This new provision clarifies the scope limitations of Substack's privacy policy and transfers responsibility for Creator data practices to individual creators, potentially reducing Substack's liability.

Removal of explicit disclosure about staff access to direct message contents may obscure internal monitoring practices from users.

This detailed provision explaining creator data sharing was replaced with the more general 'Creator as Independent Data Controller' provision, potentially reducing transparency around specific data sharing scenarios.

The cookie and tracking disclosure language was removed from the contact syncing provision, potentially obscuring tracking practices from users who only review the address book section.

Severity downgraded from 'high' to 'medium', content remains identical.

Severity escalated from 'low' to 'medium' and excerpt expanded to show additional context with more formal language structure.

Provision remains materially identical with no changes to content or severity.

Severity elevated from 'low' to 'medium', and clarifying language '(each, a "DPF")' was added for definitional purposes.

Provision renamed from 'Privacy Rights and One-Month Response Commitment' to 'Privacy Rights Request and One-Month Response Commitment' with identical content.

Severity upgraded from 'medium' to 'medium' (unchanged), but cookie/tracking language was removed and separated into distinct provision; title changed from generic to address-book-specific.

Provision title changed from 'Data Transfer on Business Sale or Merger' to 'Business Transfer and Asset Sale Data Sharing' with identical content.