Traction Guest

Executive Summary

The diff appears to replace a short privacy/contact section with a substantially expanded Privacy Notice. The new text describes data collection, use, sharing, international transfers, retention, individual rights, GDPR/CCPA treatment, and affiliated companies. The diff is heavily malformed in places, so the final published wording should be checked carefully.

Important Changes and Risks

1. Broad data-collection and usage disclosures

The revised notice expressly covers:

• Personal Data, including identifiers, contact details, location data, online identifiers, and potentially sensitive identity-related information.
• Aggregate Information about usage patterns, data volumes, browser types, demographics, and behavior.
• Cookies, beacons, device identifiers, and similar tracking technologies.
• Location information used for sign-ins, scheduling, and access control.

The permitted purposes are broad and include service delivery, personalization, analytics, fraud prevention, internal business purposes, product improvement, marketing, corporate transactions, and legal compliance.

Risk: Customers may view the purposes as broad enough to permit secondary uses beyond core service delivery, particularly analytics, personalization, reporting, and product improvement.

2. AI model training

No express authorization to use Customer Data to train artificial-intelligence or machine-learning models appears in the new text. The notice does not state that Personal Data, customer content, User data, or Aggregate Information may be used to train, fine-tune, evaluate, or develop AI models.

However, the following language could potentially be argued to cover some AI-related activities:

• “Improve the features and functionality of the Services”
• “Administer, operate and improve the Services”
• “Create improvements, enhancements and upgrades”
• Research and analysis of usage trends and user behavior
• Sharing Aggregate Information with affiliates and third parties

Risk: Although there is no clear training permission, the broad improvement and analytics language may create ambiguity about whether de-identified, aggregated, or customer-generated data can be used for AI development. A separate, explicit AI-data-use provision would reduce uncertainty.

3. Expanded sharing and transfer rights

The notice permits sharing with:

• Affiliates and subsidiaries;
• Hosting providers, payment processors, mail relays, and other service providers;
• Parties involved in mergers, restructurings, or asset sales;
• Legal authorities where permitted or required.

It also permits transfers to countries other than the country where the User resides or where data was collected.

Risk: Customers may require additional contractual safeguards, transfer mechanisms, subprocessors, or approval rights, especially for regulated or international data.

4. Customer/business responsibility clarified

For visitors using the Services at a customer’s location, the customer is generally identified as the data controller and determines retention periods and privacy practices.

Risk: Customers retain significant compliance responsibility for notices, lawful bases, retention, and responding to visitor rights requests.

5. Retention and deletion limitations

Data may be retained while an account is active and afterward where there is an ongoing business need. Data relating to sanctions may not be deleted or disclosed in full.

Risk: Retention periods are not specific, and the sanction-related exceptions may conflict with customer deletion or access expectations.

6. Drafting and notice defects

The document contains apparent formatting and content inconsistencies, including:

• A last-updated date of June 2, 2026 at the beginning, but March 20, 2025 in the body.
• A malformed contact-address sequence.
• “Lawful interests” appears mislabeled where “legal obligation” may be intended.
• The contact section appears duplicated or corrupted.

These issues should be corrected before publication because they may undermine transparency and regulatory compliance.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 3532 words to the document”

Accordingly, it is not possible to identify:

• The specific legal or commercial changes;
• New obligations, rights, liabilities, or limitations;
• Changes to confidentiality, security, intellectual property, or termination provisions; or
• Any provisions concerning the use of customer data to train, fine-tune, evaluate, or improve AI models.

AI Training and Customer Data

No substantive language addressing AI-model training or customer-data use is included in the supplied diff. Therefore, I cannot determine whether the new text:

• Permits the provider to use customer data, prompts, outputs, or metadata for model training;
• Limits such use to aggregated, de-identified, or anonymized data;
• Requires customer consent or provides an opt-out;
• Allows use by affiliates, subprocessors, or third-party model providers;
• Grants the provider ownership or broad usage rights over customer data or outputs;
• Imposes retention, deletion, or confidentiality obligations; or
• Addresses whether customer data may be used to train general-purpose models versus models dedicated to the customer.

Information Needed

Please provide the full redline text, including the approximately 3,532 added words, using the stated notation:

• {additions}
• [deletions]
• []{} replacements

Once provided, the changes can be reviewed for legal significance, with particular attention to AI training rights, data ownership, confidentiality, privacy, security, subprocessors, and liability.

Summary of Important Changes

1. Privacy Notice substantially replaced or expanded

The diff appears to replace the prior short privacy notice/navigation and contact language with a comprehensive privacy notice covering:

• Categories of personal data, aggregate information, cookies, location data, and usage data.
• Collection points, including registration, use of features, uploads, communications, and use by customers’ visitors.
• Purposes for processing, lawful bases, data-protection principles, security, retention, international transfers, and individual rights.
• GDPR, CCPA, children’s data, third-party links, and changes to the notice.
• A list of current affiliates and their addresses.

Risk: The new notice creates a much broader and more detailed description of permitted data uses and disclosures. Customers should verify that these disclosures match the underlying contract, Data Processing Agreement, actual practices, and applicable law.

2. Broader use and sharing rights

SIS states that it may use personal data to:

• Provide, personalize, administer, improve, and secure the Services.
• Analyze usage, generate reports, and conduct internal business activities.
• Evaluate corporate transactions.
• Conduct consent-based marketing.
• Share data with affiliates, hosting providers, payment processors, mail relays, and other service providers.
• Transfer personal data internationally.

It also states that aggregate information may be used for research, trend analysis, demographics, behavioral analysis, improvements, and other legitimate business purposes, and may be shared with affiliates, investors, potential investors, and service providers.

Risk: “Improve,” “analyze,” “research,” and “other legitimate business purposes” are relatively broad. The notice also says personal data may be disclosed for a business purpose, which could create uncertainty about the precise limits of permitted use.

3. AI-model training

There is no express reference to artificial intelligence, machine learning, foundation models, or training models in the added text. The notice therefore does not clearly authorize or prohibit using customer or visitor data to train AI systems.

However, the broad purposes relating to improving Services, analyzing usage, generating reports, and creating enhancements could potentially be interpreted as covering machine-learning development unless restricted elsewhere—particularly for aggregate or de-identified data.

Recommended clarification: The contract or DPA should expressly state whether customer data, visitor data, prompts, outputs, or usage data may be used to train or fine-tune AI models; whether data is opt-in/opt-out; whether de-identified data may be used; and whether third-party AI providers receive the data.

4. Data roles and customer responsibility

SIS describes itself as a processor/service provider for visitors’ data, while acting as a business for information collected directly from individuals. Businesses using the Services generally determine visitor retention periods and remain responsible for their own privacy notices and disclosures.

Risk: Customers should confirm the allocation of controller/processor responsibilities and ensure their instructions, retention requirements, and visitor notices are consistent with this notice.

5. Drafting and operational concerns

• The page header retains a 2 June 2026 update date, while the body says the notice was last updated 20 March 2025.
• Contact information appears reformatted and includes a named Global Privacy and Data Protection Officer.
• The notice includes a broad disclaimer that security cannot be absolutely guaranteed.
• Retention language is general and allows retention while an account is active and afterward where SIS has an ongoing business need.

Summary

The provided diff only states:

> “Added approximately 3532 words to the document”

It does not include the actual added language, deleted language, or replacement text. As a result, it is not possible to identify:

• New contractual obligations or liabilities
• Changes to warranties, indemnities, payment terms, or termination rights
• Changes to confidentiality, security, or data-protection provisions
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether the customer has any opt-out, consent, ownership, or deletion rights
• Whether data may be shared with affiliates, vendors, or AI service providers
• Whether customer prompts, outputs, metadata, or usage analytics are retained

AI Training and Data-Use Review

No conclusion can be reached regarding AI-model training because the substantive added text is missing. The phrase indicating that approximately 3,532 words were added does not reveal whether the new provisions:

• Permit use of customer data for model training or product improvement
• Limit training use to de-identified, aggregated, or anonymized data
• Require customer consent or provide an opt-out
• Give the provider rights to retain or reuse prompts, inputs, outputs, or feedback
• Allow human review or contractor access to customer data
• Permit transfer of data across jurisdictions
• Address ownership of training data, model weights, or generated outputs

Information Needed

Please provide the actual marked-up contract text, including the additions shown in {}, deletions shown in [], and replacement language shown in []{}. Once provided, the changes can be assessed for legal effect, including specific risks concerning AI training and customer-data use.

Summary of Important Changes and Risks

1. Major rewrite and scope

• The existing Privacy Notice has effectively been replaced with a substantially expanded notice.
• The notice now expressly covers Sign In Solutions Inc. and numerous affiliates, including entities in the United States, United Kingdom, Spain, and Denmark.
• It applies to users, customers, and visitors who interact with businesses using the Services.
• Users are deemed to agree to the collection, use, and disclosure terms by downloading, accessing, viewing, or using the Services. This may create a broad “consent by use” position, subject to applicable law.

2. Expanded data collection

The revised notice expressly identifies collection of:

• Personal Data, including names, contact details, identifiers, location data, online identifiers, and potentially sensitive identity-related information;
• Aggregate Information about usage, entered data, accessed features, and browser/device activity; and
• Cookie and similar technology data.

It also states that location information may be collected to identify sign-ins at specific business locations and provide access-related functionality.

3. Broader permitted uses and disclosures

Personal Data may be used for service delivery, personalization, analytics, fraud prevention, internal business purposes, marketing with consent, corporate transactions, and legal compliance.

The notice permits disclosure to:

• Customer companies;
• Affiliates and subsidiaries;
• Hosting, payment, mail-relay, and other service providers;
• Authorities where legally required or reasonably believed necessary; and
• Parties involved in a sale, merger, restructuring, or transfer of assets.

SIS may transfer Personal Data internationally. The notice does not identify specific transfer mechanisms, such as Standard Contractual Clauses, which may create compliance and transparency concerns for international customers.

4. AI-model training implications

• There is no express statement authorizing or prohibiting the use of customer data to train, fine-tune, evaluate, or improve AI models.
• The broad purposes—particularly “improve the Services,” “internal business purposes,” “analyze usage,” “create improvements, enhancements and upgrades,” and “other legitimate business purposes”—could potentially be interpreted as covering AI development or model training.
• However, the notice does not clearly explain:
• Whether customer content or Personal Data is used for AI training;
• Whether data is shared with AI vendors;
• Whether training is performed on identifiable, deidentified, or aggregated data;
• Whether customers can opt out; or
• How long training data or model outputs are retained.
• This ambiguity creates consent, purpose-limitation, confidentiality, and customer-expectation risks. A separate AI/data-use provision would be advisable.

5. Other notable risks

• “Aggregate Information” is described as anonymized and non-identifying, but the notice does not explain the anonymization methodology or re-identification safeguards.
• Retention periods remain general and depend partly on the relevant business customer’s policy, which may be unclear to individuals.
• SIS disclaims responsibility for customer businesses’ handling of visitor data, potentially creating allocation-of-responsibility issues.
• The notice contains inconsistent update dates: the header refers to June 2, 2026, while the closing text states March 20, 2025. This should be corrected.

Contract Change Analysis

Executive Summary

The supplied diff does not include the actual added, deleted, or replaced legal language. It only states:

> “Added approximately 3532 words to the document”

Accordingly, it is not possible to identify the substantive contractual changes, new risks, or any provisions concerning the use of customer data to train AI models.

AI Training and Customer Data

No language was provided that would allow assessment of whether the contract:

• Permits the provider to use customer data, content, prompts, outputs, or usage data to train, fine-tune, or improve AI models;
• Uses customer data for model training by default or only with consent;
• Allows the provider to use data in de-identified, aggregated, or pseudonymized form;
• Gives the customer an opt-out or deletion right;
• Restricts human review or access to customer data;
• Applies different rules to personal data, confidential information, or regulated data;
• Allows subcontractors, affiliates, or third-party AI providers to use the data;
• Provides assurances that customer data will not be used to train publicly available models; or
• Specifies retention, deletion, security, audit, or data-location requirements.

Other Legal Risks

The actual text is also required to evaluate potential changes involving:

• Intellectual-property ownership and licensing;
• Confidentiality obligations;
• Data protection and regulatory compliance;
• Liability caps and indemnities;
• Warranties and disclaimers;
• Service suspension or termination rights;
• Customer audit rights;
• Subcontracting and international transfers; and
• Governing law and dispute resolution.

Information Needed

Please provide the full marked-up text, including the content represented by {added}, [deleted], and []{replaced}. Without the underlying language, any assessment of the legal or AI-related impact would be speculative.

Summary

Key Observation

• The diff only states that approximately 3,532 words were removed.
• The actual deleted language is not provided.
• No additions, replacements, or specific deleted clauses are shown.

Changes to Customer Data and AI Training

• It is not possible to determine from the supplied diff whether the document changed:
• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether customer prompts, inputs, outputs, or usage data are collected for model development;
• Whether data is anonymized, aggregated, or de-identified before AI use;
• Whether customer data is shared with affiliates, service providers, or third-party model providers;
• Whether customers can opt out of AI training or request deletion of training-related data;
• Whether confidentiality, security, retention, or data-processing restrictions apply to AI systems; or
• Whether the provider has expanded or limited its rights to use customer data.

Potential Legal Risks

Because the deleted text is unavailable, the removal could have materially changed the agreement by eliminating:

• Restrictions on data use, potentially broadening permitted use of customer data;
• Consent or notice requirements for AI training;
• Confidentiality and privacy protections;
• Data retention or deletion obligations;
• Customer audit, objection, or opt-out rights;
• Intellectual-property protections concerning customer inputs and outputs;
• Representations, warranties, or liability provisions relating to AI-generated content or data processing; or
• Regulatory compliance language, including obligations under data-protection laws.

Alternatively, the deletion may have removed provider rights or obligations and therefore narrowed the agreement. The direction and significance of the change cannot be established without the underlying text.

Recommended Next Step

Provide the actual deleted passages, preferably alongside the unchanged surrounding provisions. Particular attention should be given to sections titled “Customer Data,” “Data Usage,” “Privacy,” “Confidentiality,” “Artificial Intelligence,” “Machine Learning,” “Service Improvement,” “Training,” or “Aggregated Data.”

Summary

The provided diff only states:

> “Added approximately 3532 words to the document”

It does not include the actual added language, deleted language, or replacement text. As a result, the legal and commercial impact cannot be reliably assessed.

AI Training and Data Use

No conclusions can be drawn about whether the contract now:

• Permits the provider to use customer data to train, fine-tune, test, or improve AI models;
• Allows use of customer prompts, inputs, outputs, files, or usage metadata for model development;
• Uses customer data for generalized or product-wide model training;
• Requires customer consent or provides an opt-out;
• Anonymizes, aggregates, or de-identifies data before using it for training;
• Retains customer data for training after termination;
• Allows human review or labeling of customer data;
• Shares data with affiliates, subprocessors, or third-party model providers;
• Provides confidentiality, security, deletion, or audit protections for training data; or
• Allocates ownership of model improvements, outputs, or derived data.

Important Limitation

Because the substantive text of the diff is missing, it is not possible to identify:

• New customer obligations;
• Expanded provider rights;
• Changes to warranties, indemnities, liability limits, or confidentiality;
• Changes to data retention, security, privacy, or regulatory compliance terms;
• Whether any provisions are materially one-sided or ambiguous.

Information Needed

Please provide the actual redline text, including the approximately 3,532 added words and any deleted or replacement language. The analysis should focus particularly on provisions containing terms such as “customer data,” “inputs,” “outputs,” “content,” “train,” “fine-tune,” “improve,” “develop,” “machine learning,” “artificial intelligence,” “models,” “anonymized,” “aggregated,” “de-identified,” and “usage data.”

Executive Summary

The diff appears to replace a short introductory/contact section with a substantially expanded Privacy Notice. It adds detailed provisions governing data collection, use, disclosure, retention, security, international transfers, user rights, GDPR, and CCPA compliance.

Important Changes and Risks

1. Expanded data-use purposes

The notice states that SIS may use Personal Data to:

• Provide, operate, improve, personalize, and market the Services;
• Analyze usage patterns, user demographics, and behavior;
• Prevent fraud and abuse;
• Conduct internal business activities;
• Support mergers, restructurings, and asset sales; and
• Comply with legal obligations or protect against legal claims and safety risks.

Risk: Several purposes are broad, particularly “internal business purposes,” service improvement, usage analysis, and legitimate interests. These provisions may allow extensive secondary use of customer and User data unless limited by the customer contract or Data Processing Agreement.

2. AI-model training

No express reference to artificial intelligence, machine learning, generative AI, or training models appears in the provided diff.

The notice does authorize use of data to “improve” and “enhance” the Services and to analyze usage, but it does not clearly state whether Personal Data, Aggregate Information, prompts, outputs, or customer content may be used to train AI models.

Risk: The absence of an express AI-training restriction or permission creates ambiguity. Customers should confirm through the Terms, DPA, or a separate AI addendum whether their data may be used for model training, product development, benchmarking, or human review. The definition of “Aggregate Information” also states that it is anonymized and cannot identify individuals, but the notice does not explain the anonymization methodology or prohibit re-identification.

3. Broader sharing and international transfers

The notice permits sharing with:

• Affiliates and subsidiaries;
• Hosting providers, payment processors, mail relays, and other service providers;
• Authorities where legally required or reasonably believed necessary; and
• Purchasers or successors in a corporate transaction.

It also permits transfers to countries other than the country where the User resides or data was collected.

Risk: The notice does not identify all service providers directly, instead requiring customers to request a list. International-transfer safeguards are described generally rather than specifying mechanisms such as Standard Contractual Clauses.

4. Customer/business responsibility

For visitor data, SIS states that the business using the Services is generally the data controller and determines retention periods and certain uses.

Risk: Customers may bear primary responsibility for notices, lawful bases, retention, and responding to visitor rights requests. The notice also states that SIS may disclose Personal Data to the customer in connection with use of the Services.

5. Retention and deletion limitations

Data may be retained while an account is active and afterward where SIS has an “ongoing business need.” Deletion rights are limited where data concerns sanctions or fraud-prevention activities.

Risk: Retention periods are not specific, and exceptions may make deletion requests difficult.

6. Drafting and compliance concerns

• The notice contains inconsistent update dates: June 2, 2026 in the heading and March 20, 2025 in the body.
• “Lawful interests” appears to be used where “legal obligation” may have been intended.
• The document includes broad disclaimers that SIS cannot guarantee security.
• Contact information and corporate-affiliate details are added, including a Global Privacy and Data Protection Officer.

Summary

The diff indicates that approximately 3,532 words were added, but it does not include the actual added language. Because the substantive text is missing, it is not possible to reliably identify:

• Changes to the customer’s rights or obligations;
• New fees, liability limits, warranties, or termination rights;
• Changes to confidentiality, privacy, or data-security obligations;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, vendors, or third-party AI providers;
• Any new consent, opt-out, deletion, or data-retention requirements.

AI Training and Data-Use Review

The supplied diff does not contain enough information to determine whether the agreement now permits AI training. The added language should be reviewed for provisions stating that the provider may:

• Use customer content, prompts, inputs, outputs, telemetry, or usage data to train or improve models;
• Use data in aggregated, de-identified, anonymized, or pseudonymized form;
• Retain data after termination for model development, testing, safety, or analytics;
• Permit subprocessors or third-party model providers to access customer data;
• Claim ownership or broad licensing rights over customer content or generated outputs;
• Use customer data by default unless the customer opts out;
• Exclude certain plans, enterprise customers, or confidential information from training.

These provisions can create significant risks, particularly where customer data includes personal information, confidential business information, regulated data, trade secrets, or third-party materials. “Aggregated” or “de-identified” use may still present re-identification or confidentiality concerns, and an opt-out mechanism may not address data already incorporated into trained models.

Important Limitation

No substantive legal changes can be assessed from the notation “Added approximately 3532 words to the document” alone. The actual additions—and any surrounding text needed to understand replacements or deletions—are required for a meaningful contract-risk analysis.

Summary of Important Changes

1. Privacy Notice appears substantially shortened or removed

The diff removes the detailed Privacy Notice, including provisions addressing:

• Categories of Personal Data, Aggregate Information, and Cookies.
• Collection of location data and user-entered information.
• Purposes for processing Personal Data.
• Sharing with affiliates, service providers, customers, and authorities.
• International data transfers.
• Security, retention, and deletion.
• Data-subject rights and complaint procedures.
• GDPR, CCPA, and other regional privacy disclosures.
• Children’s data and external links.
• Privacy-notice update procedures.
• Detailed company and affiliate information.

The replacement text appears limited primarily to navigation labels and contact information. If this reflects the final published version, customers may no longer receive important legally required disclosures or contractual assurances.

2. Contact information is reformatted and possibly clarified

The contact language changes from a general statement that SIS and its affiliates “respect your privacy” and are committed to protecting information to a reference to the “Global Privacy and Data Protection Officer.”

The address is presented as:

> Sign In Solutions Inc.

> Attn: Global Privacy and Data Protection Officer

> 150 2nd Ave N, Suite 1540

> St. Petersburg, Florida 33701, USA

The prior notice also listed an email address and toll-free telephone number; those details appear to be removed in the deletion unless preserved elsewhere.

3. AI model training and use of customer data

No express AI-training authorization is added

The diff contains no language expressly stating that SIS may use Customer Data, Personal Data, content, prompts, outputs, or usage data to:

• Train, fine-tune, or improve artificial-intelligence or machine-learning models;
• Develop generalized models;
• Share data with AI vendors for training; or
• Retain data for AI-training purposes.

Important risk from deleting the prior language

The removed notice stated that SIS could use information to improve, administer, analyze, research, and enhance the Services, and could share Aggregate Information with affiliates and certain third parties. Although that language did not expressly authorize AI training, its removal eliminates some boundaries and explanations concerning permitted uses.

If AI functionality is offered elsewhere, the absence of a clear AI-data-use provision creates uncertainty about whether customer data may be used for model training under broad “service improvement” or “legitimate business purpose” concepts. Customers should seek an express statement that Customer Data is not used for AI training without consent, or that any permitted use is limited to de-identified data and subject to contractual safeguards.

4. Compliance risk

The apparent removal of GDPR, CCPA, rights, retention, security, transfer, and processor disclosures could create regulatory and contractual compliance risks. The document should also be checked for inconsistent dates: it references a June 2026 update while the deleted text states March 20, 2025.

Structured Summary of Important Changes

1. New and expanded Privacy Notice

• The notice now states that it was updated on 2 June 2026.
• It provides a substantially expanded description of:
• SIS and its affiliated companies;
• the Services covered;
• Personal Data, Aggregate Information, and Cookies;
• collection, use, disclosure, retention, security, and international transfers;
• data-subject rights and GDPR/CCPA compliance.
• The notice identifies several affiliates, including Sign In Enterprise, Traction Guest, Sign In App, Sign In Compliance, and Sign In Workspace.

Risk: The notice applies broadly to users, customers, and visitors at customer locations. Customers should confirm that its terms align with their own notices and contractual obligations, particularly where SIS processes visitor data on the customer’s behalf.

2. Broader data-use and disclosure provisions

SIS states that it may use Personal Data to:

• provide, administer, personalize, and improve the Services;
• analyze usage and user behavior;
• prevent fraud and protect SIS, customers, and users;
• support internal business purposes;
• conduct corporate transactions;
• provide marketing where consent is obtained.

SIS may disclose Personal Data to:

• customer companies;
• affiliates and subsidiaries;
• service providers, including hosting providers, payment processors, and mail relays;
• legal authorities where legally required or justified;
• parties involved in a sale or restructuring.

Risk: The permitted purposes and recipient categories are broad. The notice also permits international transfers and does not provide a fixed list of service providers, only stating that a list may be requested.

3. AI-model training

• There is no express statement authorizing SIS to use customer data, Personal Data, or visitor data to train, fine-tune, or evaluate AI models.
• However, SIS may use Aggregate Information to:
• improve and enhance the Services;
• research usage trends, demographics, and behavior;
• develop upgrades; and
• pursue other legitimate business purposes.
• Depending on how “Aggregate Information” is created and interpreted, these provisions could potentially support analytics or machine-learning activities, but the notice does not clearly authorize training models on identifiable customer data.
• SIS states that Aggregate Information is anonymized and cannot identify individuals, and that service providers may not use Personal Data for purposes other than providing the Services.

Risk: The notice does not clearly address whether de-identified, aggregated, prompts, uploaded content, or customer-controlled data may be used for AI development. Customers seeking an AI-data restriction should require an express contractual commitment prohibiting such use unless separately authorized.

4. Date and drafting issues

• The notice header says 2 June 2026, but the body still says it was last updated 20 March 2025.
• The diff contains duplicated and apparently corrupted navigation/contact text.

Risk: These inconsistencies may create uncertainty about which version governs and undermine transparency or regulatory compliance.

Key Changes and Risks

1. Privacy Notice content appears to be removed

The diff deletes nearly the entire substantive Privacy Notice, including provisions concerning:

• Types of Personal Data, Aggregate Information, and Cookies collected
• Purposes for processing Personal Data
• Sharing with affiliates, customers, service providers, and authorities
• International data transfers
• Security, retention, and deletion practices
• Data-subject rights and complaint procedures
• GDPR, CCPA, and other jurisdiction-specific provisions
• Children’s data
• External links and policy updates
• The complete “How to Contact Us” section

The replacement text shown in the diff is largely limited to navigation labels and fragments of a contact description. If this reflects the actual revised notice, it may leave customers without clear disclosures required by applicable privacy laws.

Risk: Significant uncertainty about the applicable processing purposes, legal bases, recipients, retention periods, international transfers, and customer rights. The deletion may also create inconsistencies with the Data Processing Agreement or other addenda.

2. Contact information is being changed or corrupted

The revised text adds or reconstructs a contact reference for the Data Protection Officer, including:

> “Data Protection Officer”

> “150 2nd Ave N, Suite 1540, St. Petersburg, Florida 33701, USA”

However, the diff shows the address and wording being assembled from deleted/replaced fragments. The prior notice also listed an email address and toll-free telephone number, which appear to be removed in the diff.

Risk: Customers may not have a reliable method to exercise privacy rights or contact the responsible privacy officer. The final formatting and accuracy of the contact details should be verified.

3. Navigation and document structure changes

The “Legal stuff” navigation is changed so that several individual addenda are replaced by a general “Addenda” link. The archive reference also changes.

Risk: It may become less clear which contractual addenda apply to a customer. If addenda contain data-use or AI-related terms, customers could have difficulty identifying the governing document.

4. AI model training and use of customer data

The deleted Privacy Notice does not expressly authorize or prohibit using customer data to train artificial-intelligence or machine-learning models. It contains general rights to use Aggregate Information to improve, analyze, research, and develop the Services, but also states that Aggregate Information is anonymized.

There is no new language in the visible additions expressly addressing:

• Training or fine-tuning AI models
• Use of customer content, prompts, inputs, outputs, or Personal Data for AI
• Human review of data for model development
• Opt-out or deletion rights for AI training
• Whether data is used to train SIS models or third-party models

Risk: The change creates ambiguity, particularly if AI-training practices are governed elsewhere in an Addendum or if “improve the Services” is intended to cover model training. Customers should require an express statement confirming whether their data may be used for AI training and under what safeguards.

Important Changes Summary

1. New, comprehensive Privacy Notice

The diff replaces what appears to be a navigation/contact section with a substantially expanded Privacy Notice. The revised notice:

• Applies to Sign In Solutions Inc. and named affiliates, including entities in the United States, United Kingdom, Spain, and Denmark.
• Covers websites, software applications, features, enhancements, and related content.
• Defines and addresses Personal Data, Aggregate Information, and Cookies.
• States that accessing or using the Services constitutes agreement to the collection, use, and disclosure practices described in the notice.

Risk: The notice attempts to obtain broad acceptance merely through downloading, viewing, or accessing the Services. Depending on the applicable law and the type of processing, this may not substitute for specific consent.

2. Expanded data collection and sharing disclosures

The revised notice expressly allows collection of information:

• Provided during registration, communications, uploads, and use of features.
• Generated through use of the Services, including location information.
• Obtained through cookies, beacons, device identifiers, and similar technologies.

It permits disclosure to:

• Customer companies and business locations using the Services.
• Affiliates and subsidiaries.
• Hosting providers, payment processors, mail relays, and other service providers.
• Authorities where legally required or reasonably believed necessary for legal, safety, fraud, or liability purposes.
• Buyers or successors in connection with corporate transactions.

Risk: Customers’ and visitors’ data may be transferred internationally and shared across a wider corporate and vendor ecosystem. The notice does not provide a detailed vendor list, only a right to request one.

3. Use of data for analytics and service improvement

The notice authorizes use of Personal Data for administering, operating, improving, personalizing, and enhancing the Services. It separately permits use of “Aggregate Information” to analyze usage, research trends, evaluate user behavior, and create improvements and upgrades.

4. AI model training

No express provision authorizing or prohibiting the use of customer data to train AI models appears in the diff.

However, the broad permissions to “improve” and “enhance” the Services, analyze usage, and use Aggregate Information could potentially support machine-learning or AI development if the provider treats such information as anonymized or aggregated.

Key risk: The notice does not clearly state:

• Whether customer content may be used to train, fine-tune, or evaluate AI models.
• Whether Personal Data or customer-uploaded content is excluded from training.
• Whether data is shared with AI vendors.
• Whether customers can opt out.
• Whether trained models retain or reproduce customer information.

This ambiguity should be addressed expressly, particularly for confidential, regulated, or identifiable data.

5. Rights, retention, and security

The new text adds detailed provisions on:

• Access, correction, deletion, restriction, portability, and non-discrimination rights.
• Retention and deletion/anonymization.
• International transfers and security controls.
• GDPR, CCPA, and processor/service-provider roles.

Drafting issue: The page states it was updated on 2 June 2026, but the body says it was last updated on 20 March 2025. This inconsistency should be corrected.

6. Contact and affiliate information

The revision adds corporate headquarters, named affiliates, and privacy contact information, including the privacy email, telephone number, and mailing address.

Summary of Changes

High-Level Change

• Approximately 3,532 words have been removed from the document.
• No replacement language or added terms are shown in the diff.
• Because the deleted text is not provided, the specific legal and operational effects cannot be determined.

Customer Data and AI Training

• The diff does not show whether any language concerning the use of customer data to train AI models was removed.
• It is therefore impossible to confirm whether the document now:
• Permits or prohibits using customer data to train, fine-tune, or improve AI models;
• Requires customer consent before such use;
• Limits training to aggregated, anonymized, or de-identified data;
• Allows use of prompts, inputs, outputs, metadata, or usage data for model development;
• Gives the provider ownership or license rights over customer data;
• Requires deletion or segregation of customer data from training datasets; or
• Provides opt-out, audit, confidentiality, or security protections.

Key risk: If the deleted provisions addressed AI training or data use, their removal could eliminate important restrictions or protections. Conversely, the deleted text may have imposed permissions or obligations that are no longer applicable. The direction of the change cannot be determined without the removed language.

Other Potential Risks

The deleted provisions may have affected:

• Confidentiality: Scope of protected information and permitted disclosures.
• Data protection: Processing purposes, security measures, retention, deletion, and subprocessors.
• Intellectual property: Ownership or licensing of customer data, outputs, and derivative works.
• Liability: Indemnities, warranties, disclaimers, damages caps, and exclusions.
• Termination: Data return or deletion obligations and post-termination rights.
• Compliance: Privacy laws, regulatory requirements, or customer audit rights.
• Service terms: Performance commitments, support obligations, and usage restrictions.

Recommended Review

Obtain the prior version of the document or the full redline showing the deleted text. The removed provisions should be specifically reviewed for terms such as “train,” “training,” “improve,” “machine learning,” “AI,” “models,” “inputs,” “outputs,” “usage data,” “de-identified,” “aggregated,” “license,” “ownership,” and “consent.”

Until that comparison is available, the principal conclusion is that the deletion creates material uncertainty, particularly regarding the provider’s rights to use customer data for AI model development.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 3532 words to the document”

Because the additions, deletions, and replacements are not shown, it is not possible to reliably identify:

• Changes to customer data rights or ownership
• New permissions to collect, use, disclose, or retain data
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data may be shared with affiliates, vendors, or subprocessors
• New security, confidentiality, indemnity, or liability provisions
• Changes to termination, deletion, audit, or compliance rights
• Any restrictions or exceptions that could materially increase customer risk

AI Training and Data Use

No specific AI-training language is included in the supplied diff. Accordingly, there is no basis to conclude whether the revised contract:

• Permits using customer content to train general-purpose or product-specific AI models
• Allows human review or automated analysis of customer data
• Uses de-identified, aggregated, or identifiable data for model development
• Grants the provider a continuing or perpetual license after termination
• Allows data to be combined with information from other customers
• Provides an opt-out, deletion, or prohibition on model-training use

Required Information

Please provide the full redlined text, including the content represented by:

• {additions}
• [deletions]
• []{replacements}

Without the actual language, any legal-risk assessment would be speculative.

Structured Summary of Important Changes

1. Privacy Notice content appears to be removed or replaced

The diff deletes nearly the entire substantive Privacy Notice, including provisions addressing:

• Categories of Personal Data, Aggregate Information, and Cookies
• Collection and use of location data
• Purposes for processing Personal Data
• Sharing with affiliates, service providers, customers, and authorities
• International data transfers
• Security safeguards and breach procedures
• Retention periods
• Children’s data
• Data-subject rights, including access, deletion, correction, and restriction
• GDPR and CCPA provisions
• Third-party links and notice-change procedures

No equivalent replacement language is shown for these topics. If this represents the actual published change, the revised notice may become materially incomplete and could fail to provide legally required transparency disclosures.

2. Changes to contact information

The prior wording identifying the company and its affiliates as respecting privacy and protecting information is replaced with a shorter contact-related statement. The replacement identifies a Global Privacy and Data Protection Officer and gives the following address:

> 150 2nd Ave N, Suite 1540, St. Petersburg, Florida 33701, USA

The diff also retains or adds the privacy email address in the deleted material, but it is unclear whether the email, telephone number, and complete postal contact details remain in the final version. The final notice should clearly and consistently state all privacy-contact methods.

3. “Addenda” navigation change

The legal-navigation list changes from multiple separately listed addenda—such as the Success Services, Hardware, and Equipment Rental Addenda—to a single generic “Addenda” link. This may make it less clear which contractual documents apply to the customer and whether specific addenda remain accessible.

4. Update-date inconsistency

The prior notice contained multiple update-date references, including 2 June 2026 and 20 March 2025. These date statements appear to be deleted or altered. The final notice should include one accurate “last updated” date to establish which version governs.

5. AI training and model development

The diff contains no express authorization to use Customer Data to train AI models, and no new AI-training language is shown.

However, the deleted provisions broadly allowed use of information to:

• Improve, administer, and develop the Services
• Generate reports and analyze usage
• Create enhancements and upgrades
• Share Aggregate Information with affiliates and third parties

Depending on how “improve” or “develop” is interpreted, those provisions could potentially support machine-learning development, but they did not expressly address AI training, whether Customer Data would be used, or whether data would be de-identified. Their deletion removes any stated authorization or limitation rather than clearly prohibiting AI training.

Executive Summary

The diff replaces much of the prior privacy-page content with a substantially expanded Privacy Notice, dated 2 June 2026. It introduces detailed descriptions of data collection, use, sharing, international transfers, retention, rights, and regulatory compliance. It does not expressly address whether customer data or Personal Data may be used to train, fine-tune, evaluate, or improve AI models.

Important Changes and Risks

1. Broader scope of covered entities and users

• The notice now applies to Sign In Solutions Inc. and a listed group of affiliates, including entities in the United States, United Kingdom, Spain, and Denmark.
• It covers website and software users, customers, employees or representatives, and visitors to customer business locations.
• Customers may be responsible for reviewing how the notice interacts with their own privacy notices and contracts.

Risk: The expanded affiliate structure may allow broader intra-group access, processing, and international transfers than the prior wording clearly disclosed.

2. Expanded data collection

The notice expressly covers:

• Personal Data, including identifiers, contact details, location data, online identifiers, and potentially sensitive identity-related information;
• Aggregate Information about usage, entered data quantity and type, accessed features, and browser types;
• Cookies, beacons, device identifiers, and similar tracking technologies;
• Location information used for sign-ins, scheduling, and related functionality.

Risk: “Aggregate Information” and usage-data descriptions are broad. Although the notice says aggregate information is anonymized and cannot identify individuals, the effectiveness of anonymization should be assessed, especially where data is combined with other datasets.

3. Expanded permitted uses

Personal Data may be used to:

• Provide, personalize, administer, improve, and develop the Services;
• Analyze usage patterns and user behavior;
• Prevent fraud and protect SIS, customers, and users;
• Support corporate transactions;
• Conduct marketing where legally permitted and consented to.

AI training: There is no specific permission or prohibition concerning AI model training. The general purposes—particularly “improve,” “develop,” “analyze usage,” “internal business purposes,” and “create improvements, enhancements and upgrades”—could potentially be argued to encompass machine-learning activities, but they do not clearly authorize training on customer content or Personal Data. This ambiguity creates customer consent, transparency, purpose-limitation, confidentiality, and regulatory risk.

4. Broader sharing and transfers

• Personal Data may be shared with affiliates, third-party providers, hosting providers, payment processors, mail relays, and customer companies.
• SIS may transfer Personal Data internationally.
• A list of service providers may be requested rather than being directly provided.

Risk: Customers may have limited visibility into subprocessors, locations, and onward transfers unless they separately obtain the provider list or review the Data Processing Agreement.

5. Retention and deletion

• Retention depends on business, legal, tax, accounting, and contractual needs.
• Data may be retained while an account is active and afterward under SIS’s retention policy.
• Data collected for a business customer may be retained according to that business’s policy.

Risk: The notice does not state specific retention periods, making it difficult to assess deletion obligations and AI-related model or backup retention.

6. Liability and rights limitations

• SIS disclaims responsibility for customer businesses’ privacy practices.
• Access and deletion rights may be limited where information relates to sanctions or fraud prevention.
• SIS cannot absolutely guarantee security.

Overall Assessment

The notice is materially more comprehensive but leaves a significant AI-data-use gap. Customers should seek contractual confirmation that their data, Personal Data, confidential information, and customer content will not be used to train or improve general-purpose AI models without express authorization, defined safeguards, and deletion or opt-out mechanisms.

Executive Summary

The diff appears to remove nearly all substantive provisions of the existing Privacy Notice and replace them with a much shorter set of navigation and contact information. This is a major change, not merely an editorial update. The revised text may no longer explain key data practices required for transparency and compliance.

Important Changes and Risks

1. Removal of core privacy disclosures

The existing notice’s detailed provisions appear to be deleted, including:

• Categories of Personal Data, Aggregate Information, and Cookies collected.
• Purposes for collecting and using data.
• Disclosures to affiliates, customers, service providers, authorities, and other third parties.
• International data transfers.
• Security measures and breach procedures.
• Data retention periods.
• Data subject rights and procedures for exercising them.
• GDPR, UK, and CCPA provisions.
• Controller/processor role descriptions.
• Children’s privacy protections.
• Change-notification procedures.

Risk: Removing these provisions may make the notice materially less transparent and could create compliance issues under privacy laws such as the GDPR, UK GDPR, CCPA/CPRA, and other applicable laws. It may also conflict with customer contracts or the Data Processing Agreement.

2. Changed contact and corporate information

The revised text changes the contact wording from a general privacy commitment to contact details for the “Data Protection Officer.” It also appears to introduce or retain:

• Sign In Solutions Inc. and affiliated entities.
• An address at 150 2nd Ave N, Suite 1540, St. Petersburg, Florida 33701, USA.
• A privacy email address.

Risk: The new text should clearly identify the legal entity acting as controller, processor, or service provider, and should provide complete and accurate contact details. The fragmented wording in the diff suggests possible formatting or drafting errors.

3. AI model training and data use

No express provision authorizing or prohibiting the use of customer data to train, fine-tune, evaluate, or improve AI models appears in the diff.

The deleted notice did allow data to be used to:

• Improve and enhance the Services.
• Analyze usage patterns.
• Create improvements, enhancements, and upgrades.

However, it did not expressly mention AI training.

Risk: The revised notice provides no clear explanation of whether customer data, user content, metadata, or aggregate information may be used for AI development or model training. This ambiguity is material. If AI training is intended, the notice should specify the data involved, purposes, legal basis, safeguards, retention, opt-out rights, and whether data is shared with AI providers. If it is not intended, an express prohibition would reduce uncertainty.

4. Date and version-control concerns

The diff references different update dates, including 2 June 2026 and 20 March 2025.

Risk: Conflicting dates may undermine evidence of notice, consent, and effective communication of changes. The final published version should contain one accurate effective date and a clear change history.

Diff Analysis

Available Information

The diff only states:

> “Added approximately 3532 words to the document”

No actual added, deleted, or replaced legal language has been provided.

Substantive Changes

Because the text of the changes is unavailable, it is not possible to determine:

• Which contractual provisions were added or modified;
• Whether obligations, liability, warranties, indemnities, termination rights, or governing law changed;
• Whether customer rights or provider discretion expanded;
• Whether new fees, service limitations, audit rights, or data-access rights were introduced; or
• Whether existing protections were deleted or narrowed.

AI Model Training and Customer Data

The supplied diff does not identify whether customer data may be:

• Used to train, fine-tune, evaluate, or improve AI models;
• Combined with other customers’ data for model development;
• Reviewed by human personnel or service providers for training purposes;
• Retained after termination for model training or evaluation;
• Anonymized, de-identified, or aggregated before such use;
• Excluded from training by default or only upon an opt-out request; or
• Subject to separate consent, security, confidentiality, deletion, or ownership protections.

Accordingly, no conclusion can be reached about changes to AI-training rights or the associated privacy, confidentiality, intellectual-property, or regulatory risks.

Key Risk Assessment

The statement that approximately 3,532 words were added is not itself a legal provision and does not reveal the effect of the amendment. Any risk assessment based solely on that statement would be speculative.

Information Needed

To complete the review, provide the actual redlined language, including:

1. All added text;

2. All deleted text;

3. All replacement language; and

4. Any definitions or incorporated policies referenced by the new provisions.

Particular attention should be given to terms such as customer data, usage data, content, service improvement, artificial intelligence, machine learning, training, fine-tuning, de-identification, aggregated data, retention, and opt-out.

Executive Summary

The diff appears to replace the prior privacy notice with a substantially expanded notice. It adds detailed provisions on data collection, use, disclosure, international transfers, retention, individual rights, GDPR and CCPA compliance. It also updates the privacy contact information and navigation links.

Important Changes and Risks

1. Broader data collection and use

The added notice expressly covers:

• Personal Data, including names, contact details, identifiers, location data, online identifiers, and potentially sensitive identity-related information.
• Aggregate Information about usage patterns, features accessed, browser types, demographics, and user behavior.
• Cookies, beacons, device identifiers, and similar tracking technologies.
• Location information used to identify sign-ins at business locations and support scheduling or manual-login features.

The stated purposes are broad and include providing, personalizing, improving, monitoring, analyzing, and marketing the Services, as well as internal business purposes and corporate transactions.

Risk: The scope of permitted internal analysis and service improvement is broad. Customers should confirm whether their contract, Data Processing Agreement, or other addenda impose narrower limits.

2. AI model training

The added notice does not expressly state that customer data or Personal Data may be used to train artificial intelligence or machine-learning models. It also does not expressly prohibit such use.

However, the notice permits use of Aggregate Information for:

• Research and analysis;
• Compiling usage trends, demographics, and behaviors;
• Creating improvements, enhancements, and upgrades to the Services; and
• Other legitimate business purposes.

Risk: Although “Aggregate Information” is described as anonymized and not capable of identifying individuals, the notice does not explain whether such information may be used for AI training, model evaluation, or product-development datasets. It also does not address whether Personal Data will be de-identified before such use, whether customer content is excluded, or whether customers can opt out. These issues should be clarified contractually.

3. Expanded disclosure and transfer rights

The notice authorizes disclosure to:

• Affiliates and subsidiaries;
• Hosting providers, payment processors, mail relays, and other service providers;
• A buyer or successor in a merger, restructuring, or asset sale;
• Legal authorities where legally required or reasonably believed necessary.

It also permits transfers to countries other than the country where the user resides or where data was collected.

Risk: The notice does not identify all service providers directly, offering only a right to request a list. International-transfer safeguards are described generally rather than naming specific mechanisms.

4. Controller/processor roles

The notice states that SIS acts as a processor for visitor data, while the business operating the location is the controller. It also states that SIS may act as a business and service provider under the CCPA.

Risk: Responsibilities may vary depending on the customer’s use case. The customer’s DPA should control where it conflicts with this general notice.

5. Consent and user agreement

Accessing or using the Services is stated to constitute agreement to the collection, use, and disclosure of data under the notice.

Risk: This may be insufficient as consent where applicable law requires specific, informed, or affirmative consent, particularly for cookies, marketing, location data, or sensitive information.

6. Drafting and document-control concerns

The added text contains apparent inconsistencies:

• The header says the notice was updated on 2 June 2026, while the body says it was last updated on 20 March 2025.
• The diff includes substantial formatting and contact-information changes.
• The notice refers to both a “Privacy Policy” and “Privacy Notice.”

These issues could create uncertainty about which version and terms govern.

Summary

The supplied diff only states: “Added approximately 3,532 words to the document.” It does not include the actual added, deleted, or replaced contract language.

What can be determined

• The document has been materially expanded.
• Because the substantive text is unavailable, it is not possible to determine:
• Whether customer data may be used to train, fine-tune, test, or evaluate AI models;
• Whether such use is limited to aggregated, anonymized, or de-identified data;
• Whether the customer’s confidential information, personal data, prompts, outputs, or usage metadata may be retained or disclosed;
• Whether the provider receives a broad license to customer data or customer content;
• Whether data may be shared with affiliates, subprocessors, vendors, or model providers;
• Whether the customer can opt out of AI training or require deletion;
• Whether new indemnities, warranties, liability exclusions, audit rights, or security obligations apply; or
• Whether the added terms override or conflict with existing data-protection provisions.

Key risk

A 3,532-word addition could contain significant new obligations or permissions, particularly concerning data rights, AI systems, confidentiality, privacy, security, intellectual property, and liability. The absence of the actual language prevents a reliable legal risk assessment.

Information needed

Please provide the complete diff, including the text marked as:

• {additions};
• [deletions]; and
• []{replacements}.

The AI-data provisions should be reviewed specifically for terms such as train, fine-tune, improve, develop, machine learning, artificial intelligence, model, prompts, inputs, outputs, telemetry, usage data, anonymized, de-identified, retain, license, subprocessors, and service improvement.

Summary of Important Changes

1. Substantial deletion of the Privacy Notice

The diff appears to delete nearly all substantive provisions of the Privacy Notice, including:

• The categories of Personal Data, Aggregate Information, and Cookies collected.
• The purposes for collecting and using data.
• Sharing with affiliates, service providers, customers, and authorities.
• International data transfers.
• Security, retention, and deletion practices.
• Data-subject rights and procedures for exercising them.
• GDPR, CCPA, and children’s privacy provisions.
• Third-party links and privacy-policy change procedures.
• The list of corporate affiliates and their addresses.

Unless this text has merely been moved to another document or location, the revised notice may be materially incomplete.

2. New or revised contact information

The visible additions create or revise a privacy contact block referring to:

• A “Data Protection Officer.”
• Sign In Solutions Inc.
• 150 2nd Ave N, Suite 1540, St. Petersburg, Florida 33701, USA.
• The email address privacy@signinsolutions.com appears to remain part of the contact information.

The redline formatting produces fragments such as “Data Protection Officer” and the address, so the final published wording should be checked for formatting and grammatical errors.

3. Navigation and archive changes

The navigation text changes “Addenda” to a broader or consolidated “Addenda” link. The archived-material navigation also appears to be changed. This may affect which contractual addenda customers can locate and whether older terms remain accessible.

4. AI-model training and data use

No express provision authorizing or prohibiting the use of customer data to train, fine-tune, evaluate, or improve artificial-intelligence models appears in the diff.

However, the deletion of the prior “use and sharing” provisions removes language that previously described purposes such as improving services, analyzing usage, generating reports, and creating enhancements. If those provisions are not preserved elsewhere, the revised notice may:

• Create uncertainty about whether customer data may be used for AI development.
• Fail to explain whether Personal Data, Aggregate Information, prompts, outputs, or usage data are used for model training.
• Make it unclear whether customer data is shared with AI vendors or subprocessors.
• Create inconsistencies with the customer agreement, Data Processing Agreement, or AI-related addenda.

A separate, clear AI-data-use provision should specify permitted data types, purposes, vendor access, de-identification, retention, opt-out or consent requirements, and whether customer content is used to train general-purpose models.

5. Principal legal risk

The central risk is that the final Privacy Notice may no longer provide legally required transparency about data processing. Confirm whether the deleted language has been relocated, and reconcile the notice with the Terms and Conditions, Data Processing Agreement, subprocessors list, and any AI addendum.