Squareup

No

Summary of Important Changes and Risks

1. Major restructuring and scope expansion

• The prior text was primarily a cookie-consent banner covering analytics, advertising, personalization, and sharing with ad partners.
• The replacement is a comprehensive “General Privacy Notice for Square Sellers” covering:
• Website visitors;
• Sole proprietors and businesses applying for or using Square Services;
• Certain consumers who provide information to Square, use Square Pay, receive digital receipts, or sign up for marketing.
• Consumers shopping at Square-enabled businesses are directed to a separate privacy notice, creating a more complex, cross-referenced privacy framework.

Risk: Important terms are moved from a short cookie notice into a broad privacy notice, potentially expanding the purposes and categories of processing beyond what users previously saw.

2. Expanded categories of data

The new notice expressly covers:

• Financial data, including bank account and payment-card information;
• Tax information;
• Government identification, including passports, driver’s licenses, Social Security numbers, and taxpayer identification numbers;
• Precise geolocation;
• Device, online activity, cookie, and advertising data;
• Employee and payroll information;
• Contacts uploaded from a mobile device;
• Survey responses, chatbot disclosures, referrals, and support-related information;
• In some cases, photographs, facial scans, and extracted biometrics.

Risk: Processing and sharing facial scans and biometric information creates heightened privacy, consent, security, retention, and regulatory exposure. The notice does not appear to provide detailed biometric-specific retention or deletion rules in the supplied text.

3. Expanded sharing and profiling

Square may share data with:

• Identity-verification, credit-reporting, fraud-prevention, analytics, advertising, and other service providers;
• Affiliates, including Cash App, Afterpay/Clearpay, and TIDAL;
• Referral partners, including transaction-volume information;
• Potential business partners and corporate transaction participants.

Square may combine transaction, identity, risk, usage, and profile information for identity verification, fraud prevention, personalization, product development, and marketing.

Risk: Cross-service sharing and profiling may create broader secondary uses and increased exposure to inaccurate inferences or automated decisions.

4. AI-related changes

The new notice expressly states that Square may use:

• Commercial Information; and
• Other personal information that the user inputs or asks Square to analyze

“in connection with artificial intelligence technologies” to generate personalized business features.

The stated legal bases are contract performance and legitimate interests, including improving and personalizing Services in ways Sellers reasonably expect.

The notice also includes information voluntarily disclosed to Square chatbots.

Training analysis: The supplied language does not expressly say that customer data will be used to train general-purpose AI models, nor does it clearly prohibit such training. However, the wording is broad enough to permit AI analysis and potentially model improvement unless another policy or contract limits it. Customer data appears otherwise usable only to provide requested Services, as disclosed in the separate consumer notice, or as instructed by customers. This distinction should be clarified, especially regarding model training, retention, human review, and use of identifiable customer data.

5. Customer-data responsibility

Square may process “Your Customers’ Data” as a service provider to deliver requested Services. The seller is expressly responsible for obtaining any permissions necessary for Square’s use of that data.

Risk: This shifts consent and compliance responsibility to the seller, including for customer data used in AI-enabled features.

Summary of Important Changes

1. Privacy Notice Replaced by Cookie-Consent Content

The diff appears to replace substantial portions of the prior Privacy Notice with a cookie-consent interface and Cookie Policy references. The revised text focuses on website cookies, rather than clearly presenting the full prior disclosures about collection, use, retention, sharing, international transfers, and user rights.

Risk: This may make important privacy terms less visible or potentially create uncertainty about which document governs. Confirm that the complete Privacy Notice remains available and that the cookie banner does not inadvertently replace legally required privacy disclosures.

2. Expanded Cookie and Tracking Activities

The new language states that Square and its partners use cookies and similar technologies to:

• Maintain security and website functionality;
• Measure performance and analyze usage;
• Personalize the user experience;
• Personalize and deliver advertising;
• Track activity across websites;
• Measure advertising campaigns, conversions, and ad frequency; and
• Support ad billing.

It also expressly permits disclosure of data to analytics partners and advertising partners for these purposes.

Users are offered “Accept all,” “Reject all” (except strictly necessary cookies), and category-level controls. Strictly necessary cookies are always active, while performance, functional, and targeting/advertising cookies are initially inactive.

Risks:

• Broader sharing with analytics and advertising partners;
• Cross-site tracking and interest-based advertising;
• Potential regulatory exposure if consent is not freely given, sufficiently informed, granular, and properly recorded;
• The wording “by accepting these cookies, you consent” may not be sufficient in jurisdictions requiring specific consent standards.

3. Broader Scope of Covered Services

The language changes references from visiting the “website” to interacting with Square’s broader “services,” including online services, mobile applications, and potentially hardware or other Square offerings.

Risk: The cookie and tracking disclosures may now apply across a wider range of products and interactions than before.

4. AI-Related Data Use

The underlying privacy language states that Square may use:

• Commercial Information; and
• Other personal information that users input or request Square to analyze

“in connection with artificial intelligence technologies” to generate personalized business features. It also permits technology providers to operate automated systems, including AI technologies, to help provide the Services.

Important limitation: The diff does not expressly state that customer data will be used to train AI models, nor does it grant a clearly defined right to use data for model training, generalized model development, or sharing data with AI model providers for training.

However, the wording is broad enough to permit AI-based analysis and personalization, and potentially service-provider processing. It does not clearly explain whether inputs are retained, used to improve models, de-identified, or excluded from training datasets.

Recommended clarification: Square should expressly state whether Seller or customer data may be used to train or improve AI models, identify the data covered, describe retention and human access, and provide opt-out or consent mechanisms where required.

Summary of Changes

Overall change

• Approximately 5,545 words were removed from the document.
• No replacement language or added language is shown.
• Because the actual deleted text is not provided, it is not possible to determine which contractual rights, obligations, limitations, or protections were removed.

Potential legal significance

A deletion of this size may materially affect:

• Data ownership and permitted uses
• Confidentiality and security obligations
• Intellectual-property rights
• Service warranties and disclaimers
• Liability limits and indemnities
• Termination rights and data-return/deletion obligations
• Audit, compliance, and regulatory provisions
• Governing law and dispute-resolution terms
• Customer remedies and provider obligations

The deletion should not be treated as merely editorial unless the removed provisions have been reviewed individually.

AI-model training and data use

• The provided diff does not identify whether any language concerning AI-model training was added, removed, or modified.
• In particular, the available information does not show whether the contract now:
• Permits or prohibits using customer data to train, fine-tune, or improve AI models;
• Distinguishes between customer content, prompts, outputs, telemetry, or aggregated/de-identified data;
• Requires customer consent or provides an opt-out;
• Limits use to service improvement or permits broader commercial use;
• Applies different rules to human review, subcontractors, or third-party AI providers; or
• Requires deletion or segregation of data used for model training.

Key risk

If the deleted text contained restrictions on AI training or secondary data use, its removal could broaden the provider’s ability to use customer data. Conversely, if the deleted text granted such rights, its removal could restrict that use. The direction of the risk cannot be determined from the redacted diff alone.

Recommended follow-up

Obtain:

1. The full prior and revised versions; and

2. A redline showing the actual deleted provisions.

The AI/data-use clauses should be reviewed specifically for express language addressing training, fine-tuning, model improvement, retention, de-identification, aggregation, human review, and third-party model providers.

Summary

Key Limitation

The supplied diff states only:

> “Added approximately 4606 words to the document”

It does not include the actual added contractual language, deleted language, or replacement text. As a result, it is not possible to identify the legal or commercial effect of the changes reliably.

AI Training and Customer Data

No conclusions can be drawn about whether the new language:

• Permits the provider to use customer data to train, fine-tune, test, or improve AI models;
• Restricts training to de-identified, aggregated, or anonymized data;
• Allows use of prompts, inputs, outputs, metadata, usage data, or personal information for model development;
• Gives the provider ownership or license rights in customer data or AI-generated outputs;
• Allows data to be shared with affiliates, subprocessors, or third-party model providers;
• Provides an opt-out or requires the customer’s prior consent;
• Requires deletion or exclusion of customer data from training datasets; or
• Creates confidentiality, security, privacy, or regulatory risks associated with AI processing.

Other Legal Risks That Cannot Yet Be Assessed

The missing text prevents review of possible changes involving:

• Intellectual-property ownership and licensing;
• Confidentiality and permitted disclosures;
• Data protection and international transfers;
• Security obligations and breach notification;
• Subprocessors and third-party services;
• Warranties, indemnities, and limitations of liability;
• Retention, deletion, and return of data;
• Audit rights and compliance obligations;
• Suspension, termination, and post-termination access; and
• Changes to governing law, dispute resolution, or renewal terms.

Required Information

Please provide the actual redline text, including:

1. The added provisions;

2. Any deleted provisions;

3. Replacement language showing both the old and new text; and

4. The surrounding section headings or clause numbers.

Once provided, the changes can be analyzed for their practical effect, with particular focus on whether customer data may be used to train or improve AI models and whether the customer has meaningful controls over that use.