Validity

Summary of Important Changes

1. Major restructuring and replacement

• The prior introductory material and policy navigation have been replaced with a substantially expanded Privacy Policy.
• The revised policy is stated to be effective March 2026.
• The policy now expressly distinguishes between:
• Validity acting as a data controller for its own business purposes; and
• Validity acting as a data processor on behalf of customers, which it says is governed by the Data Processing Addendum (DPA) and customer agreement.

Risk: The policy leaves the allocation of rights and obligations dependent on whether particular data is treated as controller or processor data. Customers should confirm that the DPA and service agreement contain adequate restrictions for customer-uploaded data, including AI use, model training, retention, and deletion.

2. New or expanded AI-related processing

The revised policy expressly permits AI-powered analysis in at least two contexts:

• Sales and support calls or online meetings
• Validity may record calls and meetings.
• AI-powered tools may analyze the content of calls and recordings.
• Validity may generate automated transcripts for analysis and audit.
• Purposes include improving sales/support processes, updating CRM records, training sales and support teams, and quality assurance.

• Service usage data
• Validity may use AI-powered tools to analyze aggregated usage data to understand interactions with its Services, perform analytics, and improve the Services.

The policy also states that Validity may use Personal Data and inferences drawn from it for business, analytics, product development, marketing, fraud prevention, and other broad purposes.

AI training risk

• The policy does not clearly state whether customer data, call recordings, transcripts, prompts, outputs, or usage data may be used to train Validity’s own AI models or third-party models.
• “Train our sales and support teams” appears to refer to human workforce training, not model training, but the wording does not expressly exclude AI/model training.
• “Analyze,” “improve,” “enhance,” and “develop” the Services are broad enough to create uncertainty about whether data could contribute to model development or tuning.
• Customers should seek express confirmation that customer data will not be used to train generalized or third-party AI models without authorization, and should identify the AI vendors, retention periods, security controls, and opt-out rights.

3. Expanded data collection and sharing

The policy newly or more clearly covers:

• Audio, video, images, call content, transcripts, CRM information, device identifiers, behavioral data, and location information.
• Data obtained from public databases, marketing partners, social media, and data-validation providers.
• Sharing with affiliates, service providers, advertising partners, analytics providers, business partners, and event sponsors.
• Hashing and combining email addresses with other identifiers for cross-device advertising and measurement.

Risk: The expanded collection and advertising provisions may increase profiling, targeted advertising, and third-party disclosure risks, particularly for California and other jurisdictions recognizing “sale” or “sharing” concepts.

4. De-identified data and retention

• Validity may create, maintain, and use de-identified data to analyze and improve products and Services.
• Validity states it will not attempt re-identification once data is reasonably de-identified.
• Retention is tied to an ongoing legitimate business need, with deletion or aggregation when feasible.

Risk: The policy does not specify detailed de-identification standards, retention periods, or whether derived insights and model outputs are deleted when customer data is deleted.

5. Other notable changes

• New or expanded privacy rights, including opt-outs for targeted advertising, profiling, sale, and sharing.
• Recognition of Global Privacy Control signals.
• Expanded international-transfer language, including Data Privacy Framework and standard contractual clauses.
• Privacy Policy changes may become binding through continued use of the Services.
• Customers and individuals are expressly told they are responsible for complying with applicable privacy laws when submitting data to Validity.

Summary

What the diff shows

• The diff states only that approximately 6,516 words were added.
• The actual added language is not included.
• There are no identifiable deletions, replacements, or specific contractual provisions to review.

AI Training and Customer Data

• It is not possible to determine whether the revised terms:
• Permit the provider to use customer data to train, fine-tune, or improve AI models;
• Limit training to aggregated, anonymized, or de-identified data;
• Prohibit use of customer content for model training;
• Allow use of prompts, outputs, metadata, or usage information for AI development;
• Apply different rules to personal data, confidential information, or regulated data;
• Give the customer an opt-out or require prior consent;
• Permit retention of data after termination for training or model improvement; or
• Allocate responsibility for data protection, intellectual-property rights, or confidentiality risks arising from AI training.

Other Legal Risks

The available diff does not provide enough information to assess changes involving:

• Liability limits, indemnities, or warranties;
• Confidentiality and intellectual-property ownership;
• Data protection and security obligations;
• Subprocessors or third-party service providers;
• Termination and data deletion;
• Audit rights or regulatory compliance;
• Service changes, suspension, or unilateral amendment rights; or
• Governing law and dispute resolution.

Recommended Next Step

Provide the full added and modified contract language, especially any sections addressing:

1. Customer content or data;

2. Artificial intelligence, machine learning, or model training;

3. Service improvement or analytics;

4. Confidentiality and intellectual property;

5. Data retention and deletion; and

6. Privacy and security.

Without the text of the changes, no reliable legal comparison or assessment of AI-training rights can be made.

Summary of Important Changes

1. Privacy Policy substantially expanded and updated

• The prior text was largely a brief introduction and list of legal documents.
• It is replaced with a comprehensive Privacy Policy, stated to be effective March 2026.
• The policy now explains:
• What Personal Data Validity collects and from where
• Legal bases and business purposes for processing
• Data sharing, international transfers, cookies, retention, privacy rights, and security
• Validity’s role as a data controller versus its role as a processor for customer data

2. AI-related processing

The new policy expressly permits certain AI-assisted analysis:

• Sales and support calls/meetings: Validity may record calls and use “AI powered tools” to analyze call content and recordings.
• Stated purposes include:
• Improving sales and support processes
• Keeping CRM records current
• Generating automated transcripts
• Analysis, auditing, and training Validity’s sales and support teams
• Service usage data: Validity may use AI-powered tools to analyze aggregated usage data to understand interactions with its Services and improve them.

AI training risk and limitation

• The policy does not expressly state that customer-provided data will be used to train general-purpose AI models, nor does it clearly prohibit such use.
• “Train our sales and support teams” appears to refer to human employee training, not training AI models.
• However, the broad language allowing AI analysis of recordings, transcripts, usage data, and “any inferences” creates uncertainty about whether outputs or derived data could later be used to improve internal AI tools.
• The policy’s “de-identified data” provision allows Validity to create, maintain, and use de-identified data to analyze and improve products and services. It promises not to re-identify such data, but does not specify:
• Whether de-identified data may be used to train machine-learning models
• The de-identification standard
• Whether customer data may be included
• Whether customers can opt out
• Customer-controlled data processed on behalf of customers is expressly stated to be outside this Privacy Policy and governed by the Data Processing Addendum and service agreement. Those documents should be reviewed for any AI-training authorization, especially regarding customer content, telemetry, prompts, outputs, and de-identified or aggregated data.

3. Broader data collection and profiling

• Validity may combine information from websites, emails, content, public sources, partners, and social media.
• It may use Personal Data and inferences for marketing, business development, product improvement, analytics, fraud prevention, and usage profiling.
• Human personnel are stated to be involved, and Validity says it does not make automated decisions producing legal or similarly significant effects.

4. Expanded third-party and advertising disclosures

• More detailed sharing is authorized with affiliates, service providers, analytics providers, advertising partners, business partners, and event sponsors.
• Hashed email addresses may be combined with other identifiers for cross-device recognition, targeted advertising, and measurement.
• Cookie-based disclosures may constitute “sharing” under applicable California laws.

5. Other material changes

• New international-transfer language references the Data Privacy Framework and standard contractual clauses.
• New privacy-rights mechanisms include opt-outs for targeted advertising, profiling, sale/sharing, and Global Privacy Control.
• Continued use of the Services is deemed acceptance of future policy changes.
• Retention language permits continued secure storage where deletion is impractical or legally required.

No

No

Summary of the Change

The diff states that approximately 6,516 words were removed from the document, but it does not identify which clauses were deleted or provide the replacement text.

Key Legal Implications

Scope of Deletions

Because the deleted language is not shown, it is not possible to determine whether the changes affect:

• Customer data ownership and licensing rights
• Confidentiality and security obligations
• Data retention, deletion, or return requirements
• Subprocessors or third-party sharing
• Liability, indemnification, or warranties
• Termination rights
• Compliance with privacy and data-protection laws
• Audit, transparency, or reporting rights

The deletion of a substantial amount of text may materially change the parties’ rights and obligations, even if the remaining agreement appears unchanged.

Use of Customer Data to Train AI Models

The provided diff does not reveal whether any provisions concerning AI training were added, removed, or modified. In particular, it is not possible to determine whether the deleted text previously:

• Prohibited or permitted training AI models using customer data
• Granted the provider a license to use customer data, prompts, inputs, outputs, or usage data for training
• Distinguished between personal data, confidential information, and de-identified or aggregated data
• Required customer consent or provided an opt-out
• Limited training to service improvement, abuse prevention, or product development
• Applied different rules to human review, automated processing, or third-party model providers
• Required deletion of customer data from training datasets or model weights

If AI-related restrictions were among the deleted provisions, the customer could face increased uncertainty or broader permitted use of its data. Conversely, deletion of a provider’s data-use authorization could restrict the provider’s ability to train or improve models.

Recommended Action

Obtain a redline showing the actual deleted language and any replacement provisions before approving the amendment. Particular attention should be given to clauses addressing:

1. Customer data and confidential information

2. AI training and model improvement

3. Aggregated or de-identified data

4. Data retention and deletion

5. Third-party and subprocessors’ use of data

6. Privacy, security, and liability protections

No

Summary of Important Changes

1. Privacy Policy substantially replaced and expanded

The prior short “Effective Date” reference appears to be replaced with a comprehensive Privacy Policy effective March 2026. The new policy:

• Defines Validity’s role as a data controller for its own business purposes.
• States that it does not cover processing performed on behalf of customers as a data processor, which remains governed by the DPA and service agreement.
• Adds extensive descriptions of data collection, purposes, legal bases, disclosures, retention, international transfers, cookies, privacy rights, and California-specific rights.
• States that customers are generally responsible for determining how data entered into Validity products is used and for complying with applicable privacy laws.

Risk: The policy places substantial compliance responsibility on customers and may not itself resolve whether particular customer-uploaded data is processed under the DPA or used for Validity’s independent business purposes. The contract, DPA, and product-specific terms should be reviewed together.

2. AI-related processing and model-training provisions

The new policy expressly permits several AI-related activities:

• Recorded calls and meetings: Validity may record sales and support calls or online meetings, after notifying participants. It may use AI tools to analyze call content and recordings.
• Purpose of analysis: The stated purposes include improving sales and support processes, maintaining CRM records, generating automated transcripts, auditing, and training Validity’s sales and support teams.
• Service usage data: Validity may use AI-powered tools to analyze aggregated usage data to understand interactions with its Services and improve the Services.
• De-identified data: Validity may create, collect, maintain, and use de-identified data to analyze and improve products and Services, while stating it will not attempt to re-identify individuals.
• Profiling: Validity may combine collected data and inferences to determine products of interest and purchasing readiness, including through repeated interactions with websites, emails, and content.

Important limitation: The policy does not clearly state whether customer data, call recordings, transcripts, prompts, outputs, or usage data are used to train generative AI or machine-learning models. It authorizes AI analysis and “training” of personnel, but that phrase does not expressly mean model training. Customers should seek written confirmation regarding whether their data is used to train, fine-tune, evaluate, or improve AI models, and whether opt-out or deletion controls exist.

3. Broader data-use and disclosure rights

Validity may use personal data and inferences for analytics, product development, service improvement, marketing, fraud prevention, business expansion, and other legitimate interests. It may share data with affiliates, service providers, advertising providers, analytics providers, business partners, and transaction-related parties.

Risk: The broad purposes and references to providers such as Google Analytics and NextRoll may permit extensive analytics, targeted advertising, profiling, and cross-device recognition.

4. Tracking, advertising, and privacy rights

The policy adds detailed cookie and tracking provisions, including targeted advertising, hashed email addresses, Global Privacy Control, California “sharing” opt-outs, and rights to object, delete, restrict, or access data.

5. Policy-change mechanism

Continued use of the Services is deemed acceptance of future Privacy Policy changes. Customers or users who disagree must stop using the Services and notify Validity.

Risk: This creates a unilateral-change mechanism and may conflict with negotiated contractual terms or DPA restrictions.

No

Summary of Changes

Overall Change

• Approximately 6,516 words were removed from the document.
• No replacement language or details about the deleted provisions were provided.
• Because the deleted text is unavailable, it is not possible to determine precisely which rights, obligations, limitations, or protections changed.

Key Legal Risks

Loss of Customer Protections

The deleted provisions may have included terms addressing:

• Confidentiality and permitted use of customer information
• Data security and breach notification
• Data ownership and intellectual property rights
• Service levels, warranties, and liability limits
• Indemnification obligations
• Audit, compliance, or regulatory requirements
• Termination and data-return or deletion obligations

Removing these provisions could materially reduce the customer’s contractual protections or create uncertainty about the parties’ responsibilities.

Increased Ambiguity

If important operational or legal terms were removed without replacement, the agreement may now lack clarity concerning:

• What each party is required or permitted to do
• Which terms govern disputes or service failures
• How customer data must be handled after termination
• Whether any restrictions or safeguards continue after the agreement ends

Ambiguity may increase the likelihood of disputes and make enforcement more difficult.

AI Training and Data Use

• The provided diff does not identify whether any language concerning AI models, machine learning, model training, or use of customer data was removed.
• Any deleted provisions could have addressed whether the provider may:
• Use customer data or inputs to train, fine-tune, or improve AI models
• Use data in aggregated, de-identified, or anonymized form
• Retain prompts, outputs, or usage data for model development
• Permit affiliates, subcontractors, or third-party model providers to use the data
• Opt the customer out of training or require prior consent
• Delete training data or derived model artifacts upon termination

If AI-related restrictions or opt-out rights were among the deleted provisions, the change could significantly expand the provider’s ability to use customer data. Conversely, deletion of a provider permission could restrict such use. The direction of the change cannot be determined from the information supplied.

Recommended Review

Obtain the original and revised documents, or at least the text of the 6,516 deleted words. Particular attention should be given to sections titled:

• Data Use, Privacy, or Confidentiality
• Artificial Intelligence or Machine Learning
• Intellectual Property
• Security
• Retention and Deletion
• Termination
• Liability and Indemnification

No definitive conclusion about AI-training rights or other substantive legal changes can be made from the deletion count alone.