words could materially affect the agreement, including potentially:

• Data-use rights: deletion of restrictions may broaden the provider’s ability to use customer data.
• Confidentiality: deleted confidentiality language could reduce protection for customer information.
• Privacy and security: deleted safeguards, compliance commitments, or breach obligations could increase exposure.
• Intellectual property: deleted ownership or license provisions could affect rights in customer data, inputs, and outputs.
• Indemnities and liability: deleted provisions may remove protections, remedies, or liability limits.
• Termination and deletion: deleted provisions could weaken the customer’s ability to require data return or deletion.
• Service limitations: deleted disclaimers or obligations may change performance expectations and risk allocation.

Conclusion

No specific contractual change—including any change to AI-training rights—can be identified from this summary alone. The full redlined text, or at least the deleted and added clauses, is required to assess the legal and commercial impact. Particular attention should be given to provisions containing terms such as “train,” “training,” “improve,” “develop,” “machine learning,” “AI,” “model,” “inputs,” “customer data,” “usage data,” “de-identified,” and “aggregated.”

Summary of Important Changes

AI and use of customer data

• The revised notice expressly refers to third-party providers using “artificial intelligence technologies” to help Square provide, maintain, and improve the Services.
• This is a new and important reference to AI. However, the notice does not clearly state:
• whether Square or its providers may use customer data to train, fine-tune, or evaluate AI models;
• whether data may be used to train general-purpose or third-party models;
• whether customer data will be de-identified, aggregated, or retained for training;
• whether customers can opt out; or
• whether AI providers may use the data for their own purposes.
• The existing broad purposes—internal research, analytics, measuring trends, improving and personalising Services—may create ambiguity about whether data can be used for AI development. This presents a potential secondary-use, confidentiality, and regulatory risk, particularly where the data includes payment, tax, identity, biometric, employee, or customer information.
• Customer data is expressly described as potentially including information about the seller’s customers. Sellers should therefore assess whether they have provided adequate notices and obtained any required consents from their own customers.

Broader data collection and use

• The notice is reorganized to identify:

1. information provided directly;

2. information collected while using the Services; and

3. information obtained from other sources, with processing purposes and legal bases.

• Examples of sensitive information remain or are clarified, including bank and payment-card information, tax data, government identifiers, photo identification, facial scans, and biometric information.
• Square may request and use precise geolocation. Refusing access may prevent use of certain Services or mobile applications. Uninstalling Square applications is described as a way to stop mobile location collection.
• Promotional communications opt-outs are clarified, but opting out may affect use of the Services. Non-promotional account communications will continue.

Customer information and third-party sharing

• The notice more expressly addresses “Your Customers’ Data,” including customer device, transaction, and information supplied or entered by sellers.
• Sharing with technology providers, potential partners, AI providers, analytics providers, identity-verification vendors, fraud agencies, and other service providers is described. The scope of permitted provider access remains broad.

International transfers and rights

• International processing is described more specifically, including the United States, Japan, the UK, EU, and other countries.
• EU and UK transfer safeguards are identified, including EU Standard Contractual Clauses, the UK Addendum, and the UK International Data Transfer Agreement.
• EU/UK rights are expanded or clarified, including objection to profiling, objection to solely automated decisions, data portability, and withdrawal of consent.

Other material changes

• Children’s data language changes from retaining information where legally required to stating that Square does not knowingly collect, share, or sell data from children under 18 and will promptly delete it if discovered.
• Square may amend the notice, with reasonable prior notice of material changes and a right to cancel the account.

Summary

What changed

• The diff indicates that approximately 605 words were removed from the document.
• No text showing the deleted provisions has been provided.

AI training and customer data

• It is not possible to determine from this diff whether the removed language:
• Permitted or prohibited using customer data to train AI models;
• Defined “customer data,” “usage data,” “de-identified data,” or similar categories;
• Granted the provider a license to use customer content;
• Allowed use of data to improve, develop, or train machine-learning or generative-AI systems;
• Required customer consent before AI training;
• Applied anonymization, aggregation, retention, deletion, or opt-out restrictions; or
• Addressed whether human reviewers or third-party AI providers could access the data.

Potential legal significance

Removal of 605 words could materially affect:

• Data-use rights: Deleted restrictions may broaden the provider’s ability to use customer information, while deleted permissions may reduce it.
• Confidentiality: Deletions could remove protections for customer content or exceptions permitting internal use.
• Privacy and regulatory compliance: Deleted language may have addressed data-processing purposes, international transfers, security, or data-subject rights.
• Intellectual property: Deleted provisions may have allocated ownership of inputs, outputs, model improvements, or derived data.
• Risk allocation: Removed indemnities, warranties, liability exclusions, or security commitments could shift risk to the customer.
• Termination and deletion: Deleted obligations may affect whether customer data is returned or deleted after termination.

Assessment limitations

Because the actual additions, deletions, and replacements are not included, the direction and legal effect of the changes cannot be reliably assessed. The notation only confirms that text was removed; it does not show whether the removal is favorable or unfavorable to the customer.

Information needed

To perform a meaningful review, provide:

1. The actual deleted text;

2. Any surrounding unchanged provisions; and

3. The revised agreement or a full redline.

Particular attention should be paid to provisions containing terms such as “train,” “improve,” “develop,” “machine learning,” “artificial intelligence,” “model,” “de-identified,” “aggregated,” “usage data,” “customer content,” and “service improvement.”

Summary

The diff states only that approximately 605 words were removed from the document. The actual deleted language is not provided.

Key Legal Impact

Because the deleted text is unavailable, it is not possible to determine:

• Which contractual rights or obligations were removed.
• Whether liability, indemnity, confidentiality, security, privacy, or termination provisions changed.
• Whether customer data may now be used more broadly or with fewer restrictions.
• Whether any customer-consent, notice, deletion, or audit rights were eliminated.
• Whether governing law, dispute resolution, fees, warranties, or service-level commitments were affected.

AI Model Training and Customer Data

No conclusion can be reached regarding changes to AI training provisions. The deleted language could have contained restrictions or permissions concerning:

• Use of customer data to train, fine-tune, evaluate, or improve AI models.
• Whether customer content is used for general models or only customer-specific systems.
• De-identification, aggregation, or anonymization requirements.
• Customer consent or opt-out rights.
• Human review or use of prompts, outputs, or telemetry.
• Retention and deletion of data used for training.
• Restrictions on using confidential or personal information for model development.
• Ownership of data, model inputs, outputs, or resulting intellectual property.

Risk Assessment

The principal risk is loss of protections through deletion, particularly if the removed provisions limited the provider’s ability to use customer data or imposed confidentiality, security, or deletion obligations. However, this cannot be confirmed from the abbreviated diff.

Information Needed

A meaningful legal analysis requires either:

1. The actual 605 words that were deleted; or

2. The complete document before and after the amendment.

Without that text, the change should be treated as unreviewable and potentially material, especially with respect to customer-data use and AI model training.

Yes