Found in 281 of 343 platforms tracked (82% adoption) · 4037 provisions
The clause discloses that data analysis conducted by 23andMe may result in commercial arrangements involving third parties, which is a material data-sharing consideration.
This clause requires a written contractual guarantee of equivalent data protection before any Personal Data transfer, establishing a minimum standard that external and internal processors must meet.
This clause directly addresses one of the most consequential data practices — the commercial sale of personal information — and covers even the most sensitive category of personal data.
AT&T retains authority to disclose user Content and transaction information not only when legally compelled but also based on its own reasonable judgment, which broadens the circumstances under which…
AWS's stated position is that customer personal information is not sold, which addresses a common data monetization concern.
Customers who rely on SCCs as their legal transfer mechanism should confirm both conditions are met; if either condition is absent, the SCCs do not apply and an alternative transfer mechanism may be …
Ending a customer relationship with Acorns does not stop the sharing of a former customer's information, meaning data sharing obligations and practices persist beyond account closure or termination.
Using the service constitutes an express grant of authority for Acorns to access financial institution data on the user's behalf and a separate agreement to Plaid handling that data, involving a name…
This clause establishes broad routine sharing of user data across multiple operational and legal contexts, meaning user data flows to third parties as a standard part of Acorns' business operations.
Contact Data—which may belong to the user's own contacts—can be disclosed to external parties, expanding the circle of entities with access to that data.
This permits the creation of a more comprehensive user profile than either Activision or the advertising partner holds alone, potentially enabling more extensive tracking across unrelated services.
User information is shared across the Activision Blizzard corporate family for those entities' independent purposes, meaning your data can be used for marketing by companies you have not directly int…
Users who register Adobe accounts with a business email address may have their account information disclosed to their employer without further individual consent, in the context of account migration.
Users' personal information is not solely controlled by Adobe but may be disclosed to a third-party Business entity without requiring a separate consent action at the time of disclosure.
This requirement places a legal compliance burden on users: storing content that includes others' personal information without legal authorization to share it constitutes a violation of this obligati…
The absolute restriction on other uses or disclosures of sensitive personal information means Adyen has limited its own discretion and cannot rely on other bases to process this category of data.
Data transfers outside the EEA may move personal data to jurisdictions with different or lower data protection standards than those applicable within the EEA.
Your personal data may be transferred to a different legal entity without your consent in the event of a business sale or integration, potentially subjecting it to new data practices.
The breadth of purposes for which Affirm shares information means user data flows to multiple parties across a wide range of activities without requiring additional consent.
User information is shared with unrelated third-party companies for their own marketing, but an opt-out right exists, making it important for users to know they can act.
Granting a power of attorney to Affirm and its third-party providers authorizes them to act legally on the user's behalf and handle the user's information, which is a significant legal authorization …
User information is disclosed to third parties outside Affirm for security and fraud-related purposes, expanding the circle of entities that access personal data.
Acceptance of the Notice combined with use of the Services is treated as consent to third-party merchant marketing data disclosure, meaning continued use triggers this consent.
Third-party data sharing determines who beyond Afterpay may receive and use your personal information, which affects your privacy exposure.
Personal data a user includes in an AI Product Input is not confined to Afterpay but may flow to external third-party service providers, expanding the universe of entities that handle the user's data.
Although customer data can change hands in a corporate transaction, the receiving party is bound by prior privacy commitments, limiting the new owner's freedom to repurpose the data.
This means user data flows beyond Amazon's own advertising purposes to benefit third-party advertisers the user has no direct relationship with.
Information is shared with ad companies for advertising purposes, but a stated limit prevents the sharing of directly identifying information such as users' names.
This is a direct statement against the commercial sale of personal data, which addresses a key privacy concern for users whose data is otherwise collected extensively.
Personal information is shared with third parties as a direct consequence of transacting through Amazon Marketplace when a third party is involved, without requiring separate consent at the time of s…
American Airlines' disclosure of travel data to government agencies is framed as legally compelled across multiple jurisdictions, meaning such sharing occurs regardless of user preferences and extend…
American Airlines' reservation of this right means that opting out does not prevent data sharing for joint activity purposes, which explicitly encompasses administrative, transactional, and analytica…
Consent to international data transfer is established through the act of using Amplitude's services, meaning users may not be aware they are consenting to cross-border data transfers simply by intera…
Users' Personal Data may be transferred to a new entity as a result of a corporate transaction without requiring separate user consent, potentially subjecting it to different privacy practices.
Opting in to DNA matching triggers mutual disclosure of Personal Information to other users, not just to Ancestry.
A user's physical DNA sample—not just derived data—may be transferred to third-party companies outside Ancestry's direct control.
Personal Information is disclosed to external parties for commercial advertising purposes, extending its reach beyond Ancestry.
This provision permits disclosure of personal data to government and law enforcement actors without user consent, conditioned only on Anthropic's good-faith belief that it is reasonably necessary for…
Google Cloud Platform underpins cloud infrastructure for every Anthropic product globally, meaning all user data is processed within GCP infrastructure worldwide.
User data—including the content of interactions with Claude—may be transmitted to external third parties outside Anthropic's direct control, expanding the set of entities that receive and process tha…
The claim establishes that personal data leaves the EEA and UK, which are jurisdictions with heightened data protection standards, meaning users' data may be subject to different legal protections af…
AWS underpins cloud infrastructure for every Anthropic product globally, meaning all user data is processed within AWS infrastructure worldwide.
Billing data for paying and developer-tier users is shared with a third-party sub-processor in the United States, while free-tier and government users are not covered by this arrangement.
Microsoft Azure underpins cloud infrastructure for every Anthropic product globally, meaning all user data is processed within Azure infrastructure worldwide.
Global transfer of personal information to countries with weaker or different data protection laws may reduce the legal protections available to you over your data.
Sharing personal information with third-party advertising partners who deploy their own tracking tools means your data and behavior may be collected and used by entities outside Anyscale's direct con…
The clause establishes that Apple App Store will not provide personal data to third parties whose purpose in receiving it is their own marketing, protecting users from a common form of data monetizat…
The clause establishes that Apple App Store's practices fall outside the legal definitions of 'sale' and 'share' under Nevada and California privacy statutes, which carry specific consumer rights and…
The clause establishes a specific restriction on data flows from Apple App Store's advertising platform to data brokers, a category of third party that commercially trades in personal data.
The clause grants Apple Pay broad discretion to share any user data with a wide range of recipients, including private third parties, with no liability attaching to Apple for such disclosure.
Cross-border transfers of personal information under Japanese law are conditioned on contractual safeguards, making the existence of those contracts the critical protection mechanism.
Incorporating these frameworks and SCCs into the DPA provides the legal mechanisms required for lawful cross-border personal data transfers under EU, UK, and Swiss law.
Atlassian retains discretion to share your information with government and law enforcement based on its own belief that compliance requires it, without specifying that a court order or equivalent is …
Users may not expect that their account content and usage history are visible to both an organizational administrator and colleagues sharing a domain, beyond just Atlassian itself.
Third-party services that users connect to their Atlassian account gain access not just to the integration but to personal account information, including at minimum name and email address.
Vermont residents receive a statutory baseline protection restricting information sharing to Bank of America's corporate family, with the only exception being where law affirmatively permits broader …
Medical information—a sensitive category of personal data—is subject to sharing by Bank of America under specified operational and consent-based conditions.
Customer opt-out choices are legally overridden in circumstances where Bank of America is required to disclose information, meaning consumer preference controls do not apply in those situations.
Because no opt-out is available, consumers cannot prevent Bank of America from sharing their information for these core operational purposes.
The end of a customer relationship does not stop Bank of America from sharing the former customer's information under the terms of the notice.
California consumers receive a statutory baseline protection prohibiting third-party sharing, with the only exception being where law affirmatively permits it.
Because no opt-out is available, consumers cannot prevent Bank of America from sharing their information with third-party service providers for marketing purposes.
Consumers holding credit card accounts have the right to limit third-party marketing by opting out of this specific category of nonaffiliate sharing.
Consumers have an actionable right to limit the flow of their creditworthiness data to Bank of America's affiliates, meaning this sharing is not automatic and unrestricted.
This restriction directly limits how Baseten may commercially exploit or otherwise process personal information, providing a contractual floor of data protection aligned with CCPA requirements.
BeReal's phone number data associated with user accounts is used in an audience-matching process with external advertiser data, linking BeReal users to advertiser customer lists.
This establishes a limit on what advertiser-provided matching data and user phone data BeReal will return to advertisers, even after a matching process has occurred.
Data shared for advertising purposes falls outside the protections of Best Buy's general sharing rule, creating a significant carve-out that can encompass browsing history, inferred preferences, and …
Purchase history, which is specific and sensitive behavioral data, may be shared with social-media companies, enabling those companies to target Best Buy advertising based on what you have bought.
The clause is consequential because it confirms that personal information is disclosed to generative AI providers, while the only stated protection against training-data use is assurances received by…
The clause is consequential because it acknowledges that Betterment's advertising technology practices may trigger legal protections afforded to consumers under State Privacy Laws governing the sale …
The clause is consequential because it constitutes an absolute, unqualified prohibition on two specific forms of commercial transfer of user information.
User information—potentially including sensitive identity data—may be shared with external third parties, and the stated purposes include a basis for service denial based on risk assessment.
The public-by-design nature of the platform means a wide range of user activity is visible to others without any additional action by Bluesky or the user.
This clause means your personal information can move to or be handled by other entities in a wide range of corporate transactions, without requiring your separate consent.
The clause explicitly extends the prohibition on selling personal information to minors, and separately prohibits sharing with third parties for marketing, establishing two distinct protections.
The clause permits transfer of user information to a new owner in a business sale or partial sale, which could result in your information being held by a different entity without your direct consent.
The clause permits Boston Dynamics to share user information with law enforcement and regulators, conditioning that disclosure on legal and regulatory compliance obligations.
The clause establishes that personal information is not monetized through sale or shared for third-party marketing, which are two common data-sharing practices users may be concerned about.
Sharing Content may result in third parties gaining unrestricted use of that Content with no obligation to compensate or seek further permission from the user.
The prohibition is contractual, meaning enforcement depends on Brex's oversight of its service providers rather than a direct legal relationship with the user.
Personal information may flow to Capital One N.A. and other Brex affiliates, extending the reach of data sharing beyond Brex itself.
A third party not currently named in the Privacy Policy may receive personal information as a result of a corporate transaction outside the user's control.
The act of enabling a TPA integration automatically authorises Calendly to share Customer Data with that third party, without requiring a separate or explicit consent step.
The obligation to provide adequate safeguards is conditional on legal requirement, meaning protections for international transfers apply only where law mandates them rather than universally.
Users' personal data may be subject to weaker legal protections than those available in their home jurisdiction, depending on where Calm or its service providers operate.
User personal data can be transferred to a different corporate entity without a separate consent event, as part of standard business transactions.
The default behavior of this setting exposes a design and associated user metadata to anyone with the link — including people with no Canva account — without requiring any authentication.
User information may be disclosed to third parties — and potentially sold — even before a corporate transaction is completed, including during preliminary due diligence processes.
Personal data voluntarily included in AI inputs is not confined to Cash App but may flow to third-party technology partners, expanding the circle of entities that handle that data.
This clause is consequential because it establishes a future date on which Cash App may begin sharing user data with third-party advertising technology providers, expanding the scope of third-party d…
This clause obtains consent to cross-border data transfers, including to the United States, through the act of using the Services or providing information, rather than through a separate affirmative …
This is a direct representation that Cerebras does not engage in the sale or sharing of personal information, which is a significant protection under privacy laws such as the CCPA.
The report defines the precise scope of parental visibility — parents see time-on-platform and top Characters, establishing what is and is not disclosed to them on a recurring basis.
User data is shared across Chase's broader corporate family of affiliated entities, expanding the number of parties that may access user information beyond Chase itself.
User data collected by Chase may be distributed to external parties for advertising, subject only to legal permissibility — not user consent as a stated condition.
The end of the customer relationship does not stop data sharing; former customers' information remains subject to the sharing practices described in the notice.
North Dakota customers receive a default restriction on external data sharing that limits transfers outside the corporate family to legally permitted circumstances.
This restriction limits external sharing of financial information to legally permitted circumstances, providing California residents a stronger default protection than the general policy.
This is a strong categorical commitment covering project and task data, but it carries a carve-out for the Data Protection Addendum, meaning the full scope of protection depends on what that separate…
The act of enabling a third-party integration is itself the consent mechanism, meaning no separate consent prompt is required before Content is shared.
A corporate transaction could result in your personal information moving to a new owner, though that owner is contractually required to honor the Privacy Policy terms.
Personal data may move across borders to jurisdictions—including the United States—that may have different data protection standards than the user's country of residence, and third parties may be inv…
This is an absolute commitment against two of the most commercially significant forms of personal data transfer.
Disclosure outside the stated policy purposes is permitted only when Cloudflare first provides notice and a consent opportunity, preserving user awareness before broader sharing occurs.
Personal information shared with Cloudflare's Service Providers is contractually ring-fenced to Cloudflare-directed service purposes, preventing secondary commercial use by those providers.
Characterizing cookie use as a potential sale or sharing under California law is consequential because it triggers specific consumer rights and opt-out obligations under that law.
Customer data may be used by third parties for purposes governed by those third parties' own terms, which are outside the customer's contractual relationship with Cohere.
This clause defines who inside or connected to Cohere can see the content of user interactions, establishing a meaningful restriction on internal access to sensitive user data.
Third-party counterparty data is collected and shared with other service providers as a regulatory obligation, meaning information about parties to a transaction is not limited to Coinbase's internal…
IP addresses and conversion data shared with named third-party advertisers enable targeted advertising profiling, meaning user activity data leaves Coinbase and reaches external commercial platforms.
Personal information may be transferred to a different entity without the user's affirmative consent in the event of corporate restructuring or insolvency, potentially placing data under different pr…
This clause permits personal data to change hands in a corporate transaction, with compliance by the receiving entity as the stated condition.
This clause provides a specific commitment against selling personal data or sharing it for cross-contextual behavioral advertising, scoped to the definitions established by applicable local law.
This clause confirms that personal data flows to third-party advertising partners and that those partners may independently collect activity data through tracking tools deployed on Copy.ai's own Serv…
Enterprise learners' detailed learning activity may be visible to their employer or sponsoring organization, not just to Coursera.
These restrictions address concerns about data exposure to Chinese legal jurisdiction, both through direct infrastructure presence and through subprocessor relationships.
Users whose accounts are linked to an employer or organization may have their account information disclosed to and actively managed by that organization's administrators, affecting privacy expectatio…
Personal data may be disclosed or transferred to new or third-party entities entirely outside the user's control as a result of corporate events, potentially changing who controls the data.
This establishes that data protection obligations extend beyond Cursor itself to its model providers, through both technical and contractual mechanisms.
Cursor's belief that disclosure is necessary is the operative threshold, meaning disclosure to governments or third parties may occur based on Cursor's own assessment of legal necessity.
Personal information is disclosed to advertising providers who build interest profiles from cross-service, longitudinal online activity data, extending data use well beyond the Databricks platform it…
Personal information may change hands to a third party not only upon completion of a business transaction but also during preliminary activities, before any deal is finalized.
Personal data held by Datadog may be disclosed to government or law enforcement agencies under lawful compulsion, including for national security purposes, without the user's consent.
International transfers of personal information are constrained to legally recognized safeguard mechanisms, limiting Datadog's ability to move data to countries without adequate protections.
Customer data may be processed for infrastructure purposes across five countries with differing legal frameworks, by a major third-party cloud provider.
Datadog's belief that disclosure is permitted—not only that it is required—is sufficient to trigger sharing, which broadens the circumstances under which user information may be disclosed.
Customer data is processed by multiple Datadog corporate affiliates across several countries with differing legal and regulatory frameworks.
Customer data is not restricted to Datadog itself; it may be accessed by external third parties and internal corporate affiliates performing data-processing activities.
Customer data is stored or processed within a third-party data warehouse operated by Snowflake, Inc. in the United States.
Employees using DeepL through a business email may have their individual usage activity disclosed to their employer for license-planning purposes.
Selecting marketing cookies triggers international data transfers and sharing of hashed email addresses with named third parties, carrying data-protection implications beyond the EU's jurisdiction.
A range of personal and transactional data is shared with a third-party fraud-detection provider, expanding the circle of entities that hold the user's information.
Users who register with a business email may have that email disclosed to their employer or domain administrator without initiating the disclosure themselves.
Users who take an Uber trip in this context cannot assume their trip details and location are kept private from third-party entities involved in the facilitation of that trip.
Users who interact with Delta Airlines by text message have a stated protection against their personal data being shared with third parties for marketing.
Discord makes an explicit commitment that personal information is not sold to third parties, which directly addresses a common concern about data monetization.
Disclosure is conditioned on Discord's own belief that the law requires it, rather than a confirmed legal obligation, and expressly includes national security and law enforcement contexts.
User information may be shared with third parties not only upon completion of a corporate transaction but also during the evaluation phase, before any deal is finalized.
Even limited or pseudonymous data such as hashed email addresses may be disclosed to third parties, which can enable identification or targeting outside Disney+'s own platforms.
Once personal information is submitted to a public forum feature, Disney+ places no limitation on its subsequent use by itself or any third party, meaning the user loses practical control over that i…
Personal information may be disclosed to third parties across a broad range of circumstances, including some—such as a good-faith belief that law requires disclosure—that are determined unilaterally …
Affiliated companies may use your information not only to support Disney+ services but also for their own independent purposes, subject only to a prohibition under applicable law—significantly expand…
Binding Corporate Rules are a formal cross-border data transfer mechanism under EU/UK data protection law; their adoption determines the legal basis on which EEA and UK personal data leaves those jur…
Data processed outside a user's home jurisdiction may be subject to different legal protections, and users in jurisdictions with strong data protection laws may have fewer legal remedies once their d…
Personal information may be processed in jurisdictions beyond those specifically named, as the list is non-exhaustive, potentially placing data in countries with fewer privacy protections than the us…
Advertising delivered by third-party partners may be personalized using behavioral data from outside the DoorDash platform, meaning data from unrelated third-party services may influence what ads you…
Users outside the United States may have fewer legal protections over their data once it is transferred, and consent is deemed given simply by using the services.
Personal information is shared with third-party service providers across a range of core operational functions, meaning multiple external parties may access user data.
Acceptance of the privacy notice and use of services operates as an authorization for entities holding sensitive user data — including financial institutions — to transmit that data to DraftKings.
Viewers of shared content may not realize that their identifying information is disclosed to the person who shared the content, not just collected by Dropbox, when analytics features are enabled.
A corporate transaction could result in user data being transferred to a new entity over which users have no prior relationship or negotiated terms, potentially changing how their data is handled.
An explicit prohibition on sale distinguishes Dropbox's data practices from services that monetize user data through sale, providing users a defined boundary on how their information may be commercia…
Users' personal or proprietary information may be transmitted to other countries, which may have different legal protections, and users have consented to this as a condition of use.
Users' account information and content may be accessed, retained, or shared with third parties by Dun & Bradstreet based on either a legal requirement or its own good faith judgment that it is reason…
Individual usage data (not just anonymized data) may be shared with a third-party Code Provider, which means personally identifiable usage information could leave Duolingo's direct control.
The clause permits Duolingo to share personal information with multiple named third-party marketing platforms for personalized advertising purposes.
The clause discloses that user-submitted content during AI-enabled interactions is not confined to Duolingo but may be transmitted to named third-party AI vendors.
This establishes that the act of using EA services through a third-party platform is treated as affirmative consent to data transfer, without requiring a separate explicit consent step.
Personal information collected by Egnyte may be transferred to a different entity without the user's consent in the event of a corporate transaction or reorganization.
Visitor data may be shared with third parties to enable targeted advertising directed at those visitors or other users beyond the Website itself.
Transfer to countries with different legal frameworks—including China—means users' Personal Data may be subject to legal regimes that provide fewer protections than those in their home country.
Personal Data flows not just to Eufy but to third-party advertising networks, which then independently collect additional data through cookies, expanding the number of parties holding user informatio…
This sharing covers highly sensitive identifiers—including safe words and emergency contacts—with named third-party monitoring companies, which are external entities outside Eufy's direct control.
RISKIFIED's ability to aggregate personal information from other e-commerce platforms means a purchase on Eufy's site may result in cross-platform profiling of the user's transaction history.
Users' contact information is shared with external parties, enabling those parties to identify individual users or build audience profiles based on user attributes.
Users have an explicit commitment from Eventbrite that their Personal Data will not be sold to outside parties, including entities whose business model depends on targeted advertising.
Information submitted by users in connection with an Organizer event is not solely held by Eventbrite but is shared with the Organizer, who has independent authority to use it.
Personal information is explicitly categorized as a transferable business asset, meaning it may change hands without users initiating or consenting to the transfer.
Even in hashed form, email addresses and unique identifiers disclosed to third parties can be used for cross-platform identification and ad targeting.
The range of potential recipients — spanning regulatory, sports, collegiate, and governmental bodies — means users' personal data and device identifiers may be shared with a wide array of institution…
FanDuel's authority to contact a user's employer about eligibility violations carries significant real-world consequences, as it could affect a user's professional standing based on FanDuel's interna…
The breadth of the disclosure — covering 'various types' of information and an undefined set of third parties — means users' data may be shared widely to enable advertising targeting across digital c…
FanDuel's acknowledgment that its third-party disclosures may qualify as a 'sale' under applicable law is legally significant because sale-of-data classifications trigger specific consumer rights and…
The clause grants FanDuel authority over the full spectrum of information-handling actions — access, use, preservation, transfer, and disclosure — and the trigger is FanDuel's own good faith opinion,…
Personal data may be transferred to a new entity in a corporate transaction, and that entity may operate under different privacy practices, affecting how the data is subsequently handled.
This prohibition gives the Subscriber a contractual commitment that its data will not be monetized or shared with third parties by Fastly.
This clause establishes a legal floor for cross-border data transfers, tying Fastly's conduct to whatever mechanisms applicable law mandates rather than leaving the method to Fastly's discretion.
Cross-border data transfers subject personal information to the laws and protections of other jurisdictions, which may differ from those of the user's home country.
A commitment not to sell personal data is a material privacy protection, distinguishing Fastly's practice from data-monetization models and carrying legal significance under statutes such as the CCPA.
All personal information, regardless of where users are located, is subject to U.S. jurisdiction and data law by virtue of being processed and stored there.
Default enablement of domain capture means it is active without any affirmative choice by the account administrator, automatically affecting users with matching email domains.
Users whose accounts are organizationally managed or paid for by a third party have their information accessible to that third party upon request, limiting personal privacy from the account sponsor.
Third parties, not just Figma, are collecting user activity and device data through technologies Figma has permitted, expanding the scope of data collection beyond Figma itself.
All collected Personal Data could move to a new controlling entity, potentially one with different privacy practices, without users having the ability to prevent the transfer.
All categories of Personal Data that Figure AI holds are subject to potential disclosure to government entities, including law enforcement, when legal requirements apply.
Users' Personal Data is not monetized through targeted advertising sales or sharing, and this commitment covers the preceding 12-month period.
Third-party advertising partners are involved in delivering content to users not only within Fireworks AI's Services but also on external websites and across multiple devices, extending the reach of …
Your information reaches third-party business partners who may use it independently for commercial ends, including direct marketing, beyond Fireworks AI's own use.
Personal data crossing international borders may be subject to different legal protections than those of the user's home jurisdiction, affecting privacy rights and remedies.
The restriction is scoped to the CCPA's specific definitions of 'sell' and 'share,' meaning activities outside those definitions are not addressed by this clause.
This clause identifies circumstances under which Fitbit may disclose user information to third parties—including governments—without the user's consent, covering a broad range of legal and law-enforc…
A categorical prohibition on the sale of personal information is a meaningful data-protection commitment that distinguishes Fitbit's stated practice from business models that monetize user data throu…
User profile information is shared bilaterally between Fitbit and Google, meaning data flows in both directions between two distinct corporate entities.
This is an explicit prohibition on commercial monetisation of user data through third-party transactions, covering a broad range of transfer mechanisms.
A change of corporate ownership is a legally recognised trigger for data transfer to a new entity; the confidentiality preservation requirement is the only stated constraint on that transfer.
Personal information may flow to third-party advertising networks either through GOAT's active sharing or by GOAT permitting direct collection on its own sites, enabling targeted advertising against …
The act of providing personal information is treated as consent to cross-jurisdictional transfer to countries where legal protections for that data may be weaker than in the user's home jurisdiction.
Personal data sharing in this context is mandatory and not subject to user consent, meaning users cannot prevent it when a legal requirement applies.
An explicit no-sale commitment means users can rely on Garmin not monetising their personal data through sale, which is a key consumer protection concern.
Precise movement data from a navigation device is sensitive; the consent requirement means this sharing should not occur without the user's affirmative agreement.
The prohibition limits secondary use of users' Personal Information by third-party service providers, confining it to the scope of their engagement with Gemini.
Personal Information may be transferred to unknown third parties as part of corporate transactions, including events that are merely proposed and not yet completed.
Sharing driving and location data with an insurance entity is gated on affirmative consumer consent, meaning this disclosure cannot occur without an active, affirmative step by the consumer.
General Motors has set a baseline procedural requirement — a warrant or court order — for most government disclosures of personal information, which limits routine or informal government access.
Identifiers, digital activity data, and vehicle identification numbers may flow to advertising networks and financial institutions through General Motors' business and marketing arrangements, enablin…
Personal Data may be transferred to new owners or parties in the event of a corporate transaction, subject to legal and policy constraints.
This carve-out limits the reach of the license by preventing user data from flowing to external AI providers for their independent training pipelines, which would be outside GitHub's control.
Third-party partners—not just GitHub—may track users' cross-service activity over time and use it for targeted advertising.
Personal Data may flow to Microsoft and other GitHub affiliates for purposes as broad as marketing and advertising, not only operational necessities.
Users added to an organization's account may have their Personal Data shared with that organization without initiating the sharing themselves.
Profile data users provide to Glassdoor is automatically shared with and updated across Indeed's services, without a per-instance user action.
Consent to data processing and sharing is obtained through the act of using the services rather than through an affirmative opt-in, meaning continued use constitutes binding agreement.
The non-sale commitment is scoped to the legal definition of 'sell' under applicable privacy laws, meaning the practical scope depends on how those laws define the term.
The non-sharing commitment is conditioned on consent, meaning Customer Data is protected from third-party disclosure only where the applicable consent has not been given.
Advertisers do not receive directly identifying user information by default, limiting the ability of advertisers to individually identify users from data provided by YouTube Ads.
This clause restricts Google from using GTM data across its other products unless the user has consented, providing a meaningful data-sharing boundary.
The commitment not to sell or CCPA-share personal information defines the outer boundary of certain data transfers, which is a material protection for users, particularly California residents.
The clause authorises cross-border data processing across a broad range of countries, which may include jurisdictions with varying levels of data protection, constrained only by the Additional Terms.
The clause imposes both a disclosure obligation and a compliance obligation on Google Ads for cross-border transfers subject to European Data Protection Legislation, ensuring transfers are not made w…
The clause establishes an absolute prohibition on Google Ads selling or sharing Customer Personal Data, directly addressing CCPA-relevant data commercialisation concerns.
Service Data may flow to third parties outside Google's control whenever a third-party service or application is procured or used through the specified Google platforms.
This is a direct prohibition on one category of commercial data transfer, providing users with a clear assurance about a specific use of their data.
It establishes that human beings — not just automated systems — can read a portion of users' chats, and that this access extends to third-party service providers.
It establishes that task completion through Gemini's agentic features requires sharing potentially sensitive personal data with external parties beyond Google's direct control.
Users' Payment Method details may be transmitted to third parties outside of a Seller context, expanding the set of parties who receive that financial information.
Third-party AI providers processing Grammarly user content are contractually barred from using that content for their own model training, limiting downstream data use.
Despite sharing some cookie and interaction data with advertising partners, Grammarly explicitly excludes user content from what those partners can access, which limits the scope of third-party data …
The no-sale commitment is qualified by two carve-outs—policy-described disclosures and point-of-collection disclosures—meaning the scope of protection depends on what those documents say.
This authorizes active outbound sharing of user data with third-party employers, beyond merely facilitating user-initiated applications.
Disclosure of sensitive categories is blocked by default; only affirmative express consent—a higher standard than implied or passive consent—unlocks it.
Sharing personal information with advertising and marketing partners means data about users can flow to third parties whose primary purpose is commercial targeting.
Advertising IDs and IP addresses can be used to identify and track individuals across services; their processing enables targeted advertising and cross-context tracking.
Processing personal data outside the EEA, UK, and Switzerland means it may be subject to different legal protections than those that apply in those regions.
Users whose personal information is transferred internationally in restricted circumstances have a commitment from Groq that adequate protective measures will be applied.
User information may be transferred to third parties in a wide range of corporate events, including ones that are only proposed and not yet completed, and including bankruptcy proceedings.
The non-sale commitment is limited to a specific category of third parties — those providing online analytics or targeted advertising services to Groq — and does not address other third parties.
User personal data is actively shared externally for two distinct commercial purposes: targeted advertising and amplification of Groq's own marketing.
Non-US users' data is subject to US law once transferred, and consent to that transfer is obtained through the act of using or accessing the platform rather than through a separate explicit consent s…
Personal identifiers such as name, address, phone number, and email address may be distributed to third-party advertising networks for behavioral targeting purposes.
Grubhub's commercial information about users—such as purchase history—may be distributed to third-party advertising ecosystems for behavioral targeting purposes.
User data may be handed over to government authorities or in legal proceedings without the user's individual consent, as a condition of legal compliance.
User data may be transferred to an entirely different company—including during preliminary negotiations—and could be treated as a transferable asset in bankruptcy or receivership.
This clause confirms that commercial information is shared with advertising partners in a manner Gusto classifies as a sale or sharing, which has legal significance under privacy laws such as CCPA.
Enabling an AI-powered integration triggers potential disclosure of personal information to external third parties, expanding the circle of entities with access to user data.
This clause provides an explicit prohibition on a specific category of data sharing, limiting how mobile information can be used by external parties for commercial outreach.
A user's employer may receive detailed information about the user's individual account activity and usage logs, which could be used for monitoring or performance purposes.
Harvey AI reserves the right to disclose user information to law enforcement or others proactively—without being legally required to do so—based on its own good-faith belief of reasonable necessity.
Harvey AI's commitment is limited to prohibiting exchanges of Personal Data for payment; it does not prohibit all sharing of Personal Data with third parties.
An employer or other entity sponsoring a user's benefit may receive identifiable personal information about that user's account activity.
The carve-out means the baseline protection against sharing activity data with a Benefit Sponsor can be lifted in healthcare-related contexts, broadening potential disclosure.
User data flows to external advertising and analytics companies, expanding the number of parties who can access and process that data beyond Headspace itself.
This clause discloses that Heap has actually engaged in the sale or sharing of specific categories of personal information within the past year, which directly informs users of the scope of data mone…
This clause discloses an active practice of sharing or enabling collection of personal information for targeted advertising, directly affecting user privacy with respect to third-party ad partners.
Employees who use corporate booking codes or corporate credit cards may have their detailed stay information shared with their employer and credit card company without a separate, individual consent …
Mexico-based Hilton customers' loyalty and contact information may be shared with a third-party telemarketer, meaning they may receive unsolicited marketing contact as a result.
Characterizing the sharing as a potential sale under California law is consequential because it may trigger California Consumer Privacy Act rights, including the right to opt out.
The protection is contingent on an intra-group agreement that may—but does not always—apply, meaning coverage is not guaranteed for every transfer within the Hilton Group.
Sensitive personal data including health and sex life information may flow to advertising partners unless it meets the threshold of Protected Information, leaving a potentially broad category of sens…
The explicit notice that sensitive personal data may be sold—even under a statutory definition of 'sell'—signals that sensitive data may be transferred to third parties for consideration, triggering …
User data flows to third-party advertising partners either through active sharing by Hinge or by granting those partners direct technical access to collect data from Hinge's own services.
User data is not confined to Hinge alone; it may flow to affiliated companies specifically under the justification of safety and security.
This clause authorizes Hinge to disclose personal data to authorities or others across three distinct grounds, some of which—crime prevention and personal safety—involve discretionary judgments by Hi…
User data flows across all Match Group platforms for safety enforcement purposes, meaning activity or data on Hinge can result in consequences—including bans—on other Match Group services.
This commitment prevents a consumer's SMS opt-in status from being sold or transferred to third-party marketers, limiting a specific vector for unsolicited commercial messaging.
Consent to infrastructure sub-processor access to Customer Data is bundled into DPA agreement rather than requiring a separate, explicit opt-in at the time of sub-processor engagement.
HubSpot's disclosure of Personal Data is not limited to legal compulsion; it extends to situations where HubSpot holds a reasonable belief that disclosure is necessary, covering a broader set of circ…
Users' behavioral data on HubSpot websites is made available to third-party advertising networks, meaning third parties are actively collecting data during website visits.
Consent to affiliate sub-processor access to Customer Data is obtained through DPA agreement rather than a separate, explicit opt-in at the time of sub-processor engagement.
The prohibition contains an internal exception, meaning the Policy's own terms may authorize conduct that would otherwise constitute selling, renting, or leasing personal information.
This right permits disclosure of user information without consent whenever Hugging Face determines a security or fraud purpose is at stake, with no third-party oversight mechanism stated.
Personal information may be transferred to entities the user has no relationship with if Hugging Face is acquired or restructured, expanding the pool of parties holding that data.
Hulu may proactively disclose user details to third-party system administrators and law enforcement without limiting this to legally compelled disclosures, covering security incidents and law violati…
Users' personal information may be disclosed to government and law enforcement bodies without the user's consent when Ideogram determines legal compliance requires it.
The commitment is explicitly scoped to the CCPA definitions of 'sell' and 'share,' meaning the assurance applies within those specific legal definitions rather than any broader colloquial sense.
Disclosure to marketing and advertising partners, including social media platforms, enables third-party use of a user's personal data for commercial purposes outside Instacart's direct control.
Treating personal information as a transferable asset in insolvency means users' data could pass to unknown third parties beyond the scope of the original privacy relationship with Instacart.
The prior written consent requirement establishes a higher protection standard for Personal Health Information than for other personal data, but the Services-necessity exception creates a carve-out t…
Sensitive financial and personal details of UK residents may be disclosed to multiple named third-party companies, including lenders and financial services providers, which can affect credit and fina…
User actions short of an explicit consent prompt—such as interacting with or linking to a platform partner—are framed as consent to personal data sharing, which may not be apparent to users.
Users outside the United States are explicitly required to acknowledge that their data will be handled in the US, a jurisdiction that may offer different data protection standards than their home cou…
Users' personal information is not transferred to third parties in exchange for payment or other consideration by Khan Academy.
User information may be transferred to another entity as part of a merger or acquisition involving Khan Academy.
Kick's use of third-party advertising networks means your activity on Kick's Services may be used to deliver advertising beyond Kick's own platform, including on other websites and devices.
Sharing an account identifier with advertising partners enables cross-device tracking of users, extending the reach of targeted advertising beyond a single device or session.
Users' personal information and content held within Third-Party Services may flow to Amazon, expanding Amazon's visibility beyond direct Kindle usage data.
Disclosure is triggered by LangChain's own good-faith belief rather than a confirmed legal requirement, meaning personal information may be shared with a broad range of recipients at LangChain's judg…
Processing in the United States means your personal information is subject to U.S. law rather than the privacy protections of your home jurisdiction.
Your personal information may be transferred to a different legal entity as a result of corporate activity, potentially changing who controls and processes your data.
Sharing identifiable information such as email addresses and location data with third-party advertising partners extends the reach of your data beyond Leonardo AI to external commercial entities.
Users of Lime for Business should expect that their employer will receive detailed ride data, meaning their travel activity is not private from their employer.
Joint controllership means both Lime and Meta Ireland share legal responsibility for the data processing involved in advertising via the Meta pixel, which affects users' rights and remedies under dat…
User information may be disclosed to a wide range of governmental and regulatory bodies, meaning data shared with Lime could reach law enforcement or regulators without additional user consent.
Lime may proactively share user data with government agencies not only when legally compelled but also for activities that merely 'may' violate its own policies or terms, a lower threshold than confi…
This clause means the entirety of a user's Personal Data could move to a new controlling entity in a business transaction, potentially subject to different privacy practices.
This clause authorizes disclosure of any Personal Data — without category limitation — to third parties whenever the activity relates to legal compliance or enforcement, which can be a broad basis fo…
This clause establishes that payment card data is collected by a third-party partner rather than Linear directly, meaning Stripe's separate privacy practices govern that data rather than Linear's Pri…
This clause establishes that Personal Data is subject to U.S. jurisdiction and potentially the laws of other countries, regardless of where the user is located or where the data originated.
Public content posted on LinkedIn may be shared with and used by Microsoft and other affiliates to build or operate their own services, extending the reach of that content beyond LinkedIn.
Profile data can be exported by LinkedIn's paying customers for commercial purposes by default, with opt-out as the only user mechanism to prevent this.
Employer visibility into LinkedIn usage is explicitly authorized, but two specific categories—job searches and personal messages—are carved out from that visibility.
Advertising and personalized content delivery extends beyond LlamaIndex's own services to other websites and devices, meaning the reader may be targeted based on LlamaIndex-related data in third-part…
LlamaIndex's business partners are permitted to use the reader's personal data independently for their own purposes, meaning the reader's data may be used for ends beyond LlamaIndex's own services.
The act of providing information itself is defined as consent to international data transfer, storage, and processing, which has direct implications for users in jurisdictions with strict data transf…
Users' personal information may pass to a different legal entity in a corporate transaction, potentially changing who controls and processes that data.
Lyft expressly disclaims two specific forms of monetizing personal data: direct monetary sale and operating as a data broker.
User information is not confined to Mailchimp's own systems or purposes; it flows to the broader Intuit corporate group and is used to benefit products and services beyond the ones the user signed up…
Users' personal data may be subject to lower legal protections once transferred internationally, and Marqeta has disclosed this risk explicitly.
Continued use of the services is treated as affirmative consent to international data transfers, meaning no separate or explicit consent action is required from the user.
Personal information gathered from website interactions may be passed to third-party advertising and analytics ecosystems, enabling targeted advertising across platforms beyond Marqeta's own services.
Users' entered information is disclosed to a third party whose privacy practices may differ from McDonald's, and that third party's policy may govern how the data is handled.
The scope of sharing is broad — covering all or substantially all personal information categories — and extends to an entire named group of affiliated entities.
Personal information is shared with third parties beyond Medium itself, expanding the number of entities that hold and can act on users' data.
Even actions such as sending private notes — which users may consider non-public — cause certain account information to be exposed to other parties.
Users' personal data may be subject to the legal frameworks of foreign jurisdictions that offer fewer protections, potentially affecting their privacy rights.
This is a direct statement that Medium does not engage in the sale of personal data, which is a key concern under privacy laws such as the CCPA.
This obligation binds users to a prohibition whose precise scope is determined by applicable laws, meaning the restriction may vary by jurisdiction.
Medium may disclose personal data based on its own belief that a policy or legal violation has occurred, without requiring a confirmed or adjudicated violation.
The clause identifies the specific legal mechanisms Mercury uses to legitimize cross-border transfers of Personal Information from the EEA and UK, which are subject to heightened regulatory requireme…
Personal Information may be transferred to third parties in corporate transactions, including to parties who are only potential — not confirmed — acquirers.
The clause establishes a specific limit on Mercury's data monetization practices, though the same excerpt acknowledges that other practices may still qualify as a 'sale' or 'sharing' under certain U.…
The clause signals that users' Personal Information may be legally treated as sold or shared under certain U.S. privacy laws through the use of advertising technologies, triggering potential opt-out …
The requirement that the Service Provider agree in writing before use means developers bear responsibility for obtaining written commitments from third parties before engaging them, and failure to do…
The dual restriction — requiring both compliance with the Terms and satisfaction of enumerated circumstances — means any sharing of Platform Data outside those boundaries is prohibited.
This clause establishes Meta's default non-disclosure obligation for Business Tool Data, with sharing permitted only on advertiser authorization or legal compulsion.
Restricting Meta advertising data sharing to agents of the advertiser limits onward disclosure and prevents third-party monetization of that data.
Enabling MEV Protection triggers a specific data-sharing authorization, meaning users' transaction data is disclosed to external third parties as a direct consequence of activating the feature.
The 'good faith belief' standard means Microsoft may disclose personal data without a court order or legal compulsion, as long as Microsoft itself judges the disclosure necessary—placing the threshol…
This clause establishes that Midjourney's confidentiality of user data is not absolute—legal compulsion by public authorities can override it.
Miro's use of tracking-based advertising means user behavior data may be shared with or processed by third-party advertising and analytics services for targeted advertising purposes.
Using Miro's AI features may result in a user's data being shared with a third party, Microsoft, for purposes that include compliance monitoring.
Employees using Miro through an employer's account have limited privacy from that employer, who can monitor activity logs and alter profile information.
Enabling a third-party integration can trigger Miro sharing Customer Content and Services Data with that third party, governed by Miro's agreement with the third party rather than solely by Miro's Pr…
A prior and general authorization means Customer does not need to approve each Subprocessor individually, giving Mistral AI broad latitude to engage third parties to process Personal Data.
User information may be shared with third-party advertising partners and used to target users—or profiles similar to them—with interest-based advertising outside of Mixpanel's own platform.
The restriction on use and sharing is bounded entirely by what is described elsewhere in the Privacy Policy, making the scope of the commitment dependent on the full contents of that document.
The prohibition covers every mode of transfer or communication of Customer Personal Data, leaving no gap through which Modal could lawfully pass data to third parties without prior written consent.
Users' Personal Information is shared with third parties, with the stated purpose being task performance on Modal's behalf.
The obligation on third parties limits their permitted use of personal information to their assigned tasks, restricting secondary use or disclosure.
This clause discloses that MyFitnessPal may share identifiable user data with external marketing and advertising entities, which can enable targeted advertising beyond MyFitnessPal's own platform.
This clause discloses that users' personal information may be subject to legal regimes outside their home country, which may afford different or lesser privacy protections.
The clause signals that NVIDIA NIM's data-sharing practices with advertisers may trigger legal rights and protections—such as opt-out rights—available to users under applicable privacy laws.
The clause establishes that personal contact information is disclosed to external parties who may then independently communicate with users, extending the reach of user data beyond NVIDIA NIM.
The clause establishes that two specific personal identifiers—email address and phone number—are disclosed to a named third party (Google) for advertising measurement purposes.
The clause establishes that consent to marketing communications or recommendations triggers disclosure of hashed personal data to external advertising providers for interest-based targeting.
Content shared on Nextdoor is not inherently private; it may be indexed by search engines and accessed by governments and agencies as well as the general public, potentially exposing personal informa…
Nextdoor's standard for disclosing content and personal data to law enforcement and private parties is its own good-faith belief of reasonable necessity, not a formal judicial determination, and disc…
Even in a transformed form such as hashed emails, personal information may be shared with third-party advertising partners, conditional on applicable law permitting it.
Using third-party login is conditioned on the user's authorization for that third party to transfer personal information to Nextdoor, meaning the login method itself constitutes a data-sharing consen…
This establishes a present and forward-looking commitment by Nintendo against the sale of user information, providing users with a firm assurance on this specific data practice.
This establishes that Nintendo authorises third-party collection of user data for cross-site and cross-device behavioural tracking, extending data exposure beyond Nintendo's own systems.
Data collection by third parties through Noom's own platforms means personal data flows to entities outside Noom's direct control, and those entities may aggregate it across other sites.
Noom acknowledges that certain data disclosures may trigger state-law protections — including opt-out rights — that apply specifically to sales and sharing of personal information.
Noom commits to sharing user information with law enforcement and government agencies based on its own belief that doing so is legally necessary, without specifying a requirement for a court order or…
Noom expressly acknowledges the potential sale of sensitive personal data and the existence of a user opt-out right, placing the burden on users to exercise that right.
Users who belong to an organizational account may have their profile information and Workspace details disclosed to their organization without a separate consent step.
User information can change hands to a third party — including in bankruptcy proceedings — without users initiating or necessarily being able to prevent the transfer.
Attending an Okta event may result in broad disclosure of Personal Data to third-party sponsors for commercial purposes, beyond what attendees may expect.
If Okta's sharing is a CCPA 'sale,' individuals have a right to opt out, making this acknowledgment significant for understanding available privacy rights.
Third-party tracking across multiple channels and over time enables broad profiling of user behavior beyond any single interaction with Okta.
Processing in countries without adequacy decisions means Personal Data may not receive the same level of legal protection as in the individual's home jurisdiction.
This establishes two explicit prohibitions on monetising personal data in ways that are regulated under certain privacy laws, affecting users' data rights and protections.
A general authorization means Customer has pre-approved the listed Sub-Processors collectively rather than approving each one individually, limiting Customer's control over which third parties handle…
Customer data is sent to Snowflake for warehousing unless the customer has Zero Data Retention, making ZDR status the operative factor in whether Snowflake processes a customer's data.
Customer data is transferred to a third-party sub-processor across three countries for moderation purposes, expanding the geographic and organizational footprint of data handling.
Customer data across all OpenAI services is accessible to TaskUs in the Philippines for support purposes, and content and GPT moderation data for specific services is also processed there.
This establishes the legal mechanism OpenAI Ireland Limited uses to legitimize international transfers of EEA and Swiss Data, which is a core requirement under European data protection law.
Personal Data is transferred to and stored in the United States and other jurisdictions, which may carry different legal protections than the user's home country.
Customer data processed through Microsoft's cloud infrastructure may be handled in any of 22 countries, each with different data protection regimes, significantly broadening the geographic scope of d…
Personal Data and behavioral interaction data can be shared with a broad range of third parties, including government authorities, under this clause.
Customer Content that triggers policy flags may be disclosed to third-party sub-processors, expanding the set of entities that access that content beyond OpenAI itself.
The act of using or enabling the App triggers an automatic data transmission authorization, and the receiving Application's terms—not OpenAI's—govern that data once transmitted.
Personal Data may be shared with external parties in corporate or financial proceedings, which are circumstances outside a user's control.
Customer data is routed to Cinder Technologies for moderation, but Zero Data Retention customers are carved out, meaning their data does not pass through this sub-processor.
Data submitted through OpenRouter may be used by third-party Model Providers to train or improve AI models, a use that extends beyond delivering the immediate service to the user.
This commitment conditions cross-border data transfers on the existence of a legally valid transfer mechanism, providing a compliance baseline for EEA, UK, and Swiss residents.
User information is treated as a transferable business asset in insolvency proceedings, meaning it may pass to a new owner without users' control or consent.
The good faith belief standard means OpenSea can disclose user information to legal investigations or in response to legal process based on its own assessment, without requiring a final court order.
User information may be shared with third parties during corporate transactions even before any transaction is completed, including during the negotiation phase.
Personal information may be transferred to a broad range of commercial third parties, and the legal definitions of 'sold' and 'shared' under state privacy laws determine the full scope of this disclo…
Personal information may be shared with multiple categories of third parties that can then deploy their own tracking technologies, extending data collection beyond Oscar Health's direct control.
Control over and legal responsibility for personal data shifts from Oura to the Data Recipient at the moment of sharing, which affects which entity the user must look to for data rights and protectio…
User permission is the prerequisite for third-party integrations, meaning these integrations — which may involve data sharing with external platforms — cannot occur without the user's authorization.
User consent is established as the trigger that makes synced personal data accessible to the Data Recipient, meaning participation and consent are both required before any data transfer occurs.
Cross-context behavioral advertising — which involves tracking users across unrelated contexts to target ads — is expressly excluded as a permitted use of personal data.
The prohibition on selling or renting and the limitation of sharing to trusted partners for defined purposes constrains how Oura may distribute personal data.
The use of Standard Contractual Clauses is the named legal mechanism Palantir relies on to legitimise international personal data transfers from the EEA and UK, providing a defined level of contractu…
Personal Information collected after a specific date is shared for personalized shopping by default, without the user's affirmative consent, unless law mandates otherwise.
Characterizing disclosure as a potential 'sale' under applicable law triggers statutory rights — such as opt-out rights — that users may hold under privacy laws like the CCPA.
The disclosure extends to third-party platforms, meaning user data shared for advertising purposes reaches entities outside Peacock's direct control.
Personal information including directly identifying data may flow to a broad set of Related Businesses, expanding the universe of entities that hold user data beyond Peacock itself.
The data linkage and credit file search footprint can affect the user's credit record and the records of associated individuals, beyond the user alone.
Applicants for qualifying products or services have their personal information shared with third-party credit reference agencies as a condition of the application process.
This prohibition applies specifically to cross-context behavioral advertising, a defined category under certain U.S. privacy laws, and is limited to sensitive personal data rather than all personal d…
Data sharing for advertising measurement can expose user data to third-party ad-tech companies through technical channels that may not be visible to users.
Pinecone commits to a baseline standard for cross-border data transfers, either through jurisdictional approval or contractual safeguards, rather than transferring data without restriction.
Your personal information may be subject to weaker legal protections once transferred to another jurisdiction, reducing the rights you can exercise over that data.
Third-party advertisers—not just Pinecone—may track your behavior across multiple websites and apps, extending data collection beyond Pinecone's own services.
Your personal information may be disclosed to third parties in connection with a business deal that has not yet been completed, expanding the pool of entities that can access your data.
Pinecone retains broad discretion to disclose personal information to a wide range of recipients—including private parties—based on its own belief that protection of rights, safety, or property warra…
Use of Pinterest's products or services itself operates as authorization for cross-border data transfer and storage, meaning no separate affirmative consent step is required beyond use of the service.
Disclosure of identifiers to third parties who may combine them with their own datasets means Pinterest's data sharing can enable those third parties to build or enrich profiles of users beyond what …
The claim establishes a direct obligation on PlanetScale to maintain adequate protections whenever personal data crosses borders, grounding a legal commitment to international data protection standar…
The claim establishes an explicit prohibition on the sale of personal information, which is a legally significant commitment under privacy frameworks such as the CCPA.
The claim establishes that PlanetScale may share user data with third parties specifically to enable lookalike advertising on external platforms, extending the use of user data beyond PlanetScale's o…
The claim establishes that PlanetScale's advertising activity involves third-party platforms, meaning PlanetScale's ads may appear on external services operated by those third parties.
The claim establishes that disclosure to law enforcement, government bodies, and private parties is governed by PlanetScale's own good-faith belief of necessity or appropriateness, not a formal legal…
There is no stated limit on the category of information or files covered; anything submitted to a bot or app is transmitted to external AI model providers and developers.
Sensitive tax identification data is disclosed to a third-party tax service provider, meaning it leaves Poe's direct control.
Even in hashed form, email addresses shared with ad platform partners can be used for user identification and targeting across advertising ecosystems.
The contents of chats and uploaded media—not just metadata—may be disclosed to multiple external parties, including both model providers and third-party developers.
Interaction context is not siloed to a single model provider; it flows across multiple model providers within Poe, broadening the set of external parties that receive a user's conversational history.
Disclosure to law enforcement or government agencies is triggered by Public.com's own belief that it is necessary, without any stated requirement to notify the user, meaning users may not learn their…
Data collected on Public.com may be merged with data from other sites by third-party analytics providers, expanding the scope of data use beyond Public.com's own purposes.
Users' data rights and protections for information handled through financial-account linking and payment processing are determined by third-party privacy policies, not Public.com's Privacy Policy.
Public.com's data profile on users is not limited to what users directly provide; it is augmented through third-party commercial data sources, broadening the information Public.com holds.
Characterizing these marketing practices as a potential 'share' or 'sale' under California law may trigger specific consumer rights and opt-out entitlements for California residents.
Because Company Data is shared with third parties for eligibility determinations, Company's information is disclosed outside of Ramp to external partners as part of the standard Services process.
RapidAPI's reliance on 'legitimate interest' as the legal basis means personal data can be transferred in a broad range of business transactions without requiring user consent.
Users' payment data is governed not by RapidAPI's Privacy Policy but by the third-party payment processor's own privacy notices, which users must independently review.
Personal data stored or processed in other countries may be subject to foreign government access, potentially under legal frameworks with different protections than those of the user's home country.
Data stored or processed in countries with different legal frameworks may receive a lower level of legal protection than users expect under their home country's laws.
Redfin's acknowledgment that these practices may qualify as a CCPA 'sale' or 'sharing' is legally significant because it triggers opt-out rights for California residents under that law.
Information Redfin collects may be shared with third-party ad networks, extending the use of that data beyond Redfin's own platforms to other websites and social media.
A referral to a Partner Agent triggers automatic sharing of a user's information with that third party, without requiring a separate consent step at the time of sharing.
Even in hashed form, a user's email may be passed to LiveRamp and then onward to advertising companies, extending the reach of user data beyond Redfin and LiveRamp.
The commitment is scoped to the legal definitions of 'sell' and 'share' under U.S. state privacy laws, meaning other forms of data transfer not captured by those definitions are not addressed by this…
Personal information may be disclosed to third parties who are considering but have not yet completed an acquisition, with use limited exclusively to that evaluation purpose.
This permits Replicate to share personal information with legal authorities or in response to legal demands without user consent.
Personal information may transfer to a new entity outside Replicate's control, and that entity is permitted to use and disclose it, expanding the set of actors who can act on your data.
The prohibition on disclosure without explicit consent includes direct competitors, but is subject to exceptions for legal requirements and the Privacy Policy's own terms, which may authorize signifi…
Data may be transferred internationally, potentially to jurisdictions with different privacy protections than the user's home country.
Reverb can proactively disclose user information to law enforcement without a legal obligation to do so, based on its own good-faith judgment.
Member information can change hands to an entirely different entity without the member's consent, as a routine component of a business transaction.
The user is required to grant a federal agency the authority to verify and share sensitive personal identifying information with named third parties as a condition of the process.
The scope definition clarifies that privacy obligations and data handling practices apply across multiple Revolut subsidiaries and service categories operating in the U.S. market. This establishes th…
This establishes that Ring's personal data practices do not include monetization through direct sale of user personal information to outside parties.
This limits government-compelled disclosure to situations where both legal obligation and proper service are satisfied, establishing a dual condition before Ring will share user information.
Access to the video recording is gated solely by possession of the share link ID, meaning the creator has no further control over who views or downloads it once the link exists.
This practice means customer contact information is shared with third-party service providers and used in advertising targeting processes, even if in de-identified form.
Biometric data is among the most sensitive personal data categories and is subject to heightened legal protections in many jurisdictions; disclosure that vendors may collect it signals a material pri…
Sharing personal identifiers with marketing partners enables cross-platform tracking and targeting of users on sites and services outside Robinhood's own platform.
The involvement of third-party partners in tracking and ad delivery means user data and behavior may be shared with and acted upon by entities outside Robinhood, enabling cross-platform interest-base…
This restriction limits downstream use of shared data by third-party providers, specifically prohibiting resale of Personal Information, which constrains how broadly user data can be exploited outsid…
User data may flow to third-party advertising ecosystems beyond Roblox's own systems, expanding the number of external entities that receive personal information.
Users in jurisdictions with stronger data protection laws than the US or Canada may have their Personal Information transferred to a jurisdiction where those protections do not apply.
The clause permits disclosure of both anonymized data and individually identifiable Personal Information to third-party advertising partners, meaning personal data is not limited to anonymized form w…
Users' Personal Information can change hands to an entirely different corporate entity—potentially with different privacy practices—without the user's separate consent at the time of transfer.
Consenting to the Privacy Policy itself functions as a trigger for potential data sharing with third-party Social Networking Sites, meaning engagement behavior tied to identifying information may flo…
While a use-limitation obligation is imposed on third-party providers, the clause confirms that Personal Information does flow to external parties, and the enforceability of that obligation depends o…
In insolvency or acquisition scenarios, your personal information may be transferred to a new entity whose data practices may differ from RunPod's.
Disclosure is permitted even for prospective transactions that may never complete, meaning your personal information may be shared with potential acquirers or investors who retain access regardless o…
Sharing personal information with third-party advertisers for interest-based advertising means your data is disclosed to external parties whose data practices are governed by their own policies.
The commitment is qualified by the word 'try,' which means RunPod does not guarantee equivalent protection for personal information transferred outside Europe.
User information may be shared with third-party advertising and analytics partners, extending Runway's data disclosures beyond its own use.
Engaging with Salesforce-organized events or sponsored content may trigger disclosure of a reader's Personal Data to third-party sponsors outside Salesforce's direct control.
This clause removes Salesforce from the data-controller role entirely for badge-scan data, meaning Salesforce's Privacy Statement provides no protections for that data.
This clause establishes that Salesforce takes on a contractual obligation to vet the data-protection standards of international recipients before transferring Personal Data to them.
Personal Data may leave a reader's home jurisdiction, potentially subjecting it to different legal protections than those available locally.
Data masking at the prompt stage means sensitive personal or business information is de-identified before it reaches the underlying LLM, limiting exposure of that data to the model.
Characterizing the sharing as a potential 'sale' or 'targeted advertising' use under certain privacy laws triggers specific legal rights for consumers in those jurisdictions, such as the right to opt…
Personal information may move to jurisdictions with different data protection standards than the EEA, UK, or Switzerland, affecting the legal protections that apply to that data.
Scale AI makes an unqualified, forward-looking commitment against selling personal information, covering both present and future conduct.
User information may pass to a different entity outside Scale AI's control in a range of corporate transactions, including bankruptcy, without requiring user consent.
This commitment tracks a specific legal definition of "sell" under US Privacy Laws, meaning the scope of the protection is bounded by that definition rather than any broader ordinary meaning.
This limits third-party access to Personal Data to two conditions: user permission and legal compulsion, excluding other bases.
Merchants trigger broad data-sharing permissions automatically by enabling a third-party service, without any additional consent step at the time of sharing.
Cross-border data transfers mean your Personal Data may be governed by foreign laws that may offer different or lesser protections than your home jurisdiction.
Users consent to cross-border transfer of their encrypted information and metadata as a condition of using Signal's Services.
User consent is a prerequisite for partner data sharing or control, and the ability to revoke at any time gives users ongoing control rather than a one-time choice.
Membership in cross-site ad networks means user browsing behavior beyond SimpliSafe's own site may be used to target advertisements at them.
Browsing and shopping behavior, which can be highly revealing, may be shared with external parties based on SimpliSafe's own assessment of value rather than user direction.
User interest data is shared with or used by major third-party advertising platforms to enable targeted advertising directed at SimpliSafe users.
Personal Information can move to a new corporate owner in a business sale, with privacy policy protections persisting only to the extent applicable law does not override them.
Teachers on the platform receive identifiable and technical data about users' content interactions, extending personal data access beyond Skillshare to third-party instructors.
Enrollment constitutes affirmative consent to personal data sharing with individual Teachers, meaning a user's personal data leaves Skillshare's direct control upon each class enrollment.
The clause constitutes an explicit acknowledgment that user Identifiers are sold or shared under the California legal definition, triggering CCPA-related rights for California residents.
Personal information will transfer to third parties in corporate transactions; the only stated protection is a requirement that the receiving party agrees to respect it.
A corporate transaction could result in your personal Information being transferred to a new entity, and users have no opt-out right stated in this clause.
Slack makes an explicit commitment not to sell personal information under the CCPA definition, with a conditional assurance that any future sale would be preceded by an opt-out right.
Personal information may flow to third-party advertisers for ad targeting purposes on external platforms, extending data use beyond the Slack environment.
Consent to international data transfer is obtained at the moment of data provision, meaning users who provide personal data have already agreed to cross-border transfer and/or processing.
Processing personal data outside a user's home country may subject that data to different legal protections and privacy regimes than those applicable in the user's country of residence.
The clause permits disclosure of account data to law enforcement without specifying a legal process requirement, and the triggering condition — protecting safety — is broad and assessed by Snapchat.
Teen account data, including social connection information, is disclosed to a third party (the parent or guardian) when Family Center is active, meaning teen users have reduced informational privacy …
Authorizing a broad category of affiliates—rather than named third parties—for core service functions means customer data may be accessed by multiple related entities for operational purposes.
As the foundational infrastructure sub-processor, Microsoft Azure may process all customer data stored or handled on the Snowflake platform where the customer has selected Azure as their cloud provid…
As the foundational infrastructure sub-processor, Google Cloud Platform may process all customer data stored or handled on the Snowflake platform where the customer has selected GCP as their cloud pr…
As the foundational infrastructure sub-processor, AWS may process all customer data stored or handled on the Snowflake platform where the customer has selected AWS as their cloud provider.
The clause grants unlimited, uncompensated rights over user information to any third party, with no stated restrictions on purpose, scope, or recipient, eliminating any practical control the user mig…
The commitment covers both present practice and future conduct, prohibiting monetization of personal information through sale.
This prohibition directly addresses data monetization practices that are regulated under privacy laws such as the CCPA, providing users with a clear commitment against targeted advertising use of the…
Standard Contractual Clauses are a specific legal mechanism required to lawfully transfer personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, establishing the le…
Once an integration is enabled and personal data is shared with a third party, Sourcegraph Cody bears no responsibility for how that third party handles the data, shifting risk to the user.
Enabling the embeddings feature triggers the transfer of repository contents to a third party, which customers may not anticipate and which depends on an administrator's action rather than the end us…
Users' personal data shared by Spotify can be merged with partner-held data to build a richer profile, and both Spotify and its partners may use that enriched profile for marketing purposes.
User data flows into Spotify not only from users themselves but from external advertising partners, meaning Spotify's profile of a user is enriched by third-party sources the user may not be aware of.
Square has already sold or shared Usage Data for targeted advertising, meaning this is a disclosed past practice rather than a merely potential future use.
The use of standard contractual clauses is the named legal mechanism Square relies on for cross-border data transfers, and the protection afforded is qualified as something Square works to help ensur…
Sensitive identity information, potentially including biometrics, is disclosed to third parties such as credit reporting agencies and wireless carriers, expanding the circle of entities that hold thi…
Users pre-authorize law enforcement disclosure triggered solely by Square's reasonable suspicion, without requiring any additional user consent or legal process at the time of disclosure.
It establishes that personal account and usage data may be transferred to external social media platforms for advertising suppression purposes.
Users' personal data embedded in Inputs may reach third parties, which has implications for privacy and data control beyond Stability AI's own handling.
Because the clause covers 'each of the categories of information described above,' the scope of data shared with third-party advertisers and analytics providers is as broad as Starbucks's entire data…
Users' Subscription Data is shared with unspecified third parties, and users must permit this as a condition of use, with sharing limited to verification and account-charging purposes.
This grant extends authority not only to Stash but to Plaid, a third-party data aggregator, giving both parties direct access to a user's financial institution data through a user-granted authorizati…
Sharing user information with ad partners for behavioral targeting, retargeting, and ad optimization means personal data flows to external parties for commercial advertising purposes.
An opt-in requirement places the affirmative burden on Stash to obtain consent before sharing, rather than on the user to opt out after sharing has begun.
The obligation to protect customer information extends beyond State Farm itself to third parties acting on its behalf, and that obligation is enforced through contractual requirements.
Customer medical information receives a heightened sharing restriction within the State Farm corporate family, requiring affirmative authorization or a legal or contractual basis for any intra-family…
This restricts third parties acting on State Farm's behalf from exploiting customer information for their own commercial benefit through marketing, beyond the scope of their work for State Farm.
This establishes a categorical prohibition on the sale of customer information, which is a significant data protection commitment.
The claim establishes that cross-border transfers of personal data occur and that Steam assumes an obligation to apply additional protective measures when they do.
The claim establishes that user data is shared with third-party developers and publishers through a defined technical channel, and that ownership data is a baseline minimum of what is disclosed.
The claim establishes that credit card data passes through Valve before reaching the payment service provider, meaning Valve processes the data rather than directing it exclusively to the provider.
The claim establishes that Steam User Account data is publicly accessible to anyone with a Steam ID query, not limited to authenticated partners or specific parties.
The claim establishes an explicit statement that Personal Data is not sold, which is a distinct and material data practice representation.
Explicitly naming name, address, and email as data that may be sold to advertising partners and social media platforms makes the commercial use of personal data concrete and direct.
The explicit inclusion of data brokers and social media platforms as potential recipients of sold personal information significantly broadens the potential reach and use of user data.
Live location data is among the most sensitive personal information; this clause establishes that Strava both uses it and provides a mechanism by which it may be shared with other users.
Business User data and Representative Data are routed to an Indian cloud provider, and a separate regulatory obligation requires certain Indian payment transaction data to remain on servers in India.
Highly sensitive payment card data—including the full PAN and CVV—is shared with a third-party card printing vendor, representing significant data exposure risk for cardholders.
Business User data is shared with a third-party provider for merchant monitoring, a compliance-oriented purpose that involves ongoing scrutiny of Business User conduct.
End User Personal Data is actively shared with third-party partners for advertising purposes, including interest-based advertising, which involves behavioral tracking of users.
Business User data is shared with a third-party provider specifically for sanctions screening, a compliance-driven purpose that may affect whether a Business User can use Stripe's services.
Subscribing to a Creator's publication on Substack results in the Creator receiving the subscriber's name and email address, transferring personal data to a third party outside Substack's direct cont…
The clause establishes a permissive right for Substack to disclose identifiable account data to third-party organizations outside any individual legal process, for a defined child safety purpose.
This disclosure establishes that account identifiers are shared outside Substack with third-party organizations, even absent a legal order, for a defined child safety purpose.
Data transferred from the EEA or UK to the United States crosses jurisdictional boundaries, potentially affecting the level of data protection applicable to that data.
Biometric information — a sensitive category of personal data — may be disclosed beyond Suno itself to affiliated entities and third-party service providers.
This establishes a categorical prohibition on the sale of user information, which is consequential given that data sales are a common monetization practice.
Users' personal data may receive weaker legal protections after international transfer, potentially limiting their rights and remedies.
Even hashed email addresses can be used by advertising partners to identify and target users across platforms, extending Supabase's data sharing beyond its own systems.
User Content is protected from third-party marketing or advertising use by an absolute prohibition, subject only to the narrow exception of explicit user submission for that purpose.
All personal information Supabase has collected could be passed to a new owner in a business sale or asset transfer, outside the user's control.
The protection offered to users' personal information when shared with third parties is limited to 'reasonable' confidentiality terms, not an absolute prohibition on use.
The clause establishes a categorical prohibition on two specific forms of commercial transfer of personal information to third parties.
This clause restricts Synthesia's ability to disseminate Biometric Data to two named circumstances, limiting broader discretionary sharing.
Selling aggregate reports to third parties means information derived from user data generates commercial value for parties outside T-Mobile.
Sensitive personal data is withheld from cross-context behavioral advertising pipelines unless the user affirmatively consents, giving users control over this specific use.
The qualifier 'knowingly' limits the scope of the protection: T-Mobile's obligation applies only where it has actual knowledge that the individual is under 18.
The clause establishes that Tabnine does not engage in the sale of Personal Information, which is relevant to privacy rights under laws such as the California Consumer Privacy Act.
The clause establishes that legal demands can compel Tabnine to disclose user information, which means government or judicial processes may result in your data being released without your consent.
The clause provides a qualified commitment — limited to reasonable attempts and intentional disclosure — against unauthorized third-party sharing, with an express carve-out for disclosures permitted …
Personal Information is not confined to TaskRabbit's own systems; it may be passed to external third parties specifically for advertising, which extends the reach of data beyond the service context.
Personal Information may be disclosed to a broad range of governmental and authorized entities, either to satisfy legal requirements or simply upon their request, without specifying that a legal comp…
Acceptance of the Privacy Policy is framed as an acknowledgment of cross-border data transfer to the U.S., which carries different legal protections than Canada, and the acknowledgment is triggered b…
The clause defines a ceiling on what Student data Creators can access through Teachable, which determines the scope of personal information exposed to third-party Creators.
Initiating a chargeback or refund triggers a data-sharing consent the user may not anticipate, disclosing account status information to an external third party.
Using Telegram's translation feature may cause message content to be transmitted to third-party companies—Google or Microsoft—outside Telegram's infrastructure.
User identifying information—IP address and phone number—is subject to disclosure to authorities under a defined legal threshold, meaning users are not guaranteed anonymity in criminal investigations.
Data is transferred outside Telegram to third-party developers whose privacy practices Telegram does not control, creating a data-sharing relationship the user may not anticipate.
Characterizing the activity as a potential 'sale' under local privacy laws is significant because sale-based rights — such as the right to opt out — may be triggered for users in covered jurisdiction…
A routine interaction — a like or reply from a third-party user — triggers automatic data sharing with an external service, conditioned only on the user's profile being public.
Threads frames the data transfer to Third Party Services as a user-initiated direction rather than a Threads-initiated action, which may affect how responsibility for the transfer is allocated.
User content and personal information are transmitted to external services outside Threads whenever a Third Party User follows the account, without any additional action required from the user.
The scope of shared data extends beyond post content to potentially include network-identifying metadata like IP addresses, which can reveal a user's location or identity.
User personal information is transferred to third-party Event Partners for operational purposes, meaning data reaches parties outside Ticketmaster for each event attended.
SMS opt-in data and consent records are carved out from Ticketmaster's broader third-party sharing practices in the US and Canada, providing users a specific protection over their messaging consent d…
International data transfers subject user information to foreign legal regimes and data-protection standards that may differ from US protections, with compliance conditioned on evolving legal obligat…
The no-sale and no-behavioral-advertising-sharing commitment is conditioned on legal restriction, meaning the protection applies only where law mandates it rather than as an unconditional policy.
User data flows to third-party advertising partners either by Tinder actively providing it or by permitting direct collection, expanding the number of entities with access to user data.
A ban on one Match Group platform can have direct consequences on a user's ability to access Tinder, based on data shared across the Match Group ecosystem.
This clause establishes that user data can be disclosed to law enforcement and related parties without the user's consent under qualifying legal or crime-prevention circumstances.
This establishes a baseline protection condition that must be satisfied before any international or third-party transfer of Personal Data occurs.
Users are informed of the current no-sale status of their Personal Data under CCPA, along with conditional future obligations if that status changes.
This obligation means Twilio's sub-processors are contractually bound to meet data protection standards, extending the legal protection framework beyond Twilio itself to the third parties it engages.
An explicit no-sale commitment addresses a key consumer privacy concern and, depending on jurisdiction, carries legal weight under laws like the CCPA.
Transfer Impact Assessments are a recognized mechanism for evaluating the risks of sending personal data to jurisdictions with different legal protections; Twilio's completion of these assessments in…
This means Twilio Inc. can process customer personal data as a sub-processor even when it is not the direct contracting party, which affects the chain of data processing responsibility and applicable…
This identifies the Amazon corporate family as authorized recipients of user personal data and conditions that sharing on a minimum privacy standard for subsidiaries.
Once data is transferred to the exhibitor, Twitch's privacy protections no longer apply, exposing users to a separate and potentially less protective privacy regime.
This enables cross-company data pooling between Twitch and Amazon, significantly expanding the scope of entities and purposes for which a user's personal information may be used.
This is a stated policy commitment against selling user personal information, which is relevant to user expectations about commercial data monetization.
User data is actively shared with third-party ad and marketing publishers, meaning external parties receive information that identifies and categorises users based on inferred characteristics.
Users who register with a work email may not realise their account data is potentially visible to their employer through the Uber for Business relationship.
Consent to international data transfer is obtained through use of the Services rather than a separate affirmative act, meaning users may not realize they have consented to cross-border data flows.
User data may be transferred to a third party in Japan governed by Benesse's own data use policy, not solely Udemy's Privacy Policy.
User data may flow to Google for advertising depending on settings, meaning the extent of data sharing with Google is partly determined by the user's own cookie and browser configuration.
Users' wallet addresses are disclosed to third-party analytics providers for financial crime and harm prevention purposes, extending the reach of data sharing beyond Uniswap itself.
User data can be disclosed to third parties, including government or legal authorities, without the user's consent when legal processes or compliance require it.
Users are afforded the CCPA's protections against the sale of their personal information, as Uniswap expressly commits to not engaging in that defined practice.
Third-party tracking enabled by UnitedHealthcare can result in a user's browsing behavior being monitored beyond UnitedHealthcare's own platforms, supporting targeted advertising or other profiling b…
User Information may be transferred to a new or acquiring entity as part of a corporate transaction, meaning control over that data could pass to a different organization.
User Information is not fully shielded from disclosure and may be provided to government or legal authorities without the user's consent when a legal process demands it.
Incorporation by reference means the list of sub-processors is contractually part of the DPA, making Unity's use of those third parties a binding element of the data processing agreement.
The explicit extension of the no-sell-or-share commitment to known minors under 16 addresses heightened legal protections for children's data.
User information can be conveyed to an entirely different legal entity through corporate transactions, potentially changing who controls and processes that data.
Authorizing a third-party connection triggers a bilateral, direct transfer of personal information—not merely Venmo sharing data outward, but also receiving information from the third party about you.
Using Apple's Siri or iMessage features triggers an automatic authorization for Venmo to share identifiable account data—including social graph and transaction details—with Apple.
This establishes a blanket prohibition on both the sale and sharing of personal information, extending explicitly to sensitive categories of data.
This establishes a specific limit on third-party data sharing, protecting users from having their personal information used to target them with third-party promotions or marketing.
The claim establishes that de-identified data from Hobby and Pro plan users may flow to third-party AI business partners for those partners' own development purposes, subject to a user-controlled pre…
The claim establishes that third-party AI providers receive user information as part of delivering Vercel AI's core AI offerings.
This clause discloses that Verizon Value brand customer data flows to a named third-party partner and is used in financial decision-making processes, including credit applications, which can have dir…
This clause discloses that identifiable personal information—including email address and purchase history—may flow to external advertising and analytics companies, enabling cross-context tracking and…
This clause reveals that data shared by Verizon can be enriched by third parties and used for audience targeting, extending the reach and depth of profiling beyond what Verizon alone collects.
Third-party advertising networks operating on Walgreens' behalf may independently build behavioral profiles from cookie data, extending data collection beyond Walgreens itself.
Your personal information may be transferred to a new owner in an acquisition without requiring separate consent, subject only to legal permissibility.
By acknowledging that its disclosures may constitute a sale or sharing under California law, Walgreens is triggering the legal framework that grants California residents opt-out and other rights.
Account linking between VIZIO and Walmart triggers an automatic data transfer from VIZIO to Walmart, expanding the scope of data Walmart receives.
User information is not necessarily kept solely by Walmart but may be passed to third-party Marketplace Retailers or suppliers, expanding the number of parties who receive and may process that inform…
Third-party advertiser tracking technologies may collect your information across Walmart's environment and advertisers' own websites, broadening the scope of data collection beyond Walmart itself.
This establishes a stated prohibition on monetizing personal information through sale, rental, or lease to third parties, which is a material commitment regarding the commercial use of user data.
Although data is described as de-identified, users' behavioral and location-derived metadata flows automatically to other Google products, broadening the use of data beyond Waze itself.
User data can move to a new corporate owner in a major transaction, with the only stated protection being a contractual commitment by the new entity to honor this Privacy Policy.
Users who submit content for posting have no confidentiality expectation in that content; it may be disclosed publicly without further restriction.
The act of linking to a shared view itself constitutes authorization for Wealthfront to disclose personal financial information to another individual.
This clause establishes a default non-disclosure rule for personal information shared with non-affiliates, conditioned only on California law exceptions or user authorization.
This is an absolute commitment with no stated exceptions, carve-outs, or conditions, covering three distinct forms of commercial transfer of Personal Information.
The authorization covers any country Webull operates in, meaning personal information may be subject to the laws of jurisdictions with different or weaker privacy protections than the user's home cou…
The scope of permissible disclosure is defined by Webull's own determination of necessity, without an external standard limiting that judgment.
Sharing is conditioned on use restrictions and confidentiality obligations, but the conditions are imposed on third parties by Webull rather than being enforceable directly by users.
Highly sensitive payment credentials, including CVV codes, are shared with third-party payment services providers, meaning this data leaves Webull's direct control.
Personal information may change hands to a new entity in a business transaction, potentially without any further consent from the user and with no stated restriction on how the new entity may use it.
The clause permits information sharing across a broad and expanding corporate family, including for cross-context behavioral advertising, which can result in targeted advertising based on activity tr…
The clause explicitly defines cross-context behavioral advertising, making clear that affiliate sharing can enable tracking and targeting of users across multiple platforms over time.
The clause provides a direct commitment against selling personal data, which is significant given that data selling is a common commercial practice and a key concern under privacy laws such as the CC…
Your phone number and message content can be stored or redistributed by any party you communicate with, both within and outside the WhatsApp platform, without restriction described in this clause.
A corporate transaction involving WhatsApp—including a partial asset sale or bankruptcy—triggers mandatory sharing of user information with new controlling parties.
WhatsApp's disclosure of user information to law enforcement or government is triggered by WhatsApp's own good-faith belief of necessity, not solely by a formal legal order.
Personal information may pass to a different entity outside of Windsurf's control in a corporate transaction, potentially under different privacy practices.
Personal information is shared with external parties, meaning it leaves Windsurf's direct control as part of normal service operations.
Users who register with a corporate email address may have their account existence and information disclosed to their employer without additional consent at the time of sharing.
The breadth of recipients and the inclusion of a possible sale of Personal Information signals significant commercial data flows that users may not have anticipated.
The scope of potential disclosure is broad, covering all categories of collected personal information and a wide range of third-party recipient types.
This restriction limits service providers from independently exploiting personal information they receive, confining their use strictly to Workday's directions.
Characterizing the cookie-based data disclosure as a potential sale or share is significant because certain data protection laws grant individuals rights specifically tied to the sale or sharing of t…
Third-party advertising technologies can collect user data independently, and their use is governed by those third parties rather than Writer's privacy policy alone.
It establishes a two-part internal control: a necessity limitation tied to job functions and a mandatory security approval gate for all user data access.
Writer's Privacy Policy does not govern data collected by third-party services accessed through Writer's platform, meaning users must consult each third party's privacy policy to understand how their…
It establishes that data isolation is enforced at the team level even when teams share an organizational account.
Data collection by these third parties extends beyond Wyze's own Services to other websites and mobile apps, meaning user tracking may occur across a broader digital environment than Wyze's own platf…
The clause establishes that children's information is shared with the same broad set of third-party categories as adult user information, without a stated child-specific restriction.
The clause establishes that third-party marketing disclosure occurs by default for some information types, requiring affirmative opt-out rather than opt-in consent, depending on the category of data.
Personal information held in separate consumer and business accounts may be merged by Yelp, expanding the profile of data associated with a single user.
Personal identifiers and hashed contact data are shared with external parties for advertising purposes, extending the reach of user data beyond Yelp itself.
Individual user information is protected from external disclosure by a defined set of exceptions, meaning disclosure outside Google is not at YouTube Kids' general discretion but is limited to enumer…
External sharing of individual user information is conditioned on parental consent, making parental agreement the operative requirement for this category of data sharing.
Legal compulsion to disclose means users' Personal Information may be shared with government and law enforcement authorities regardless of user preferences or consent.
Zendesk reserves the right to disclose personal data to government and law enforcement without user action whenever it receives a qualifying lawful request, including for national security purposes.
The data shared goes beyond basic contact information to include behavioral data — search histories and derived insights — which can reveal detailed preferences and intentions about a major financial…
Consent is triggered by the act of using the tool, and the receiving third parties are explicitly outside Zillow's control, meaning Zillow bears no stated responsibility for how those parties handle …
The data shared includes inferences — derived conclusions about users — and is shared with a broad category of marketing partners, extending Zillow's data use well beyond its own platforms.
Personal data may be treated as a transferable asset and disclosed to unknown third parties even before a corporate transaction is completed, including during negotiation stages.
This establishes an explicit carve-out for sensitive information from Zillow's data monetization and advertising practices, providing a stronger protection than applies to non-sensitive personal data.
Opting in to the Resume Database enables a potentially broad set of external parties to access the user's identity and contact information.
Sharing is mandatory and automatic upon application, and data flows to systems outside ZipRecruiter's direct control, including third-party Applicant Tracking Systems.
Personal Data flows to external advertising entities, expanding the universe of parties who hold information about the user beyond ZipRecruiter itself.
ZipRecruiter's liability extends to how its agents process transferred data, meaning the user retains a point of accountability at ZipRecruiter even after data moves to a third party.
Disclosure to government authorities may occur without the user's knowledge or consent, driven by legal compulsion rather than ZipRecruiter's discretion.
Users in states with applicable privacy laws may have legal rights triggered by what Zoom characterizes as a potential 'sale' or 'sharing' of their data for targeted advertising.
Intra-group data transfers across all Zoom Group entities are governed by a formal agreement incorporating EU SCCs, a legally required mechanism for cross-border personal data transfers under EU data…
Customer Content—potentially including sensitive user data—may be shared with a third-party AI provider, Anthropic, contingent on whether AI features are enabled.
Customer Content may be shared with AWS for AI processing, contingent on AI features being enabled, exposing potentially sensitive content to a third-party cloud provider.
Live meeting and webinar traffic is processed by Oracle as a third-party cloud provider, meaning real-time content reaches an external party.
Users on accounts purchased through a reseller are exposed to potential personal data and content access by a third party—the reseller—in addition to the account owner.
Customer Content may be shared with Google Cloud for AI processing, contingent on AI features being enabled, exposing potentially sensitive content to a third-party provider.
Live meeting and webinar traffic is processed by Google Cloud Platform, which serves in a dual role, meaning real-time content reaches a major third-party provider.
By flowing down equivalent DPA obligations to subprocessors, Zoom extends its own data protection commitments through the subprocessing chain, rather than allowing a lower standard at the subprocesso…
Customer Content may be shared with OpenAI for processing, contingent on AI features being enabled, exposing potentially sensitive content to a third-party AI provider.
Substantive meeting content—including live traffic, recordings, and transcriptions—is processed by a major third-party cloud provider, AWS, raising significant data exposure considerations.
Personal data is shared across the eBay corporate family, but the clause imposes a minimum privacy standard on Affiliates that mirrors eBay's own practices.
The disclosure is specifically tied to EU payment services for sellers, meaning this sharing obligation is contextually scoped rather than universal across all eBay users.
Personal information is shared with third-party service providers, but those providers are contractually restricted in how they may use and process it.
Personal information does reach advertising partners, but AWS limits what is shared by substituting indirect identifiers for directly identifying details such as name.
User data is disclosed to affiliated companies for marketing, meaning users may be targeted by entities beyond Acorns itself.
The enumerated list of potential recipients includes advertising-ecosystem entities, meaning user information may flow into advertising networks and platforms beyond Adobe's direct control.
Contractual restrictions on third-party service providers limit the permitted use of shared Personal Data and impose a confidentiality and security obligation, providing a layer of protection beyond …
User data is transferred to a third-party sub-processor in Canada for support purposes, with Claude for Government users explicitly excluded from this arrangement.
User data passes through Cloudflare's infrastructure worldwide for all products, meaning data is processed in locations local to each customer.
The clause establishes that subscription-related information about a user is shared with third-party developers or publishers through a Subscriber ID mechanism, meaning user data flows beyond Apple t…
The clause establishes that PCC metadata cannot be used to identify you or connected to your broader Apple profile, limiting re-identification risk.
The clause limits data transmission to Private Cloud Compute to only what is relevant to the specific request, restricting the scope of data leaving the device.
Users in states with broad privacy-law definitions of 'sale' may have legal rights—such as opt-out rights—triggered by this disclosure, regardless of whether money is exchanged.
International data transfers are operationally necessary for the service to function across different regions, but create jurisdictional implications regarding data protection standards and regulator…
Data sharing with third-party service providers means your personal information, potentially including sensitive categories, reaches organizations beyond Bumble itself, and the adequacy of contractua…
Information may flow beyond Calendly to a broad range of third parties, including those whose primary purpose is advertising and marketing.
A user's enrollment in a mental-wellness service may be disclosed to their employer or a family member without further consent beyond what is captured at sign-up.
Even without advertising-based data sharing, your personal data can reach third parties through legal processes or a corporate transaction, which are scenarios outside your direct control.
The clause establishes the circumstances under which Craigslist is permitted to share user data with third parties, including law enforcement and government entities acting through formal legal proce…
Personal information flows to external business partners beyond Databricks itself, expanding the set of entities that may hold or use that data.
Personal information is disclosed to third-party event sponsors for their own marketing purposes, meaning those sponsors—not just Databricks—may contact you directly.
Customer data handled by Datadog International Limited may be subject to the legal frameworks of three separate jurisdictions.
Customer data handled by Datadog Ireland Limited may be subject to the distinct legal frameworks of three separate jurisdictions.
Personal information is not confined to Datadog but may be disclosed to multiple categories of third-party vendors across operational and advertising functions.
This restricts one specific channel of data sharing, protecting information collected via SMS from being used to market on behalf of outside parties.
User information may be transmitted to third-party advertising platforms, though Discord qualifies the scope of that sharing as limited.
Users' information may flow to multiple categories of external parties as a routine part of Hulu's service operations, without requiring individual user consent for those disclosures.
Personal information may flow to third-party sponsors and marketing partners outside of DocuSign's direct control, expanding who holds and may act on that data.
Dropbox's retained responsibility means users have a point of accountability with Dropbox itself, rather than having to pursue third-party processors directly, for mishandling of their information.
Using collaborative features triggers automatic disclosure of certain personal information to other users, which the individual may not fully anticipate.
User information moves beyond Fitbit to third parties, but those parties are contractually bound to process it only as Fitbit directs and in compliance with stated confidentiality and security measur…
Users' phone numbers are disclosed to third-party shipping and delivery partners, who may then initiate direct contact with users via SMS or other channels.
Users' data may be processed by Garmin entities in other countries, but the policy asserts consistent privacy policy coverage across all of them.
Personal data leaves Garmin's direct control and is accessible to third-party vendors, whose own data practices may differ from Garmin's.
Third-party companies, not just Grammarly, may be collecting data about users' website behavior through cookies, expanding who has access to user interaction data.
Cloudflare's role as a sub-processor means customer data may pass through Cloudflare's network as part of HubSpot's standard infrastructure and security operations.
Identifying AWS as HubSpot's hosting and infrastructure sub-processor across four countries clarifies where customer data may be stored or processed at the infrastructure level.
Anonymous data shared for ad targeting means user behaviour or attributes may influence advertisements shown to users, even without identifying them by name.
Users who access Khan Academy through a school context should expect their information to be visible to their school, not only to Khan Academy.
This clause confirms that Personal Data flows beyond Linear to external parties engaged for operational purposes, expanding the set of entities that handle a user's data.
This provision establishes that user data from all jurisdictions, including EU and UK users, is transferred to and processed in the United States and other countries. The legal mechanisms supporting …
A third-party publisher—not Microsoft—gains access to personal identifiers and account details, expanding the circle of entities holding user data beyond Microsoft itself.
The clause defines the legal bases OnlyFans relies upon for cross-border data transfers, which determines the level of protection your data receives outside its country of origin.
Customer data processed through AWS cloud infrastructure is handled in the United States, fixing the geographic jurisdiction for that processing.
This represents a direct commitment against two specific categories of data transaction as legally defined under California law, covering both current practice and a defined historical period.
Content creators' email addresses are disclosed to an external third party as part of the payment process, meaning that data leaves Poe's direct control.
Users retain a baseline of account-level anonymity from AI model providers and developers unless a specific condition changes that default.
Your usage and device data is transferred to service providers in specific foreign jurisdictions, each with potentially different data protection frameworks.
This recognition serves as the legal basis justifying data transfers to those countries without additional safeguards, affecting the level of protection your data receives when transferred internatio…
Your personal data flows to multiple third-party organisations including credit reference agencies, which can affect your credit profile at other institutions, and to counterparties in your transacti…
The breadth of sharing categories means your financial, identity, and behavioral data may flow to many organizations beyond Revolut itself, some of which you may not have a direct relationship with.
Personal Data flows beyond Salesforce to multiple categories of external vendors, expanding the number of parties who handle that data.
Personal information is not held solely by Scale AI but may be accessed by external parties engaged to support Scale AI's services.
Customer data used within the Data Clean Rooms Web App may be processed on AWS infrastructure.
Customer account data in GCP regions may be routed to AWS for the purpose of native app security scanning.
Customer data processed by the Cortex cross-region inference feature in GCP or Azure regions may be routed through AWS infrastructure.
Customer data processed by the Cortex cross-region inference feature in GCP or AWS regions may be routed through Microsoft Azure infrastructure.
Three distinct categories of data subjects—Business Users, End Customers, and Visitors—have their data shared with Google for a broad range of purposes, including site protection and behavioral measu…
This establishes that Stripe does not engage in the direct monetization of Personal Data through sale, which is a specific and limited commitment.
Your personal data may be disclosed to outside parties during a corporate transaction, potentially before any ownership change is finalized.
Joint Data Controller status means Tinder shares formal legal responsibility over user data with Meta Ireland when those specific tools are active, rather than Tinder bearing sole responsibility.
This exclusion means telecommunications providers are not subject to the sub-processor obligations and protections described elsewhere in the document, which limits the data protection framework appl…
Users' data is transmitted to major social media platforms as a direct consequence of Uber embedding those platforms' tools in its own products.
User information is not confined to Uniswap alone but may flow to third-party service providers and vendors involved in operating the Services.
The restriction is limited to numbers provided specifically for security purposes and to marketing or promotional use, leaving other potential sharing scenarios outside the scope of this commitment.
Messages you send to a business on WhatsApp may be accessible to third-party service providers chosen by that business, including potentially Meta, outside of WhatsApp's direct control.
Participating in a Workday-hosted webinar or event involving third-party collaborators may result in those third parties independently contacting you using the information Workday shares.
Data transferred internationally may be subject to privacy laws that differ from those in the user's home country, affecting the legal protections available to users.
Monitor emails you after the daily check that finds a change to these clauses on a platform you choose.
A data sharing clause is a provision in a platform's terms of service or privacy policy governing data sharing-related rights, obligations, or restrictions.
ConductAtlas tracks 281 platforms with data sharing clauses - roughly 82% of platforms in the archive.