Found in 288 of 352 platforms tracked (82% adoption) · 4430 provisions
The clause discloses that data analysis conducted by 23andMe may result in commercial arrangements involving third parties, which is a material data-sharing consideration.
This clause requires a written contractual guarantee of equivalent data protection before any Personal Data transfer, establishing a minimum standard that external and internal processors must meet.
The sharing of a broad range of identifiers, including government-issued identifiers, with ad networks for behavioral advertising raises significant privacy concerns about the scope of data disclosed…
This clause directly addresses one of the most consequential data practices — the commercial sale of personal information — and covers even the most sensitive category of personal data.
User data is shared with Facebook through these tools for ad targeting purposes, expanding the set of parties that receive user information beyond AI21 Labs itself.
This prohibition covers both the transfer of data to third parties for behavioral advertising and AI21 Labs' own use of data for targeted advertising, restricting two distinct forms of commercial dat…
AT&T retains authority to disclose user Content and transaction information not only when legally compelled but also based on its own reasonable judgment, which broadens the circumstances under which…
AWS's stated position is that customer personal information is not sold, which addresses a common data monetization concern.
Customers who rely on SCCs as their legal transfer mechanism should confirm both conditions are met; if either condition is absent, the SCCs do not apply and an alternative transfer mechanism may be …
Using the service constitutes an express grant of authority for Acorns to access financial institution data on the user's behalf and a separate agreement to Plaid handling that data, involving a name…
Ending a customer relationship with Acorns does not stop the sharing of a former customer's information, meaning data sharing obligations and practices persist beyond account closure or termination.
This clause establishes broad routine sharing of user data across multiple operational and legal contexts, meaning user data flows to third parties as a standard part of Acorns' business operations.
Contact Data—which may belong to the user's own contacts—can be disclosed to external parties, expanding the circle of entities with access to that data.
User information is shared across the Activision Blizzard corporate family for those entities' independent purposes, meaning your data can be used for marketing by companies you have not directly int…
This permits the creation of a more comprehensive user profile than either Activision or the advertising partner holds alone, potentially enabling more extensive tracking across unrelated services.
This requirement places a legal compliance burden on users: storing content that includes others' personal information without legal authorization to share it constitutes a violation of this obligati…
Users' personal information is not solely controlled by Adobe but may be disclosed to a third-party Business entity without requiring a separate consent action at the time of disclosure.
Users who register Adobe accounts with a business email address may have their account information disclosed to their employer without further individual consent, in the context of account migration.
Your personal data may be transferred to a different legal entity without your consent in the event of a business sale or integration, potentially subjecting it to new data practices.
The absolute restriction on other uses or disclosures of sensitive personal information means Adyen has limited its own discretion and cannot rely on other bases to process this category of data.
Data transfers outside the EEA may move personal data to jurisdictions with different or lower data protection standards than those applicable within the EEA.
Granting a power of attorney to Affirm and its third-party providers authorizes them to act legally on the user's behalf and handle the user's information, which is a significant legal authorization …
Acceptance of the Notice combined with use of the Services is treated as consent to third-party merchant marketing data disclosure, meaning continued use triggers this consent.
User information is shared with unrelated third-party companies for their own marketing, but an opt-out right exists, making it important for users to know they can act.
User information is disclosed to third parties outside Affirm for security and fraud-related purposes, expanding the circle of entities that access personal data.
The breadth of purposes for which Affirm shares information means user data flows to multiple parties across a wide range of activities without requiring additional consent.
Third-party data sharing determines who beyond Afterpay may receive and use your personal information, which affects your privacy exposure.
Personal data a user includes in an AI Product Input is not confined to Afterpay but may flow to external third-party service providers, expanding the universe of entities that handle the user's data.
The presence of this option indicates Airtable acknowledges user rights, likely under privacy regulations such as the CCPA, to opt out of the sale or sharing of personal information.
Although customer data can change hands in a corporate transaction, the receiving party is bound by prior privacy commitments, limiting the new owner's freedom to repurpose the data.
This means user data flows beyond Amazon's own advertising purposes to benefit third-party advertisers the user has no direct relationship with.
This is a direct statement against the commercial sale of personal data, which addresses a key privacy concern for users whose data is otherwise collected extensively.
Information is shared with ad companies for advertising purposes, but a stated limit prevents the sharing of directly identifying information such as users' names.
Personal information is shared with third parties as a direct consequence of transacting through Amazon Marketplace when a third party is involved, without requiring separate consent at the time of s…
American Airlines' reservation of this right means that opting out does not prevent data sharing for joint activity purposes, which explicitly encompasses administrative, transactional, and analytica…
American Airlines' disclosure of travel data to government agencies is framed as legally compelled across multiple jurisdictions, meaning such sharing occurs regardless of user preferences and extend…
Consent to international data transfer is established through the act of using Amplitude's services, meaning users may not be aware they are consenting to cross-border data transfers simply by intera…
Users' Personal Data may be transferred to a new entity as a result of a corporate transaction without requiring separate user consent, potentially subjecting it to different privacy practices.
Personal Information is disclosed to external parties for commercial advertising purposes, extending its reach beyond Ancestry.
A user's physical DNA sample—not just derived data—may be transferred to third-party companies outside Ancestry's direct control.
Opting in to DNA matching triggers mutual disclosure of Personal Information to other users, not just to Ancestry.
This provision permits disclosure of personal data to government and law enforcement actors without user consent, conditioned only on Anthropic's good-faith belief that it is reasonably necessary for…
Billing data for paying and developer-tier users is shared with a third-party sub-processor in the United States, while free-tier and government users are not covered by this arrangement.
Google Cloud Platform underpins cloud infrastructure for every Anthropic product globally, meaning all user data is processed within GCP infrastructure worldwide.
User data—including the content of interactions with Claude—may be transmitted to external third parties outside Anthropic's direct control, expanding the set of entities that receive and process tha…
Microsoft Azure underpins cloud infrastructure for every Anthropic product globally, meaning all user data is processed within Azure infrastructure worldwide.
The claim establishes that personal data leaves the EEA and UK, which are jurisdictions with heightened data protection standards, meaning users' data may be subject to different legal protections af…
User data including identity-related information is shared with a third-party sub-processor, but only for users of Claude Free, Pro, and Max, not other Anthropic products.
Claude for Government data is processed by a dedicated FedRAMP-designated cloud service, isolating this product's data-sharing arrangement from all other Anthropic products.
User data including identity-related information is transferred to a third-party sub-processor in the United Kingdom, but only for users of Claude Free, Pro, and Max.
AWS underpins cloud infrastructure for every Anthropic product globally, meaning all user data is processed within AWS infrastructure worldwide.
Cross-site behavioural tracking extends data collection beyond Anyscale's own site, building a broader profile of user activity to inform advertising.
Sharing site-usage data with third-party partners who can combine it with their own data about the user enables the creation of richer profiles than Anyscale's own data alone would allow.
Global transfer of personal information to countries with weaker or different data protection laws may reduce the legal protections available to you over your data.
Post-interaction tracking allows Anyscale and advertisers to link user actions to specific ad exposures, enabling both performance measurement and ongoing ad targeting.
Use of Facebook's real-time bidding infrastructure means visitor data may be shared with Facebook and third-party advertisers to facilitate ad auctions.
Sharing personal information with third-party advertising partners who deploy their own tracking tools means your data and behavior may be collected and used by entities outside Anyscale's direct con…
Sharing device and behavioural data with a third-party marketing platform and tracking visitors across devices and channels extends the reach of data collection beyond Anyscale's own systems.
The clause establishes that Apple App Store's practices fall outside the legal definitions of 'sale' and 'share' under Nevada and California privacy statutes, which carry specific consumer rights and…
The clause establishes that Apple App Store will not provide personal data to third parties whose purpose in receiving it is their own marketing, protecting users from a common form of data monetizat…
The clause establishes a specific restriction on data flows from Apple App Store's advertising platform to data brokers, a category of third party that commercially trades in personal data.
The clause grants Apple Pay broad discretion to share any user data with a wide range of recipients, including private third parties, with no liability attaching to Apple for such disclosure.
Incorporating these frameworks and SCCs into the DPA provides the legal mechanisms required for lawful cross-border personal data transfers under EU, UK, and Swiss law.
Cross-border transfers of personal information under Japanese law are conditioned on contractual safeguards, making the existence of those contracts the critical protection mechanism.
Users may not expect that their account content and usage history are visible to both an organizational administrator and colleagues sharing a domain, beyond just Atlassian itself.
Atlassian retains discretion to share your information with government and law enforcement based on its own belief that compliance requires it, without specifying that a court order or equivalent is …
Third-party services that users connect to their Atlassian account gain access not just to the integration but to personal account information, including at minimum name and email address.
Medical information—a sensitive category of personal data—is subject to sharing by Bank of America under specified operational and consent-based conditions.
Vermont residents receive a statutory baseline protection restricting information sharing to Bank of America's corporate family, with the only exception being where law affirmatively permits broader …
California consumers receive a statutory baseline protection prohibiting third-party sharing, with the only exception being where law affirmatively permits it.
The end of a customer relationship does not stop Bank of America from sharing the former customer's information under the terms of the notice.
Because no opt-out is available, consumers cannot prevent Bank of America from sharing their information with third-party service providers for marketing purposes.
Consumers holding credit card accounts have the right to limit third-party marketing by opting out of this specific category of nonaffiliate sharing.
Consumers have an actionable right to limit the flow of their creditworthiness data to Bank of America's affiliates, meaning this sharing is not automatic and unrestricted.
Customer opt-out choices are legally overridden in circumstances where Bank of America is required to disclose information, meaning consumer preference controls do not apply in those situations.
Because no opt-out is available, consumers cannot prevent Bank of America from sharing their information for these core operational purposes.
This restriction directly limits how Baseten may commercially exploit or otherwise process personal information, providing a contractual floor of data protection aligned with CCPA requirements.
This clause confirms that the sale of personal information is a permitted and potentially past practice at Baseten, spanning multiple broad categories of data.
International or out-of-state data transfers mean Personal Data may be subject to different legal protections than those in the user's own jurisdiction.
BeReal's phone number data associated with user accounts is used in an audience-matching process with external advertiser data, linking BeReal users to advertiser customer lists.
This establishes a limit on what advertiser-provided matching data and user phone data BeReal will return to advertisers, even after a matching process has occurred.
Purchase history, which is specific and sensitive behavioral data, may be shared with social-media companies, enabling those companies to target Best Buy advertising based on what you have bought.
Data shared for advertising purposes falls outside the protections of Best Buy's general sharing rule, creating a significant carve-out that can encompass browsing history, inferred preferences, and …
The clause is consequential because it acknowledges that Betterment's advertising technology practices may trigger legal protections afforded to consumers under State Privacy Laws governing the sale …
The clause is consequential because it constitutes an absolute, unqualified prohibition on two specific forms of commercial transfer of user information.
The clause is consequential because it confirms that personal information is disclosed to generative AI providers, while the only stated protection against training-data use is assurances received by…
User information—potentially including sensitive identity data—may be shared with external third parties, and the stated purposes include a basis for service denial based on risk assessment.
The public-by-design nature of the platform means a wide range of user activity is visible to others without any additional action by Bluesky or the user.
This clause means your personal information can move to or be handled by other entities in a wide range of corporate transactions, without requiring your separate consent.
The clause permits transfer of user information to a new owner in a business sale or partial sale, which could result in your information being held by a different entity without your direct consent.
The clause permits Boston Dynamics to share user information with law enforcement and regulators, conditioning that disclosure on legal and regulatory compliance obligations.
The clause establishes that personal information is not monetized through sale or shared for third-party marketing, which are two common data-sharing practices users may be concerned about.
The clause explicitly extends the prohibition on selling personal information to minors, and separately prohibits sharing with third parties for marketing, establishing two distinct protections.
Sharing Content may result in third parties gaining unrestricted use of that Content with no obligation to compensate or seek further permission from the user.
A third party not currently named in the Privacy Policy may receive personal information as a result of a corporate transaction outside the user's control.
Personal information may flow to Capital One N.A. and other Brex affiliates, extending the reach of data sharing beyond Brex itself.
The prohibition is contractual, meaning enforcement depends on Brex's oversight of its service providers rather than a direct legal relationship with the user.
This provision establishes the operational mechanism by which user demographic and location data flows to external advertising partners. The conditional consent requirement creates a documented autho…
The act of enabling a TPA integration automatically authorises Calendly to share Customer Data with that third party, without requiring a separate or explicit consent step.
User personal data can be transferred to a different corporate entity without a separate consent event, as part of standard business transactions.
The obligation to provide adequate safeguards is conditional on legal requirement, meaning protections for international transfers apply only where law mandates them rather than universally.
Users' personal data may be subject to weaker legal protections than those available in their home jurisdiction, depending on where Calm or its service providers operate.
User information may be disclosed to third parties — and potentially sold — even before a corporate transaction is completed, including during preliminary due diligence processes.
The default behavior of this setting exposes a design and associated user metadata to anyone with the link — including people with no Canva account — without requiring any authentication.
Personal data voluntarily included in AI inputs is not confined to Cash App but may flow to third-party technology partners, expanding the circle of entities that handle that data.
This clause is consequential because it establishes a future date on which Cash App may begin sharing user data with third-party advertising technology providers, expanding the scope of third-party d…
This is a direct representation that Cerebras does not engage in the sale or sharing of personal information, which is a significant protection under privacy laws such as the CCPA.
This clause obtains consent to cross-border data transfers, including to the United States, through the act of using the Services or providing information, rather than through a separate affirmative …
The report defines the precise scope of parental visibility — parents see time-on-platform and top Characters, establishing what is and is not disclosed to them on a recurring basis.
User data collected by Chase may be distributed to external parties for advertising, subject only to legal permissibility — not user consent as a stated condition.
User data is shared across Chase's broader corporate family of affiliated entities, expanding the number of parties that may access user information beyond Chase itself.
Transaction information, which may include purchase history or financial activity, is identified as data that Chegg may sell or share with multiple categories of third parties for targeted advertisin…
Characterizing Chegg's advertising practices as a potential sale or share under the CCPA and CPRA triggers California residents' statutory rights, including the right to opt out.
Contact information is identified as data that may be sold or shared with a broad set of third parties specifically for targeted advertising purposes.
Although customers have the right to limit this sharing, the default position is that data is shared with nonaffiliates for marketing unless a customer takes action to restrict it.
The end of the customer relationship does not stop data sharing; former customers' information remains subject to the sharing practices described in the notice.
North Dakota customers receive a default restriction on external data sharing that limits transfers outside the corporate family to legally permitted circumstances.
This restriction limits external sharing of financial information to legally permitted circumstances, providing California residents a stronger default protection than the general policy.
A corporate transaction could result in your personal information moving to a new owner, though that owner is contractually required to honor the Privacy Policy terms.
Personal data may move across borders to jurisdictions—including the United States—that may have different data protection standards than the user's country of residence, and third parties may be inv…
This is a strong categorical commitment covering project and task data, but it carries a carve-out for the Data Protection Addendum, meaning the full scope of protection depends on what that separate…
The act of enabling a third-party integration is itself the consent mechanism, meaning no separate consent prompt is required before Content is shared.
Disclosure outside the stated policy purposes is permitted only when Cloudflare first provides notice and a consent opportunity, preserving user awareness before broader sharing occurs.
This is an absolute commitment against two of the most commercially significant forms of personal data transfer.
Personal information shared with Cloudflare's Service Providers is contractually ring-fenced to Cloudflare-directed service purposes, preventing secondary commercial use by those providers.
This clause defines who inside or connected to Cohere can see the content of user interactions, establishing a meaningful restriction on internal access to sensitive user data.
Customer data may be used by third parties for purposes governed by those third parties' own terms, which are outside the customer's contractual relationship with Cohere.
Characterizing cookie use as a potential sale or sharing under California law is consequential because it triggers specific consumer rights and opt-out obligations under that law.
IP addresses and conversion data shared with named third-party advertisers enable targeted advertising profiling, meaning user activity data leaves Coinbase and reaches external commercial platforms.
Personal information may be transferred to a different entity without the user's affirmative consent in the event of corporate restructuring or insolvency, potentially placing data under different pr…
Third-party counterparty data is collected and shared with other service providers as a regulatory obligation, meaning information about parties to a transaction is not limited to Coinbase's internal…
This clause confirms that personal data flows to third-party advertising partners and that those partners may independently collect activity data through tracking tools deployed on Copy.ai's own Serv…
This clause permits personal data to change hands in a corporate transaction, with compliance by the receiving entity as the stated condition.
This clause provides a specific commitment against selling personal data or sharing it for cross-contextual behavioral advertising, scoped to the definitions established by applicable local law.
Enterprise learners' detailed learning activity may be visible to their employer or sponsoring organization, not just to Coursera.
Cursor's belief that disclosure is necessary is the operative threshold, meaning disclosure to governments or third parties may occur based on Cursor's own assessment of legal necessity.
Users whose accounts are linked to an employer or organization may have their account information disclosed to and actively managed by that organization's administrators, affecting privacy expectatio…
Personal data may be disclosed or transferred to new or third-party entities entirely outside the user's control as a result of corporate events, potentially changing who controls the data.
Model selection by the user acts as the triggering condition for potential sharing of prompts and telemetry with third-party model providers.
This establishes that data protection obligations extend beyond Cursor itself to its model providers, through both technical and contractual mechanisms.
Account creation date determines whether data-sharing with model providers applies, creating a materially different data treatment for pre- and post-cutoff accounts.
These restrictions address concerns about data exposure to Chinese legal jurisdiction, both through direct infrastructure presence and through subprocessor relationships.
Personal information is disclosed to advertising providers who build interest profiles from cross-service, longitudinal online activity data, extending data use well beyond the Databricks platform it…
Personal information may change hands to a third party not only upon completion of a business transaction but also during preliminary activities, before any deal is finalized.
Customer data is processed by multiple Datadog corporate affiliates across several countries with differing legal and regulatory frameworks.
Customer data may be processed for infrastructure purposes across five countries with differing legal frameworks, by a major third-party cloud provider.
Datadog's belief that disclosure is permitted—not only that it is required—is sufficient to trigger sharing, which broadens the circumstances under which user information may be disclosed.
Customer data is stored or processed within a third-party data warehouse operated by Snowflake, Inc. in the United States.
Personal data held by Datadog may be disclosed to government or law enforcement agencies under lawful compulsion, including for national security purposes, without the user's consent.
Customer data is not restricted to Datadog itself; it may be accessed by external third parties and internal corporate affiliates performing data-processing activities.
International transfers of personal information are constrained to legally recognized safeguard mechanisms, limiting Datadog's ability to move data to countries without adequate protections.
Employees using DeepL through a business email may have their individual usage activity disclosed to their employer for license-planning purposes.
Users who register with a business email may have that email disclosed to their employer or domain administrator without initiating the disclosure themselves.
A range of personal and transactional data is shared with a third-party fraud-detection provider, expanding the circle of entities that hold the user's information.
Selecting marketing cookies triggers international data transfers and sharing of hashed email addresses with named third parties, carrying data-protection implications beyond the EU's jurisdiction.
Users who interact with Delta Airlines by text message have a stated protection against their personal data being shared with third parties for marketing.
Users who take an Uber trip in this context cannot assume their trip details and location are kept private from third-party entities involved in the facilitation of that trip.
User information may be shared with third parties not only upon completion of a corporate transaction but also during the evaluation phase, before any deal is finalized.
Disclosure is conditioned on Discord's own belief that the law requires it, rather than a confirmed legal obligation, and expressly includes national security and law enforcement contexts.
Discord makes an explicit commitment that personal information is not sold to third parties, which directly addresses a common concern about data monetization.
Personal information may be disclosed to third parties across a broad range of circumstances, including some—such as a good-faith belief that law requires disclosure—that are determined unilaterally …
Even limited or pseudonymous data such as hashed email addresses may be disclosed to third parties, which can enable identification or targeting outside Disney+'s own platforms.
Affiliated companies may use your information not only to support Disney+ services but also for their own independent purposes, subject only to a prohibition under applicable law—significantly expand…
Once personal information is submitted to a public forum feature, Disney+ places no limitation on its subsequent use by itself or any third party, meaning the user loses practical control over that i…
Binding Corporate Rules are a formal cross-border data transfer mechanism under EU/UK data protection law; their adoption determines the legal basis on which EEA and UK personal data leaves those jur…
Data processed outside a user's home jurisdiction may be subject to different legal protections, and users in jurisdictions with strong data protection laws may have fewer legal remedies once their d…
Advertising delivered by third-party partners may be personalized using behavioral data from outside the DoorDash platform, meaning data from unrelated third-party services may influence what ads you…
Personal information may be processed in jurisdictions beyond those specifically named, as the list is non-exhaustive, potentially placing data in countries with fewer privacy protections than the us…
Users outside the United States may have fewer legal protections over their data once it is transferred, and consent is deemed given simply by using the services.
Acceptance of the privacy notice and use of services operates as an authorization for entities holding sensitive user data — including financial institutions — to transmit that data to DraftKings.
Personal information is shared with third-party service providers across a range of core operational functions, meaning multiple external parties may access user data.
Viewers of shared content may not realize that their identifying information is disclosed to the person who shared the content, not just collected by Dropbox, when analytics features are enabled.
A corporate transaction could result in user data being transferred to a new entity over which users have no prior relationship or negotiated terms, potentially changing how their data is handled.
An explicit prohibition on sale distinguishes Dropbox's data practices from services that monetize user data through sale, providing users a defined boundary on how their information may be commercia…
Users' account information and content may be accessed, retained, or shared with third parties by Dun & Bradstreet based on either a legal requirement or its own good faith judgment that it is reason…
Users' personal or proprietary information may be transmitted to other countries, which may have different legal protections, and users have consented to this as a condition of use.
EU-U.S. Data Privacy Framework certification is a recognized legal mechanism for transferring personal data from the EU to the U.S. in compliance with EU data protection requirements.
Individual usage data (not just anonymized data) may be shared with a third-party Code Provider, which means personally identifiable usage information could leave Duolingo's direct control.
The clause permits Duolingo to share personal information with multiple named third-party marketing platforms for personalized advertising purposes.
The clause discloses that user-submitted content during AI-enabled interactions is not confined to Duolingo but may be transmitted to named third-party AI vendors.
This establishes that the act of using EA services through a third-party platform is treated as affirmative consent to data transfer, without requiring a separate explicit consent step.
Personal information collected by Egnyte may be transferred to a different entity without the user's consent in the event of a corporate transaction or reorganization.
Visitor data may be shared with third parties to enable targeted advertising directed at those visitors or other users beyond the Website itself.
Users located outside the United States—including those in jurisdictions with stronger data protection laws—have their personal data transferred to and stored in the US, where different legal protect…
Users located outside the United States have their personal data transferred internationally, which may affect the legal protections that apply to that data.
The clause establishes a stated limiting condition on data sharing, but 'legitimate purposes' is not defined in the excerpt, leaving the scope of permissible sharing open to Equifax's interpretation.
RISKIFIED's ability to aggregate personal information from other e-commerce platforms means a purchase on Eufy's site may result in cross-platform profiling of the user's transaction history.
This sharing covers highly sensitive identifiers—including safe words and emergency contacts—with named third-party monitoring companies, which are external entities outside Eufy's direct control.
Personal Data flows not just to Eufy but to third-party advertising networks, which then independently collect additional data through cookies, expanding the number of parties holding user informatio…
Transfer to countries with different legal frameworks—including China—means users' Personal Data may be subject to legal regimes that provide fewer protections than those in their home country.
Users have an explicit commitment from Eventbrite that their Personal Data will not be sold to outside parties, including entities whose business model depends on targeted advertising.
Information submitted by users in connection with an Organizer event is not solely held by Eventbrite but is shared with the Organizer, who has independent authority to use it.
Users' contact information is shared with external parties, enabling those parties to identify individual users or build audience profiles based on user attributes.
Even in hashed form, email addresses and unique identifiers disclosed to third parties can be used for cross-platform identification and ad targeting.
Personal information is explicitly categorized as a transferable business asset, meaning it may change hands without users initiating or consenting to the transfer.
The breadth of the disclosure — covering 'various types' of information and an undefined set of third parties — means users' data may be shared widely to enable advertising targeting across digital c…
FanDuel's authority to contact a user's employer about eligibility violations carries significant real-world consequences, as it could affect a user's professional standing based on FanDuel's interna…
The range of potential recipients — spanning regulatory, sports, collegiate, and governmental bodies — means users' personal data and device identifiers may be shared with a wide array of institution…
The clause grants FanDuel authority over the full spectrum of information-handling actions — access, use, preservation, transfer, and disclosure — and the trigger is FanDuel's own good faith opinion,…
FanDuel's acknowledgment that its third-party disclosures may qualify as a 'sale' under applicable law is legally significant because sale-of-data classifications trigger specific consumer rights and…
Personal data may be transferred to a new entity in a corporate transaction, and that entity may operate under different privacy practices, affecting how the data is subsequently handled.
A commitment not to sell personal data is a material privacy protection, distinguishing Fastly's practice from data-monetization models and carrying legal significance under statutes such as the CCPA.
Cross-border data transfers subject personal information to the laws and protections of other jurisdictions, which may differ from those of the user's home country.
This clause establishes a legal floor for cross-border data transfers, tying Fastly's conduct to whatever mechanisms applicable law mandates rather than leaving the method to Fastly's discretion.
This prohibition gives the Subscriber a contractual commitment that its data will not be monetized or shared with third parties by Fastly.
Third parties, not just Figma, are collecting user activity and device data through technologies Figma has permitted, expanding the scope of data collection beyond Figma itself.
Third parties, not just Figma, are permitted to collect detailed behavioral and device data from users through Figma's platform.
All personal data handled by Figma, regardless of where the user is located, is subject to United States data storage and processing practices.
All personal information, regardless of where users are located, is subject to U.S. jurisdiction and data law by virtue of being processed and stored there.
Users whose accounts are organizationally managed or paid for by a third party have their information accessible to that third party upon request, limiting personal privacy from the account sponsor.
Users on Figma for Education Enterprise accounts are subject to domain capture data sharing without needing to take any affirmative action to enable it.
Default enablement of domain capture means it is active without any affirmative choice by the account administrator, automatically affecting users with matching email domains.
Users whose accounts have domain capture enabled will have their name, email, and profile picture automatically visible to all organization members sharing their email domain.
All collected Personal Data could move to a new controlling entity, potentially one with different privacy practices, without users having the ability to prevent the transfer.
Users' Personal Data is not monetized through targeted advertising sales or sharing, and this commitment covers the preceding 12-month period.
All categories of Personal Data that Figure AI holds are subject to potential disclosure to government entities, including law enforcement, when legal requirements apply.
Your information reaches third-party business partners who may use it independently for commercial ends, including direct marketing, beyond Fireworks AI's own use.
The restriction is scoped to the CCPA's specific definitions of 'sell' and 'share,' meaning activities outside those definitions are not addressed by this clause.
Third-party advertising partners are involved in delivering content to users not only within Fireworks AI's Services but also on external websites and across multiple devices, extending the reach of …
Personal data crossing international borders may be subject to different legal protections than those of the user's home jurisdiction, affecting privacy rights and remedies.
A categorical prohibition on the sale of personal information is a meaningful data-protection commitment that distinguishes Fitbit's stated practice from business models that monetize user data throu…
User profile information is shared bilaterally between Fitbit and Google, meaning data flows in both directions between two distinct corporate entities.
This clause identifies circumstances under which Fitbit may disclose user information to third parties—including governments—without the user's consent, covering a broad range of legal and law-enforc…
A change of corporate ownership is a legally recognised trigger for data transfer to a new entity; the confidentiality preservation requirement is the only stated constraint on that transfer.
This is an explicit prohibition on commercial monetisation of user data through third-party transactions, covering a broad range of transfer mechanisms.
The act of providing personal information is treated as consent to cross-jurisdictional transfer to countries where legal protections for that data may be weaker than in the user's home jurisdiction.
Personal information may flow to third-party advertising networks either through GOAT's active sharing or by GOAT permitting direct collection on its own sites, enabling targeted advertising against …
Precise movement data from a navigation device is sensitive; the consent requirement means this sharing should not occur without the user's affirmative agreement.
An explicit no-sale commitment means users can rely on Garmin not monetising their personal data through sale, which is a key consumer protection concern.
Personal data sharing in this context is mandatory and not subject to user consent, meaning users cannot prevent it when a legal requirement applies.
The prohibition limits secondary use of users' Personal Information by third-party service providers, confining it to the scope of their engagement with Gemini.
Personal Information may be transferred to unknown third parties as part of corporate transactions, including events that are merely proposed and not yet completed.
Sharing driving and location data with an insurance entity is gated on affirmative consumer consent, meaning this disclosure cannot occur without an active, affirmative step by the consumer.
Identifiers, digital activity data, and vehicle identification numbers may flow to advertising networks and financial institutions through General Motors' business and marketing arrangements, enablin…
General Motors has set a baseline procedural requirement — a warrant or court order — for most government disclosures of personal information, which limits routine or informal government access.
Personal Data may be transferred to new owners or parties in the event of a corporate transaction, subject to legal and policy constraints.
This carve-out limits the reach of the license by preventing user data from flowing to external AI providers for their independent training pipelines, which would be outside GitHub's control.
Users added to an organization's account may have their Personal Data shared with that organization without initiating the sharing themselves.
Third-party partners—not just GitHub—may track users' cross-service activity over time and use it for targeted advertising.
Personal Data may flow to Microsoft and other GitHub affiliates for purposes as broad as marketing and advertising, not only operational necessities.
Profile data users provide to Glassdoor is automatically shared with and updated across Indeed's services, without a per-instance user action.
Consent to data processing and sharing is obtained through the act of using the services rather than through an affirmative opt-in, meaning continued use constitutes binding agreement.
The non-sale commitment is scoped to the legal definition of 'sell' under applicable privacy laws, meaning the practical scope depends on how those laws define the term.
The commitment not to sell or CCPA-share personal information defines the outer boundary of certain data transfers, which is a material protection for users, particularly California residents.
This clause restricts Google from using GTM data across its other products unless the user has consented, providing a meaningful data-sharing boundary.
The non-sharing commitment is conditioned on consent, meaning Customer Data is protected from third-party disclosure only where the applicable consent has not been given.
Advertisers do not receive directly identifying user information by default, limiting the ability of advertisers to individually identify users from data provided by YouTube Ads.
The clause establishes an absolute prohibition on Google Ads selling or sharing Customer Personal Data, directly addressing CCPA-relevant data commercialisation concerns.
The clause imposes both a disclosure obligation and a compliance obligation on Google Ads for cross-border transfers subject to European Data Protection Legislation, ensuring transfers are not made w…
The permission to share is conditioned on necessity for transaction processing, but it encompasses merchants, payment processors, and a broad category of other third parties, meaning personal informa…
The clause authorises cross-border data processing across a broad range of countries, which may include jurisdictions with varying levels of data protection, constrained only by the Additional Terms.
This is a direct prohibition on one category of commercial data transfer, providing users with a clear assurance about a specific use of their data.
Service Data may flow to third parties outside Google's control whenever a third-party service or application is procured or used through the specified Google platforms.
It establishes that human beings — not just automated systems — can read a portion of users' chats, and that this access extends to third-party service providers.
It establishes that activating agentic features triggers data sharing with external parties, expanding the circle of entities who receive user data beyond Google itself.
It establishes that task completion through Gemini's agentic features requires sharing potentially sensitive personal data with external parties beyond Google's direct control.
Users' Payment Method details may be transmitted to third parties outside of a Seller context, expanding the set of parties who receive that financial information.
Third-party AI providers processing Grammarly user content are contractually barred from using that content for their own model training, limiting downstream data use.
Despite sharing some cookie and interaction data with advertising partners, Grammarly explicitly excludes user content from what those partners can access, which limits the scope of third-party data …
Disclosure of sensitive categories is blocked by default; only affirmative express consent—a higher standard than implied or passive consent—unlocks it.
The no-sale commitment is qualified by two carve-outs—policy-described disclosures and point-of-collection disclosures—meaning the scope of protection depends on what those documents say.
Greenhouse contractually extends data protection obligations to every subprocessor it uses, creating a chain of data protection agreements covering personal data processed downstream.
This authorizes active outbound sharing of user data with third-party employers, beyond merely facilitating user-initiated applications.
Sharing personal information with advertising and marketing partners means data about users can flow to third parties whose primary purpose is commercial targeting.
Processing personal data outside the EEA, UK, and Switzerland means it may be subject to different legal protections than those that apply in those regions.
Advertising IDs and IP addresses can be used to identify and track individuals across services; their processing enables targeted advertising and cross-context tracking.
The non-sale commitment is limited to a specific category of third parties — those providing online analytics or targeted advertising services to Groq — and does not address other third parties.
User personal data is actively shared externally for two distinct commercial purposes: targeted advertising and amplification of Groq's own marketing.
User information may be transferred to third parties in a wide range of corporate events, including ones that are only proposed and not yet completed, and including bankruptcy proceedings.
Users whose personal information is transferred internationally in restricted circumstances have a commitment from Groq that adequate protective measures will be applied.
User data may be transferred to an entirely different company—including during preliminary negotiations—and could be treated as a transferable asset in bankruptcy or receivership.
Grubhub's commercial information about users—such as purchase history—may be distributed to third-party advertising ecosystems for behavioral targeting purposes.
User data may be handed over to government authorities or in legal proceedings without the user's individual consent, as a condition of legal compliance.
Non-US users' data is subject to US law once transferred, and consent to that transfer is obtained through the act of using or accessing the platform rather than through a separate explicit consent s…
Personal identifiers such as name, address, phone number, and email address may be distributed to third-party advertising networks for behavioral targeting purposes.
This clause provides an explicit prohibition on a specific category of data sharing, limiting how mobile information can be used by external parties for commercial outreach.
This clause confirms that commercial information is shared with advertising partners in a manner Gusto classifies as a sale or sharing, which has legal significance under privacy laws such as CCPA.
Enabling an AI-powered integration triggers potential disclosure of personal information to external third parties, expanding the circle of entities with access to user data.
Harvey AI reserves the right to disclose user information to law enforcement or others proactively—without being legally required to do so—based on its own good-faith belief of reasonable necessity.
Harvey AI's commitment is limited to prohibiting exchanges of Personal Data for payment; it does not prohibit all sharing of Personal Data with third parties.
A user's employer may receive detailed information about the user's individual account activity and usage logs, which could be used for monitoring or performance purposes.
An employer or other entity sponsoring a user's benefit may receive identifiable personal information about that user's account activity.
User data flows to external advertising and analytics companies, expanding the number of parties who can access and process that data beyond Headspace itself.
The carve-out means the baseline protection against sharing activity data with a Benefit Sponsor can be lifted in healthcare-related contexts, broadening potential disclosure.
This clause discloses an active practice of sharing or enabling collection of personal information for targeted advertising, directly affecting user privacy with respect to third-party ad partners.
This clause discloses that Heap has actually engaged in the sale or sharing of specific categories of personal information within the past year, which directly informs users of the scope of data mone…
Characterizing the sharing as a potential sale under California law is consequential because it may trigger California Consumer Privacy Act rights, including the right to opt out.
The protection is contingent on an intra-group agreement that may—but does not always—apply, meaning coverage is not guaranteed for every transfer within the Hilton Group.
Employees who use corporate booking codes or corporate credit cards may have their detailed stay information shared with their employer and credit card company without a separate, individual consent …
Mexico-based Hilton customers' loyalty and contact information may be shared with a third-party telemarketer, meaning they may receive unsolicited marketing contact as a result.
Sensitive personal data including health and sex life information may flow to advertising partners unless it meets the threshold of Protected Information, leaving a potentially broad category of sens…
The explicit notice that sensitive personal data may be sold—even under a statutory definition of 'sell'—signals that sensitive data may be transferred to third parties for consideration, triggering …
User data flows across all Match Group platforms for safety enforcement purposes, meaning activity or data on Hinge can result in consequences—including bans—on other Match Group services.
User data is not confined to Hinge alone; it may flow to affiliated companies specifically under the justification of safety and security.
This clause authorizes Hinge to disclose personal data to authorities or others across three distinct grounds, some of which—crime prevention and personal safety—involve discretionary judgments by Hi…
User data flows to third-party advertising partners either through active sharing by Hinge or by granting those partners direct technical access to collect data from Hinge's own services.
This commitment prevents a consumer's SMS opt-in status from being sold or transferred to third-party marketers, limiting a specific vector for unsolicited commercial messaging.
Consent to infrastructure sub-processor access to Customer Data is bundled into DPA agreement rather than requiring a separate, explicit opt-in at the time of sub-processor engagement.
Consent to affiliate sub-processor access to Customer Data is obtained through DPA agreement rather than a separate, explicit opt-in at the time of sub-processor engagement.
HubSpot's disclosure of Personal Data is not limited to legal compulsion; it extends to situations where HubSpot holds a reasonable belief that disclosure is necessary, covering a broader set of circ…
Information in HubSpot's commercial dataset is actively distributed to third-party customers as part of an enrichment feature, not merely retained internally.
Users' behavioral data on HubSpot websites is made available to third-party advertising networks, meaning third parties are actively collecting data during website visits.
Personal Data in HubSpot's commercial dataset is not held exclusively by HubSpot; it may be passed to third-party customers for their own use.
This right permits disclosure of user information without consent whenever Hugging Face determines a security or fraud purpose is at stake, with no third-party oversight mechanism stated.
Personal information may be transferred to entities the user has no relationship with if Hugging Face is acquired or restructured, expanding the pool of parties holding that data.
The prohibition contains an internal exception, meaning the Policy's own terms may authorize conduct that would otherwise constitute selling, renting, or leasing personal information.
Hulu may proactively disclose user details to third-party system administrators and law enforcement without limiting this to legally compelled disclosures, covering security incidents and law violati…
Users' personal information may be disclosed to government and law enforcement bodies without the user's consent when Ideogram determines legal compliance requires it.
The commitment is explicitly scoped to the CCPA definitions of 'sell' and 'share,' meaning the assurance applies within those specific legal definitions rather than any broader colloquial sense.
The default setting makes user profile and resume data broadly available to third parties upon account creation, without requiring any affirmative action by the user to share it.
Linking accounts grants potentially unlimited access to all account information, including any candidate data held in the Employer's account, with no stated restriction on scope.
Treating personal information as a transferable asset in insolvency means users' data could pass to unknown third parties beyond the scope of the original privacy relationship with Instacart.
Disclosure to marketing and advertising partners, including social media platforms, enables third-party use of a user's personal data for commercial purposes outside Instacart's direct control.
The prior written consent requirement establishes a higher protection standard for Personal Health Information than for other personal data, but the Services-necessity exception creates a carve-out t…
User actions short of an explicit consent prompt—such as interacting with or linking to a platform partner—are framed as consent to personal data sharing, which may not be apparent to users.
Sensitive financial and personal details of UK residents may be disclosed to multiple named third-party companies, including lenders and financial services providers, which can affect credit and fina…
Users outside the United States are explicitly required to acknowledge that their data will be handled in the US, a jurisdiction that may offer different data protection standards than their home cou…
User information may be transferred to another entity as part of a merger or acquisition involving Khan Academy.
Users' personal information is not transferred to third parties in exchange for payment or other consideration by Khan Academy.
Kick's use of third-party advertising networks means your activity on Kick's Services may be used to deliver advertising beyond Kick's own platform, including on other websites and devices.
Sharing an account identifier with advertising partners enables cross-device tracking of users, extending the reach of targeted advertising beyond a single device or session.
Users' personal information and content held within Third-Party Services may flow to Amazon, expanding Amazon's visibility beyond direct Kindle usage data.
Data sharing with third parties is conditional on the service used, meaning the scope of sharing varies by product and users may not know in advance which services trigger sharing.
Your personal information may be transferred to a different legal entity as a result of corporate activity, potentially changing who controls and processes your data.
Processing in the United States means your personal information is subject to U.S. law rather than the privacy protections of your home jurisdiction.
Disclosure is triggered by LangChain's own good-faith belief rather than a confirmed legal requirement, meaning personal information may be shared with a broad range of recipients at LangChain's judg…
Sharing identifiable information such as email addresses and location data with third-party advertising partners extends the reach of your data beyond Leonardo AI to external commercial entities.
User information may be disclosed to a wide range of governmental and regulatory bodies, meaning data shared with Lime could reach law enforcement or regulators without additional user consent.
Lime may proactively share user data with government agencies not only when legally compelled but also for activities that merely 'may' violate its own policies or terms, a lower threshold than confi…
Users of Lime for Business should expect that their employer will receive detailed ride data, meaning their travel activity is not private from their employer.
Joint controllership means both Lime and Meta Ireland share legal responsibility for the data processing involved in advertising via the Meta pixel, which affects users' rights and remedies under dat…
This clause means the entirety of a user's Personal Data could move to a new controlling entity in a business transaction, potentially subject to different privacy practices.
This clause establishes that Personal Data is subject to U.S. jurisdiction and potentially the laws of other countries, regardless of where the user is located or where the data originated.
This clause authorizes disclosure of any Personal Data — without category limitation — to third parties whenever the activity relates to legal compliance or enforcement, which can be a broad basis fo…
This clause establishes that payment card data is collected by a third-party partner rather than Linear directly, meaning Stripe's separate privacy practices govern that data rather than Linear's Pri…
Profile data can be exported by LinkedIn's paying customers for commercial purposes by default, with opt-out as the only user mechanism to prevent this.
Public content posted on LinkedIn may be shared with and used by Microsoft and other affiliates to build or operate their own services, extending the reach of that content beyond LinkedIn.
Employer visibility into LinkedIn usage is explicitly authorized, but two specific categories—job searches and personal messages—are carved out from that visibility.
LlamaIndex's business partners are permitted to use the reader's personal data independently for their own purposes, meaning the reader's data may be used for ends beyond LlamaIndex's own services.
Advertising and personalized content delivery extends beyond LlamaIndex's own services to other websites and devices, meaning the reader may be targeted based on LlamaIndex-related data in third-part…
Loom's belief that disclosure is reasonably necessary—rather than a formal legal order—is the stated threshold, giving Loom discretion to disclose user data to authorities proactively.
Account access granted to third-party services extends beyond Loom's direct control, and users may not be fully aware that installation decisions by their administrator or other users can expose thei…
The act of providing information itself is defined as consent to international data transfer, storage, and processing, which has direct implications for users in jurisdictions with strict data transf…
Users' personal information may pass to a different legal entity in a corporate transaction, potentially changing who controls and processes that data.
Lyft expressly disclaims two specific forms of monetizing personal data: direct monetary sale and operating as a data broker.
User information is not confined to Mailchimp's own systems or purposes; it flows to the broader Intuit corporate group and is used to benefit products and services beyond the ones the user signed up…
Continued use of the services is treated as affirmative consent to international data transfers, meaning no separate or explicit consent action is required from the user.
Personal information gathered from website interactions may be passed to third-party advertising and analytics ecosystems, enabling targeted advertising across platforms beyond Marqeta's own services.
Users' personal data may be subject to lower legal protections once transferred internationally, and Marqeta has disclosed this risk explicitly.
Users' entered information is disclosed to a third party whose privacy practices may differ from McDonald's, and that third party's policy may govern how the data is handled.
The scope of sharing is broad — covering all or substantially all personal information categories — and extends to an entire named group of affiliated entities.
This obligation binds users to a prohibition whose precise scope is determined by applicable laws, meaning the restriction may vary by jurisdiction.
Even actions such as sending private notes — which users may consider non-public — cause certain account information to be exposed to other parties.
Users' personal data may be subject to the legal frameworks of foreign jurisdictions that offer fewer protections, potentially affecting their privacy rights.
This is a direct statement that Medium does not engage in the sale of personal data, which is a key concern under privacy laws such as the CCPA.
Personal information is shared with third parties beyond Medium itself, expanding the number of entities that hold and can act on users' data.
Medium may disclose personal data based on its own belief that a policy or legal violation has occurred, without requiring a confirmed or adjudicated violation.
The clause establishes a specific prohibition on Mercury monetizing or distributing mobile contact data and SMS consent for marketing, limiting a common commercial data-sharing practice.
The clause signals that users' Personal Information may be legally treated as sold or shared under certain U.S. privacy laws through the use of advertising technologies, triggering potential opt-out …
The clause establishes a specific limit on Mercury's data monetization practices, though the same excerpt acknowledges that other practices may still qualify as a 'sale' or 'sharing' under certain U.…
Personal Information may be transferred to third parties in corporate transactions, including to parties who are only potential — not confirmed — acquirers.
The clause identifies the specific legal mechanisms Mercury uses to legitimize cross-border transfers of Personal Information from the EEA and UK, which are subject to heightened regulatory requireme…
This clause establishes Meta's default non-disclosure obligation for Business Tool Data, with sharing permitted only on advertiser authorization or legal compulsion.
The requirement that the Service Provider agree in writing before use means developers bear responsibility for obtaining written commitments from third parties before engaging them, and failure to do…
The dual restriction — requiring both compliance with the Terms and satisfaction of enumerated circumstances — means any sharing of Platform Data outside those boundaries is prohibited.
Restricting Meta advertising data sharing to agents of the advertiser limits onward disclosure and prevents third-party monetization of that data.
Enabling MEV Protection triggers a specific data-sharing authorization, meaning users' transaction data is disclosed to external third parties as a direct consequence of activating the feature.
This is an explicit commitment against the commercial sale of Personal Information, which is a key data rights protection for users.
The 'good faith belief' standard means Microsoft may disclose personal data without a court order or legal compulsion, as long as Microsoft itself judges the disclosure necessary—placing the threshol…
This establishes a legally compelled disclosure pathway that operates independently of user consent, meaning personal data can be shared with public authorities without user permission when legally r…
This clause establishes that Midjourney's confidentiality of user data is not absolute—legal compulsion by public authorities can override it.
Enabling a third-party integration can trigger Miro sharing Customer Content and Services Data with that third party, governed by Miro's agreement with the third party rather than solely by Miro's Pr…
Employees using Miro through an employer's account have limited privacy from that employer, who can monitor activity logs and alter profile information.
Miro's use of tracking-based advertising means user behavior data may be shared with or processed by third-party advertising and analytics services for targeted advertising purposes.
Using Miro's AI features may result in a user's data being shared with a third party, Microsoft, for purposes that include compliance monitoring.
A prior and general authorization means Customer does not need to approve each Subprocessor individually, giving Mistral AI broad latitude to engage third parties to process Personal Data.
User information may be shared with third-party advertising partners and used to target users—or profiles similar to them—with interest-based advertising outside of Mixpanel's own platform.
The obligation on third parties limits their permitted use of personal information to their assigned tasks, restricting secondary use or disclosure.
Users' Personal Information is shared with third parties, with the stated purpose being task performance on Modal's behalf.
The restriction on use and sharing is bounded entirely by what is described elsewhere in the Privacy Policy, making the scope of the commitment dependent on the full contents of that document.
The prohibition covers every mode of transfer or communication of Customer Personal Data, leaving no gap through which Modal could lawfully pass data to third parties without prior written consent.
This clause discloses that MyFitnessPal may share identifiable user data with external marketing and advertising entities, which can enable targeted advertising beyond MyFitnessPal's own platform.
This clause discloses that users' personal information may be subject to legal regimes outside their home country, which may afford different or lesser privacy protections.
The clause establishes that personal contact information is disclosed to external parties who may then independently communicate with users, extending the reach of user data beyond NVIDIA NIM.
The clause establishes that two specific personal identifiers—email address and phone number—are disclosed to a named third party (Google) for advertising measurement purposes.
The clause signals that NVIDIA NIM's data-sharing practices with advertisers may trigger legal rights and protections—such as opt-out rights—available to users under applicable privacy laws.
The clause establishes that consent to marketing communications or recommendations triggers disclosure of hashed personal data to external advertising providers for interest-based targeting.
This disclosure enables third-party advertising providers to build behavioral profiles from cross-service activity, extending the privacy impact of Neon's data sharing beyond Neon's own platforms.
User information can change hands to another company before a transaction is finalized, meaning data may be shared with third parties during due diligence or negotiation stages.
Even in a transformed form such as hashed emails, personal information may be shared with third-party advertising partners, conditional on applicable law permitting it.
Nextdoor's standard for disclosing content and personal data to law enforcement and private parties is its own good-faith belief of reasonable necessity, not a formal judicial determination, and disc…
Content shared on Nextdoor is not inherently private; it may be indexed by search engines and accessed by governments and agencies as well as the general public, potentially exposing personal informa…
Using third-party login is conditioned on the user's authorization for that third party to transfer personal information to Nextdoor, meaning the login method itself constitutes a data-sharing consen…
This establishes a present and forward-looking commitment by Nintendo against the sale of user information, providing users with a firm assurance on this specific data practice.
This establishes that Nintendo authorises third-party collection of user data for cross-site and cross-device behavioural tracking, extending data exposure beyond Nintendo's own systems.
Data collection by third parties through Noom's own platforms means personal data flows to entities outside Noom's direct control, and those entities may aggregate it across other sites.
Noom acknowledges that certain data disclosures may trigger state-law protections — including opt-out rights — that apply specifically to sales and sharing of personal information.
Noom commits to sharing user information with law enforcement and government agencies based on its own belief that doing so is legally necessary, without specifying a requirement for a court order or…
Noom expressly acknowledges the potential sale of sensitive personal data and the existence of a user opt-out right, placing the burden on users to exercise that right.
Users who belong to an organizational account may have their profile information and Workspace details disclosed to their organization without a separate consent step.
User information can change hands to a third party — including in bankruptcy proceedings — without users initiating or necessarily being able to prevent the transfer.
If Okta's sharing is a CCPA 'sale,' individuals have a right to opt out, making this acknowledgment significant for understanding available privacy rights.
Attending an Okta event may result in broad disclosure of Personal Data to third-party sponsors for commercial purposes, beyond what attendees may expect.
Processing in countries without adequacy decisions means Personal Data may not receive the same level of legal protection as in the individual's home jurisdiction.
Third-party tracking across multiple channels and over time enables broad profiling of user behavior beyond any single interaction with Okta.
This establishes two explicit prohibitions on monetising personal data in ways that are regulated under certain privacy laws, affecting users' data rights and protections.
Customer Content that triggers policy flags may be disclosed to third-party sub-processors, expanding the set of entities that access that content beyond OpenAI itself.
The terms authorize OpenAI to use input content for model training by default, which means conversation data including any personal or sensitive information in prompts may be used for AI development …
Personal Data and behavioral interaction data can be shared with a broad range of third parties, including government authorities, under this clause.
This establishes the legal mechanism OpenAI Ireland Limited uses to legitimize international transfers of EEA and Swiss Data, which is a core requirement under European data protection law.
Personal Data is transferred to and stored in the United States and other jurisdictions, which may carry different legal protections than the user's home country.
Customer data processed through Microsoft's cloud infrastructure may be handled in any of 22 countries, each with different data protection regimes, significantly broadening the geographic scope of d…
The act of using or enabling the App triggers an automatic data transmission authorization, and the receiving Application's terms—not OpenAI's—govern that data once transmitted.
A general authorization means Customer has pre-approved the listed Sub-Processors collectively rather than approving each one individually, limiting Customer's control over which third parties handle…
Customer data is sent to Snowflake for warehousing unless the customer has Zero Data Retention, making ZDR status the operative factor in whether Snowflake processes a customer's data.
Customer data is routed to Cinder Technologies for moderation, but Zero Data Retention customers are carved out, meaning their data does not pass through this sub-processor.
Customer data across all OpenAI services is accessible to TaskUs in the Philippines for support purposes, and content and GPT moderation data for specific services is also processed there.
Customer data is transferred to a third-party sub-processor across three countries for moderation purposes, expanding the geographic and organizational footprint of data handling.
Personal Data may be shared with external parties in corporate or financial proceedings, which are circumstances outside a user's control.
Data submitted through OpenRouter may be used by third-party Model Providers to train or improve AI models, a use that extends beyond delivering the immediate service to the user.
User information is treated as a transferable business asset in insolvency proceedings, meaning it may pass to a new owner without users' control or consent.
This commitment conditions cross-border data transfers on the existence of a legally valid transfer mechanism, providing a compliance baseline for EEA, UK, and Swiss residents.
User information may be shared with third parties during corporate transactions even before any transaction is completed, including during the negotiation phase.
The good faith belief standard means OpenSea can disclose user information to legal investigations or in response to legal process based on its own assessment, without requiring a final court order.
Personal information may be transferred to a broad range of commercial third parties, and the legal definitions of 'sold' and 'shared' under state privacy laws determine the full scope of this disclo…
Personal information may be shared with multiple categories of third parties that can then deploy their own tracking technologies, extending data collection beyond Oscar Health's direct control.
User permission is the prerequisite for third-party integrations, meaning these integrations — which may involve data sharing with external platforms — cannot occur without the user's authorization.
Control over and legal responsibility for personal data shifts from Oura to the Data Recipient at the moment of sharing, which affects which entity the user must look to for data rights and protectio…
User consent is established as the trigger that makes synced personal data accessible to the Data Recipient, meaning participation and consent are both required before any data transfer occurs.
The prohibition on selling or renting and the limitation of sharing to trusted partners for defined purposes constrains how Oura may distribute personal data.
Cross-context behavioral advertising — which involves tracking users across unrelated contexts to target ads — is expressly excluded as a permitted use of personal data.
The use of Standard Contractual Clauses is the named legal mechanism Palantir relies on to legitimise international personal data transfers from the EEA and UK, providing a defined level of contractu…
Personal Information collected after a specific date is shared for personalized shopping by default, without the user's affirmative consent, unless law mandates otherwise.
Personal information including directly identifying data may flow to a broad set of Related Businesses, expanding the universe of entities that hold user data beyond Peacock itself.
Characterizing disclosure as a potential 'sale' under applicable law triggers statutory rights — such as opt-out rights — that users may hold under privacy laws like the CCPA.
The disclosure extends to third-party platforms, meaning user data shared for advertising purposes reaches entities outside Peacock's direct control.
Applicants for qualifying products or services have their personal information shared with third-party credit reference agencies as a condition of the application process.
The data linkage and credit file search footprint can affect the user's credit record and the records of associated individuals, beyond the user alone.
Data sharing for advertising measurement can expose user data to third-party ad-tech companies through technical channels that may not be visible to users.
This prohibition applies specifically to cross-context behavioral advertising, a defined category under certain U.S. privacy laws, and is limited to sensitive personal data rather than all personal d…
Third-party data collection across websites over time enables the construction of detailed behavioral profiles, extending the privacy impact well beyond Perplexity AI's own platform.
Health information shared with third-party AI models goes beyond Perplexity AI's own systems, creating additional exposure for some of the most sensitive personal data.
Your personal information may be disclosed to third parties in connection with a business deal that has not yet been completed, expanding the pool of entities that can access your data.
Pinecone retains broad discretion to disclose personal information to a wide range of recipients—including private parties—based on its own belief that protection of rights, safety, or property warra…
Pinecone commits to a baseline standard for cross-border data transfers, either through jurisdictional approval or contractual safeguards, rather than transferring data without restriction.
Your personal information may be subject to weaker legal protections once transferred to another jurisdiction, reducing the rights you can exercise over that data.
Third-party advertisers—not just Pinecone—may track your behavior across multiple websites and apps, extending data collection beyond Pinecone's own services.
Disclosure of identifiers to third parties who may combine them with their own datasets means Pinterest's data sharing can enable those third parties to build or enrich profiles of users beyond what …
Use of Pinterest's products or services itself operates as authorization for cross-border data transfer and storage, meaning no separate affirmative consent step is required beyond use of the service.
The claim establishes that disclosure to law enforcement, government bodies, and private parties is governed by PlanetScale's own good-faith belief of necessity or appropriateness, not a formal legal…
The claim establishes a direct obligation on PlanetScale to maintain adequate protections whenever personal data crosses borders, grounding a legal commitment to international data protection standar…
The claim establishes that PlanetScale may share user data with third parties specifically to enable lookalike advertising on external platforms, extending the use of user data beyond PlanetScale's o…
The claim establishes an explicit prohibition on the sale of personal information, which is a legally significant commitment under privacy frameworks such as the CCPA.
The claim establishes that PlanetScale's advertising activity involves third-party platforms, meaning PlanetScale's ads may appear on external services operated by those third parties.
The contents of chats and uploaded media—not just metadata—may be disclosed to multiple external parties, including both model providers and third-party developers.
There is no stated limit on the category of information or files covered; anything submitted to a bot or app is transmitted to external AI model providers and developers.
Interaction context is not siloed to a single model provider; it flows across multiple model providers within Poe, broadening the set of external parties that receive a user's conversational history.
Even in hashed form, email addresses shared with ad platform partners can be used for user identification and targeting across advertising ecosystems.
Sensitive tax identification data is disclosed to a third-party tax service provider, meaning it leaves Poe's direct control.
Users' data rights and protections for information handled through financial-account linking and payment processing are determined by third-party privacy policies, not Public.com's Privacy Policy.
Public.com's data profile on users is not limited to what users directly provide; it is augmented through third-party commercial data sources, broadening the information Public.com holds.
Disclosure to law enforcement or government agencies is triggered by Public.com's own belief that it is necessary, without any stated requirement to notify the user, meaning users may not learn their…
Data collected on Public.com may be merged with data from other sites by third-party analytics providers, expanding the scope of data use beyond Public.com's own purposes.
Because Company Data is shared with third parties for eligibility determinations, Company's information is disclosed outside of Ramp to external partners as part of the standard Services process.
Characterizing these marketing practices as a potential 'share' or 'sale' under California law may trigger specific consumer rights and opt-out entitlements for California residents.
Personal data stored or processed in other countries may be subject to foreign government access, potentially under legal frameworks with different protections than those of the user's home country.
Data stored or processed in countries with different legal frameworks may receive a lower level of legal protection than users expect under their home country's laws.
Users' payment data is governed not by RapidAPI's Privacy Policy but by the third-party payment processor's own privacy notices, which users must independently review.
RapidAPI's reliance on 'legitimate interest' as the legal basis means personal data can be transferred in a broad range of business transactions without requiring user consent.
Information Redfin collects may be shared with third-party ad networks, extending the use of that data beyond Redfin's own platforms to other websites and social media.
Redfin's acknowledgment that these practices may qualify as a CCPA 'sale' or 'sharing' is legally significant because it triggers opt-out rights for California residents under that law.
A referral to a Partner Agent triggers automatic sharing of a user's information with that third party, without requiring a separate consent step at the time of sharing.
Even in hashed form, a user's email may be passed to LiveRamp and then onward to advertising companies, extending the reach of user data beyond Redfin and LiveRamp.
This permits Replicate to share personal information with legal authorities or in response to legal demands without user consent.
The commitment is scoped to the legal definitions of 'sell' and 'share' under U.S. state privacy laws, meaning other forms of data transfer not captured by those definitions are not addressed by this…
Personal information may be disclosed to third parties who are considering but have not yet completed an acquisition, with use limited exclusively to that evaluation purpose.
Personal information may transfer to a new entity outside Replicate's control, and that entity is permitted to use and disclose it, expanding the set of actors who can act on your data.
Replit frames continued use of its Services as consent to international data transfer, which has significant implications for users in jurisdictions with strict data-protection regimes.
Profile information is permanently and publicly exposed to other users and search engines, with no opt-out indicated, making this a significant and ongoing disclosure of personal information.
Payment card data is transferred to and processed by a third party rather than Replit directly, meaning a separate entity's data practices govern that information.
Reverb can proactively disclose user information to law enforcement without a legal obligation to do so, based on its own good-faith judgment.
Member information can change hands to an entirely different entity without the member's consent, as a routine component of a business transaction.
The prohibition on disclosure without explicit consent includes direct competitors, but is subject to exceptions for legal requirements and the Privacy Policy's own terms, which may authorize signifi…
Data may be transferred internationally, potentially to jurisdictions with different privacy protections than the user's home country.
The scope definition clarifies that privacy obligations and data handling practices apply across multiple Revolut subsidiaries and service categories operating in the U.S. market. This establishes th…
The user is required to grant a federal agency the authority to verify and share sensitive personal identifying information with named third parties as a condition of the process.
This permits Ring to disclose user information to law enforcement without a legal demand or prior notice to the user, provided the imminent-danger condition is met.
These restrictions define the internal boundaries on employee access to sensitive video content, distinguishing between stored videos (policy-restricted) and live streams (access-prohibited).
This establishes that Ring's personal data practices do not include monetization through direct sale of user personal information to outside parties.
This limits government-compelled disclosure to situations where both legal obligation and proper service are satisfied, establishing a dual condition before Ring will share user information.
Access to the video recording is gated solely by possession of the share link ID, meaning the creator has no further control over who views or downloads it once the link exists.
This practice means customer contact information is shared with third-party service providers and used in advertising targeting processes, even if in de-identified form.
The provision defines the operational scope of data practices within the margin account relationship, establishing what customer information the firm may process and with whom it may be disclosed. Th…
Biometric data is among the most sensitive personal data categories and is subject to heightened legal protections in many jurisdictions; disclosure that vendors may collect it signals a material pri…
The involvement of third-party partners in tracking and ad delivery means user data and behavior may be shared with and acted upon by entities outside Robinhood, enabling cross-platform interest-base…
Sharing personal identifiers with marketing partners enables cross-platform tracking and targeting of users on sites and services outside Robinhood's own platform.
This restriction limits downstream use of shared data by third-party providers, specifically prohibiting resale of Personal Information, which constrains how broadly user data can be exploited outsid…
The restriction limits how third-party agents can use shared data, including an explicit prohibition on selling Personal Information, which constrains downstream data use.
User information may flow to external advertising companies beyond Roblox itself, enabling ad targeting and measurement by parties outside the platform.
User data may flow to third-party advertising ecosystems beyond Roblox's own systems, expanding the number of external entities that receive personal information.
While a use-limitation obligation is imposed on third-party providers, the clause confirms that Personal Information does flow to external parties, and the enforceability of that obligation depends o…
Users in jurisdictions with stronger data protection laws than the US or Canada may have their Personal Information transferred to a jurisdiction where those protections do not apply.
Users' Personal Information can change hands to an entirely different corporate entity—potentially with different privacy practices—without the user's separate consent at the time of transfer.
Consenting to the Privacy Policy itself functions as a trigger for potential data sharing with third-party Social Networking Sites, meaning engagement behavior tied to identifying information may flo…
The clause permits disclosure of both anonymized data and individually identifiable Personal Information to third-party advertising partners, meaning personal data is not limited to anonymized form w…
In insolvency or acquisition scenarios, your personal information may be transferred to a new entity whose data practices may differ from RunPod's.
Disclosure is permitted even for prospective transactions that may never complete, meaning your personal information may be shared with potential acquirers or investors who retain access regardless o…
The commitment is qualified by the word 'try,' which means RunPod does not guarantee equivalent protection for personal information transferred outside Europe.
Sharing personal information with third-party advertisers for interest-based advertising means your data is disclosed to external parties whose data practices are governed by their own policies.
User information may be shared with third-party advertising and analytics partners, extending Runway's data disclosures beyond its own use.
This clause removes Salesforce from the data-controller role entirely for badge-scan data, meaning Salesforce's Privacy Statement provides no protections for that data.
Engaging with Salesforce-organized events or sponsored content may trigger disclosure of a reader's Personal Data to third-party sponsors outside Salesforce's direct control.
This clause establishes that Salesforce takes on a contractual obligation to vet the data-protection standards of international recipients before transferring Personal Data to them.
Personal Data may leave a reader's home jurisdiction, potentially subjecting it to different legal protections than those available locally.
Data masking at the prompt stage means sensitive personal or business information is de-identified before it reaches the underlying LLM, limiting exposure of that data to the model.
Characterizing the sharing as a potential 'sale' or 'targeted advertising' use under certain privacy laws triggers specific legal rights for consumers in those jurisdictions, such as the right to opt…
Scale AI makes an unqualified, forward-looking commitment against selling personal information, covering both present and future conduct.
User information may pass to a different entity outside Scale AI's control in a range of corporate transactions, including bankruptcy, without requiring user consent.
Personal information may move to jurisdictions with different data protection standards than the EEA, UK, or Switzerland, affecting the legal protections that apply to that data.
The written contract requirement—with the qualifier 'strict accordance'—means sub-processors cannot operate outside documented, binding terms, creating an enforceable framework for sub-processing con…
Transfer Impact Assessments are a legal mechanism for evaluating risks of cross-border data transfers; Segment's completion of these assessments for relevant sub-processor engagements indicates a ste…
An explicit commitment not to sell personal data is a meaningful restriction on how Segment may monetize user information.
Sub-processors are contractually required to meet data protection standards set by applicable law, not merely Segment's internal standards, meaning legal compliance obligations flow down through the …
This determines Twilio Inc.'s legal role—sub-processor rather than data controller or primary processor—when a different Twilio entity is the contracting party, which affects how data protection obli…
Cross-border data transfers, particularly to countries outside U.S. jurisdiction, may subject user data to different legal protections than those applicable in the United States.
Personal information, including financial account details like Wallet balances, may transfer to entirely new corporate entities — including prospective buyers who may not complete a transaction — wit…
This commitment tracks a specific legal definition of "sell" under US Privacy Laws, meaning the scope of the protection is bounded by that definition rather than any broader ordinary meaning.
This limits third-party access to Personal Data to two conditions: user permission and legal compulsion, excluding other bases.
Merchants trigger broad data-sharing permissions automatically by enabling a third-party service, without any additional consent step at the time of sharing.
Cross-border data transfers mean your Personal Data may be governed by foreign laws that may offer different or lesser protections than your home jurisdiction.
Users consent to cross-border transfer of their encrypted information and metadata as a condition of using Signal's Services.
User interest data is shared with or used by major third-party advertising platforms to enable targeted advertising directed at SimpliSafe users.
Membership in cross-site ad networks means user browsing behavior beyond SimpliSafe's own site may be used to target advertisements at them.
Browsing and shopping behavior, which can be highly revealing, may be shared with external parties based on SimpliSafe's own assessment of value rather than user direction.
User consent is a prerequisite for partner data sharing or control, and the ability to revoke at any time gives users ongoing control rather than a one-time choice.
Personal Information can move to a new corporate owner in a business sale, with privacy policy protections persisting only to the extent applicable law does not override them.
Personal information will transfer to third parties in corporate transactions; the only stated protection is a requirement that the receiving party agrees to respect it.
Teachers on the platform receive identifiable and technical data about users' content interactions, extending personal data access beyond Skillshare to third-party instructors.
Enrollment constitutes affirmative consent to personal data sharing with individual Teachers, meaning a user's personal data leaves Skillshare's direct control upon each class enrollment.
The clause constitutes an explicit acknowledgment that user Identifiers are sold or shared under the California legal definition, triggering CCPA-related rights for California residents.
A corporate transaction could result in your personal Information being transferred to a new entity, and users have no opt-out right stated in this clause.
Personal information may flow to third-party advertisers for ad targeting purposes on external platforms, extending data use beyond the Slack environment.
Slack makes an explicit commitment not to sell personal information under the CCPA definition, with a conditional assurance that any future sale would be preceded by an opt-out right.
Consent to international data transfer is obtained at the moment of data provision, meaning users who provide personal data have already agreed to cross-border transfer and/or processing.
Processing personal data outside a user's home country may subject that data to different legal protections and privacy regimes than those applicable in the user's country of residence.
Teen account data, including social connection information, is disclosed to a third party (the parent or guardian) when Family Center is active, meaning teen users have reduced informational privacy …
The clause permits disclosure of account data to law enforcement without specifying a legal process requirement, and the triggering condition — protecting safety — is broad and assessed by Snapchat.
As the foundational infrastructure sub-processor, Google Cloud Platform may process all customer data stored or handled on the Snowflake platform where the customer has selected GCP as their cloud pr…
As the foundational infrastructure sub-processor, Microsoft Azure may process all customer data stored or handled on the Snowflake platform where the customer has selected Azure as their cloud provid…
As the foundational infrastructure sub-processor, AWS may process all customer data stored or handled on the Snowflake platform where the customer has selected AWS as their cloud provider.
Authorizing a broad category of affiliates—rather than named third parties—for core service functions means customer data may be accessed by multiple related entities for operational purposes.
The notice's stated scope determines what disclosures SoFi is committing to make and signals that sharing extends beyond SoFi itself to both affiliated and unaffiliated third parties.
Behavioral and usage data collected by SoFi is transmitted to external third-party partners across multiple sectors, expanding the audience that has access to the reader's information.
The commitment covers both present practice and future conduct, prohibiting monetization of personal information through sale.
Sharing extends beyond delivering a user's existing services to enabling unsolicited outreach from other Sony Group companies about products and offerings unrelated to the user's direct relationship …
Public profile information is disclosed not just within the PlayStation platform but also to the open internet and unspecified third-party websites, apps, and services, broadly expanding its reach.
The clause grants unlimited, uncompensated rights over user information to any third party, with no stated restrictions on purpose, scope, or recipient, eliminating any practical control the user mig…
Once an integration is enabled and personal data is shared with a third party, Sourcegraph Cody bears no responsibility for how that third party handles the data, shifting risk to the user.
This prohibition directly addresses data monetization practices that are regulated under privacy laws such as the CCPA, providing users with a clear commitment against targeted advertising use of the…
Enabling the embeddings feature triggers the transfer of repository contents to a third party, which customers may not anticipate and which depends on an administrator's action rather than the end us…
Standard Contractual Clauses are a specific legal mechanism required to lawfully transfer personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, establishing the le…
Users' personal data shared by Spotify can be merged with partner-held data to build a richer profile, and both Spotify and its partners may use that enriched profile for marketing purposes.
User data flows into Spotify not only from users themselves but from external advertising partners, meaning Spotify's profile of a user is enriched by third-party sources the user may not be aware of.
Sensitive identity information, potentially including biometrics, is disclosed to third parties such as credit reporting agencies and wireless carriers, expanding the circle of entities that hold thi…
Users pre-authorize law enforcement disclosure triggered solely by Square's reasonable suspicion, without requiring any additional user consent or legal process at the time of disclosure.
The use of standard contractual clauses is the named legal mechanism Square relies on for cross-border data transfers, and the protection afforded is qualified as something Square works to help ensur…
Square has already sold or shared Usage Data for targeted advertising, meaning this is a disclosed past practice rather than a merely potential future use.
It establishes that personal account and usage data may be transferred to external social media platforms for advertising suppression purposes.
It creates a specific protection for 2FA phone numbers against third-party SMS marketing use, limiting a commercially valuable form of data transfer.
This clause permits disclosure of user information to third parties during corporate transactions, including during preliminary negotiations before any deal is finalized.
This constitutes both a backward-looking representation about past conduct and a forward-looking commitment against selling personal information, which is directly relevant to CCPA-style rights.
Users' personal data embedded in Inputs may reach third parties, which has implications for privacy and data control beyond Stability AI's own handling.
Because the clause covers 'each of the categories of information described above,' the scope of data shared with third-party advertisers and analytics providers is as broad as Starbucks's entire data…
Users' Subscription Data is shared with unspecified third parties, and users must permit this as a condition of use, with sharing limited to verification and account-charging purposes.
An opt-in requirement places the affirmative burden on Stash to obtain consent before sharing, rather than on the user to opt out after sharing has begun.
This grant extends authority not only to Stash but to Plaid, a third-party data aggregator, giving both parties direct access to a user's financial institution data through a user-granted authorizati…
Sharing user information with ad partners for behavioral targeting, retargeting, and ad optimization means personal data flows to external parties for commercial advertising purposes.
Customer medical information receives a heightened sharing restriction within the State Farm corporate family, requiring affirmative authorization or a legal or contractual basis for any intra-family…
This restricts third parties acting on State Farm's behalf from exploiting customer information for their own commercial benefit through marketing, beyond the scope of their work for State Farm.
This establishes a categorical prohibition on the sale of customer information, which is a significant data protection commitment.
The obligation to protect customer information extends beyond State Farm itself to third parties acting on its behalf, and that obligation is enforced through contractual requirements.
The claim establishes an explicit statement that Personal Data is not sold, which is a distinct and material data practice representation.
The claim establishes that credit card data passes through Valve before reaching the payment service provider, meaning Valve processes the data rather than directing it exclusively to the provider.
The claim establishes that cross-border transfers of personal data occur and that Steam assumes an obligation to apply additional protective measures when they do.
The claim establishes that Steam User Account data is publicly accessible to anyone with a Steam ID query, not limited to authenticated partners or specific parties.
The claim establishes that user data is shared with third-party developers and publishers through a defined technical channel, and that ownership data is a baseline minimum of what is disclosed.
The explicit inclusion of data brokers and social media platforms as potential recipients of sold personal information significantly broadens the potential reach and use of user data.
Explicitly naming name, address, and email as data that may be sold to advertising partners and social media platforms makes the commercial use of personal data concrete and direct.
Live location data is among the most sensitive personal information; this clause establishes that Strava both uses it and provides a mechanism by which it may be shared with other users.
Business User data and Representative Data are routed to an Indian cloud provider, and a separate regulatory obligation requires certain Indian payment transaction data to remain on servers in India.
Business User data is shared with a third-party provider for merchant monitoring, a compliance-oriented purpose that involves ongoing scrutiny of Business User conduct.
End User Personal Data is actively shared with third-party partners for advertising purposes, including interest-based advertising, which involves behavioral tracking of users.
Highly sensitive payment card data—including the full PAN and CVV—is shared with a third-party card printing vendor, representing significant data exposure risk for cardholders.
Business User data is shared with a third-party provider specifically for sanctions screening, a compliance-driven purpose that may affect whether a Business User can use Stripe's services.
Subscribing to a Creator's publication on Substack results in the Creator receiving the subscriber's name and email address, transferring personal data to a third party outside Substack's direct cont…
This disclosure establishes that account identifiers are shared outside Substack with third-party organizations, even absent a legal order, for a defined child safety purpose.
The clause establishes a permissive right for Substack to disclose identifiable account data to third-party organizations outside any individual legal process, for a defined child safety purpose.
This establishes a categorical prohibition on the sale of user information, which is consequential given that data sales are a common monetization practice.
Data transferred from the EEA or UK to the United States crosses jurisdictional boundaries, potentially affecting the level of data protection applicable to that data.
Biometric information — a sensitive category of personal data — may be disclosed beyond Suno itself to affiliated entities and third-party service providers.
All personal information Supabase has collected could be passed to a new owner in a business sale or asset transfer, outside the user's control.
Users' personal data may receive weaker legal protections after international transfer, potentially limiting their rights and remedies.
User Content is protected from third-party marketing or advertising use by an absolute prohibition, subject only to the narrow exception of explicit user submission for that purpose.
The protection offered to users' personal information when shared with third parties is limited to 'reasonable' confidentiality terms, not an absolute prohibition on use.
Even hashed email addresses can be used by advertising partners to identify and target users across platforms, extending Supabase's data sharing beyond its own systems.
This clause restricts Synthesia's ability to disseminate Biometric Data to two named circumstances, limiting broader discretionary sharing.
The clause establishes a categorical prohibition on two specific forms of commercial transfer of personal information to third parties.
The qualifier 'knowingly' limits the scope of the protection: T-Mobile's obligation applies only where it has actual knowledge that the individual is under 18.
Selling aggregate reports to third parties means information derived from user data generates commercial value for parties outside T-Mobile.
Sensitive personal data is withheld from cross-context behavioral advertising pipelines unless the user affirmatively consents, giving users control over this specific use.
The clause establishes that Tabnine does not engage in the sale of Personal Information, which is relevant to privacy rights under laws such as the California Consumer Privacy Act.
The clause provides a qualified commitment — limited to reasonable attempts and intentional disclosure — against unauthorized third-party sharing, with an express carve-out for disclosures permitted …
The clause establishes that legal demands can compel Tabnine to disclose user information, which means government or judicial processes may result in your data being released without your consent.
Personal Information may be disclosed to a broad range of governmental and authorized entities, either to satisfy legal requirements or simply upon their request, without specifying that a legal comp…
Personal Information is not confined to TaskRabbit's own systems; it may be passed to external third parties specifically for advertising, which extends the reach of data beyond the service context.
Acceptance of the Privacy Policy is framed as an acknowledgment of cross-border data transfer to the U.S., which carries different legal protections than Canada, and the acknowledgment is triggered b…
The clause defines a ceiling on what Student data Creators can access through Teachable, which determines the scope of personal information exposed to third-party Creators.
Using Telegram's translation feature may cause message content to be transmitted to third-party companies—Google or Microsoft—outside Telegram's infrastructure.
User identifying information—IP address and phone number—is subject to disclosure to authorities under a defined legal threshold, meaning users are not guaranteed anonymity in criminal investigations.
Data is transferred outside Telegram to third-party developers whose privacy practices Telegram does not control, creating a data-sharing relationship the user may not anticipate.
Initiating a chargeback or refund triggers a data-sharing consent the user may not anticipate, disclosing account status information to an external third party.
Authorization for cross-border data transfer is obtained through the act of interaction itself, meaning users do not provide a separate, explicit consent to international transfer before it occurs.
Characterizing the activity as a potential 'sale' under local privacy laws is significant because sale-based rights — such as the right to opt out — may be triggered for users in covered jurisdiction…
User content and personal information are transmitted to external services outside Threads whenever a Third Party User follows the account, without any additional action required from the user.
A routine interaction — a like or reply from a third-party user — triggers automatic data sharing with an external service, conditioned only on the user's profile being public.
Threads frames the data transfer to Third Party Services as a user-initiated direction rather than a Threads-initiated action, which may affect how responsibility for the transfer is allocated.
The scope of shared data extends beyond post content to potentially include network-identifying metadata like IP addresses, which can reveal a user's location or identity.
User personal information is transferred to third-party Event Partners for operational purposes, meaning data reaches parties outside Ticketmaster for each event attended.
SMS opt-in data and consent records are carved out from Ticketmaster's broader third-party sharing practices in the US and Canada, providing users a specific protection over their messaging consent d…
The no-sale and no-behavioral-advertising-sharing commitment is conditioned on legal restriction, meaning the protection applies only where law mandates it rather than as an unconditional policy.
International data transfers subject user information to foreign legal regimes and data-protection standards that may differ from US protections, with compliance conditioned on evolving legal obligat…
This disclosure extends user-level engagement data beyond TikTok to a range of external commercial parties, including third-party measurement companies that may combine it with other data.
A ban on one Match Group platform can have direct consequences on a user's ability to access Tinder, based on data shared across the Match Group ecosystem.
User data flows to third-party advertising partners either by Tinder actively providing it or by permitting direct collection, expanding the number of entities with access to user data.
This clause establishes that user data can be disclosed to law enforcement and related parties without the user's consent under qualifying legal or crime-prevention circumstances.
Users are informed of the current no-sale status of their Personal Data under CCPA, along with conditional future obligations if that status changes.
This establishes a baseline protection condition that must be satisfied before any international or third-party transfer of Personal Data occurs.
Users can identify which data is and is not consolidated: most offering data is pooled into one account, but tax preparation data is explicitly carved out from that consolidation.
This means Twilio Inc. can process customer personal data as a sub-processor even when it is not the direct contracting party, which affects the chain of data processing responsibility and applicable…
An explicit no-sale commitment addresses a key consumer privacy concern and, depending on jurisdiction, carries legal weight under laws like the CCPA.
Transfer Impact Assessments are a recognized mechanism for evaluating the risks of sending personal data to jurisdictions with different legal protections; Twilio's completion of these assessments in…
This obligation means Twilio's sub-processors are contractually bound to meet data protection standards, extending the legal protection framework beyond Twilio itself to the third parties it engages.
Once data is transferred to the exhibitor, Twitch's privacy protections no longer apply, exposing users to a separate and potentially less protective privacy regime.
This identifies the Amazon corporate family as authorized recipients of user personal data and conditions that sharing on a minimum privacy standard for subsidiaries.
This is a stated policy commitment against selling user personal information, which is relevant to user expectations about commercial data monetization.
This enables cross-company data pooling between Twitch and Amazon, significantly expanding the scope of entities and purposes for which a user's personal information may be used.
User data is actively shared with third-party ad and marketing publishers, meaning external parties receive information that identifies and categorises users based on inferred characteristics.
Users who register with a work email may not realise their account data is potentially visible to their employer through the Uber for Business relationship.
User data can be disclosed to third parties, including government or legal authorities, without the user's consent when legal processes or compliance require it.
Users are afforded the CCPA's protections against the sale of their personal information, as Uniswap expressly commits to not engaging in that defined practice.
Users' wallet addresses are disclosed to third-party analytics providers for financial crime and harm prevention purposes, extending the reach of data sharing beyond Uniswap itself.
User Information may be transferred to a new or acquiring entity as part of a corporate transaction, meaning control over that data could pass to a different organization.
Third-party tracking enabled by UnitedHealthcare can result in a user's browsing behavior being monitored beyond UnitedHealthcare's own platforms, supporting targeted advertising or other profiling b…
User Information is not fully shielded from disclosure and may be provided to government or legal authorities without the user's consent when a legal process demands it.
Incorporation by reference means the list of sub-processors is contractually part of the DPA, making Unity's use of those third parties a binding element of the data processing agreement.
User information can be conveyed to an entirely different legal entity through corporate transactions, potentially changing who controls and processes that data.
The explicit extension of the no-sell-or-share commitment to known minors under 16 addresses heightened legal protections for children's data.
Authorizing a third-party connection triggers a bilateral, direct transfer of personal information—not merely Venmo sharing data outward, but also receiving information from the third party about you.
This establishes a specific limit on third-party data sharing, protecting users from having their personal information used to target them with third-party promotions or marketing.
This establishes a blanket prohibition on both the sale and sharing of personal information, extending explicitly to sensitive categories of data.
Using Apple's Siri or iMessage features triggers an automatic authorization for Venmo to share identifiable account data—including social graph and transaction details—with Apple.
The claim establishes that third-party AI providers receive user information as part of delivering Vercel AI's core AI offerings.
The claim establishes that de-identified data from Hobby and Pro plan users may flow to third-party AI business partners for those partners' own development purposes, subject to a user-controlled pre…
This clause discloses that Verizon Value brand customer data flows to a named third-party partner and is used in financial decision-making processes, including credit applications, which can have dir…
This clause discloses that identifiable personal information—including email address and purchase history—may flow to external advertising and analytics companies, enabling cross-context tracking and…
This clause reveals that data shared by Verizon can be enriched by third parties and used for audience targeting, extending the reach and depth of profiling beyond what Verizon alone collects.
The clause establishes that legal compliance is a basis on which Verizon discloses user information, meaning regulatory or legal obligations can trigger data sharing without user consent.
The clause establishes two separate bases for Verizon to disclose user information: legal compulsion and user consent.
It identifies the Global Privacy Notice as the authoritative document governing Visa's collection, use, and disclosure of Personal Information, including disclosure to third parties.
Your personal information may be transferred to a new owner in an acquisition without requiring separate consent, subject only to legal permissibility.
Third-party advertising networks operating on Walgreens' behalf may independently build behavioral profiles from cookie data, extending data collection beyond Walgreens itself.
By acknowledging that its disclosures may constitute a sale or sharing under California law, Walgreens is triggering the legal framework that grants California residents opt-out and other rights.
Account linking between VIZIO and Walmart triggers an automatic data transfer from VIZIO to Walmart, expanding the scope of data Walmart receives.
User information is not necessarily kept solely by Walmart but may be passed to third-party Marketplace Retailers or suppliers, expanding the number of parties who receive and may process that inform…
Third-party advertiser tracking technologies may collect your information across Walmart's environment and advertisers' own websites, broadening the scope of data collection beyond Walmart itself.
This clause establishes that personal information reaches third parties who are not acting on Walmart's behalf, meaning those parties may use the data under their own terms and for their own ends.
This clause establishes that personal information flows to third-party publishers and social media platforms for advertising purposes, extending Walmart's data sharing beyond its own properties.
This establishes a stated prohibition on monetizing personal information through sale, rental, or lease to third parties, which is a material commitment regarding the commercial use of user data.
Although data is described as de-identified, users' behavioral and location-derived metadata flows automatically to other Google products, broadening the use of data beyond Waze itself.
Users who submit content for posting have no confidentiality expectation in that content; it may be disclosed publicly without further restriction.
User data can move to a new corporate owner in a major transaction, with the only stated protection being a contractual commitment by the new entity to honor this Privacy Policy.
The act of linking to a shared view itself constitutes authorization for Wealthfront to disclose personal financial information to another individual.
This clause establishes a default non-disclosure rule for personal information shared with non-affiliates, conditioned only on California law exceptions or user authorization.
This is an absolute commitment with no stated exceptions, carve-outs, or conditions, covering three distinct forms of commercial transfer of Personal Information.
Personal information may change hands to a new entity in a business transaction, potentially without any further consent from the user and with no stated restriction on how the new entity may use it.
Sharing is conditioned on use restrictions and confidentiality obligations, but the conditions are imposed on third parties by Webull rather than being enforceable directly by users.
Highly sensitive payment credentials, including CVV codes, are shared with third-party payment services providers, meaning this data leaves Webull's direct control.
The scope of permissible disclosure is defined by Webull's own determination of necessity, without an external standard limiting that judgment.
The authorization covers any country Webull operates in, meaning personal information may be subject to the laws of jurisdictions with different or weaker privacy protections than the user's home cou…
The clause provides a direct commitment against selling personal data, which is significant given that data selling is a common commercial practice and a key concern under privacy laws such as the CC…
The clause explicitly defines cross-context behavioral advertising, making clear that affiliate sharing can enable tracking and targeting of users across multiple platforms over time.
The clause permits information sharing across a broad and expanding corporate family, including for cross-context behavioral advertising, which can result in targeted advertising based on activity tr…
WhatsApp's disclosure of user information to law enforcement or government is triggered by WhatsApp's own good-faith belief of necessity, not solely by a formal legal order.
A corporate transaction involving WhatsApp—including a partial asset sale or bankruptcy—triggers mandatory sharing of user information with new controlling parties.
Your phone number and message content can be stored or redistributed by any party you communicate with, both within and outside the WhatsApp platform, without restriction described in this clause.
Users who register with a corporate email address may have their account existence and information disclosed to their employer without additional consent at the time of sharing.
Personal information may pass to a different entity outside of Windsurf's control in a corporate transaction, potentially under different privacy practices.
Personal information is shared with external parties, meaning it leaves Windsurf's direct control as part of normal service operations.
The scope of potential disclosure is broad, covering all categories of collected personal information and a wide range of third-party recipient types.
The breadth of recipients and the inclusion of a possible sale of Personal Information signals significant commercial data flows that users may not have anticipated.
Characterizing the cookie-based data disclosure as a potential sale or share is significant because certain data protection laws grant individuals rights specifically tied to the sale or sharing of t…
This restriction limits service providers from independently exploiting personal information they receive, confining their use strictly to Workday's directions.
It establishes a two-part internal control: a necessity limitation tied to job functions and a mandatory security approval gate for all user data access.
Writer's Privacy Policy does not govern data collected by third-party services accessed through Writer's platform, meaning users must consult each third party's privacy policy to understand how their…
It establishes that data isolation is enforced at the team level even when teams share an organizational account.
Third-party advertising technologies can collect user data independently, and their use is governed by those third parties rather than Writer's privacy policy alone.
Data collection by these third parties extends beyond Wyze's own Services to other websites and mobile apps, meaning user tracking may occur across a broader digital environment than Wyze's own platf…
The clause establishes that third-party marketing disclosure occurs by default for some information types, requiring affirmative opt-out rather than opt-in consent, depending on the category of data.
The clause establishes that children's information is shared with the same broad set of third-party categories as adult user information, without a stated child-specific restriction.
Personal information held in separate consumer and business accounts may be merged by Yelp, expanding the profile of data associated with a single user.
Personal identifiers and hashed contact data are shared with external parties for advertising purposes, extending the reach of user data beyond Yelp itself.
Individual user information is protected from external disclosure by a defined set of exceptions, meaning disclosure outside Google is not at YouTube Kids' general discretion but is limited to enumer…
External sharing of individual user information is conditioned on parental consent, making parental agreement the operative requirement for this category of data sharing.
Legal compulsion to disclose means users' Personal Information may be shared with government and law enforcement authorities regardless of user preferences or consent.
Zendesk reserves the right to disclose personal data to government and law enforcement without user action whenever it receives a qualifying lawful request, including for national security purposes.
Personal data may be treated as a transferable asset and disclosed to unknown third parties even before a corporate transaction is completed, including during negotiation stages.
Consent is triggered by the act of using the tool, and the receiving third parties are explicitly outside Zillow's control, meaning Zillow bears no stated responsibility for how those parties handle …
The data shared goes beyond basic contact information to include behavioral data — search histories and derived insights — which can reveal detailed preferences and intentions about a major financial…
This establishes an explicit carve-out for sensitive information from Zillow's data monetization and advertising practices, providing a stronger protection than applies to non-sensitive personal data.
The data shared includes inferences — derived conclusions about users — and is shared with a broad category of marketing partners, extending Zillow's data use well beyond its own platforms.
Opting in to the Resume Database enables a potentially broad set of external parties to access the user's identity and contact information.
Personal Data flows to external advertising entities, expanding the universe of parties who hold information about the user beyond ZipRecruiter itself.
Sharing is mandatory and automatic upon application, and data flows to systems outside ZipRecruiter's direct control, including third-party Applicant Tracking Systems.
ZipRecruiter's liability extends to how its agents process transferred data, meaning the user retains a point of accountability at ZipRecruiter even after data moves to a third party.
Disclosure to government authorities may occur without the user's knowledge or consent, driven by legal compulsion rather than ZipRecruiter's discretion.
Users in states with applicable privacy laws may have legal rights triggered by what Zoom characterizes as a potential 'sale' or 'sharing' of their data for targeted advertising.
Customer Content may be shared with Google Cloud for AI processing, contingent on AI features being enabled, exposing potentially sensitive content to a third-party provider.
Live meeting and webinar traffic is processed by Google Cloud Platform, which serves in a dual role, meaning real-time content reaches a major third-party provider.
Users on accounts purchased through a reseller are exposed to potential personal data and content access by a third party—the reseller—in addition to the account owner.
Customer Content may be shared with AWS for AI processing, contingent on AI features being enabled, exposing potentially sensitive content to a third-party cloud provider.
By flowing down equivalent DPA obligations to subprocessors, Zoom extends its own data protection commitments through the subprocessing chain, rather than allowing a lower standard at the subprocesso…
Customer Content—potentially including sensitive user data—may be shared with a third-party AI provider, Anthropic, contingent on whether AI features are enabled.
Intra-group data transfers across all Zoom Group entities are governed by a formal agreement incorporating EU SCCs, a legally required mechanism for cross-border personal data transfers under EU data…
Substantive meeting content—including live traffic, recordings, and transcriptions—is processed by a major third-party cloud provider, AWS, raising significant data exposure considerations.
Live meeting and webinar traffic is processed by Oracle as a third-party cloud provider, meaning real-time content reaches an external party.
Customer Content may be shared with OpenAI for processing, contingent on AI features being enabled, exposing potentially sensitive content to a third-party AI provider.
Personal data is shared across the eBay corporate family, but the clause imposes a minimum privacy standard on Affiliates that mirrors eBay's own practices.
The disclosure is specifically tied to EU payment services for sellers, meaning this sharing obligation is contextually scoped rather than universal across all eBay users.
Personal information does reach advertising partners, but AWS limits what is shared by substituting indirect identifiers for directly identifying details such as name.
Personal information is shared with third-party service providers, but those providers are contractually restricted in how they may use and process it.
User data is disclosed to affiliated companies for marketing, meaning users may be targeted by entities beyond Acorns itself.
The enumerated list of potential recipients includes advertising-ecosystem entities, meaning user information may flow into advertising networks and platforms beyond Adobe's direct control.
Contractual restrictions on third-party service providers limit the permitted use of shared Personal Data and impose a confidentiality and security obligation, providing a layer of protection beyond …
User data is shared with a third-party sub-processor for fraud and abuse detection, excluding only Claude for Government users from this arrangement.
User data is transferred to a third-party sub-processor in Canada for support purposes, with Claude for Government users explicitly excluded from this arrangement.
User data passes through Cloudflare's infrastructure worldwide for all products, meaning data is processed in locations local to each customer.
User data is shared with a third-party sub-processor for text-to-speech, but this arrangement is limited to Claude for Work users only.
User data is shared with a third-party sub-processor for web search across every Anthropic product, with no product excluded.
The clause establishes that subscription-related information about a user is shared with third-party developers or publishers through a Subscriber ID mechanism, meaning user data flows beyond Apple t…
The clause limits data transmission to Private Cloud Compute to only what is relevant to the specific request, restricting the scope of data leaving the device.
The clause establishes that PCC metadata cannot be used to identify you or connected to your broader Apple profile, limiting re-identification risk.
Sharing behavioral data with advertising partners for cross-site tracking extends beyond operational service delivery and creates profiles that follow users across the web, which has significant priv…
The clause establishes the operational framework for data collection and third-party sharing practices on Auth0's websites. It permits the transfer of usage data to external partners whose systems an…
The clause establishes the operational framework for information sharing across the Bank's business operations and establishes that data practices are governed by a separate Privacy Notice document r…
Users in states with broad privacy-law definitions of 'sale' may have legal rights—such as opt-out rights—triggered by this disclosure, regardless of whether money is exchanged.
This provision establishes the operational framework under which Bumble engages third-party processors and service providers as part of its standard business functions. The clause creates the contrac…
International data transfers are operationally necessary for the service to function across different regions, but create jurisdictional implications regarding data protection standards and regulator…
Data sharing with third-party service providers means your personal information, potentially including sensitive categories, reaches organizations beyond Bumble itself, and the adequacy of contractua…
Information may flow beyond Calendly to a broad range of third parties, including those whose primary purpose is advertising and marketing.
A user's enrollment in a mental-wellness service may be disclosed to their employer or a family member without further consent beyond what is captured at sign-up.
Customers have no opt-out right for this category of data sharing, meaning their information will be shared for joint marketing regardless of their preferences.
The clause establishes the circumstances under which Craigslist is permitted to share user data with third parties, including law enforcement and government entities acting through formal legal proce…
Even without advertising-based data sharing, your personal data can reach third parties through legal processes or a corporate transaction, which are scenarios outside your direct control.
Personal information is disclosed to third-party event sponsors for their own marketing purposes, meaning those sponsors—not just Databricks—may contact you directly.
Personal information flows to external business partners beyond Databricks itself, expanding the set of entities that may hold or use that data.
Customer data handled by Datadog International Limited may be subject to the legal frameworks of three separate jurisdictions.
Customer data handled by Datadog Ireland Limited may be subject to the distinct legal frameworks of three separate jurisdictions.
Personal information is not confined to Datadog but may be disclosed to multiple categories of third-party vendors across operational and advertising functions.
This restricts one specific channel of data sharing, protecting information collected via SMS from being used to market on behalf of outside parties.
User information may be transmitted to third-party advertising platforms, though Discord qualifies the scope of that sharing as limited.
Users' information may flow to multiple categories of external parties as a routine part of Hulu's service operations, without requiring individual user consent for those disclosures.
Personal information may flow to third-party sponsors and marketing partners outside of DocuSign's direct control, expanding who holds and may act on that data.
Dropbox's retained responsibility means users have a point of accountability with Dropbox itself, rather than having to pursue third-party processors directly, for mishandling of their information.
Users engaging in collaboration or interaction on the platform should expect that some of their information will be shared with the other parties involved.
Using collaborative features triggers automatic disclosure of certain personal information to other users, which the individual may not fully anticipate.
User information moves beyond Fitbit to third parties, but those parties are contractually bound to process it only as Fitbit directs and in compliance with stated confidentiality and security measur…
Users' phone numbers are disclosed to third-party shipping and delivery partners, who may then initiate direct contact with users via SMS or other channels.
Users' data may be processed by Garmin entities in other countries, but the policy asserts consistent privacy policy coverage across all of them.
Personal data leaves Garmin's direct control and is accessible to third-party vendors, whose own data practices may differ from Garmin's.
The act of saving an item functions as a legal consent trigger, enabling third-party merchants to send communications directly to the user through Google Pay without any separate opt-in.
Third-party companies, not just Grammarly, may be collecting data about users' website behavior through cookies, expanding who has access to user interaction data.
Identifying AWS as HubSpot's hosting and infrastructure sub-processor across four countries clarifies where customer data may be stored or processed at the infrastructure level.
Cloudflare's role as a sub-processor means customer data may pass through Cloudflare's network as part of HubSpot's standard infrastructure and security operations.
Anonymous data shared for ad targeting means user behaviour or attributes may influence advertisements shown to users, even without identifying them by name.
Users who access Khan Academy through a school context should expect their information to be visible to their school, not only to Khan Academy.
This clause confirms that Personal Data flows beyond Linear to external parties engaged for operational purposes, expanding the set of entities that handle a user's data.
A third-party publisher—not Microsoft—gains access to personal identifiers and account details, expanding the circle of entities holding user data beyond Microsoft itself.
This clause establishes that user data may flow to external advertising and analytics partners through tracking technologies, subject to a legal-permission condition.
User data may flow to external advertising and analytics parties, meaning information about users can be used to measure performance and target ads beyond Midjourney's own systems.
The clause defines the legal bases OnlyFans relies upon for cross-border data transfers, which determines the level of protection your data receives outside its country of origin.
Customer data processed through AWS cloud infrastructure is handled in the United States, fixing the geographic jurisdiction for that processing.
This represents a direct commitment against two specific categories of data transaction as legally defined under California law, covering both current practice and a defined historical period.
Content creators' email addresses are disclosed to an external third party as part of the payment process, meaning that data leaves Poe's direct control.
Users retain a baseline of account-level anonymity from AI model providers and developers unless a specific condition changes that default.
Your usage and device data is transferred to service providers in specific foreign jurisdictions, each with potentially different data protection frameworks.
This recognition serves as the legal basis justifying data transfers to those countries without additional safeguards, affecting the level of protection your data receives when transferred internatio…
Your personal data flows to multiple third-party organisations including credit reference agencies, which can affect your credit profile at other institutions, and to counterparties in your transacti…
The clause establishes the operational framework for data flows across the Revolut group structure and to external entities necessary for service delivery, regulatory compliance, and fraud management…
The breadth of sharing categories means your financial, identity, and behavioral data may flow to many organizations beyond Revolut itself, some of which you may not have a direct relationship with.
This provision authorizes sharing of personal information with a broad set of third parties beyond direct service delivery, including for marketing and analytics purposes, which affects how user data…
Data collection and sharing practices establish the operational framework for how Robinhood processes user information to support margin account administration, compliance monitoring, and business op…
Personal Data flows beyond Salesforce to multiple categories of external vendors, expanding the number of parties who handle that data.
Personal information is not held solely by Scale AI but may be accessed by external parties engaged to support Scale AI's services.
Users' contact and address data passes to third-party sellers — parties outside of Shein — whose own data practices may differ from Shein's.
Customer data used within the Data Clean Rooms Web App may be processed on AWS infrastructure.
Customer data processed by the Cortex cross-region inference feature in GCP or Azure regions may be routed through AWS infrastructure.
Customer account data in GCP regions may be routed to AWS for the purpose of native app security scanning.
Customer data processed by the Cortex cross-region inference feature in GCP or AWS regions may be routed through Microsoft Azure infrastructure.
Three distinct categories of data subjects—Business Users, End Customers, and Visitors—have their data shared with Google for a broad range of purposes, including site protection and behavioral measu…
This establishes that Stripe does not engage in the direct monetization of Personal Data through sale, which is a specific and limited commitment.
Your personal data may be disclosed to outside parties during a corporate transaction, potentially before any ownership change is finalized.
Joint Data Controller status means Tinder shares formal legal responsibility over user data with Meta Ireland when those specific tools are active, rather than Tinder bearing sole responsibility.
Some of a user's personal information may flow to third-party advertising partners through cookies and trackers, extending data exposure beyond TurboTax itself.
This exclusion means telecommunications providers are not subject to the sub-processor obligations and protections described elsewhere in the document, which limits the data protection framework appl…
Customers have a meaningful choice over where their CDP Segment data is hosted, which has direct implications for data residency and compliance obligations.
Identifying AWS as the infrastructure host in the USA is consequential for understanding where customer data physically resides and which legal jurisdiction governs it.
Users' data is transmitted to major social media platforms as a direct consequence of Uber embedding those platforms' tools in its own products.
User information is not confined to Uniswap alone but may flow to third-party service providers and vendors involved in operating the Services.
The restriction is limited to numbers provided specifically for security purposes and to marketing or promotional use, leaving other potential sharing scenarios outside the scope of this commitment.
The clause establishes that user information moves across Verizon's corporate structure, including to affiliated entities, beyond the specific product or service a user engaged with.
The clause establishes that Verizon's data may flow to external third parties for identity verification purposes under an optional program.
Messages you send to a business on WhatsApp may be accessible to third-party service providers chosen by that business, including potentially Meta, outside of WhatsApp's direct control.
Participating in a Workday-hosted webinar or event involving third-party collaborators may result in those third parties independently contacting you using the information Workday shares.
Data transferred internationally may be subject to privacy laws that differ from those in the user's home country, affecting the legal protections available to users.
In a corporate transaction, your authentication data, device identifiers, and behavioral profiles could transfer to a new owner whose privacy practices may differ materially from Okta's current polic…
Monitor emails you the same day a platform you choose changes these clauses.
A data sharing clause is a provision in a platform's terms of service or privacy policy governing data sharing-related rights, obligations, or restrictions.
ConductAtlas tracks 288 platforms with data sharing clauses - roughly 82% of platforms in the archive. 1735 are classified as high severity.
Severity reflects the magnitude of rights waived, availability of opt-out, breadth of users affected, financial or legal exposure created, and the degree of discretion retained by the platform.