Squiz

Key Changes and Risks

1. Agreement scope and support access

• The title changes from “Managed Services & Support Agreement” to “Legal Managed Services and Support Agreement.”
• The agreement now expressly applies only where Squiz is the hosting provider.
• Support access is expanded and clarified:
• Customer Portal;
• Customer Support Hotline;
• Help Center forums, e-learning, product guides, and release notes.
• Requests must generally concern one Support issue. Squiz may split a multi-issue request into separate requests, potentially affecting ticket handling, prioritisation, and charges.

2. Add-on services and customer approvals

• The revised terms expressly include additional paid services, including special-event support, audits and drills, custom requirements, training, consultation, and staff augmentation.
• Customer responsibilities now include:
• approving payment for add-on services;
• submitting or approving account-level changes and updates.
• These obligations could create uncertainty about when a customer is financially committed, particularly where approval is given through a support channel or by an authorised contact.

3. Expanded customer obligations

The customer’s obligations are materially broader. The customer must:

• ensure authorised support contacts complete required Squiz training;
• assist with diagnosis and triage;
• understand that Squiz may need to reproduce errors;
• maintain the customer’s environment in accordance with vendor recommendations;
• complete troubleshooting procedures before raising an Incident Ticket and attach evidence;
• oversee ticket activity and act under Squiz’s instructions;
• promptly update Squiz when authorised contacts change.

Until Squiz is notified, all known authorised contacts remain authorised. This creates a risk that former employees or contractors could continue to submit requests, approve changes, or incur charges.

The customer also bears greater responsibility for delays or unsuccessful troubleshooting where it cannot reproduce or adequately document an issue.

4. Squiz liability and support exclusions

• The prior wording excluded liability for loss arising from the customer’s failure to notify Squiz about changes to authorised contacts. The revised wording more broadly excludes liability for loss or damage arising from the customer’s failure to perform the listed obligations.
• Support may be refused where Squiz reasonably determines that an Incident is not attributable to a failure of the Subscription Services or Squiz’s performance.
• The exclusions continue to cover misuse or unauthorised modifications, third-party systems, trials/betas, and professional-services deliverables. The revised “reasonable determination” formulation may give Squiz greater discretion to reject support.

5. Service levels and remedies

• Service Level Credits remain the customer’s sole and exclusive remedy for failure to meet a Service Level.
• Credit claims must be submitted within 28 days with specified information. Failure to comply may eliminate the remedy.
• Squiz may modify the Support offering provided the Service Level does not materially decrease during the Subscription Period.

6. Language and fair use

• English remains the standard support language; other languages require prior arrangement.
• The Fair Use Policy applies where requests exceed Order parameters. The policy’s content is not included, creating a transparency and cost risk.

7. AI training and customer data

No express change concerning the use of customer data to train AI models appears in this diff. The revised text does not grant or remove rights to use Customer Data, support tickets, content, prompts, or outputs for model training. Any such rights must be checked in the Subscription Agreement, privacy/data-processing terms, or AI-specific policy incorporated by reference.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 314 words to the document”

Accordingly, it is not possible to identify the legal changes, new obligations, allocation of risk, or changes concerning the use of customer data to train AI models.

AI-Training and Data-Use Review

No substantive language is provided addressing whether:

• Customer data may be used to train, fine-tune, test, or improve AI models;
• Customer prompts, inputs, outputs, personal information, or confidential information may be retained;
• Data may be shared with affiliates, contractors, cloud providers, or model providers;
• Customer data may be aggregated, anonymized, or de-identified for model development;
• the customer may opt out of AI training or data use;
• data will be deleted after termination; or
• the provider offers commitments regarding confidentiality, security, ownership, or intellectual-property rights in AI-generated outputs.

Information Needed

Please provide the full diff using the stated notation:

• Additions: {new language}
• Deletions: [removed language]
• Replacements: [old language]{new language}

Without the actual text, no reliable legal-risk analysis can be performed.

Summary

The supplied diff does not include the text of the approximately 135 added words. It only states that words were added.

Key Legal Changes

• Cannot determine: The actual contractual changes, revised obligations, limitations of liability, permissions, or customer rights cannot be assessed without the added language.
• No identifiable AI-training provision: The diff does not reveal whether customer data may be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Used to develop products, services, or algorithms;
• Shared with affiliates, vendors, or model providers for training;
• Retained after termination for training or model improvement; or
• Anonymized, aggregated, or otherwise exempted from data-use restrictions.
• No identifiable changes to data protections: It is not possible to determine whether the additions affect confidentiality, data ownership, security, deletion, retention, consent, or regulatory compliance.

Risk Assessment

No reliable legal-risk assessment can be made from the information provided. The actual 135-word addition is necessary to identify whether the customer has granted broader rights to use its data, whether those rights are subject to consent or opt-out mechanisms, and whether the provider has imposed any disclaimers or limitations.

Please provide the full redline text, including the added words and any surrounding provisions, for a substantive analysis.

Summary of Important Changes and Risks

1. AI training and model use

• The diff does not expressly state that customer data will be used to train, fine-tune, evaluate, or improve artificial-intelligence models.
• However, the revised California purposes include “Analyzing and improving the Services” and “Personalizing the Services,” which are broader than the previous wording. Depending on how Squiz operates its AI features, these terms could arguably support use of customer data for AI development or service improvement.
• The revised policy should expressly clarify:
• whether customer content, prompts, outputs, usage data, or personal information may be used for AI training;
• whether data is used for Squiz’s own models or third-party provider models;
• whether data is de-identified, aggregated, or retained;
• whether customers can opt out; and
• whether customer data is excluded from general-purpose model training by default.
• Risk: Customers may reasonably interpret the absence of an express AI-training restriction, combined with broad “analyzing and improving” language, as permitting secondary use of their data for model development.

2. Broader disclosure to third parties

• The policy replaces more limited disclosure scenarios with a broad list of recipients, including:
• delivery services;
• direct-marketing agencies;
• software providers;
• market-research agencies;
• business partners and affiliates; and
• successors to the business or transferred business assets.
• The policy now says Squiz may disclose information to third parties for their own purposes, including marketing, where Squiz has a “legal basis.” The former wording more clearly referred to obtaining prior consent in many cases.
• Risk: This may permit broader third-party use and marketing without clearly requiring consent, particularly where “legitimate interest” is relied upon.

3. Expanded processing purposes

The revised policy adds or makes more explicit purposes including:

• providing services and support;
• protecting service integrity;
• analyzing and improving services;
• personalizing services;
• advertising, marketing and promotional purposes;
• securing and protecting the business;
• defending legal rights;
• auditing, reporting, governance and internal operations; and
• complying with legal obligations.

Risk: These purposes are materially broader and may permit retention and use beyond the customer’s immediate service request.

4. International transfers

• Transfers to affiliates and third parties in countries outside the EEA are expressly contemplated.
• The policy refers generally to “appropriate measures and controls,” but does not identify specific transfer mechanisms such as standard contractual clauses.
• Risk: Customers receive less certainty about where data may go and what safeguards apply.

5. Retention and withdrawal

• Retention is tied to the purposes in the expanded policy rather than only to providing services.
• Squiz states that withdrawing consent or objecting may prevent continued use of the services and that data may nevertheless be retained for legal, dispute, recordkeeping and enforcement purposes.

6. Compliance and drafting concerns

• The diff reorganizes and updates rights, complaint routes, California disclosures, global privacy controls and contact procedures.
• Some inserted text appears poorly formatted or duplicated, creating ambiguity.
• The final policy should be reviewed for numbering, cross-references, defined terms, and consistency before publication.

Summary

The supplied diff contains only the notation:

> {Added approximately 314 words to the document}

It does not include the actual added, deleted, or replaced contractual language.

AI Training and Customer Data

• No substantive terms are provided addressing whether customer data may be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Combined with other customers’ data;
• Reviewed by humans or shared with service providers for model development;
• Retained after termination for training purposes;
• De-identified, anonymized, or otherwise protected before use; or
• Excluded from model training unless the customer opts in or gives consent.

Accordingly, it is not possible to determine whether the amendment creates any new rights for the provider to use customer data for AI training, or any new restrictions or protections for the customer.

Other Contractual Risks

The actual 314 words are required to assess potential changes concerning:

• Data ownership and licensing;
• Confidentiality;
• Privacy and regulatory compliance;
• Security obligations;
• Data retention and deletion;
• Intellectual-property rights;
• Liability and indemnification;
• Subprocessors or third-party disclosures; and
• Changes to termination or audit rights.

Please provide the full redline text, including the words shown inside {}, [], and []{}, for a substantive analysis.

Executive Summary

The revised Privacy Policy substantially reorganizes and broadens Squiz’s stated data-processing and disclosure practices. The most important changes concern third-party sharing, international transfers, retention and business purposes, and expanded jurisdiction-specific rights. The diff does not expressly mention training AI models or using customer data to train generative AI systems. However, several new purposes are broad enough that AI-related analytics or model development could potentially be argued to fall within them unless separately restricted.

Key Changes and Risks

1. No express AI-training authorization—but broad new purposes

• The revised policy adds purposes including:
• “Analyzing and improving the Services”
• “Personalizing the Services”
• “Advertising, marketing, and promotional purposes”
• Securing and protecting the business
• Auditing, reporting, governance and internal operations
• There is no express statement that customer data:
• will or will not be used to train AI or machine-learning models;
• will be de-identified, aggregated or anonymised before such use;
• will be used only to provide the contracted services; or
• will be excluded from foundation-model or third-party model training.

Risk: “Analyzing and improving” could be interpreted broadly enough to include training or fine-tuning models, particularly where customer content, prompts, usage data or support communications are processed. Customers requiring a prohibition on AI training should seek an express contractual restriction rather than rely on the policy’s silence.

2. Broader third-party disclosures

The policy changes from more limited disclosures to sharing with suppliers such as delivery providers, marketing agencies, software providers and market-research agencies. It also permits disclosure where Squiz has a legal basis, rather than primarily referring to prior consent.

Risk: Customer data may be made available to a wider vendor ecosystem, potentially including vendors that use data for their own analytics or AI development. The policy does not clearly distinguish processors acting only on Squiz’s instructions from independent controllers or vendors’ secondary uses.

3. Expanded business-transfer rights

Customer information may be transferred as part of business assets to successors, including entities using the information for the purposes in the Privacy Policy.

Risk: A purchaser or successor could continue broad processing, potentially under different technologies, vendors or AI practices, without a fresh customer agreement.

4. International transfers

The revised wording expressly contemplates transfers to Squiz group companies or third parties in countries outside the EEA, subject to “appropriate measures and controls.”

Risk: The safeguards are not identified. Customers should request details of transfer mechanisms, destination countries, onward-transfer controls and vendor locations.

5. Retention and use after objection

The policy states that Squiz may retain and use information, where legally permitted, for legal obligations, disputes, records and enforcing agreements, even after withdrawal or objection.

Risk: Deletion or cessation requests may not eliminate copies held for legal, operational or backup purposes. The policy does not give a specific retention period.

Recommended Action

Request written clarification that customer data, prompts, outputs, content and usage data will not be used to train, fine-tune or improve general-purpose AI models, except with express written consent, and require equivalent restrictions on all subcontractors.

Summary of Important Changes

1. Scope and access to Support

• The agreement is retitled “Legal Managed Services and Support Agreement” and is clarified to apply only where Squiz is the hosting provider.
• Support access methods are reorganized. Customers may:
• Log requests through the Squiz Customer Portal;
• Telephone the support hotline; and
• Use the Help Center for forums, training, product guides and release notes.
• A request must generally concern one Support issue. Squiz may split multiple issues into separate Support requests, which could affect service tracking, prioritization and potentially charges.

2. Expanded Customer obligations

The Customer’s obligations are materially expanded. Customers must:

• Ensure Authorized Support Contacts complete required Squiz training;
• Assist Squiz with diagnosis and triage;
• Understand that Squiz may need to reproduce errors before resolving them;
• Maintain and update the Customer’s environment in accordance with vendor recommendations;
• Complete troubleshooting procedures before opening an Incident Ticket and attach evidence; and
• Oversee Incident Ticket activity and act under Squiz’s instructions.

These requirements create additional conditions for effective Support and may give Squiz grounds to delay, limit or deny assistance if the Customer has not followed them. The Customer must also promptly update its Authorized Support Contacts. Until notified, Squiz may treat existing contacts as authorized, creating an access and authorization risk.

3. Narrower and more discretionary Support obligations

• Squiz’s obligation is reframed as providing Support according to the Agreement and Subscription Agreement, rather than a more direct commitment to provide Support for Subscription Services.
• Squiz may refuse Support where it reasonably determines that an Incident is not attributable to a failure of the Services or Squiz’s performance.
• The previous exclusion wording is replaced with a broader attribution-based standard. This may increase Squiz’s discretion, particularly for issues involving third-party systems, customer configuration, misuse, unauthorized modifications, trials/betas or professional-services deliverables.
• The prior statement that Support is available 24/7 is retained, but clarified so that only Incident Support is provided 24/7.
• Support remains in English; other languages require prior arrangement.

4. Additional services and administrative authority

New Customer responsibilities include approving payment for add-on services and submitting or approving account-level changes or updates. This could create operational and financial exposure if contacts are incorrectly authorized or changes are approved without sufficient internal controls.

5. Service levels and remedies

• Service-level eligibility continues to depend on sufficient information in the Incident Ticket and Squiz’s priority assessment.
• Service credits remain the Customer’s sole and exclusive remedy for failure to meet a Service Level Commitment.
• Claims require submission through the portal within 28 days and must include specified details, creating a procedural forfeiture risk.

6. AI model training and Customer data

No express change concerning AI, machine-learning models, model training, data mining, or use of Customer data for training AI models appears in the supplied diff. The revised Support obligations may require Customers to provide troubleshooting evidence, reproduce errors and share environment information, but the diff does not state that such information may be used to train AI systems. The broader agreement’s privacy, confidentiality and data-use provisions should nevertheless be reviewed separately.

Summary

The supplied diff does not include the actual added language. It only states:

> “Added approximately 135 words to the document”

Without the text of those additions, it is not possible to determine:

• What contractual rights or obligations changed;
• Whether liability, confidentiality, intellectual property, privacy, or termination provisions were affected;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether the customer can opt out of such use;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether customer prompts, outputs, files, or usage metadata are included;
• Whether third-party AI providers may receive or retain the data; or
• Whether the provider claims ownership or broad usage rights over customer data or generated outputs.

AI-Training Risk Assessment

No conclusion can be reached regarding AI-model training from the information provided. The phrase “Added approximately 135 words” does not identify any legal terms or provide enough context to assess whether the new language:

• Authorizes training on customer content by default;
• Limits training to service improvement or safety purposes;
• Prohibits use of customer data for model training;
• Applies different rules to personal data, confidential information, or enterprise data;
• Permits retention after account termination; or
• Imposes disclosure, consent, or opt-out requirements.

Information Needed

Please provide the actual 135-word addition, using the stated notation:

• {new language}
• [deleted language]
• []{replacement language}

The surrounding section or the complete affected clause would also be helpful, because the legal effect may depend on defined terms and related provisions elsewhere in the agreement.

Executive Summary

The revised policy materially expands the purposes for which Squiz may use and disclose personal information, adds broader supplier and business-transfer disclosures, and updates jurisdiction-specific rights. It does not expressly mention AI, machine learning, foundation models, generative AI, or training models. However, the wording is broad enough that some uses—particularly “analyzing and improving the Services,” personalization, advertising and marketing—could potentially encompass AI development or model training unless limited elsewhere.

Key Changes and Risks

1. AI and model-training use

• The new California purposes include “Analyzing and improving the Services” and “Personalizing the Services,” alongside advertising, marketing and promotional purposes.
• The policy does not state whether customer data, prompts, content, usage data, support communications or outputs may be:
• used to train or fine-tune AI models;
• used to evaluate or improve third-party AI systems;
• retained in model-training datasets;
• shared with AI vendors; or
• excluded from training by default.
• This creates material ambiguity and customer risk. Customers may reasonably expect their service data to be used only to provide the contracted service, while the broad “analysis/improvement” language could be interpreted more expansively.
• The policy should expressly state whether customer data is used for AI training, identify the data involved, explain opt-out/consent rights, and distinguish service improvement from generalized model training.

2. Broader disclosures to third parties

The revised wording replaces narrower disclosures with a broader list of suppliers, including:

• delivery services;
• direct-marketing agencies;
• software providers; and
• market-research agencies.

It also permits disclosures where Squiz has a “legal basis,” rather than generally requiring prior consent. This may allow broader marketing, analytics and vendor processing.

3. Expanded business-transfer rights

Personal information may be transferred to:

• Squiz group companies;
• business partners and affiliates;
• successors or purchasers of the business or transferred assets; and
• third parties in connection with a sale.

Successors may use information for the purposes in the Privacy Notice, increasing the risk that data will continue to be used after a corporate transaction.

4. International transfers

The policy continues to permit transfers outside the EEA and adds transfers to other countries, subject to “appropriate measures and controls.” The specific safeguards are not identified, although individuals may request a copy of the measures.

5. Retention and withdrawal

Retention is described as lasting as long as necessary for stated purposes, legal obligations, disputes, records and enforcement. The policy states that withdrawing consent or objecting may prevent continued use of the Services, potentially limiting practical control over data.

6. Rights and compliance updates

The policy adds or clarifies:

• privacy contact email: privacy@squiz.net;
• Australian, New Zealand, UK, EEA and California complaint routes;
• California correction, deletion and “know” requests;
• global privacy control and other universal opt-out mechanisms; and
• expanded CCPA “sale” and “sharing” disclosures.

Several portions appear to contain compressed or poorly formatted text and inconsistent section numbering, which may reduce clarity and create interpretation risk.

Summary

The supplied diff does not contain the actual contractual language. It only states:

> “Added approximately 314 words to the document”

Because the added text is not provided, it is not possible to identify:

• Changes to the parties’ rights or obligations
• New liability, indemnity, confidentiality, or termination risks
• Changes to ownership or licensing of customer data
• Whether customer data may be used to train, fine-tune, validate, or improve AI models
• Whether data may be shared with affiliates, vendors, or AI providers
• Any opt-out, consent, deletion, retention, anonymization, or security protections
• Whether customer prompts, outputs, usage data, or personal information are included in any permitted AI training

AI Training Review

No conclusion can be reached regarding AI model training because the relevant added wording is missing. The complete diff—especially provisions referring to terms such as “train,” “fine-tune,” “improve,” “develop,” “machine learning,” “artificial intelligence,” “customer data,” “inputs,” “outputs,” or “usage data”—is needed for analysis.

Recommended Next Step

Provide the actual 314 words of added text, together with any surrounding or amended language. The analysis should then assess:

1. What categories of customer data may be used.

2. Whether use for AI training is automatic or requires consent.

3. Whether data is used for the provider’s own models or only to provide the service.

4. Whether data is anonymized, aggregated, or de-identified.

5. Whether human reviewers or third-party providers may access it.

6. How long data is retained and whether it can be deleted.

7. Whether the customer can opt out or restrict training.

8. Allocation of intellectual-property, confidentiality, privacy, and security risks.

Summary

The diff only states that approximately 314 words were added; it does not include the actual added language.

Legal and Commercial Impact

• The substantive changes cannot be assessed without seeing the text of the 314 added words.
• It is not possible to determine whether the additions:
• Change the parties’ rights or obligations;
• Introduce new fees, warranties, limitations of liability, or indemnities;
• Modify termination, confidentiality, security, or intellectual-property provisions;
• Permit broader use, disclosure, retention, or transfer of customer data; or
• Create additional compliance obligations.

AI Training and Customer Data

• The provided diff does not reveal whether customer data may be used to train, fine-tune, test, evaluate, or improve AI or machine-learning models.
• It is also not possible to determine:
• Whether customer data is used for the provider’s general models or only customer-specific models;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether human reviewers or third-party AI providers may access the data;
• Whether the customer can opt out or must provide consent;
• Whether prompts, inputs, outputs, metadata, or usage data are retained for training; or
• Whether trained models or derived insights may be retained after termination.

Required Information

Please provide the actual 314-word addition, preferably with the surrounding clause or full redline. Without the added wording, no reliable legal-risk analysis can be performed.

Executive Summary

The revised Privacy Policy substantially broadens and reorganizes Squiz’s stated data uses, disclosures, retention purposes, international transfers, and jurisdiction-specific rights. The changes appear generally more expansive for Squiz, although some user rights and contact procedures are clarified.

Key Changes and Risks

1. AI model training — no express authorization or restriction

• The diff does not expressly mention artificial intelligence, machine learning, generative AI, model training, fine-tuning, or use of customer content as training data.
• However, the revised purposes include:
• “Analyzing and improving the Services”
• “Personalizing the Services”
• “Advertising, marketing, and promotional purposes”
• “Securing and protecting our business”
• Internal operations and business purposes
• These broad purposes could potentially be interpreted to permit analytics or development of AI-enabled services using customer data, depending on the data involved and the applicable law.
• The policy does not state:
• Whether customer data or customer content may be used to train general-purpose or proprietary AI models;
• Whether data is de-identified, aggregated, or retained for training;
• Whether AI providers or subprocessors receive the data;
• Whether customers can opt out or require deletion from training datasets; or
• Whether customer data is excluded from model weights or human review.
• Risk: Customers seeking assurance that their data will not train AI models receive no clear contractual protection. A separate contractual restriction or explicit AI-use clause should be considered.

2. Broader disclosure to third parties

The policy replaces narrower disclosure scenarios with broader categories, including:

• Third-party service providers acting on Squiz’s behalf;
• Delivery services, agencies conducting direct marketing, software providers, and market research agencies;
• Business partners and affiliates;
• Successors or purchasers of transferred business assets; and
• Third parties in other countries.

The previous language more clearly limited certain disclosures to situations involving obligations or consent. The revised wording generally relies on “a legal basis,” which may include legitimate interests and is less restrictive than consent.

3. International transfers

The policy now expressly permits transfers to Squiz group companies or third parties in another country, including outside the EEA, subject to “appropriate measures and controls” and applicable data protection legislation. This is clearer but still does not identify the countries, transfer mechanisms, or specific safeguards.

4. Expanded processing and retention purposes

The revised policy lists numerous additional purposes, including service improvement, personalization, advertising, marketing, security, legal compliance, auditing, corporate governance, and enforcing agreements. Retention is tied broadly to the purposes for which data was collected and used, rather than a defined period.

5. Customer rights and procedures

The policy adds or clarifies:

• Requests may be sent to privacy@squiz.net, an Account Manager, or Business Development Manager;
• A generally one-month response period;
• Identity verification requirements;
• Australian, New Zealand, UK, EEA, California, and other U.S. state rights and complaint routes;
• California procedures for access, correction, deletion, and opt-outs of “sale” and “sharing.”

6. Drafting and implementation concern

The diff contains extensive apparent section renumbering and duplicated or compressed text. The final published policy should be checked carefully for broken headings, inaccurate cross-references, and missing wording.

No