Wistia

Summary

The diff does not include the text of the approximately 372 added words. It only states that words were added. As a result, the legal changes and any new risks cannot be reliably analyzed.

AI Training and Customer Data

No substantive language is provided addressing:

• Whether customer data may be used to train, fine-tune, or improve AI models;
• Whether customer prompts, inputs, outputs, or uploaded materials are retained;
• Whether data is anonymized, aggregated, or de-identified before use;
• Whether customer data may be shared with affiliates, vendors, or third-party model providers;
• Whether the customer can opt out of AI training or revoke consent;
• Ownership or licensing rights in customer data, outputs, or model improvements;
• Security, confidentiality, or deletion obligations relating to training data; or
• Use of data for human review, monitoring, or product development.

Conclusion

No legal or data-use conclusions can be drawn from the supplied diff. The actual added text—together with any deleted or replacement language—is required to identify changes, particularly any provisions authorizing use of customer data to train AI models.

Summary of Important Changes

1. Privacy Policy Reorganization and Expanded Scope

• The introduction has been substantially rewritten and reorganized into numbered sections.
• The policy now expressly covers:
• Wistia’s websites, Media, Services, applications, features, and content;
• Users who access, listen to, or view Media; and
• Customers creating and distributing videos, audio, and other media.
• The definition of “Users” appears broader because it includes individuals who merely view or use Media, not only account holders or customers.

Risk: More people and activities may fall within the policy’s data-collection and tracking provisions. Customers should confirm that their disclosures to viewers, employees, students, and other individuals adequately reflect this expanded scope.

2. Broader and Updated Legal Coverage

• The policy now lists additional state privacy laws and clarifies coverage of the CCPA/CPRA, GDPR, UK GDPR, Swiss law, and PIPEDA.
• References and quotation formatting have been standardized, but the substantive list of covered laws appears largely maintained or clarified rather than materially expanded.

Risk: The policy may create compliance obligations across more jurisdictions, including obligations concerning sensitive data, consumer rights, automated decision-making, and data transfers.

3. AI Tools and AI Content

• The policy clarifies that Wistia may integrate publicly available third-party AI platforms, applications, and software (“AI Tools”).
• Users may choose to use these AI Tools during Media creation, producing “AI Content.”
• Information processed by an external AI provider is stated to be processed by that third party and not subject to Wistia’s Privacy Policy.

Important AI risk: This language may shift responsibility for AI-related processing to external providers and does not clearly state:

• whether Customer data, Media, prompts, transcripts, or outputs are used to train AI models;
• whether third-party providers may retain or reuse submitted information;
• whether Wistia opts out of provider model training;
• what contractual safeguards apply; or
• how deletion, confidentiality, and customer instructions are handled.

Conclusion: The diff does not expressly add or remove a right for Wistia to train its own AI models using Customer data. However, the third-party AI language creates uncertainty and a potential risk that information submitted to AI Tools may be governed by those providers’ separate terms, including possible model-training practices.

4. Data Rights, Complaints, and Contact Information

• The policy adds a Data Protection Office contact address, telephone number, and email.
• Complaint and regulatory-authority information is more clearly organized.
• Accessibility and nondiscrimination provisions have been relocated and revised.
• Wistia expressly reserves the ability to vary price, service level, or quality where reasonably related to the value of data provided, consistent with applicable law.

Risk: Data-based service differentiation remains a commercial and regulatory sensitivity, particularly under state privacy laws.

5. Data Privacy Framework and Effective Date

• Data Privacy Framework references are clarified for the EU, UK, and Switzerland.
• The effective date is stated as March 20, 2026.
• Wistia adds a statement that it will make reasonable efforts to resolve concerns.

Summary

The diff does not include the actual revised legal language. It only states that approximately 372 words were added. As a result, the substantive changes and legal risks cannot be reliably analyzed.

AI-Training and Data-Use Changes

No language is provided showing whether the customer’s data may be:

• Used to train, fine-tune, or improve AI or machine-learning models;
• Combined with other customers’ data for model development;
• Reviewed by human personnel for model evaluation or safety;
• Retained after termination for training or analytics;
• Anonymized, aggregated, or otherwise de-identified before use;
• Excluded from training by default or only excluded through an opt-out; or
• Shared with affiliates, subprocessors, or third-party AI providers.

Accordingly, it is not possible to determine whether the revision creates new permissions to use customer data, narrows confidentiality protections, changes ownership rights, or increases privacy and regulatory risk.

Other Potential Legal Changes

The actual additions are also necessary to assess changes concerning:

• Liability, indemnification, and disclaimers;
• Data security and breach notification;
• Confidentiality and permitted disclosures;
• Intellectual-property ownership and license grants;
• Data retention and deletion;
• Subprocessors and third-party services;
• Customer audit or opt-out rights; and
• Termination consequences.

Information Needed

Please provide the full diff, including the text marked with:

• {additions};
• [deletions]; and
• []{replacements}.

Without the underlying wording, any conclusion about the legal effect of the changes—particularly AI-training rights—would be speculative.

Structured Summary of Important Changes

1. Major restructuring and expanded scope

• The policy has been substantially reorganized into numbered sections covering:
• Information collected
• Uses and disclosures
• Legal bases
• Retention
• User rights
• Security
• Children’s privacy
• Automated decision-making
• Data Privacy Framework
• Changes and contact information
• The policy now more clearly defines “Users,” “Customers,” “Media,” “Services,” “Personal Information,” “Students,” and “Schools.”
• Coverage is broadened from visits to Wistia websites to accessing or using Media, applications, features, content, and other Services offered by Wistia.

2. AI tools and AI model training

• The revised policy states that Wistia may integrate publicly available third-party AI platforms, applications, and software to benefit Customers.
• Users may choose to use those AI Tools during Media creation. Content generated through those tools is defined as “AI Content.”
• The policy states that information processed by an external AI provider is not subject to Wistia’s Privacy Policy.
• Important risk: The revised language does not state:
• Whether Customer Media, prompts, recordings, transcripts, or other Personal Information are used to train Wistia’s own AI models;
• Whether Wistia permits or prohibits third-party AI providers from using submitted data to train their models;
• Whether AI providers retain submitted data or use it for product improvement;
• Whether Customers can opt out of AI training or require deletion of AI inputs and outputs.
• Accordingly, the principal change is increased disclosure that third-party AI processing may occur, but the policy leaves a significant training-use and downstream-provider risk unresolved. Customers should review the applicable AI provider’s terms and consider contractual restrictions on model training.

3. Broader data categories and processing disclosures

• The policy provides more detailed descriptions of Personal Information, including engagement data, IP address, device and cookie information, profile data, submissions, recruiting data, and potentially sensitive information.
• It expressly addresses information collected in educational settings involving Students and Schools.
• Wistia’s purposes now expressly include operating, developing, and growing the business, recruiting, assessing applicants, and improving recruitment processes.

4. Sharing, sales, and service differences

• The policy continues to state that Wistia does not “sell” Personal Information as defined by the CCPA, while acknowledging disclosure or sharing with Customers and third parties.
• It expands discussion of opt-out rights and service differences, including possible differences in price, discounts, benefits, or service quality where permitted by law and reasonably related to the value of the data.
• This may affect Customers or Users who exercise privacy rights.

5. Legal and operational updates

• Privacy-law coverage is clarified and expanded to include additional U.S. state laws, GDPR, UK GDPR, Swiss law, and PIPEDA.
• Data Privacy Framework commitments are described more fully for EEA, UK, and Swiss data transfers.
• A Data Protection Office, postal address, telephone number, and privacy email are added or consolidated.
• The effective date is stated as March 20, 2026.
• New or more explicit sections address automated decision-making, accessibility, non-discrimination, and regulatory complaint contacts.

Summary

The provided diff only states:

> “Added approximately 372 words to the document”

It does not include the actual added, deleted, or replaced legal language. Therefore, it is not possible to determine:

• What contractual terms changed;
• Whether the customer assumed new obligations or liabilities;
• Whether the provider received broader rights;
• Whether confidentiality, security, intellectual-property, indemnity, or termination provisions changed; or
• Whether the customer’s data may now be used to train, fine-tune, evaluate, or improve AI models.

AI Training and Data-Use Analysis

No substantive language concerning AI models or customer-data use is included in the supplied diff. In particular, the diff does not reveal whether the agreement:

• Permits use of customer data or inputs to train or improve models;
• Distinguishes between customer content, prompts, outputs, usage data, and de-identified or aggregated data;
• Requires the customer to opt in or allows use by default;
• Applies the permission to human review, automated training, or third-party model providers;
• Limits retention or requires deletion;
• Restricts use of confidential, personal, regulated, or sensitive information; or
• Grants the customer any ownership, exclusion, or opt-out rights.

Conclusion

The actual redlined text is required for a meaningful legal-risk analysis. Please provide the full diff, including the approximately 372 added words and any deleted or replaced language.

Structured Summary of Important Changes

1. Reorganized and Expanded Privacy Policy

• The policy has been substantially restructured with a new table of contents and numbered sections covering:
• Information collection and use
• Sharing
• Legal bases
• Retention
• User rights
• Service differences
• Security
• Children’s privacy
• Contractual/statutory requirements
• Automated decision-making
• Data Privacy Framework
• Contact information
• The effective date is expressly stated as March 20, 2026.
• The policy now identifies a Data Protection Office and provides a postal address, telephone number, and privacy email address.

2. Broader Description of Covered Services and Users

• The scope is rewritten to cover not only websites, but also Media, applications, services, features, and functionalities offered by Wistia “from time to time.”
• “Users” is defined broadly to include individuals who view or use customer-hosted Media, including video, audio, and other content.
• The policy more clearly distinguishes Wistia’s Customers from viewers or other Users.
• This may increase the categories of individuals whose information Wistia claims authority to collect and process.

3. AI Tools and AI-Generated Content

• The policy states that Wistia may integrate publicly available third-party AI platforms, applications, and software to benefit Customers.
• Users may choose to use those AI Tools during the Media-creation process.
• Content generated or processed through those tools is referred to as “AI Content.”
• The policy states that information processed by an external AI provider is not subject to Wistia’s Privacy Policy.

AI-related risks

• The wording places substantial responsibility on external AI providers and may leave Users without the protections, rights, retention limits, or security commitments stated elsewhere in the policy.
• The policy does not clearly identify the external AI providers, the categories of Customer data sent to them, applicable locations, retention periods, or whether providers may use submitted data to train their own models.
• The diff does not clearly add an express right for Wistia to use Customer Media, Personal Information, or AI Content to train Wistia’s AI models. It also does not clearly state that such data will not be used for training.
• Customers should obtain specific contractual confirmation regarding:
• Whether Customer Media or prompts are used for model training or improvement;
• Whether third-party AI providers may train on submitted data;
• Opt-out or deletion rights;
• Use of inputs and outputs for product development; and
• Confidentiality and data-processing restrictions.

4. Privacy Laws and International Transfers

• The policy continues to reference a broad range of U.S. state laws, the GDPR, UK GDPR, Swiss law, and Canadian PIPEDA.
• Data Privacy Framework language is retained and more clearly organized for transfers from the EEA, UK, and Switzerland.
• The policy adds or emphasizes automated decision-making, potentially creating additional transparency and objection obligations.

5. User Rights and Disclosures

• Contact procedures for access, deletion, correction, objection, and opt-out requests are consolidated and expanded.
• The non-discrimination language is revised to clarify that service or pricing differences may be permitted where reasonably related to the value of Personal Information.
• The policy continues to state that Personal Information may be shared with Customers and other third parties, while stating that Wistia does not “sell” Personal Information as defined by the CCPA.

Summary

The provided diff does not include the actual amended legal language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to determine:

• What contractual provisions were added or changed;
• Whether customer obligations or provider rights have expanded;
• Whether liability, indemnification, confidentiality, security, or termination terms changed;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether the provider may share customer data with affiliates, subcontractors, or third-party AI providers;
• Whether any opt-out, consent, deletion, retention, or de-identification protections were added or removed.

AI Training and Data-Use Review

No conclusion can be reached regarding AI-model training because the relevant added wording is not included. The key language to review would address whether the provider may:

• Use customer content, prompts, outputs, usage data, or personal data to train or improve models;
• Use data for “service improvement,” “research,” “analytics,” or similar broad purposes that could include model training;
• Aggregate, anonymize, or de-identify customer data and use it without restriction;
• Permit third-party vendors or affiliates to use the data for AI development;
• Retain data after termination for training or other secondary purposes;
• Provide customers with an opt-out right or require affirmative consent;
• Exclude confidential information, personal data, regulated data, or inputs from training.

Information Needed

Please provide the full redlined text, including the approximately 372 added words and any surrounding provisions. The analysis should include the actual additions and deletions, not merely the word-count description.

Summary of Important Changes

1. Expanded and clarified policy scope

• The introduction is substantially rewritten and now more clearly defines:
• “Media” as videos, audio recordings, and other media created and distributed by Customers.
• “Users” as individuals who view or use that Media.
• “Services” as Websites, Media, applications, features, content, and other services offered by Wistia.
• The policy now expressly covers use of Wistia’s Websites, hosted Media, and other functionalities—not merely visits to the Wistia.com domain.
• This broader scope may bring more viewers, listeners, and users within the policy’s data-collection provisions.

2. AI tools and AI-generated content

• The revised language states that Wistia may integrate publicly available AI platforms, applications, software, or other tools to benefit Customers.
• Users may choose to use those AI Tools during the Media-creation process, producing “AI Content.”
• The policy indicates that information processed by an external AI provider is processed by a third party and is not subject to Wistia’s Privacy Policy.

AI-related risks and limitations

• The language appears to permit use of external AI providers without identifying the providers, governing terms, retention periods, security practices, or whether inputs are used to train those providers’ models.
• It does not clearly state whether Customer Media, prompts, transcripts, voice recordings, images, viewer data, or other Personal Information may be used to train Wistia’s own AI models.
• No express new authorization to use Customer data for AI-model training is visible in this diff. However, the external-AI disclaimer creates a significant risk that data submitted to AI Tools will be governed by third-party terms and potentially used for model improvement or training.
• Customers should seek contractual clarification and avoid submitting confidential, sensitive, or third-party Personal Information to AI Tools unless appropriate safeguards and opt-outs are available.

3. New or more prominent compliance sections

The revised table of contents adds or highlights sections concerning:

• Automated decision-making;
• Data Privacy Framework participation;
• Contractual or statutory requirements;
• Children’s privacy;
• Data-security practices; and
• Users’ rights and service differences.

The diff does not provide the substantive text of the automated-decision-making or security sections, so their actual legal effect cannot be fully assessed.

4. Consumer rights and service differences

• The non-discrimination language is reorganized and now expressly addresses different prices, rates, discounts, benefits, penalties, and service quality.
• Wistia retains the right to provide different pricing or service levels where reasonably related to the value of Personal Information.
• This may reinforce Wistia’s ability to condition service differences on privacy choices, subject to applicable law.

5. Contact information and effective date

• The policy adds detailed contact information for Wistia’s Data Protection Office.
• The effective date is stated as March 20, 2026.
• Numerous edits are stylistic, including punctuation, capitalization, and corrected legal citations.

Structured Summary of Important Changes

1. Major restructuring and expanded scope

• The introduction and table of contents were substantially rewritten and reorganized into sixteen sections.
• The policy now more clearly covers:
• Websites, hosted Media, and other Wistia functionalities, features, content, applications, and services.
• People who view or use customer-hosted Media, defined as “Users.”
• Customer-created videos, audio recordings, and other media.
• The scope appears broader and more comprehensive, although much of the change is editorial rather than substantive.

Risk: Customers should confirm that the expanded definition of “Services” does not change the permitted uses of customer data under their commercial agreement or data-processing addendum.

2. AI tools and AI-generated content

• The policy states that Wistia may integrate publicly available third-party AI platforms, applications, and software to benefit Customers.
• Users may choose to use those AI Tools during Media creation, producing “AI Content.”
• The revised language confirms that information processed by an external AI provider is handled by that third party and is not subject to Wistia’s Privacy Policy.

AI-training implications

• The diff does not show an express new right for Wistia to use Customer Media, Personal Information, or AI Content to train Wistia’s own AI models.
• It also does not expressly prohibit third-party AI providers from retaining inputs or using them for model training.
• Because AI processing is assigned to external providers outside Wistia’s policy, there is a material transparency and allocation-of-risk issue. Customers should review the applicable AI provider terms, including:
• Whether prompts, uploaded Media, transcripts, or Personal Information are retained;
• Whether inputs or outputs may be used to train models;
• Whether processing is isolated from public or shared models;
• Security, deletion, international-transfer, and subprocessors terms.

Key risk: The policy’s statement that third-party processing is outside Wistia’s policy may leave customers without clear contractual assurances regarding AI training or secondary use.

3. Legal and regulatory updates

• The policy lists and standardizes coverage of additional state, international, and Canadian privacy laws, including the GDPR, UK GDPR, Swiss DPA, PIPEDA, and multiple U.S. state laws.
• The Data Privacy Framework section is retained and clarified for EU, UK, and Swiss data transfers.
• A new or expanded “Automated Decision Making” section appears in the table of contents, although the substantive text is not included in the supplied diff.

Risk: The policy may now create additional compliance representations concerning automated decision-making, cross-border transfers, and data-subject rights. The missing substantive section should be reviewed separately.

4. Rights, contacts, and procedures

• Contact information is expanded to include Wistia’s Data Protection Office, postal address, telephone number, and privacy email.
• Accessibility language is reorganized and made more explicit.
• Non-discrimination language is revised to address different prices, discounts, benefits, penalties, and service levels, subject to legally permitted value-based differences.

5. Administrative changes

• The effective date is stated as March 20, 2026.
• Numerous changes merely standardize punctuation, quotation marks, headings, and terminology.

Overall assessment

The principal substantive concern is not an express AI-training authorization, but the lack of clear limits on third-party AI providers’ retention and training practices. Customers using Wistia’s AI features should obtain separate contractual assurances before submitting confidential, personal, regulated, or proprietary content.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 372 words to the document”

Accordingly, it is not possible to identify:

• The specific contractual changes;
• New or expanded obligations;
• Changes to liability, confidentiality, intellectual property, or termination rights; or
• Any provisions concerning the use of customer data to train AI models.

AI-Training and Data-Use Review

No language is provided addressing whether customer data may be:

• Used to train, fine-tune, or improve AI or machine-learning models;
• Used to train models for other customers or the provider generally;
• Combined with data from other customers;
• Retained after termination for model-training purposes;
• De-identified, anonymized, or aggregated before use;
• Reviewed by human personnel for model development; or
• Excluded from training unless the customer opts in or opts out.

These provisions can materially affect confidentiality, ownership, privacy, regulatory compliance, and the customer’s ability to control or delete its data.

Key Limitation

Because the substantive additions and deletions are missing, no reliable legal risk assessment can be performed. The complete redlined text—or at least the 372 newly added words together with the surrounding provisions—is needed for analysis.

Summary of Important Changes

1. Major restructuring and expanded scope

• The policy has been substantially reorganized into numbered sections covering:
• Categories of information collected
• Uses and disclosures
• Legal bases
• Retention
• User rights
• Automated decision-making
• Data Privacy Framework
• Children’s privacy
• Contact information
• The scope of covered activity is broadened from visiting Wistia websites to also include:
• Accessing, listening to, or viewing Media
• Using any Wistia functionalities, features, content, applications, or services
• Media hosted by Wistia and/or accessed through its services
• “Users” now expressly includes people who view or use customer-provided Media, not only Wistia account holders or website visitors.

Risk: Individuals who merely watch or interact with customer content may now be treated as covered data subjects, with their engagement and device information collected and used.

2. Broader and more formal legal coverage

• The policy now expressly lists additional state, national, and international privacy laws, including the CPA, CTDPA, MCDPA, OCPA, TDPA, VCDPA, UCPA, GDPR, Swiss DPA, UK GDPR, and PIPEDA.
• References to the California privacy laws and other statutes are largely clarified rather than substantively changed.
• A new or expanded section addresses automated decision-making.

Risk: The policy may create additional compliance commitments and user-rights obligations across multiple jurisdictions. The excerpt does not explain the scope or safeguards for automated decision-making.

3. AI tools and AI-generated content

• The policy now states that Wistia may integrate publicly available third-party AI platforms, applications, and software to benefit Customers.
• Users may choose to use these AI tools during the Media creation process.
• Content generated through those tools is called “AI Content.”
• The policy states that information processed by an external AI provider is not subject to Wistia’s Privacy Policy.

Important limitation: The diff does not expressly authorize Wistia to use customer data, Media, Personal Information, or AI Content to train Wistia’s own AI models. It also does not state that third-party AI providers will not use submitted information for training.

Risk: If users submit customer Media, Personal Information, confidential material, or prompts to an integrated third-party AI tool, that processing may be governed solely by the third party’s terms and privacy policy. The policy should identify the providers, purposes, retention periods, training practices, and available opt-outs or contractual restrictions.

4. Data sharing and customer access

• The policy continues to state that Personal Information may be shared with Customers and other third parties.
• It now more clearly explains that Wistia does not “sell” Personal Information under the CCPA, while still sharing information as described in the policy.
• Users may opt out of certain disclosures, although opting out may affect available service features or differences.

Risk: Customer access to viewer data and the stated value of Personal Information may create heightened transparency, consent, and controller/processor allocation issues.

5. Contact and effective-date changes

• A Data Protection Office contact address, telephone number, and email address are added or standardized.
• The policy now states an effective date of March 20, 2026.
• Accessibility and non-discrimination language is reorganized and expanded.

Summary

The provided diff does not include the actual amended contract language. It only states:

> “Added approximately 372 words to the document”

Without the added text, deleted text, or replacement text, it is not possible to identify the legal changes or assess their risks.

AI Training and Customer Data

No conclusions can be drawn about whether the contract now:

• Permits the customer’s data to be used to train, fine-tune, or improve AI models;
• Allows use of customer data for general model training or only to provide the contracted services;
• Uses customer data in anonymized, aggregated, or de-identified form;
• Retains customer prompts, inputs, outputs, or related metadata;
• Permits human review of customer data;
• Allows the provider or third parties to use customer data for product development, analytics, or advertising;
• Gives the customer an opt-out or deletion right; or
• Restricts disclosure of customer data to model providers, affiliates, or subcontractors.

Other Legal Risks

The missing text also prevents review of potential changes involving:

• Confidentiality and data-protection obligations;
• Intellectual-property ownership and rights in inputs and outputs;
• Security measures and breach notification;
• Data retention and deletion;
• Third-party service providers;
• Liability limits and indemnification;
• Audit rights and compliance obligations; and
• Changes to termination rights or governing law.

Information Needed

Please provide the full diff, including the text within {}, [], and []{}. Once provided, the changes can be analyzed clause by clause, with particular attention to whether customer data may be used to train or improve AI models.

Executive Summary

The revision substantially reorganizes and expands the Privacy Policy, including a new section-based structure, broader legal coverage, and more detailed descriptions of data collection and rights. The most important practical risk is that the policy continues to permit broad collection, use, and sharing of Personal Information while providing limited detail about AI-related processing.

AI and Model-Training Changes

• No express new authorization to train Wistia’s AI models appears in the supplied diff. The revised language does not clearly state that Customer content, Media, Personal Information, prompts, outputs, or usage data may be used to train, fine-tune, or improve models.
• AI Tools language remains important. Wistia may integrate publicly available third-party AI platforms, applications, and software. If a user chooses to use those tools during Media creation, the resulting “AI Content” is processed by an external third party and is not subject to Wistia’s Privacy Policy.
• This creates a material risk that Customer data submitted to an AI Tool will be governed by the third party’s terms, including potentially different rules concerning:
• retention;
• disclosure;
• security;
• international transfers; and
• use for model training or product improvement.
• The policy does not identify the AI providers, state whether they may train models on submitted content, or clarify whether Wistia contractually restricts such use. Customers should seek those protections in the service agreement, DPA, or AI-specific terms.

Material Scope and Data-Use Changes

• The policy now expressly covers use of Websites, Media, and Services, including individuals who view or interact with Customer-hosted Media. This may expand the population whose viewing, engagement, device, IP, cookie, and similar data is collected and analyzed.
• The revised policy retains broad consent language covering Wistia’s collection, use, and sharing of information.
• Wistia states it may share Personal Information with Customers and other third parties. The policy also permits use for operating, maintaining, developing, and growing Wistia, which may support broad internal product-development activities, although it does not expressly connect those activities to AI training.
• New language emphasizes collecting only the amount of Personal Information “necessary” for identified purposes. This is a helpful limitation, but the listed purposes remain broad.

Regulatory and Rights Updates

• Coverage is updated and reorganized to include numerous U.S. state laws, GDPR, UK GDPR, Swiss law, and PIPEDA.
• The policy adds or clarifies rights concerning access, deletion, correction, portability, opting out of sharing, sensitive-data limits, and objections.
• Student and school-related processing is more clearly addressed, including a separate Schools & Students Privacy Policy Addendum.
• The effective date is stated as March 20, 2026, with updated Data Privacy Framework and contact information.

Key Customer Risks

1. Customer content may be exposed to third-party AI providers when AI Tools are used.

2. The policy does not provide a clear prohibition on AI-model training.

3. Customer-controlled Media may generate extensive viewer analytics and Personal Information.

4. Important AI restrictions may exist only in separate contracts or provider terms, not this policy.

Summary

The provided diff does not include the actual contractual language. It only states:

> “Added approximately 478 words to the document”

Accordingly, it is not possible to identify:

• Changes to the parties’ rights or obligations;
• New liability, indemnity, confidentiality, or termination risks;
• Changes to data ownership, licensing, or permitted uses;
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models;
• Whether data may be shared with affiliates, vendors, or AI service providers;
• Any opt-out, deletion, retention, or security protections; or
• Whether the customer’s data may be used in aggregated, de-identified, or identifiable form.

Information Needed

Please provide the full redlined text using the stated notation:

• Additions: {new language}
• Deletions: [deleted language]
• Replacements: [old language]{new language}

The analysis should include the specific clauses added, deleted, or changed. This is particularly important for language addressing:

• AI training or model improvement;
• Input and output ownership;
• Use of customer content for service development;
• De-identification or aggregation;
• Data retention and deletion;
• Third-party model providers;
• Confidentiality and security; and
• Customer consent or opt-out rights.

No reliable legal-risk assessment can be made from the word-count statement alone.

Summary of Important Changes

1. Major restructuring and expanded scope

• The policy has been substantially reorganized into 16 numbered sections covering collection, uses, sharing, legal bases, retention, rights, security, children, automated decision-making, and data transfers.
• The policy now expressly covers:
• Wistia’s Websites, Media, and Services;
• people who merely view or use Wistia-hosted Media (“Users”); and
• information collected while accessing, listening to, or viewing Media.
• The policy adds or updates references to numerous privacy laws, including the CCPA/CPRA, Colorado, Connecticut, Montana, Oregon, Texas, Virginia, Utah, GDPR, Swiss DPA, UK GDPR, and PIPEDA.
• The prior broad statement that users consent to Wistia’s collection, use, and sharing by using the Services appears to be replaced with more detailed disclosures and legal bases. However, the policy still states that use of the Services constitutes acceptance of the policy.

2. AI-related changes and risks

• The diff includes provisions stating that Wistia may integrate publicly available third-party AI platforms, applications, and software (“AI Tools”) to benefit Customers.
• Users may choose to use AI Tools during the Media creation process, producing “AI Content.”
• Information processed by an external AI provider is stated to be processed by that third party and not subject to Wistia’s Privacy Policy.

Key AI risk

• The revised language appears to shift responsibility for AI processing to external providers, but it does not clearly state:
• whether Customer Media, Personal Information, prompts, recordings, transcripts, or AI Content may be used to train AI models;
• whether third-party AI providers may retain inputs or outputs;
• whether providers may use data for model improvement or generalized training;
• whether Customers can opt out of such use; or
• what contractual restrictions Wistia imposes on those providers.

No express new authorization to use Customer data to train Wistia’s or third-party AI models is visible in this diff. Nevertheless, the exclusion of third-party AI processing from Wistia’s policy creates a material transparency and allocation-of-risk concern. Customers should review the applicable AI Tool terms, subprocessors, and service agreement before submitting confidential, personal, regulated, or proprietary content.

3. Broader data collection and use framework

• Wistia adds a stated data-minimization principle: it will limit the type and amount of Personal Information to what is necessary for purposes identified in the policy.
• The policy more clearly identifies collection of account credentials, payment information, usage data, device and IP information, cookies, viewing activity, engagement data, recruiting data, and potentially sensitive information.
• Viewer engagement and Media usage data are expressly included within the policy’s scope.

4. Student and children’s data

• The revised policy expressly includes students under 16 receiving Services through schools and points to a separate Schools & Students Privacy Policy Addendum.
• This creates a clearer education-data framework, but Customers serving children should confirm which policy and contractual protections apply.

5. Rights, sharing, and administrative updates

• The policy expands descriptions of privacy rights, opt-outs, objection procedures, non-discrimination protections, and regulatory contacts.
• Wistia states it does not “sell” Personal Information under the CCPA, while acknowledging sharing with Customers and third parties.
• Contact information is consolidated under a Data Protection Office, and the effective date is March 20, 2026.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 478 words to the document”

Because the inserted text is not provided, it is not possible to determine:

• What legal provisions were added or changed
• Whether the customer’s data may be used to train, fine-tune, evaluate, or improve AI models
• Whether data may be shared with affiliates, vendors, or model providers
• Whether customer data is anonymized, aggregated, or de-identified before use
• Whether the customer can opt out of AI training or withdraw consent
• Whether the provider may retain prompts, outputs, logs, or other usage data
• Whether the provider receives ownership or broad usage rights in customer content
• Whether confidentiality, security, deletion, or data-location obligations have changed
• Whether the customer bears additional liability for AI-generated content or model use

Risk Assessment

No substantive risk assessment can be completed from the information supplied. The fact that approximately 478 words were added does not indicate whether the changes are favorable, neutral, or unfavorable to the customer.

AI-Training Provisions to Check

The missing text should be reviewed specifically for language stating that the provider may:

1. Use customer content, prompts, inputs, outputs, or usage data to train or improve artificial intelligence or machine-learning models.

2. Use data for “service improvement,” “research,” “analytics,” or similar broad purposes that could encompass model training.

3. Share customer data with third-party AI providers or subprocessors.

4. Retain data after the customer’s account is closed or a deletion request is made.

5. Create or use aggregated, anonymized, or de-identified datasets.

6. Use customer data by default unless the customer opts out.

7. Claim a license or other rights broad enough to support model training.

8. Disclaim responsibility for confidentiality, accuracy, or harmful AI-generated outputs.

Information Needed

Please provide the actual redline text, including the additions and deletions shown using {}, [], and []{}. Without the underlying language, no reliable comparison or legal analysis is possible.

Summary of Important Changes

1. Expanded and reorganized scope

• The policy is substantially rewritten and reorganized into 16 sections, with clearer navigation and updated definitions.
• Coverage is expanded from the wistia.com websites to Wistia’s websites, hosted Media, and related Services, including users who view or interact with Customer Media.
• “Users” now expressly includes people who view or use Media, not only Wistia account holders or Customers. This may broaden the population whose viewing, engagement, device, cookie, and IP data is covered.
• The prior detailed exclusion for companies and individuals Wistia does not own, control, employ, or manage remains, but is moved and rephrased.

2. Broader legal coverage

The revised policy updates the list of applicable privacy laws, including:

• Additional U.S. state laws, including Montana, Oregon, Texas, Virginia, Utah, and Connecticut;
• The GDPR, UK GDPR, Swiss Data Protection Act, and PIPEDA; and
• Existing California laws, including the CCPA, CPRA, and CalOPPA.

This appears intended to modernize compliance coverage, but inclusion in the policy does not itself establish that all statutory obligations are satisfied.

3. Data collection and use

• New language states that Wistia limits the type and amount of Personal Information to what is necessary for purposes identified in the policy. This is a favorable data-minimization commitment.
• The policy more expressly identifies information collected from Students in connection with public, charter, private, and other educational or tutoring entities, with a separate Schools & Students addendum referenced.
• The policy continues to cover engagement analytics, including viewer and user engagement with Customer Media.
• The revised policy retains broad purposes such as operating, maintaining, developing, and growing Wistia, providing Services, analytics, legal compliance, recruitment, and business transfers.

4. AI-model and AI-tool provisions

• The shown changes do not add an express statement that Customer data, Media, Personal Information, prompts, outputs, or usage data will be used to train Wistia’s or third-party AI models.
• The existing AI provision remains materially important: Wistia may integrate publicly available third-party AI platforms, applications, and software. If a user chooses to use those tools during Media creation, the resulting AI Content or related processing may be handled by an external third party and is stated to be outside Wistia’s Privacy Policy.
• This creates a continuing risk that Customer content or Personal Information submitted to an AI Tool is governed by the provider’s terms, including potentially different retention, confidentiality, and model-training practices. Customers should verify whether the relevant AI provider uses inputs or outputs for training.
• The policy should ideally state expressly whether Wistia prohibits, permits, or controls AI-model training using Customer Data and whether opt-out or deletion mechanisms apply.

5. Rights, sharing, and procedural updates

• Data-subject rights and opt-out mechanisms are reorganized and expanded, including rights concerning sharing with Customers and third parties.
• Wistia continues to state that it does not “sell” Personal Information as defined by the CCPA, while acknowledging disclosure or sharing for business purposes.
• Contact information is consolidated for the Data Protection Office, and the effective date is March 20, 2026.
• The revised policy adds clearer accessibility and nondiscrimination language, but some wording is densely consolidated and should be checked for drafting or formatting errors.

Summary

The supplied diff does not include the actual contractual language that was added, deleted, or replaced. It only states:

> “Added approximately 478 words to the document”

Accordingly, it is not possible to assess the legal or commercial effect of the changes.

AI Training and Customer Data

No provisions addressing the following can be identified from the supplied material:

• Whether customer data may be used to train, fine-tune, or improve AI models
• Whether prompts, inputs, outputs, usage data, or account information are used for training
• Whether customer data is aggregated, anonymized, or de-identified before such use
• Whether customers can opt out of AI training or request deletion
• Whether data is shared with affiliates, subprocessors, or third-party model providers
• Whether the provider obtains ownership or broad usage rights in customer data or outputs
• Whether confidential or personal information may be included in model-training datasets
• Security, retention, or cross-border transfer terms applicable to AI training

Risk Assessment

Because the substantive additions and deletions are missing, no reliable conclusions can be drawn about:

• Expansion of the provider’s data-use rights
• Changes to confidentiality or privacy protections
• New customer obligations or consent requirements
• Changes in liability, indemnity, or regulatory exposure
• Whether previously prohibited AI training has been authorized

Information Needed

Please provide the full redlined text, including the words shown in {additions}, [deletions], and []{replacements}. The actual wording is necessary to identify new rights, restrictions, consent mechanisms, and risks—particularly those concerning the use of customer data to train AI models.

Summary

The provided diff only states that approximately 478 words were added. It does not include the actual added, deleted, or replaced legal language.

AI Training and Data-Use Analysis

It is therefore not possible to determine whether the changes:

• Permit the customer’s data, content, prompts, outputs, or personal information to be used to train, fine-tune, or improve AI models;
• Distinguish between consumer-facing and enterprise AI services;
• Allow use of data in de-identified, aggregated, or identifiable form;
• Permit human review or access to customer data for model development;
• Expand data-use rights to affiliates, vendors, or subprocessors;
• Allow retention of data after termination;
• Give the customer an opt-out or require affirmative consent;
• Restrict use of confidential information, personal data, or regulated data; or
• Change ownership, licensing, confidentiality, or security obligations.

Risk Assessment

No substantive legal risks can be assessed without the wording of the additions and any associated deletions or replacements. In particular, the statement that words were added does not reveal whether the changes are favorable, neutral, or materially adverse to the customer.

Information Needed

Please provide the full redlined text, including:

• Additions shown in {};
• Deletions shown in []; and
• Replacements shown as []{}

Once the actual language is provided, the changes can be analyzed for AI-training rights, data ownership, confidentiality, privacy, retention, opt-out rights, and other customer risks.

Summary of Important Changes

1. Major restructuring and expanded scope

• The policy has been substantially reorganized into 16 numbered sections, with a new table of contents and clearer headings.
• Coverage is broadened from websites and hosted media to all “Websites,” “Media,” and “Services,” including accessing, viewing, listening to, or otherwise using Wistia functionality.
• The policy now expressly covers users who view or use customer-uploaded Media, not only Wistia account holders.
• “Media” is defined broadly to include videos, audio recordings, and other customer-created content.
• The policy retains a separate framework for students under 16 and school-related services, with reference to a Schools & Students Privacy Policy Addendum.

2. Expanded list of applicable privacy laws

The revised policy adds or expressly identifies numerous laws, including:

• CCPA/CPRA and CalOPPA;
• Colorado, Connecticut, Montana, Oregon, Texas, Virginia, and Utah privacy laws;
• GDPR, UK GDPR, Swiss data-protection law, and PIPEDA.

This may increase the compliance obligations and rights available to users, although the policy’s consolidated definitions and cross-references should be reviewed for accuracy.

3. Broader and more explicit data collection language

• The policy now says Wistia limits collection to information “necessary to fulfill the purposes identified in this Privacy Policy.”
• Examples of collected information expressly include names, phone numbers, usernames, email addresses, passwords/security questions, and payment information.
• The policy continues to cover usage data, IP addresses, device information, cookies, page requests, profiles, submissions, recruiting data, and potentially sensitive information.

4. AI tools and AI-model training risk

• The revised language continues to state that Wistia may integrate publicly available third-party AI platforms, applications, and software to benefit customers.
• If a user chooses to use those tools during Media creation, the resulting “AI Content” is processed by an external third party and is stated to be outside Wistia’s Privacy Policy.
• The diff does not add a clear promise that customer Media, prompts, transcripts, personal information, or AI Content will not be used to train AI models.
• It also does not clearly provide a Wistia-controlled opt-out from AI training. Accordingly, customers may face a material risk that information submitted to third-party AI tools could be retained or used for model improvement under those providers’ separate terms.
• Customers should obtain details on: model-training practices, data retention, human review, deletion, confidentiality, subprocessors, and whether customer data is used for product improvement.

5. User rights, sharing, and contacts

• Rights and opt-out provisions are reorganized and expanded, including access, deletion, correction, objection, portability, and “Do Not Sell or Share” mechanisms.
• Wistia continues to state it does not “sell” Personal Information under the CCPA, but may share information with Customers and third parties.
• The revised policy adds a formal Data Protection Office contact address and confirms an effective date of March 20, 2026.

Summary

The provided diff states only:

> “Added approximately 478 words to the document”

It does not include the actual added, deleted, or replaced contractual language. Therefore, it is not possible to reliably identify:

• Changes to customer data rights or permitted uses
• Whether customer data may be used to train, fine-tune, evaluate, or improve AI models
• Any opt-in, opt-out, consent, or notice requirements
• Ownership or licensing changes
• Confidentiality, security, retention, or deletion obligations
• New disclosures, warranties, indemnities, or liability limitations
• Whether data may be shared with affiliates, vendors, or third parties
• Whether de-identified, aggregated, derived, or metadata-based information may be used for AI purposes

AI Training Risk Assessment

No conclusion can be reached regarding AI-model training because the substantive additions are missing. In particular, the text may contain important distinctions between:

• Using customer data to provide the contracted service
• Using data to monitor, analyze, or improve the service
• Using data to train or fine-tune general-purpose AI models
• Using de-identified or aggregated data
• Using customer prompts, outputs, files, or usage metadata
• Allowing human review or third-party model-provider access

These distinctions can materially affect confidentiality, intellectual-property rights, privacy compliance, and the customer’s ability to control its data.

Required Information

Please provide the actual redline text, including the approximately 478 added words and any surrounding provisions. Once provided, the changes can be analyzed for:

1. Business and legal impact

2. Customer-data usage rights

3. AI training and model-improvement provisions

4. New customer obligations or provider rights

5. Privacy, security, confidentiality, and retention risks

6. Recommended negotiation points

Summary of Important Changes

1. Major restructuring and expanded scope

• The policy is substantially rewritten and reorganized into 16 numbered sections, with a new table of contents and clearer headings.
• The policy now expressly covers:
• Wistia Websites, Media, and Services;
• people who view or interact with customer-hosted Media (“Users”); and
• Personal Information collected from customers, viewers, applicants, students, and other individuals.
• The prior broad statement that users “accept” and “consent” to Wistia’s collection, use, and sharing practices is removed and replaced with a more detailed description of processing activities and legal bases.

Risk: The expanded definitions may make the policy applicable to a broader population, including viewers of customer content who may not have a direct relationship with Wistia.

2. Expanded legal and geographic coverage

The revised policy adds or expressly identifies numerous laws, including:

• CCPA and CPRA;
• CalOPPA;
• Colorado, Connecticut, Montana, Oregon, Texas, Virginia, and Utah privacy laws;
• GDPR, UK GDPR, and Swiss data-protection law; and
• Canada’s PIPEDA.

It also adds references to the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks.

Risk: Wistia is making broader compliance representations, which may create additional obligations and potential exposure if processing practices do not align with every listed law.

3. Customer and viewer data use

The revised policy emphasizes that Wistia collects information about:

• Media viewers and user engagement;
• device, IP address, cookie, and usage data;
• customer account, payment, profile, and submission information; and
• content and interactions connected with the Services.

It states that Wistia may share Personal Information with Customers and other third parties, and provides opt-out rights concerning certain disclosures.

Risk: Customers’ Media and viewer-engagement data appear to be treated as sources of Personal Information that may be used for Wistia’s business purposes and shared with Customers. The policy does not clearly distinguish customer-provided content from Wistia’s own data or define customer control over downstream uses.

4. AI-related changes

• The policy continues to state that Wistia may integrate publicly available third-party AI platforms, applications, and software.
• If a user chooses to use those tools during Media creation, the resulting “AI Content” is processed by an external third party and is not subject to Wistia’s Privacy Policy.
• The diff does not expressly authorize Wistia to use customer data, Media, Personal Information, or AI Content to train Wistia’s or third parties’ AI models.
• It also does not expressly prohibit such training, require deletion from AI-training datasets, or provide a customer opt-out or consent mechanism specifically for model training.

Key risk: The absence of explicit AI-training terms leaves uncertainty about whether data sent to external AI providers may be retained or used to train their models. Customers should review the applicable AI providers’ terms and any separate contractual restrictions.

5. Children, students, rights, and contacts

• Student-specific treatment is retained and clarified for schools and educational providers.
• New or clearer rights include access, deletion, correction, objection, appeal/challenge, and limits on certain uses.
• Contact information for Wistia’s Data Protection Office is added.
• The effective date is stated as March 20, 2026.

Key Changes and Risks

1. Major restructuring and expanded scope

• The policy is substantially reorganized into a new 16-section format, with expanded explanations of:
• Information collected;
• Purposes and legal bases for processing;
• Retention;
• User rights;
• Automated decision-making;
• Security;
• Children’s privacy; and
• Data Privacy Framework compliance.
• Coverage now expressly includes Websites, Media, and Services, including hosted media and related functionalities.
• The definition of “Users” is broadened to include individuals who view or use customer-created Media, not only people directly interacting with Wistia’s websites or products.

Risk: More viewers, listeners, and other individuals may be treated as data subjects, potentially increasing compliance obligations and customer-facing notice requirements.

2. Broader geographic and statutory coverage

The revised policy adds or expressly identifies numerous laws, including:

• CCPA/CPRA;
• Colorado, Connecticut, Montana, Oregon, Texas, Virginia, and Utah privacy laws;
• GDPR, UK GDPR, Swiss DPA; and
• PIPEDA.

Risk: The policy may create additional representations about compliance. Some terminology appears inaccurate or inconsistent—for example, references to the “UK General Data Protection Agreement” rather than the UK General Data Protection Regulation. These errors should be corrected.

3. Customer content and data usage

The revised language emphasizes that Customers create and distribute videos, audio recordings, and other Media, while Wistia measures viewer engagement with that Media.

• This clarifies that viewer activity—including access, listening, viewing, engagement, device, IP address, cookie, and usage information—may be collected in connection with customer-hosted Media.
• The policy continues to state that Personal Information may be shared with Customers and other third parties.
• The “Do Not Sell or Share” section confirms that Personal Information may be disclosed or shared with Customers, subject to opt-out rights.

Risk: Customers may need to provide appropriate notices and obtain consents for tracking viewers and sharing engagement data. The revised policy does not clearly allocate responsibility between Wistia and Customers for these obligations.

4. AI-related changes and training risk

• The diff contains only limited AI wording. It states that Wistia may integrate publicly available third-party AI platforms, applications, and software (“AI Tools”).
• Content generated through those tools is called “AI Content.”
• If a user chooses to use an AI Tool, the relevant information is processed by an external third party and is stated to be outside Wistia’s Privacy Policy.

Important finding: The diff does not expressly authorize Wistia to use Customer Data, Media, Personal Information, prompts, outputs, or usage data to train Wistia’s or third-party AI models. It also does not expressly prohibit such training.

Risk: The absence of a clear training limitation leaves ambiguity, particularly where customer Media or Personal Information is submitted to external AI providers. Customers should seek an express commitment that their data will not be used to train general-purpose or third-party AI models without prior written consent.

5. Consent and legal basis

The prior language expressly stated that use of the Services constituted consent to Wistia’s collection, use, and sharing practices. The revised text appears to replace that broad consent language with a statement that users acknowledge the policy and consent to specified practices.

Risk: Consent is still potentially broad, but the revised structure relies more heavily on stated legal bases, legitimate interests, and contractual necessity. These bases should be reviewed for consistency with actual processing activities.

Summary

The diff only states that approximately 478 words were added. It does not include the actual added language or identify where the additions appear.

Key Legal Changes

• No substantive legal changes can be assessed from the information provided.
• It is not possible to determine whether the additions affect:
• Customer data ownership or control
• Data processing or sharing
• Confidentiality obligations
• Security requirements
• Intellectual property rights
• Liability, indemnification, or warranties
• Termination or data deletion obligations
• Governing law or dispute resolution

AI Training and Model-Use Provisions

The provided diff does not reveal whether customer data may be used to train, fine-tune, evaluate, or improve AI models.

Important language to check for in the added text includes whether the provider may:

• Use customer content to train general-purpose or product-specific AI models
• Use data in de-identified, anonymized, aggregated, or pseudonymized form
• Permit human review or labeling of customer data
• Share data with affiliates, contractors, cloud providers, or AI vendors
• Retain customer data after termination for model training or improvement
• Claim ownership of model outputs, derivatives, embeddings, or statistical insights
• Use customer prompts, inputs, outputs, metadata, or usage data for analytics or product development
• Offer an opt-out or require the customer to opt out
• Treat business, personal, confidential, or regulated data differently

Risk Assessment

Because the actual language is missing, no conclusion can be reached about whether the amendment creates new customer risk. The addition could be immaterial, or it could materially expand the provider’s rights to use and disclose customer data.

The full redline or the approximately 478 added words are required for a reliable legal analysis.

Summary

The diff only states that approximately 478 words were added, but it does not include the actual added language or identify where it appears in the agreement.

AI Training and Data-Use Changes

• Cannot determine from the provided diff whether the added text:
• Permits the provider to use customer data to train, fine-tune, or improve AI models;
• Restricts training to aggregated, anonymized, or de-identified data;
• Allows use of customer prompts, inputs, outputs, files, or personal information;
• Grants the provider ownership or licensing rights in customer data;
• Permits human review or disclosure of data for model development;
• Applies training rights to third-party providers or subprocessors; or
• Allows continued use of data after termination or deletion.

Other Legal Risks

The substantive legal impact also cannot be assessed without the wording of the 478 added words. In particular, the missing text may affect:

• Confidentiality and permitted-use obligations;
• Intellectual-property ownership and licensing;
• Privacy and data-protection compliance;
• Data retention and deletion;
• Security obligations and breach liability;
• Use of subprocessors;
• Customer audit or opt-out rights;
• Indemnification and liability limitations; and
• Whether new terms apply retroactively to previously submitted data.

Required Information

Please provide the actual redline text, including the added language and any surrounding provisions. A statement that words were added is not sufficient to identify legal changes or assess whether customer data may be used to train AI models.

Key Changes and Risks

1. Major restructuring and expanded legal coverage

• The policy is substantially reorganized into a detailed, sectioned format covering collection, use, sharing, legal bases, retention, rights, security, children, automated decision-making, and international transfers.
• The defined term “Personal Information” is revised and now expressly covers information subject to numerous U.S. state laws, the GDPR, UK GDPR, Swiss law, and PIPEDA.
• The policy’s scope is clarified to include Wistia’s Websites, Media, and Services, including viewing or using Media hosted by Wistia.
• References to educational customers and students are moved into the general policy, including students under 16 receiving services through schools.

Risk: The broader scope may bring more data and activities within the policy, while the numerous legal references create compliance obligations and potential inconsistencies if the operational practices do not match every listed law.

2. Data minimization and collection language

• New language states that Wistia does not collect Personal Information indiscriminately and limits collection to the amount necessary for purposes identified in the policy.
• The policy gives more detailed examples of information collected, including account credentials, payment information, profile information, Media, usage data, device and cookie information, recruiting data, and potentially sensitive information.

Risk: The “necessary” limitation is favorable to users, but the listed categories remain broad. The policy should be checked against actual collection practices, especially for Media, viewer activity, recruiting information, and sensitive data.

3. Consent and legal basis

• The former introductory language stated that users accepted the policy and consented to Wistia’s collection, use, and sharing of information.
• The revised language uses a more formal privacy-policy framework and separately explains legal bases, including contractual necessity, legitimate interests, consent, and legal obligations.

Risk: Removing blanket consent is generally more defensible, but the policy should clearly identify when consent is required and how consent can be withdrawn.

4. AI and model-training implications

• The diff retains language stating that Wistia may integrate publicly available third-party AI platforms, applications, and software (“AI Tools”).
• User-generated outputs from those tools are called “AI Content.”
• Information processed by an external AI provider is stated not to be subject to Wistia’s privacy policy.
• No new express provision authorizes Wistia to use Customer data, Media, Personal Information, or AI Content to train Wistia’s own AI models.
• No express prohibition or contractual guarantee states that Wistia will not use such data for model training.

Risk: The absence of clear training language creates ambiguity. Customers should confirm in the services agreement, DPA, AI terms, and third-party-provider terms whether prompts, uploads, Media, outputs, usage data, or derived/aggregated information may be used to train, improve, or evaluate AI models. Third-party AI providers may apply separate retention and training policies.

5. Customer sharing and user rights

• The policy continues to state that Personal Information may be shared with Customers and other third parties, with an opt-out mechanism for certain disclosures.
• Rights, including access, deletion, correction, objection, portability, and limits on sensitive-data use, are presented more comprehensively.
• New or expanded state-law rights and regulator contact information are included.

6. Other notable changes

• Expanded children’s and school-related provisions.
• Updated Data Privacy Framework references.
• Revised accessibility, nondiscrimination, and contact provisions.
• Effective date: March 20, 2026.

Structured Summary of Important Changes

1. Major restructuring and expanded navigation

• The policy is substantially reorganized into a numbered, section-based format with a detailed table of contents.
• The revised policy more clearly separates:
• Information collected
• Uses and disclosures
• Legal bases
• Retention
• User rights
• Security
• Children’s privacy
• Automated decision-making
• Data Privacy Framework compliance
• This is primarily a presentation and organization change, but it may make additional disclosures easier to locate and enforce.

2. Broader and more specific service scope

• The revised policy expressly covers Wistia’s Websites, Media, and Services, including accessing, listening to, viewing, or using Media.
• “Media” is defined broadly to include videos, audio recordings, and other media created or distributed by Customers.
• “Users” now expressly includes individuals who view or use Customer Media, not only Wistia account holders.
• This may expand the categories of individuals whose information Wistia claims the right to collect and process, including viewers and audience members.

3. Expanded statutory coverage

• The revised policy lists a broad set of U.S. state privacy laws, including the Montana, Oregon, Texas, Virginia, Utah, Connecticut, Colorado, and California laws.
• It continues to reference GDPR, UK GDPR, Swiss law, and PIPEDA, although the drafting and grouping of these laws have changed.
• The policy now states that collection is limited to information “necessary to fulfill” identified purposes, which is a potentially favorable data-minimization commitment.

4. Children and student information

• The revised language expressly includes students under age 16 and retains a separate reference to the Schools & Students Privacy Policy Addendum.
• The policy continues to distinguish information collected while providing services to schools from information collected outside that context.
• Customers serving minors should verify that the revised policy is consistent with their contractual obligations and applicable education-privacy laws.

5. AI tools and AI-generated content

• The revised policy continues to state that Wistia may integrate publicly available third-party AI platforms, applications, software, or other tools to benefit Customers.
• It defines output or material generated through those tools as “AI Content.”
• If a user chooses to use AI Tools during Media creation, the relevant information is processed by an external third party and is stated not to be subject to Wistia’s Privacy Policy.

AI training risk

• The diff does not add an express statement authorizing Wistia or an AI provider to use Customer data, Media, prompts, transcripts, or AI Content to train or improve AI models.
• However, it also does not clearly prohibit such training or explain whether third-party AI providers may retain inputs or use them for model training.
• Customers should seek clarification on:
• Whether Customer Media or Personal Information is used for AI training;
• Which AI providers receive the data;
• Whether providers may retain or reuse it;
• Whether an opt-out or no-training setting is available; and
• Whether sensitive, confidential, or regulated information may be submitted.

6. Consent, rights, and contacts

• The revised policy replaces the older introductory consent wording with more formal policy language, while retaining consent language later in the policy.
• Contact details are expanded to identify a Data Protection Office and postal address.
• The policy adds or reorganizes rights concerning opting out, sensitive information, objections, and nondiscrimination.

Overall assessment

The principal changes are structural, scope-expanding, and compliance-oriented. The most important unresolved commercial risk concerns third-party AI processing: the policy discloses external AI use but provides insufficient detail about data retention, reuse, and model training.

Diff Analysis

Summary

The supplied diff does not include the actual contractual language. It only states:

> “Added approximately 478 words to the document”

Without the added, deleted, or replaced text, it is not possible to identify the legal or commercial impact of the changes.

AI Training and Customer Data

No conclusions can be drawn about whether the contract now:

• Permits the provider to use customer data to train AI or machine-learning models;
• Uses customer data for model development, testing, evaluation, or improvement;
• Uses customer data in aggregated, anonymized, or de-identified form;
• Allows human review or labeling of customer content;
• Gives the customer an opt-out or requires express consent;
• Applies training rights to customer prompts, outputs, metadata, or usage data;
• Retains data after termination for AI-training purposes; or
• Shares data with affiliates, subcontractors, or third-party model providers.

These issues require review of the precise contractual wording.

Other Risks That Cannot Yet Be Assessed

The missing text also prevents analysis of potential changes involving:

• Ownership and licensing of customer data;
• Confidentiality obligations;
• Data retention and deletion;
• Security commitments;
• Privacy-law compliance;
• Use of subprocessors;
• Indemnities and liability limitations;
• Warranties concerning AI-generated outputs;
• Customer audit or transparency rights; and
• Changes to termination or suspension rights.

Information Needed

Please provide the full diff, including the text marked as:

• Additions: {new language};
• Deletions: [removed language]; and
• Replacements: [old language]{new language}.

Only the statement that approximately 478 words were added is insufficient to perform a substantive contract analysis.

Summary

The provided diff does not include the actual contract language. It only states:

> “Added approximately 478 words to the document”

Accordingly, it is not possible to determine:

• What provisions were added, deleted, or replaced;
• Whether liability, indemnity, confidentiality, payment, termination, or governing-law terms changed;
• Whether the customer’s data may be accessed, stored, disclosed, or transferred;
• Whether customer data, prompts, outputs, or usage information may be used to train, fine-tune, evaluate, or improve AI models;
• Whether any opt-out, consent, deletion, security, or data-retention rights were added or removed.

AI-Training Analysis

No conclusions can be drawn about AI-model training from the information provided. The statement that approximately 478 words were added does not identify whether those words authorize:

• Training or fine-tuning models using customer content;
• Use of customer data for service improvement or product development;
• Human review or annotation of customer data;
• Sharing data with affiliates, vendors, or model providers;
• Retention of data after termination;
• Aggregation, anonymization, or de-identification of customer data; or
• Any customer right to prohibit or limit such uses.

Information Needed

Please provide the actual redline text, including the added language in {} and any deleted or replaced language in []/[]{}. Once provided, the changes can be analyzed for legal effect, risk allocation, and especially any permissions concerning the use of customer data to train or improve AI models.

Executive Summary

The diff appears to replace and substantially reorganize the Privacy Policy rather than merely make wording edits. It introduces numbered sections, updates the covered privacy laws, expands certain service and data descriptions, and changes how users contact Wistia. The provided diff does not clearly add or remove authorization to use customer data to train AI models.

Important Changes and Risks

1. Broader and reorganized scope

• The policy is reframed to cover Wistia’s Websites, Media, and Services, including media hosted by Wistia and user engagement with that media.
• “Users” now includes individuals who view or use customer-hosted Media, not only people who directly interact with Wistia.
• The policy continues to distinguish Students and Schools, but the wording is reorganized and expressly refers users to a separate Schools & Students Privacy Policy Addendum.
• The policy adds or updates references to numerous laws, including newer U.S. state privacy statutes, GDPR, UK GDPR, Swiss law, and PIPEDA.

Risk: Customers may need to reassess whether their viewers, employees, students, and other third parties are adequately notified and whether required consents or contractual disclosures are in place.

2. Data minimization language added

The revised policy states that Wistia does not collect Personal Information indiscriminately and limits the type and amount collected to what is necessary for purposes identified in the policy.

Risk: This is a potentially helpful limitation, but it is qualified by broad purposes and does not necessarily restrict data use to a customer’s instructions or prohibit secondary uses.

3. Expanded description of collected information

The revised text expressly identifies information collected when users visit Websites, register for or subscribe to Media or Services, contact Wistia, or otherwise interact with the Services. It also adds or restates collection of payment information, account credentials, and profile information.

4. AI-related provisions

• The diff changes only a grammatical reference from “software’s” to “software's” and changes quotation punctuation around “AI Content.”
• The policy continues to state that Wistia may integrate publicly available third-party AI platforms, applications, and software to benefit Customers.
• It states that AI Content processed by an external third party is not subject to Wistia’s Privacy Policy.

No clear AI-training change: The supplied diff does not expressly state that Customer Media, Personal Information, prompts, outputs, or usage data may be used to train Wistia’s or third-party AI models. It also does not expressly prohibit such training.

Risk: Because third-party AI processing is outside Wistia’s policy, customers should review the applicable AI Tool terms and confirm whether those providers may retain inputs or use them for model training.

5. Rights, contacts, and effective date

• Contact information is consolidated under a Data Protection Office.
• Non-discrimination language is reorganized and expressly addresses discounts, benefits, penalties, and service differences.
• The revised policy states an effective date of March 20, 2026.