Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy states that when users access Writer through an organizational account, the employer or enterprise customer controls the data and may have a separate agreement with Writer that governs data handling, potentially displacing this privacy policy.
This analysis describes what Writer's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that individual end users accessing Writer through an employer or enterprise account may operate under a separate contractual data governance regime, meaning the rights and protections described in this policy may not apply directly to those users in practice.
The updated policy removes detailed disclosures that previously explained five cookie categories (strictly necessary, functional, performance, targeting), their purposes, and user controls. The revised policy retains only a brief statement that Writer uses cookies to enhance navigation, analyze usage, personalize experience, and assist in advertising, but no longer provides the granular categories, opt-out procedures, or explanation of what data each type collects. Users can no longer reference specific cookie management options, targeting cookie opt-out procedures, or detailed functional descriptions within the policy itself.
View change record →The removal of this provision eliminates clarity about how enterprise customer agreements override the privacy policy, potentially creating ambiguity about data governance for organizational users.
View full change record →Changed from explicit processor/controller language to conditional language stating the organization agreement may supersede this policy; removed customer responsibility language.
View full change record →Under this clause, employees using Writer through an employer-provided account may have their data governed primarily by the enterprise customer's separate agreement with Writer rather than by this public privacy policy. The specific rights available to such users (access, deletion, correction) may depend on the terms of the employer's agreement with Writer, which is not publicly disclosed.
How other platforms handle this
Where ZipRecruiter processes your Personal Data in the capacity of a service provider (data processor), and you seek access, or want to correct, amend, or delete your Personal Data...we will provide you with the data controller's contact information, so you can contact them directly.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Monitoring
Writer has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you access our services through an organization (such as your employer), that organization may have a separate agreement with us that governs the collection, use, and disclosure of your information. In that case, the organization controls the data, and this privacy policy may not apply to the extent that the organization's agreement with us governs.Excerpt from Writer's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR controller/processor distinctions for EU deployments, where the enterprise customer may function as the data controller and Writer as the data processor, requiring a data processing agreement meeting GDPR requirements. CCPA/CPRA applies to California employees' personal information regardless of the B2B contractual structure. (2) GOVERNANCE EXPOSURE: High. This clause shifts primary data governance responsibility to enterprise customers for their employees' data, which means enterprise procurement teams bear compliance responsibility for ensuring Writer's data processing practices align with their own privacy obligations to employees and customers. (3) JURISDICTION FLAGS: EU/EEA enterprise deployments require documented data processing agreements; California enterprise deployments must address employee privacy rights under CPRA; jurisdictions with sector-specific requirements (healthcare, financial services) may impose additional obligations on enterprise customers that flow down to their Writer deployments. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should confirm the existence and scope of a data processing agreement with Writer, including sub-processor lists, deletion obligations, audit rights, breach notification timelines, and data transfer mechanisms for cross-border operations. The clause's assertion that the enterprise agreement may displace this policy entirely creates a due diligence trigger for confirming that the enterprise agreement provides equivalent or greater protections. (5) COMPLIANCE CONSIDERATIONS: Enterprise compliance teams should map their Writer data flows under the assumption that they bear controller responsibilities for their employees' data, confirm that Writer's DPA meets applicable regulatory requirements in all deployment jurisdictions, and establish internal policies for responding to employee data subject requests received in relation to Writer platform use.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that individual end users accessing Writer through an employer or enterprise account may operate under a separate contractual data governance regime, meaning the rights and protections described in this policy may not apply directly to those users in practice.
Under this clause, employees using Writer through an employer-provided account may have their data governed primarily by the enterprise customer's separate agreement with Writer rather than by this public privacy policy. The specific rights available to such users (access, deletion, correction) may depend on the terms of the employer's agreement with Writer, which is not publicly disclosed.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Writer.