Umbraco

Summary

The provided diff does not include the actual contract language. It only states:

> “[Removed approximately 27 words from the document]”

Accordingly, it is not possible to determine what legal provisions changed or whether the changes affect the parties’ rights or obligations.

AI Training and Customer Data

• No specific language concerning customer data, artificial intelligence, machine learning, model training, data retention, or data licensing is included.
• It cannot be determined whether the deleted language:
• Authorized or restricted use of customer data to train AI models;
• Allowed use of customer data in aggregated, anonymized, or de-identified form;
• Gave the provider ownership or license rights in customer data or model outputs;
• Required customer consent for AI training;
• Addressed opt-out rights, deletion, confidentiality, or security; or
• Limited use of data to providing the contracted services.

Legal Risk Assessment

Because the deleted 27 words are not shown, the principal risk is uncertainty. A deletion could materially:

• Expand the provider’s permitted use of customer data;
• Remove restrictions or consent requirements;
• Eliminate confidentiality, deletion, or security protections;
• Change ownership or licensing rights; or
• Remove representations, warranties, or indemnities related to AI use.

However, none of these effects can be confirmed from the information provided.

Recommended Next Step

Provide the exact deleted and replacement text—or a redline showing the affected provision—for a meaningful legal analysis. Until then, the change should be treated as potentially material, particularly if it occurred in provisions addressing data use, privacy, confidentiality, intellectual property, or AI services.

Summary of Important Changes

1. Access to customer data

• The wording changes “need to have” not “nice to have” to “need to have” not “nice to have”.
• This appears to be a formatting or quotation-mark correction only and does not change the substantive access standard.
• The provision continues to suggest that access is limited to persons who have a genuine business need to access the data.
• However, the wording should ideally clarify whether this applies to employees, contractors, subprocessors, or all third parties.

2. Data sharing

• “don’t” replaces “don’t”, which is only an apostrophe/formatting change.
• The statement that the company “don’t share data” appears substantively unchanged.
• This statement may be overly broad if data is disclosed to subprocessors, service providers, affiliates, auditors, regulators, or other permitted recipients. It should be read together with the provisions concerning subprocessors and international transfers.

3. International data transfers

• The text refers to signed Standard Contractual Clauses (SCCs) with subprocessors.
• It also refers to Transfer Impact Assessments (TIAs) for subprocessors located in “unsecure third countries.”
• No substantive change to these protections is apparent from the diff. The terminology “unsecure third countries” is potentially imprecise; privacy laws generally refer to countries lacking an adequacy decision or countries presenting transfer risks.
• The provision does not indicate whether customers can obtain copies or summaries of the SCCs and TIAs, or whether supplementary safeguards are used.

4. New contact and policy information

• A new sentence gives customers a contact address: GDPR@umbraco.com.
• It also directs customers to the company’s policy page for additional privacy information.
• This improves transparency and provides a privacy-related contact route, but it does not state response times, the types of requests handled, or whether the address is monitored for data-subject rights requests.

5. AI model training

• No change in the diff expressly permits or prohibits using customer data to train AI models.
• The text does not clarify whether customer data, prompts, outputs, telemetry, or support content may be used for:
• training or fine-tuning generative AI models;
• improving products or services;
• training third-party models; or
• creating aggregated or de-identified datasets.
• This remains a material ambiguity and should be addressed expressly if the service uses AI or machine-learning systems.

Summary of Important Changes

1. No express change regarding AI training

• The diff does not add or remove any express language about using customer data to train, fine-tune, evaluate, or improve AI models.
• The statement that data is handled on a “need to have” rather than “nice to have” basis may suggest data minimization and restricted internal access, but it does not prohibit AI training or define permitted uses of customer data.
• If AI-training restrictions are important, the agreement should expressly state whether customer data, prompts, outputs, metadata, or usage data may be used for:
• Training or fine-tuning models;
• Service improvement or benchmarking;
• Human review or model safety testing; and
• Training by vendors or subprocessors.

2. Data-sharing statement retained, with minor typographical change

• The wording “We [don't] share data” changes only to “We don’t share data.”
• This appears to be a typographical or formatting correction, not a substantive legal change.
• However, the statement is broad and potentially misleading unless it is qualified. Other provisions apparently refer to subprocessors, SCCs, and TIAs, which indicates that data may be disclosed to subprocessors or transferred internationally. The policy should clarify that “don’t share data” means no sharing except as permitted with service providers, subprocessors, affiliates, authorities, or other legally authorized recipients.

3. International transfer protections are described

• The revised text states that SCCs have been signed with subprocessors located in “unsecure third countries” and that Transfer Impact Assessments (TIAs) have been completed.
• This provides additional information about safeguards for international transfers and is generally favorable from a compliance and transparency perspective.
• The phrase “unsecure third countries” is imprecise and potentially problematic. A more legally standard formulation would refer to countries that do not benefit from an adequacy decision or that present relevant transfer risks.
• The provision does not identify the supplementary measures used, such as encryption, access controls, or contractual protections beyond the SCCs.

4. Removal of contact and policy-reference language

• The sentence allowing customers to contact GDPR@umbraco.com or visit the privacy policy has been deleted.
• This reduces the policy’s direct contact and transparency information and may make it harder for customers to submit privacy questions or understand their rights.
• The deletion could create practical compliance concerns if equivalent data-protection contact details are not provided elsewhere.

Overall risk assessment

The most significant changes concern international-transfer disclosure and the removal of privacy contact information. There is no clear AI-training permission or restriction in this diff. The document should not be interpreted as banning AI training unless an explicit prohibition is added.

Summary of Important Changes

1. No substantive change to “need to have” access standard

• The phrase [“need to have” not “nice to have”]{"need to have" not "nice to have"} appears to replace typographic quotation marks with straight quotation marks.
• Legal effect: No apparent change. The provision still states that access is limited to personnel who have a genuine business need to access the customer’s data.
• The surrounding wording—“anyone not legally allowed to access your data”—appears unchanged.

2. Minor wording change regarding data sharing

• [don’t]{don't} changes the typographic apostrophe to a standard apostrophe.
• Legal effect: No substantive change. The statement remains: “We don’t share data.”
• Potential ambiguity: This statement may be overbroad or potentially inconsistent with the reference to subprocessors and international data transfers. If subprocessors can access or process customer data, the policy should clarify whether “share” excludes disclosures to service providers acting on the company’s behalf.

3. Additional information about international transfers

• The text continues to state that the company has signed Standard Contractual Clauses (SCCs) with its subprocessors.
• It also states that Transfer Impact Assessments (TIAs) have been completed for subprocessors located in “unsecure third countries.”
• Legal significance: This reinforces the company’s stated approach to international data transfers and suggests an effort to address requirements arising from data-transfer laws, including GDPR.
• Potential risks or limitations:
• “Unsecure third countries” is not a precise legal term and could be replaced with “countries not recognized as providing an adequate level of protection.”
• The wording does not explain whether supplementary safeguards are used, what risks were identified, or whether customers can obtain relevant transfer information.
• The statement is a general representation and may create compliance or contractual risk if SCCs or TIAs are incomplete, outdated, or not applied to every relevant subprocessor.

4. New customer-contact language

• New text provides an email address—GDPR@umbraco.com—for privacy questions and directs customers to the company’s policy page.
• Legal effect: This improves transparency and gives customers a practical contact route.
• Potential issue: The wording does not identify response times, the responsible privacy contact, or whether the email address is also intended for formal data-subject requests or complaints.

AI Model Training

• No changes address the use of customer data to train, fine-tune, evaluate, or improve AI models.
• The diff does not grant or remove any AI-training rights, impose restrictions, or explain whether customer data is excluded from model training.
• If AI processing is relevant, the agreement should address it expressly, including consent or authorization, data retention, de-identification, subprocessors, customer opt-out rights, and whether prompts, outputs, or usage data may be used for training.

Summary of Important Changes

1. No apparent change to AI-training rights or data use

• The diff does not add, remove, or modify any express language about using customer data to train, develop, fine-tune, or improve AI models.
• Based on this excerpt, there is no new authorization for AI training and no new restriction on such use.
• However, the clause stating that the company “doesn’t share data” remains broad. If other parts of the agreement permit service improvement, analytics, product development, or AI-related processing, this wording should be reviewed alongside those provisions for consistency.

2. Formatting-only wording change

• “need to have” not “nice to have” replaces "need to have" not "nice to have".
• This appears to be a typographical or formatting correction involving curly quotation marks. It does not materially change the legal meaning.

3. Minor typographical correction

• don't is replaced with don’t.
• This is also a formatting change and does not alter the stated commitment that the company does not share data.

4. Deletion of privacy contact and policy reference

The following sentence has been removed:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

This is the most substantive change in the excerpt. Its deletion:

• Removes an expressly identified email address for privacy questions.
• Removes a direct reference to the company’s privacy policy.
• Makes it less clear how customers can obtain further information or raise data-protection concerns.
• Could reduce practical transparency and make it harder for customers to exercise privacy-related rights or seek clarification.

The deletion does not necessarily eliminate any statutory rights or obligations under applicable data-protection law, but it removes a useful contractual communication channel and may create uncertainty if no replacement contact method appears elsewhere.

5. Security and international-transfer language appears unchanged

The references to:

• Access on a “need to have” basis;
• Removing data not relevant for legal or other relevant purposes;
• Signing Standard Contractual Clauses (SCCs) with subprocessors; and
• Completing Transfer Impact Assessments (TIAs) for subprocessors in “unsecure third countries”

appear unchanged in substance.

The phrase “unsecure third countries” may be imprecise legal terminology, but the diff does not show a change to it.

Summary

The diff only states:

> “Added approximately 27 words to the document”

It does not include the actual added language or identify where the words were inserted.

Legal and Business Impact

• No substantive changes can be evaluated from the information provided.
• It is not possible to determine whether the addition changes:
• Customer rights or provider obligations;
• Data ownership, confidentiality, or security;
• Use of customer data for analytics, product improvement, or advertising;
• Intellectual-property rights or license grants;
• Liability, indemnification, warranties, or termination rights; or
• Governing law or dispute-resolution procedures.

AI Training and Data Use

• No AI-training language is visible in the diff.
• The available information does not establish whether customer data may be:
• Used to train, fine-tune, or improve AI or machine-learning models;
• Retained after termination;
• Combined with other customers’ data;
• De-identified or anonymized before use;
• Shared with vendors or model providers; or
• Excluded from training unless the customer opts out.

Required Information

To provide a meaningful legal-risk analysis, the actual 27 added words—and, preferably, the surrounding provision—are required.

Summary of Important Changes

1. No substantive change to the “need to have” access standard

• Change: ["need to have" not "nice to have"] → {“need to have” not “nice to have”}
• Effect: This is only a change in quotation-mark style. It does not alter the stated limitation that access to customer data should be restricted to persons with a necessary business or legal need.

2. No substantive change to the data-sharing statement

• Change: [don't]{don’t}
• Effect: This changes only the apostrophe formatting. The statement remains that the company does not share data.
• Risk/clarity issue: The phrase “don’t share data” is broad and may be qualified elsewhere by disclosures regarding subprocessors, legal requirements, corporate transactions, or data transfers. The excerpt does not define what “share” means.

3. Deletion of privacy-contact and policy-reference language

• Deleted text:

“You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

• Effect: Customers no longer receive, in this provision, a specific privacy contact email or a direct reference to the policy page.
• Risk: This reduces transparency and makes it less clear how customers can raise privacy questions or find additional information. It may also make it harder for customers to understand their rights or the company’s detailed data-processing practices, although the deletion may be addressed elsewhere in the agreement or privacy notice.

4. International-transfer protections remain referenced

• The language regarding Standard Contractual Clauses (SCCs) with subprocessors and Transfer Impact Assessments (TIAs) for subprocessors in “unsecure third countries” appears unchanged.
• Risk/clarity issue: “Unsecure third countries” is not a standard legal term. The agreement should preferably identify the relevant legal concept, such as countries lacking an adequacy decision, and explain how transfers are safeguarded.

5. AI-model training

• The excerpt contains no express change addressing whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• It also does not expressly prohibit such use. Accordingly, the customer’s data-use rights regarding AI training remain unclear based on this language alone. A separate provision should state whether customer data, prompts, outputs, metadata, or support data may be used for AI training and whether consent, de-identification, or opt-out rights apply.

Summary of Changes

1. No change to AI-model training rights identified

• The diff contains no express provision about using customer data to:
• train, fine-tune, or improve AI models;
• develop machine-learning systems;
• create aggregated or de-identified training datasets; or
• permit vendors or subprocessors to use data for AI purposes.
• Accordingly, the diff does not appear to add, remove, or clarify any customer-data rights relating to AI training.
• The underlying agreement should still be reviewed for separate language concerning product improvement, analytics, automated processing, or AI services.

2. Access limited to a “need to have” basis

• The wording is retained as: “need to have” not “nice to have.”
• This emphasizes that access to customer data should be limited to personnel or providers with a business need to access it.
• However, the clause appears incomplete in the supplied text (“We have made sure that your data is being treated in…”), so its exact legal effect cannot be fully assessed.
• The phrase is a general access-control commitment, not a precise definition of who may access data or for what purposes.

3. Data-sharing statement retained

• The wording is corrected from “don’t” to “don't”, with no apparent substantive change.
• The statement “We don't share data” remains broad but potentially ambiguous. It should be read alongside provisions allowing disclosure to subprocessors, affiliates, legal advisers, authorities, or other third parties.
• If subprocessors receive customer data, “we don't share data” may be misleading unless it clearly distinguishes sharing from processing on the customer’s behalf.

4. International transfers and subprocessors

• The text refers to:
• signed Standard Contractual Clauses (SCCs) with subprocessors; and
• Transfer Impact Assessments (TIAs) for subprocessors located in “unsecure third countries.”
• These additions or clarifications suggest an effort to address international data-transfer compliance.
• “Unsecure third countries” is not a standard legal term and may create uncertainty. “Third countries lacking an adequacy decision” or similar wording would be more precise.
• The clause does not state whether customers will be notified of new subprocessors, given an objection right, or provided access to the SCCs and TIAs.

5. New contact and policy reference

• A new sentence provides GDPR@umbraco.com for privacy questions and refers customers to the policy page.
• This improves transparency and gives customers a contact route, but it does not itself create a specific response-time obligation or additional contractual rights.

Summary of Important Changes

1. No apparent change to AI-model training rights

• The diff does not add, remove, or modify any express permission to use customer data to train, fine-tune, evaluate, or improve AI models.
• There is also no new restriction stating that customer data will not be used for AI training.
• Any AI-training terms that may exist elsewhere in the agreement or privacy policy are not affected by the wording shown here.

2. Access limitation clarified, but not materially changed

• The phrase “need to have” not “nice to have” replaces the same phrase using typographic quotation marks.
• This appears to be a formatting or editorial change, not a substantive change. It continues to indicate that access to customer data should be limited to personnel or parties with a genuine need to access it.
• The wording remains somewhat informal and does not specify:
• who determines whether access is necessary;
• whether access is logged or periodically reviewed; or
• what technical and organizational controls apply.

3. Data deletion language remains broad

• The text continues to refer to removing data that is not relevant for legal or other relevant purposes.
• No clear substantive change to the deletion obligation is shown.
• The phrase “other relevant purpose” is broad and could allow retention for purposes beyond strictly legal requirements. The provision does not specify:
• retention periods;
• deletion deadlines;
• backup deletion procedures; or
• whether data may be retained for internal business, security, or dispute-related purposes.

4. Data-sharing statement remains

• The statement “We don’t share data” appears to remain in place, with only an apostrophe-style correction.
• This statement should be read together with the reference to subprocessors and international transfers. It may mean that data is not shared outside the service relationship, but it does not appear to prohibit disclosures to subprocessors, affiliates, authorities, or other legally permitted recipients.
• The wording is potentially overbroad or ambiguous because it does not define “share.”

5. International-transfer safeguards remain referenced

• The text continues to state that Standard Contractual Clauses (SCCs) have been signed with subprocessors located in “unsecure third countries” and that Transfer Impact Assessments (TIAs) have been completed.
• No substantive change to these safeguards is apparent.
• “Unsecure third countries” is not a standard legal term; “countries without an adequacy decision” or similar language may be more precise.

6. Removal of contact and policy-reference sentence

The following sentence is deleted:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

Risks and practical effect

• Customers lose an expressly identified privacy contact email.
• The deletion may make it less clear how customers can exercise privacy rights or obtain further information.
• If this text formed part of a privacy notice, removing it could reduce transparency and may create compliance concerns depending on the applicable data-protection requirements.
• The deletion does not itself change how data is used, including for AI training.

Summary of Important Changes

1. No substantive change to the “need to have” access standard

• The phrase [“need to have” not “nice to have”]{"need to have" not "nice to have"} appears unchanged in substance.
• The change appears to be formatting or punctuation only.
• The provision continues to state that access to customer data is limited to individuals who have a business need to access it.

Risk assessment: No material legal change identified, although the wording could be made clearer by stating who determines the access requirement and how access is reviewed or revoked.

2. No substantive change to the data-sharing statement

• [don’t]{don't} is only a typographical or stylistic correction.
• The statement remains: “We don't share data.”

Potential legal concern: This statement is broad and may be misleading or internally inconsistent if the provider:

• Gives data to subprocessors;
• Transfers data internationally;
• Discloses data to advisers, authorities, or service providers; or
• Permits access by affiliates or other third parties.

It would be safer to clarify that data is not shared except with identified categories of subprocessors or where legally required. The existing reference to signed SCCs with subprocessors indicates that some data may in fact be disclosed or made accessible to subprocessors.

3. International data-transfer language remains substantially unchanged

The text continues to state that:

• SCCs have been signed with subprocessors; and
• Transfer Impact Assessments (TIAs) have been completed for subprocessors located in “unsecure third countries.”

Potential risks or drafting issues:

• “Unsecure third countries” is not a standard GDPR term and could be replaced with “countries that do not benefit from an adequacy decision” or similar wording.
• The provision does not explain what supplementary safeguards are used where required.
• It does not identify the relevant SCC module, implementation date, or whether data subjects/customers can obtain copies or summaries of the safeguards.
• The broad statement that the company “doesn’t share data” should be reconciled with these international transfers.

4. New privacy-contact language

The following sentence is added:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

Effect: This provides a specific privacy contact and directs users to additional policy information.

Potential issues:

• The wording is informal and grammatically unclear.
• It does not identify whether the email address is for data-subject requests, security incidents, or general privacy inquiries.
• The referenced policy page should be clearly linked and kept consistent with the contractual terms.

5. AI-model training

No change addressing AI training was identified. The diff does not state whether customer data may be used to train, fine-tune, evaluate, or improve AI models. It also does not prohibit such use or explain whether customer data is excluded from provider or third-party AI training.

Recommended clarification: Add an express statement confirming whether customer data is used for AI training and, if so, the purposes, controls, retention period, opt-out rights, and applicable subprocessors.

Summary of Changes

1. No substantive change to access controls

• The phrase ["need to have" not "nice to have"]{“need to have” not “nice to have”} only changes the quotation marks from straight to typographic quotation marks.
• The apparent commitment remains that access to customer data is limited on a strict need-to-know basis.
• Risk impact: No material legal change identified.

2. No substantive change to data-sharing statement

• ["don't"]{don’t} changes only the apostrophe style.
• The statement that the company “doesn’t share data” remains unchanged.
• Risk impact: No new risk from this edit, although the underlying statement remains broad and may need to be read together with provisions concerning subprocessors, legal requirements, and service providers.

3. Deletion of privacy contact and policy reference

The following sentence was deleted:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

This removes:

• A specific privacy contact email address.
• A direct reference to the company’s privacy policy.
• A clear route for customers to ask questions about their data.

Risk impact:

• Reduced transparency and accessibility for customers seeking to exercise privacy rights or obtain information.
• Potential concern under GDPR transparency and accountability principles, particularly if equivalent contact information is not provided elsewhere in the agreement or privacy notice.
• The deletion does not itself remove any substantive data-processing obligation, but it may make those obligations harder for customers to understand or enforce.

4. AI-model training

• The diff contains no express provision authorizing or prohibiting the use of customer data to train, fine-tune, evaluate, or improve AI models.
• There is also no clarification that customer data, prompts, outputs, or usage data are excluded from AI training.
• The statement that the company “doesn’t share data” does not necessarily address internal use of data for AI training.
• Risk: The contract remains silent on AI training. If AI use is relevant to the services, customers may want an explicit commitment that their data will not be used for model training without prior consent, or clear limitations on permitted use.

Summary

The provided diff contains only the statement:

> “Added approximately 27 words to the document”

It does not include the actual 27 words added, any deleted language, or any replacement language.

Legal and AI-Training Impact

• No substantive contractual changes can be analyzed from the information provided.
• It is not possible to determine whether the customer’s data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with affiliates, service providers, or third parties for AI development;
• Retained for model training after termination;
• Anonymized, aggregated, or otherwise de-identified before use; or
• Excluded from training by default or only upon customer request.
• No new risks, obligations, permissions, restrictions, or liability allocations can be identified without the actual amended text.

Required Information

Please provide the actual added, deleted, and replacement language. The substantive diff is necessary to assess changes involving data ownership, confidentiality, permitted data uses, AI training, security, retention, and regulatory compliance.

Summary of Important Changes

1. No substantive change to access-control standard

• The phrase “need to have” not “nice to have” has been retained.
• The change from straight quotation marks to typographic quotation marks is purely editorial and does not alter the legal meaning.
• The provision continues to suggest that access to customer data is limited to people who genuinely need it for their work.

2. No substantive change to data sharing or international-transfer safeguards

The supplied diff does not appear to change the following commitments:

• Data is deleted when it is no longer relevant for legal or other relevant purposes.
• The provider states that it does not share data.
• Standard Contractual Clauses (SCCs) are in place with subprocessors.
• Transfer Impact Assessments (TIAs) are conducted for subprocessors located in “unsecure third countries.”

However, the phrase “We don’t share data” should be read alongside the references to subprocessors and international transfers. It may not mean that data is never disclosed; it likely means that data is not shared except as permitted under the privacy terms, including disclosures to service providers or subprocessors. The policy should define “share” and identify permitted disclosures clearly.

3. Removal of privacy-contact and policy-reference language

The following sentence has been deleted:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

This removes:

• A specific email address for privacy inquiries.
• A direct reference to the provider’s privacy policy.
• A clear customer-support route for exercising privacy-related rights or asking questions.

This may reduce transparency and make it less clear how customers can obtain further information or raise data-protection concerns. Customers should confirm whether an alternative contact method appears elsewhere in the agreement or policy.

4. AI-model training

• No express reference to artificial intelligence, machine learning, model training, model improvement, or use of customer data for training appears in this diff.
• Accordingly, the diff does not grant or remove an explicit right to use customer data to train AI models.
• The unchanged data-use language should nevertheless be reviewed in the full agreement, because broad terms such as “relevant purposes,” service provision, analytics, or product improvement could potentially affect AI-related processing if defined elsewhere.

Summary of Changes

1. Access to customer data

• The wording changes from curly quotation marks to straight quotation marks:
• Before: “need to have” not “nice to have”
• After: "need to have" not "nice to have"
• This is only a formatting or typographical change and does not alter the legal meaning.
• The provision continues to state that access is limited on a “need to have” basis, suggesting that personnel or other parties should access data only when necessary for their work.

2. Data sharing statement

• The wording changes from “don’t” to “don't.”
• This is also a typographical change with no substantive legal effect.
• The statement remains: “We don't share data.”

Potential legal concern

• The statement is absolute and may be broader than the surrounding provisions, which refer to subprocessors and international transfers. It could create ambiguity about whether data is shared with:
• Service providers or subprocessors;
• Affiliates;
• Authorities or regulators;
• Other third parties where disclosure is legally required.
• The contract should clarify what “share” means and identify any permitted disclosures, especially if subprocessors process customer data.

3. International transfers and safeguards

• The text continues to refer to:
• Signed Standard Contractual Clauses (SCCs) with subprocessors; and
• Transfer Impact Assessments (TIAs) for subprocessors located in “unsecure third countries.”
• No substantive change to these obligations is apparent from the diff.
• “Unsecure third countries” may be imprecise terminology. The agreement should ideally define this by reference to applicable data-protection law or countries lacking an adequacy decision.

4. New contact and policy information

A new sentence is added:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

This provides a privacy contact email and directs customers to an external policy page.

Potential risks

• The referenced policy page may contain terms that can be changed separately from the contract. The agreement should clarify whether the policy is incorporated into the contract and how changes are notified.
• The sentence is informal and grammatically awkward (“where further is written”). A clearer formulation would identify the specific policy and explain whether it is legally binding.
• The email address should be kept current and monitored.

5. AI-model training

• The diff contains no express provision permitting or prohibiting the use of customer data to train, fine-tune, evaluate, or improve AI models.
• There is also no clarification whether customer data is excluded from provider or subprocessors’ AI-training activities.
• If AI use is relevant, a separate clause should expressly state whether customer data, prompts, outputs, metadata, or usage data may be used for model training and under what safeguards.

Summary

The provided diff only states that approximately 27 words were removed from the document. It does not identify:

• Which provisions were changed;
• The words or phrases that were deleted;
• Whether any language was added or replaced;
• Whether the deletion affects customer data, confidentiality, intellectual property, privacy, or AI training.

AI Model Training

No conclusions can be drawn about changes to the use of customer data to train AI models. In particular, the available information does not show whether the deleted language:

• Permitted or prohibited training AI models on customer data;
• Allowed use of customer data to improve products or services;
• Applied only to aggregated, de-identified, or anonymized data;
• Required customer consent or provided an opt-out;
• Allowed disclosure of customer data to AI providers or subprocessors;
• Restricted retention or reuse of data after termination; or
• Addressed ownership of model inputs, outputs, or derived data.

Risk Assessment

The deletion could be legally significant, but its effect cannot be assessed without the actual text. If the removed language limited the provider’s use of customer data, its deletion could expand the provider’s rights. Conversely, if it imposed broad usage rights or training permissions, its deletion could reduce those rights.

Required Information

To perform a meaningful legal review, provide the actual redline showing the deleted words, preferably together with the surrounding paragraph or the clean and marked-up versions of the relevant provision.

Summary

The diff only states:

> “Added approximately 27 words to the document”

It does not include the actual added contractual language. As a result, the changes cannot be legally analyzed.

AI Training and Data-Use Changes

• No specific language is provided addressing whether the customer’s data may be:
• Used to train, fine-tune, or improve AI models;
• Shared with model providers or other third parties;
• Retained after the services end;
• De-identified, aggregated, or combined with other data; or
• Used to generate analytics, products, or services.

• Accordingly, it is not possible to determine whether the amendment creates new permissions, restrictions, ownership rights, confidentiality obligations, or privacy risks concerning customer data.

Risk Assessment

The key contractual change is unavailable. Any conclusion about legal effect would be speculative. The full text of the approximately 27 added words—and, if applicable, the surrounding provision—should be provided for review.

Summary of Important Changes

1. Access to customer data

• Wording/formatting change only:

The phrase “need to have” not “nice to have” replaces the same phrase using straight quotation marks.

• Legal effect:

No substantive change appears to have been made. The clause still indicates that access is limited to people who have a genuine need to access the data, rather than merely a desirable or convenient reason.

2. Data sharing

• The text continues to state: “We don’t share data.”
• Based on the diff, this statement does not appear to have been changed.
• Potential risk: The statement may be overly broad if data is shared with subprocessors, service providers, affiliates, authorities, or other permitted recipients elsewhere in the policy. It should be consistent with the rest of the privacy terms and should clarify whether “share” excludes processing by subprocessors.

3. International transfers

• The text refers to:
• Standard Contractual Clauses (SCCs) with subprocessors; and
• Transfer Impact Assessments (TIAs) for subprocessors located in “unsecure third countries.”
• No substantive amendment to these transfer protections is clearly shown.
• Potential drafting issue: “Unsecure third countries” is not a standard legal term and may be unclear. “Countries not recognized as providing adequate protection” or similar wording may be more precise.
• The fragment appears to end with “placed in”, suggesting the provision may be incomplete or poorly integrated.

4. Deleted contact and policy-reference language

The following sentence was deleted:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

• Effect: Customers may no longer be expressly given:
• A dedicated privacy contact email; or
• A direct invitation to consult the privacy policy.
• Risk: Removing this may make it less clear how customers can exercise privacy rights or ask questions. If the email address is used elsewhere, the practical impact may be limited, but the deletion reduces transparency.

5. AI model training

• No express change concerning AI or model training appears in this diff.
• The amended text does not authorize or prohibit using customer data to train, fine-tune, evaluate, or improve AI models.
• If AI training rights are addressed elsewhere, that language should be reviewed separately. If not, the contract remains ambiguous on this important issue.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 27 words to the document”

Accordingly, the legal effect of the changes cannot be determined.

AI Training and Data Use

• No language is provided addressing whether customer data may be:
• Used to train, fine-tune, or improve AI models;
• Used to develop products or services;
• Shared with affiliates, vendors, or third parties for AI-related purposes;
• Retained after contract termination for model training;
• De-identified or aggregated before use; or
• Excluded from model training by default or only upon customer request.

Because the 27 added words are not shown, it is not possible to identify whether the amendment expands or restricts these rights.

Risk Assessment

The principal risk is lack of visibility into the actual amendment. A short addition could materially change:

• Ownership or licensing rights in customer data;
• Confidentiality obligations;
• Permitted purposes for data processing;
• The provider’s rights to train AI models;
• Customer opt-out or deletion rights;
• Liability for unauthorized use; or
• Compliance obligations under privacy and data-protection laws.

Recommendation

Obtain and review the actual 27-word addition, preferably with the surrounding sentence or clause and any defined terms. The amendment should be specifically checked for language such as “improve,” “develop,” “train,” “fine-tune,” “artificial intelligence,” “machine learning,” “de-identified,” “aggregated,” or “service data.”

Summary

The provided diff states only that approximately 27 words were removed from the document. It does not identify the deleted language or indicate which clause or section was affected.

Legal and Commercial Impact

• Cannot assess the substantive effect: Without the actual deleted words, it is impossible to determine whether the change affects liability, confidentiality, intellectual property, data rights, termination, warranties, or other obligations.
• Potential risk from deletion: Removing language may eliminate a customer protection, limitation, consent requirement, or provider obligation. However, no specific risk can be confirmed from the information provided.
• Interpretation uncertainty: The approximate word count does not reveal whether the deletion was a minor drafting edit or a material change to the parties’ rights.

Customer Data and AI Training

• No identifiable AI-related change: The diff does not show any language concerning the use of customer data to train, fine-tune, evaluate, or improve artificial intelligence or machine-learning models.
• No conclusion possible: The deleted text could theoretically have addressed AI training, data usage, confidentiality, or opt-out rights, but this cannot be determined from the word count alone.
• Recommended review: Confirm whether the deleted language contained any of the following:
• Permission to use customer data or content for model training or service improvement;
• Restrictions or prohibitions on such use;
• De-identification or aggregation requirements;
• Customer consent or opt-out rights;
• Ownership of model inputs, outputs, or derived data;
• Security, retention, or deletion obligations.

Conclusion

The diff is insufficient for a reliable legal analysis. The actual 27 deleted words, the surrounding sentence or clause, and the document section should be provided before determining whether the amendment creates new legal or data-use risks.

Summary of Important Changes

1. No substantive change to “need to have” access standard

• The phrase “need to have” not “nice to have” basis appears to be unchanged, with only formatting or quotation-mark normalization.
• It continues to state that access to customer data is limited to personnel who have a legitimate need to access it.
• This is generally privacy-protective, although the wording would be stronger if it clearly defined:
• Who determines whether access is necessary;
• Whether access is logged and reviewed; and
• What safeguards apply to privileged or administrative access.

2. No substantive change to the data-sharing statement

• “We don’t share data” appears to have changed only from a typographic apostrophe (don’t) to a standard apostrophe (don't).
• There is no apparent change in legal meaning.
• However, the statement is broad and potentially misleading unless it is qualified by the surrounding policy. Other provisions apparently refer to subprocessors, meaning data may still be disclosed to service providers acting on the company’s behalf.
• The policy should clarify that data may be shared with subprocessors or other recipients where necessary to provide the service, comply with law, or protect legitimate interests.

3. International transfer safeguards

• The text states that the company has signed Standard Contractual Clauses (SCCs) with subprocessors located in countries outside the relevant data-protection framework.
• It also states that Transfer Impact Assessments (TIAs) have been completed for all subprocessors located in “unsecure third countries.”
• This is a useful compliance clarification, particularly for transfers of EU/EEA personal data. However:
• “Unsecure third countries” is imprecise; “third countries without an adequacy decision” would be clearer.
• SCCs and TIAs do not automatically eliminate transfer risk. The company may also need supplementary safeguards and ongoing review where local laws create government-access risks.
• The text does not identify the relevant subprocessors, countries, or applicable SCC module.

4. New contact and policy-reference language

• A new sentence allows customers to contact GDPR@umbraco.com with privacy questions and directs them to the company’s policy page.
• This improves transparency and provides a practical contact route.
• It does not create a clear new customer right or remedy, and it does not state response times or how data-subject requests should be submitted.

5. AI-model training

• No provision in the supplied diff adds, removes, or changes permission to use customer data to train AI models.
• The revised language does not expressly address AI training, model improvement, prompts, outputs, or whether customer data is excluded from training datasets.
• If AI processing is relevant, the policy should state explicitly whether customer data may be used for training or fine-tuning, under what conditions, and whether customers can opt out.

Summary

The provided diff indicates only that approximately 27 words were removed, but it does not identify which words, clauses, or sections were deleted.

Legal and Risk Analysis

Because the deleted text is not shown, it is not possible to determine:

• Whether the deletion changes the parties’ rights or obligations.
• Whether liability, indemnification, confidentiality, security, or termination provisions were affected.
• Whether customer data may be collected, disclosed, retained, or used differently.
• Whether the deletion affects data ownership or intellectual-property rights.
• Whether restrictions on using customer data to train, fine-tune, evaluate, or improve AI models were removed.
• Whether customer consent, opt-out rights, or notification requirements were changed.

AI Training and Data-Use Impact

No specific change concerning AI-model training can be identified from the supplied diff. The deleted words could potentially have addressed AI training or model improvement, but the actual language is necessary to assess that risk.

If the removed language concerned customer data, important questions include whether the deletion:

• Broadens or narrows the provider’s license to use customer data.
• Removes an express prohibition on AI training.
• Removes de-identification, aggregation, or anonymization requirements.
• Eliminates customer approval or opt-out rights.
• Permits use of data for general product improvement or service development.
• Changes whether prompts, outputs, files, or usage metadata may be retained.

Conclusion

The diff is insufficient for a reliable legal analysis. Please provide the actual 27-word deletion, preferably with the surrounding provision, to determine whether it creates any new data-use or AI-training risks.

Summary

What Changed

• The only stated change is: “Added approximately 27 words to the document.”
• The actual 27 added words are not provided in the diff.

Legal and Commercial Impact

• No substantive legal changes can be identified from the information supplied.
• It is not possible to determine whether the addition affects:
• Data ownership or licensing;
• Confidentiality obligations;
• Permitted uses of customer data;
• Data retention or deletion;
• Security requirements;
• Liability or indemnification;
• Service levels or termination rights; or
• Other contractual obligations.

AI Training and Customer Data

• The provided diff does not show any language concerning the use of customer data to train, fine-tune, evaluate, or improve AI models.
• Accordingly, no conclusion can be reached about whether the contract:
• Permits or prohibits AI training on customer data;
• Requires customer consent or notice;
• Allows use of de-identified, aggregated, or derived data;
• Applies different rules to prompts, outputs, usage data, or personal information; or
• Provides an opt-out or deletion mechanism.

Key Limitation

The change description is only a word count and does not identify the added wording. The actual text of the 27-word addition is required for a meaningful legal-risk analysis, particularly regarding customer-data use and AI model training.

Summary

The provided diff states only that approximately 27 words were removed, but does not identify the deleted language.

Key Legal Implications

• Scope of change cannot be assessed: Without the actual deleted text, it is impossible to determine whether the revision affects liability, confidentiality, intellectual property, payment terms, termination, data protection, or other rights.
• AI-model training impact cannot be determined: The diff provides no information about whether customer data may now be:
• used to train, fine-tune, or improve AI models;
• retained for model-development purposes;
• shared with model providers or other third parties;
• excluded from training through an opt-out or contractual restriction; or
• subject to anonymization, aggregation, or de-identification requirements.
• Potential risk: If the removed language previously restricted use of customer data, its deletion could expand the provider’s rights to use, retain, disclose, or commercially exploit that data. Conversely, if the deleted language granted such rights, its removal could narrow those permissions. The direction of the change cannot be determined from the information provided.

Recommended Follow-Up

Provide the actual 27 deleted words, preferably with the surrounding paragraph and any replacement text. The deleted language should be reviewed specifically for terms such as “train,” “fine-tune,” “improve,” “develop,” “models,” “machine learning,” “artificial intelligence,” “usage data,” “customer data,” “de-identified,” and “aggregated.”

Summary of Important Changes

1. Access to customer data

• The wording changes from “need to have” not “nice to have” to “need to have” not “nice to have”, with only quotation-mark/formatting normalization.
• No substantive change appears to the access standard: personnel should access data only where necessary for their role.
• The reference to people “not legally allowed to access your data” remains relevant. However, the provision should ideally identify the applicable authorization controls and consequences for unauthorized access.

2. Data retention and deletion

• The text states that data is removed when it is not relevant for legal or other relevant purposes.
• This wording is broad and potentially ambiguous. It does not specify:
• How long customer data is retained;
• What “relevant purpose” means;
• Whether data is securely deleted, anonymized, or merely removed from active systems; or
• Whether backups and disaster-recovery copies are also deleted.

A clearer retention schedule or deletion standard would reduce uncertainty.

3. Data sharing and subprocessors

• “We don’t share data” appears to be a grammatical/typographical normalization and does not materially change the meaning.
• The statement may be overbroad if the service uses subprocessors. The surrounding text refers to subprocessors and Standard Contractual Clauses (SCCs), which necessarily involves making data available to those providers.
• The policy should distinguish between:
• Selling or independently disclosing customer data; and
• Processing customer data through authorized subprocessors on the provider’s instructions.

4. International transfers

• The text refers to SCCs with subprocessors and Transfer Impact Assessments (TIAs) for subprocessors in “unsecure third countries.”
• This appears to confirm or clarify safeguards for international transfers. However, “unsecure” is not a precise legal term; “countries not recognized as providing an adequate level of protection” would be clearer.
• The policy should also explain whether customers receive notice of new subprocessors and how they may object.

5. AI model training

• No change expressly addresses whether customer data may be used to train, fine-tune, evaluate, or improve AI models.
• The diff does not add a prohibition on AI training or clarify whether customer data, prompts, outputs, or usage data may be used for that purpose.
• This remains a material unresolved risk. Customers should seek an explicit statement that their data will not be used to train or improve general-purpose AI models unless they provide affirmative consent, together with deletion, confidentiality, and opt-out rights.

6. Contact information

• A new contact address, GDPR@umbraco.com, and a reference to the privacy policy are added. This improves transparency and gives customers a channel for privacy questions.

Key Changes

1. No substantive change to access controls

• The phrase ["need to have" not "nice to have"] was changed to {“need to have” not “nice to have”}.
• This appears to be a typographical or formatting change only. It does not alter the stated principle that access to customer data is limited to persons with a genuine need to access it.

2. Minor punctuation/typography change

• don't was changed to don’t.
• This is a typographical change and does not alter the meaning of the statement that the company does not share data.

3. Removal of contact and policy-reference language

The following sentence was deleted:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

Potential impact

• The revised wording no longer expressly provides:
• A privacy-related contact email address; or
• A direct reference to the company’s policy page for further information.
• This may reduce transparency and make it less convenient for customers to ask questions or exercise privacy-related rights.
• Depending on the broader privacy notice and applicable law, removing a designated contact route could create uncertainty about how customers should submit data-protection inquiries or requests. It does not necessarily eliminate any legal obligation to provide such a contact method elsewhere.

4. International data transfers remain addressed

The remaining text states that:

• Standard Contractual Clauses (SCCs) have been signed with subprocessors; and
• Transfer Impact Assessments (TIAs) have been completed for subprocessors located in “unsecure third countries.”

No change to these safeguards is clearly shown in the diff. The wording “unsecure third countries” is potentially imprecise; “countries not recognized as providing adequate protection” or similar language may be clearer legally.

AI Training and Model Use

• The diff contains no express provision authorizing, restricting, or changing the use of customer data to train AI models.
• It also does not clarify whether customer data may be used for:
• Training or fine-tuning generative AI systems;
• Improving models or services;
• Human review or evaluation of AI outputs; or
• Creating aggregated or de-identified training datasets.
• Any AI-training rights or restrictions would need to be assessed in the unchanged portions of the agreement or privacy policy.

Summary of Important Changes

1. No substantive change to access standard

• The wording changes from [“need to have” not “nice to have”] to {"need to have" not "nice to have"}.
• This appears to be a formatting or punctuation correction only. It does not change the stated principle that access to customer data is limited to personnel who have a genuine business need.

2. No substantive change to data sharing statement

• [don’t]{don't} is changed only from a typographic apostrophe to a standard apostrophe.
• The statement that the company “doesn't share data” remains substantively unchanged.
• This statement may still require interpretation because it could coexist with disclosures to subprocessors, service providers, or authorities. The surrounding privacy policy should clarify what “share” means and identify any permitted disclosures.

3. New contact information and policy reference

The following sentence has been added:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

This provides:

• A specific privacy contact email address; and
• A reference to an online privacy policy for further information.

Potential risk: The phrase “where further is written” is vague and informal. The policy should ideally link directly to the relevant page and clearly identify the applicable rights, procedures, and response timelines. The company should also ensure that the email address is monitored and that the referenced policy is current and consistent with the contract.

4. International transfers and safeguards

The text refers to:

• Standard Contractual Clauses (SCCs) with subprocessors; and
• Transfer Impact Assessments (TIAs) for subprocessors located in “unsecure third countries.”

The diff does not clearly show a substantive change to these obligations. However, “unsecure third countries” is not a precise legal term. It would be clearer to refer to countries not recognized as providing an adequate level of data protection under applicable data-protection law.

AI Training and Model Use

No change in the supplied diff expressly addresses:

• Training AI models using customer data;
• Using customer data to improve AI systems;
• Retaining data for AI training; or
• Opt-out or consent rights relating to AI training.

Accordingly, this diff introduces no identifiable new permission or restriction on AI model training. The existing agreement and privacy policy should be reviewed separately for any AI-related data-use language.

Summary

The diff states only that approximately 27 words were removed from the document. It does not identify which words, clauses, or sections were deleted.

Key Legal and Commercial Implications

• AI training and data use:

No determination can be made about whether the deletion changes:

• the customer's permission for the provider to use data to train, fine-tune, or improve AI models;
• whether customer data may be used for product development, analytics, or other commercial purposes;
• whether prompts, inputs, outputs, usage data, or personal information are included;
• whether data is used for model training by default or only with consent/opt-in;
• deletion, retention, or isolation commitments relating to training data; or
• restrictions on using confidential, personal, or regulated information.

• Potential risk:

If the deleted language concerned data-use limitations, the change could expand the provider's rights or remove customer protections. If it concerned a disclaimer, retention period, or consent requirement, the deletion could also materially affect compliance and liability. However, the direction and significance of the change cannot be determined from the information provided.

• Other contractual terms:

It is likewise impossible to assess effects on confidentiality, intellectual property ownership, warranties, indemnities, security obligations, liability limits, termination rights, or governing law.

Required Information

To perform a meaningful legal analysis, provide either:

1. the full redline showing the exact deleted text; or

2. the surrounding clause(s), with the 27 removed words identified.

The precise wording is essential, particularly for determining whether the customer's data may be used to train AI models.

Summary of Important Changes

1. No change to AI-model training rights identified

The diff does not add, remove, or modify any language addressing:

• Use of customer data to train AI models;
• Use of customer data to improve machine-learning systems;
• Whether data may be shared with AI providers;
• De-identification or aggregation for AI training; or
• Customer opt-out or consent rights relating to AI training.

Accordingly, this diff does not appear to create a new express right to use customer data for AI training. However, the absence of such language does not necessarily confirm that AI training is prohibited; the relevant permissions may appear elsewhere in the agreement or privacy policy.

2. Access to data remains limited to a “need to have” basis

The wording changes from typographic quotation marks to straight quotation marks:

> [“need to have” not “nice to have”] → {"need to have" not "nice to have"}

This appears to be a formatting-only change. The substantive limitation remains that access is restricted to personnel or parties with a genuine need to access the data, rather than merely a desirable or convenient reason.

3. Data minimization language retained

The provision continues to refer to removing data that is not relevant for legal or other relevant purposes. No clear substantive change is visible in this portion of the diff.

The wording remains somewhat broad because “other relevant purpose” is not defined. Depending on the surrounding contract, this could permit retention where the provider considers data relevant for purposes beyond strict legal compliance.

4. No-sharing statement retained

The change from curly apostrophes to a straight apostrophe is not substantive:

> [don’t] → {don't}

The statement that the provider does not share data appears to remain unchanged. This should be read together with the following reference to subprocessors: it may not mean that data is never disclosed, since subprocessors may receive data under the contractual privacy framework.

5. International-transfer safeguards clarified or added

The text refers to:

• Standard Contractual Clauses (SCCs) with subprocessors; and
• Transfer Impact Assessments (TIAs) for subprocessors in “unsecure third countries.”

This indicates an intended compliance mechanism for international data transfers. However:

• “Unsecure third countries” is imprecise terminology; “countries lacking an adequacy decision” or similar wording would be clearer.
• The provision does not specify which SCC module, governing law, supplementary safeguards, or access controls apply.
• It is unclear whether TIAs are updated when legal or factual circumstances change.

6. New privacy-contact information

A new sentence gives customers a contact address—GDPR@umbraco.com—for privacy questions and directs them to the provider’s policy page.

This improves transparency and makes it easier to raise privacy concerns. The reference to the policy page is potentially dynamic, so customers should verify that the linked policy does not contain broader data-use permissions than the contract.

Summary of Important Changes

1. No substantive change to AI-training rights or data use

• The diff does not add or remove any express provision about using customer data to train, fine-tune, evaluate, or improve AI models.
• It also does not clarify whether customer data, prompts, outputs, or usage metadata may be used for AI-related purposes.
• Accordingly, the existing position on AI training remains unchanged based on this excerpt. If the agreement contains no separate AI-data clause, the customer may still face uncertainty about whether data can be used for model development or service improvement.

2. Minor wording and formatting changes

• The phrase “need to have” not “nice to have” is changed only from straight quotation marks to typographic quotation marks. This appears non-substantive.
• “don't” is changed to “don’t”, also a typographical change with no apparent legal effect.

3. Deletion of privacy contact and policy reference

The following sentence is deleted:

> “You can contact us at GDPR@umbraco.com if you have any questions as to the privacy of your data, or visit our policy page where further is written.”

This removes:

• The expressly identified email address for privacy questions.
• A direct reference to the provider’s privacy-policy page.
• A clear customer-facing route for raising data-protection concerns.

This may make it less convenient for customers to exercise privacy rights or obtain further information, although statutory rights and any other contractual contact mechanisms may still apply.

4. Data-access and sharing language appears unchanged

The remaining text continues to state that:

• Access is limited to persons who are legally permitted to access the data.
• Access is provided on a “need to have” rather than “nice to have” basis.
• Data is not shared.
• Standard Contractual Clauses (SCCs) have been signed with relevant subprocessors.
• Transfer Impact Assessments (TIAs) have been completed for subprocessors in “unsecure third countries.”

5. Drafting concern

The excerpt contains incomplete sentences and potentially unclear wording, including:

• “We have made sure that your data is being treated in…”
• “We have signed an SCC with our sub-processors placed in…”

The final document should be reviewed to ensure these sentences are complete and legally precise.

Summary

The diff only states: “Added approximately 27 words to the document.” It does not include the actual added language or identify where the words were inserted.

Legal and Commercial Impact

• No substantive changes can be analyzed from the information provided.
• It is not possible to determine whether the additions affect:
• Customer data ownership or usage rights
• Confidentiality or privacy obligations
• Data retention or deletion
• Security requirements
• Liability, indemnification, or compliance obligations
• Licensing or intellectual-property rights
• Termination rights or audit rights

AI Model Training

The diff does not provide enough information to determine whether customer data may be used to train, fine-tune, evaluate, or improve artificial-intelligence models.

The added language should be reviewed for terms such as:

• “train,” “fine-tune,” “develop,” “improve,” or “enhance” models
• “service improvement” or “product improvement”
• “aggregated,” “de-identified,” or “anonymized” data
• Rights to use “inputs,” “outputs,” prompts, or customer content
• Use by affiliates, subprocessors, or third-party AI providers
• Opt-out, consent, or deletion mechanisms
• Whether training may continue after termination

Conclusion

A reliable legal-risk analysis requires the actual 27-word addition, preferably showing its location and the surrounding contract language.