Found in 279 of 352 platforms tracked (79% adoption) · 3334 provisions
The 'only' qualifier restricts all other uses of 23andMe's Genetic Information, which has direct bearing on how users may lawfully apply their results.
The clause establishes that research participation results in the user's deidentified data being combined into a collective dataset, which has implications for how individual data contributes to broa…
This clause limits ADP's authority to process personal data to instructions or permissions from the employer or the individual, restricting ADP's independent discretion over data use.
This limits a specific data source—Google Workspace API data—from being used for broad model training or improvement, confining its use to the individual user's context.
The limitation confines AWS's access to customer Content to two defined purposes, restricting AWS from using Content for other purposes such as product improvement or advertising.
Customers whose content is processed by listed AI Services should understand that such content may be used to train or improve AWS's AI technologies, which has implications for data sensitivity and c…
This clause provides customers with a direct contractual protection against AWS Bedrock leveraging their data or content to build competing offerings, which is a material concern when a cloud provide…
User interactions are tracked across multiple online services over time by third parties engaged by Acorns, enabling cross-service behavioral advertising outside Acorns' own platform.
Users' Marketing Content—which may include sensitive campaign data—can be accessed and used internally by ActiveCampaign for purposes beyond delivering the immediate service.
This practice extends ad targeting and measurement using cookies and advertising IDs beyond Activision's own platforms to third-party online properties, enabling tracking across the broader web.
The disclosure of how user information is used is consequential because it defines the boundaries of Afterpay's permissible data use.
This creates a distinction between using personal information for ad targeting and using personally identifying information, which affects the degree of individual exposure in advertising.
Amplitude's role as a processor for Customer-submitted data means Amplitude's authority over that data is limited to Customer instructions, placing control and responsibility with the Customer.
Genetic Information is among the most sensitive personal data; its use for research is conditioned on a specific separate consent instrument.
User-submitted content may be used to train Anthropic's AI models, which has direct implications for data use and privacy, though users retain the ability to opt out through a specific account mechan…
The opt-out for model training is not absolute; two specific circumstances—submitting Feedback and safety flagging—override the user's opt-out choice, meaning users cannot fully prevent their Materia…
The claim establishes that AI model training from user Inputs and Outputs is Anthropic's default practice, with opt-out available only through account settings, meaning users who do not actively opt …
The claim establishes that the opt-out right for model training is not absolute—two specific circumstances override it, meaning users cannot prevent their data from being used in those scenarios rega…
Without opting out, your Materials may be used to train Anthropic's AI models; the opt-out mechanism places the burden on the user to act.
Training use of Inputs and Outputs is the default; users must take an affirmative step through account settings to prevent it, meaning inaction results in data use for model improvement.
The opt-out for model training is not absolute; two specific conditions—safety flagging and user-initiated reporting—override the opt-out, meaning users cannot prevent training use of flagged or self…
The opt-out right is not absolute; two specified conditions — safety flagging and user-submitted Feedback — override it, meaning users cannot fully prevent their Materials from being used in model tr…
User-submitted content may be used to train Anthropic's AI models by default, and avoiding this requires an affirmative opt-out action by the user.
The clause establishes that Apple App Store's advertising platform maintains a separation between first-party and third-party data for the specific purpose of targeted advertising, limiting cross-con…
An exclusivity requirement on data use prohibits any secondary use of personal data, including analytics, training, or profiling, grounding a strong purpose-limitation principle in the system's desig…
The inference engine is the core component processing user requests; a claim that it keeps user data private is a direct statement about the privacy posture of the primary processing mechanism.
The clause establishes a strict purpose limitation and post-processing deletion obligation for Private Cloud Compute, preventing any secondary use or retention of processed data.
Limiting processing to agreed purposes prevents Asana from using customer personal information for secondary purposes not authorised by the customer, a key CCPA service provider obligation.
Asana explicitly shifts all data compliance responsibility to the Customer, meaning Managed Users cannot look to Asana to fulfill these obligations.
Users' personal information and work content are processed by third-party AI Partners, not solely by Asana, expanding the scope of data access beyond Asana itself.
Free Users grant Asana a broad set of enumerated rights over their submitted content as a condition of using the Service.
An explicit prohibition on secondary uses of customer work content means Asana may not use that content for product improvement, advertising, AI training, or any purpose beyond service delivery.
Classifying Asana as a CCPA service provider rather than a business determines the legal obligations and restrictions governing how Asana may use the customer's personal information under California …
The DPA is the governing document for Asana's legal data processing obligations, meaning its scope and terms directly determine customers' data protection rights and Asana's binding commitments.
The restriction on sensitive personal information use is bounded by what applicable law permits, meaning the scope of protection depends on the law of the relevant jurisdiction.
The obligation is continuous, not a one-time check; the Customer bears ongoing responsibility for maintaining a lawful basis for all personal data processing Baseten performs on its behalf.
Users' photos and profile text are used to generate inferences that directly drive which advertisements are displayed to them within the App.
User account data is actively used for multiple advertising functions, including third-party advertiser audience matching, ad display, and performance measurement.
The clause is consequential because it discloses a mandatory screening practice in which users' identifying information is matched against government terrorist watchlists.
Employees are subject to both digital and physical monitoring, covering their use of communications systems and their physical presence on premises.
Customer identity verification and potential storage of government-issued photo identification is a legal obligation, not a discretionary practice, making it non-negotiable for users of the Sites or …
This is an absolute commitment by Bluesky not to monetize user content through sale without prior user consent.
The license to handle user Content is bounded by the necessity of providing the Services, which limits but does not eliminate Box's ability to process user data.
The irrevocable nature of the license means the reader cannot withdraw Brex's rights to Company Data even after the agreement ends, for the identified purposes.
The clause establishes the legal basis and scope for handling sensitive personal data regulated under GDPR Article 9. By designating processing as consent-based, the terms specify the regulatory fram…
Because opt-out is expressly prohibited, users must receive these communications for as long as they use the Services, regardless of personal preference.
User behavioral data collected by Calm is used not only within Calm's own service but also to influence advertising on external platforms.
Calm derives sensitive demographic inferences—location, gender, and age—from technical data, which may be used to profile users without their direct input.
Content and activity that users create or upload within Canva may be used to develop and improve Canva's AI systems, meaning user-generated material contributes to AI training by default.
User data is actively used for targeted advertising that extends beyond Canva's own platform to third-party sites and platforms, and third-party partners are involved in both the data collection and …
This clause is consequential because it establishes that Cash App engages in cross-site, cross-temporal behavioral tracking of users to deliver targeted advertising beyond the Cash App platform itsel…
This clause is consequential because it establishes that Cash App may monetize sensitive transactional and behavioral data to deliver advertising for third-party brands beyond its own platform.
This clause is consequential because it establishes that user data is used not only for immediate service delivery but as training material for AI and machine learning systems, which may have ongoing…
Users have no retained ownership or intellectual property rights in Usage Data; any such rights are assigned to Cerebras by operation of this clause.
This clause expressly carves out model training and fine-tuning from whatever rights Cerebras holds over Service Content, limiting a commercially significant use.
Once data is deidentified or aggregated, Cerebras places no restrictions on its use or disclosure, including commercial sharing with advertisers.
By defining the practice in its policy, Chase signals that online behavioral advertising — including cross-site tracking — is within scope of its data practices.
User information is used not only for service delivery but also to develop new products and evaluate business performance, broadening the internal uses of personal data.
Combining third-party data with existing user profiles allows Chase to build more comprehensive data profiles than either source alone would permit.
Contact information is used not only for Chegg's own marketing but also to deliver communications on behalf of advertisers and other third parties.
This is a categorical commitment against data sales, covering all data and explicitly including personal data, which is relevant to regulations such as the CCPA that define specific rights around dat…
Users who connect Google services to ClickUp have their Google API data governed by an external policy—Google's API Services User Data Policy—which constrains how ClickUp may use or share that data.
The filtering provides a partial privacy safeguard for training data, but it applies only to opted-in users and covers only common types of personal information, not all personal data.
The license is irrevocable and sublicensable, meaning Cohere can pass data rights to third parties and the grant cannot be withdrawn once made.
Trial Users and Researchers should understand that content they submit and outputs they receive may be used by Cohere for research and development purposes.
Establishing that Enterprise Users have control over training data use means that Cohere's training practices are not unilaterally applied to Enterprise User data.
The license is irrevocable and sublicensable, meaning Cohere retains broad rights over Customer Data and can extend those rights to third parties for service-provision purposes.
Users retain ongoing control over whether their interaction data contributes to model training, and this control is self-service and unrestricted in timing.
This clause permits Copy.ai to track users beyond its own Services and serve targeted advertising based on collected behavioral data across the wider web and apps.
This establishes a direct prohibition on Cursor using Customer Data for model training, conditioned on Privacy Mode being active.
This establishes a direct conditional restriction on Cursor's use of user data for training, contingent on the user enabling Privacy Mode.
The default prohibition on training use of Inputs and Suggestions protects user content from being used to improve AI models, with narrowly defined exceptions.
With Privacy Mode disabled, a broad range of user-generated data is eligible for use in model training and product improvement by Cursor.
Specifying legal bases for processing constrains Datadog to processing personal information only where one of the stated grounds applies.
The restriction prevents DeepL from pooling or cross-applying one customer's Training Data to benefit other customers or DeepL's general models.
Content submitted through the free version is used to develop DeepL's AI, meaning user-submitted text is not treated as purely transient.
Pro users can submit texts with the assurance that their content will not feed into DeepL's quality improvement processes, distinguishing the Pro offering from the free version.
Personal data submitted in violation of DeepL's terms of use in the free version is not treated as entirely automated and may receive direct human access.
Users who share ideas or creative content with Delta Airlines retain no control over how that content is used, including for commercial development.
Users cannot expect Delta Airlines to keep the substance of their electronic communications confidential, unless those communications contain personally identifiable information.
Consent must be given at the specific moment of data collection, not retroactively, making prior or post-hoc consent insufficient under this clause.
Delta Airlines constructs preference profiles by combining multiple categories of personal data, which shapes the products and services presented to individual users.
User content is used for AI model training by default; the opt-out places the burden on the user to affirmatively act to prevent this use.
The license is perpetual and irrevocable, meaning Descript's rights over submitted content survive account deletion or termination and cannot be unilaterally withdrawn by the user.
User information is applied to active enforcement activities, including monitoring and taking action, which means personal data is used not only for service delivery but for platform-wide conduct enf…
Content posted in larger spaces on Discord may be applied directly to service development and improvement, meaning user-generated content in such spaces contributes to building Discord's product capa…
Targeted advertising is based not only on activity within Disney+ but also on behavior tracked across third-party sites and applications, extending the data scope beyond the Disney+ ecosystem.
DocuSign's ownership of Usage Data and its right to use it for benchmarking and industry analysis means this data may inform commercial activities beyond direct service delivery.
The permitted uses of sensitive Personal Information are bounded by a 'reasonably expected by an average consumer' standard, which is a subjective threshold rather than a specific enumerated list, an…
DoorDash's use of Personal Information for advertising extends beyond its own platform to third-party websites and platforms, meaning users may encounter DoorDash-related targeted advertising across …
Dropbox's active storage, processing, and transmission of user content and related profile data means this information is not merely held passively but is operationally handled by Dropbox.
Accepting the Agreement constitutes an express authorization for Dun & Bradstreet to use automated and pre-recorded communication methods to contact users, which may have implications under telecommu…
The clause establishes that Dun & Bradstreet actively creates new data products from existing data, which may include derived information about individuals or businesses beyond what was originally co…
The clause establishes a contractual restriction on AI vendors' use of personal information, limiting their use to Duolingo's purposes rather than the vendors' own.
This establishes that EA may construct inferred cross-device identities from device data, enabling tracking of a user's service usage across multiple devices without a deterministic shared identifier.
This establishes that EA's tracking is not siloed to a single platform but operates across the broader digital ecosystem, enabling cross-context behavioral profiling for advertising purposes.
User interaction data collected on the Website may be shared with or accessed by third-party advertising partners and used to target advertising directed at users.
The classification of identity-verification Voice Data as Special Category or sensitive Personal Data triggers heightened legal protections under applicable data protection laws.
Users' personal data — including sensitive content like audio and video — may be used directly to build or refine commercial AI systems.
ElevenLabs' processing of user-provided voice recordings to create a synthetic voice model means users' biometric voice characteristics may be used to generate new audio in their likeness.
Users' personal data, including sensitive content like audio and video, may be used directly to build and refine ElevenLabs' commercial AI products.
The characterization of identity-verification Voice Data as potentially constituting Special Category or sensitive Personal Data signals that heightened legal protections may apply to that processing.
Consent is obtained through the act of using or engaging with the Services, rather than through a separate affirmative step, which determines the legal basis for a range of data processing activities.
Consent is established through use or engagement rather than an affirmative opt-in act, meaning the full scope of data uses in the Policy applies to any user who interacts with ElevenLabs.
The 'reasonably necessary and proportionate' standard limits Eufy's discretion to use Sensitive Personal Data, and the listed purposes define the scope of permitted use.
Users' Personal Data is available to Eventbrite for broad marketing and advertising use across multiple channels and device types, without limitation to those listed.
Derived predictions about a consumer's characteristics and preferences—not just raw data—are treated as sellable assets and transferred to third parties for commercial gain.
Personal data is used not only for service delivery but also as input for AI model training, which is an open-ended developmental use.
Fastly's use of Subscriber Data is contractually confined to the boundaries set by the Agreement and the Documentation, preventing unauthorized use.
The authorization is bounded by a sole-purpose limitation, which constrains how Figma and its service providers may use Customer Content and excludes other potential uses such as advertising or produ…
The authorization is limited to service delivery; use of Customer Content outside that sole purpose is not authorized by this clause.
Users retain control over whether their inputs are used for AI model development; such use requires affirmative opt-in, not merely the absence of objection.
Personal data embedded within User Content is treated as collected data and used for service delivery, meaning incidentally included personal data is within Fireworks AI's data handling scope.
User data may be used to train or develop generative AI models, a use that extends beyond conventional service improvement and carries distinct implications for how personal data is incorporated into…
This license authorizes Fly.io to use Customer Data not only to deliver the Services but also to improve them, extending Fly.io's permitted use beyond mere service delivery.
This clause creates a defined boundary on Fly.io's data use and imposes an affirmative permission requirement before any use outside that boundary, limiting scope creep in data processing.
This establishes a limit on how GOAT may commercially exploit biometric information, restricting use, disclosure, and retention to the previously described purposes only.
Pseudonymous blockchain activity, which users may assume is relatively private, is explicitly connected to verified real-world identity by Gemini for compliance purposes.
Data that General Motors has de-identified falls entirely outside the Privacy Statement's use restrictions, allowing General Motors broad latitude to use and share it.
The license explicitly extends to AI Feature training, meaning user-submitted content can be used to develop GitHub's AI capabilities as a condition of using the Service.
Personal Data is used not only to deliver existing services but also to build and train new AI and machine learning systems.
It establishes a data use restriction specifically for Business and Enterprise tiers, distinguishing how their data is handled relative to AI model training.
User data — including identifiable personal data — may be used as training material for AI models, meaning a user's information contributes to systems that may affect many other users.
Personal data drawn from multiple sources — including third parties outside Glassdoor — may be combined to target advertising at users, broadening the scope of data use beyond what users directly pro…
Ad utility determination is a stated purpose for data collection, meaning collected data is used to shape the advertising experience presented to the user.
Users' data is actively used to shape the content and ads they see, meaning their experience is not neutral or uniform.
Personalized ad delivery is based on cross-service activity, meaning data generated across all Google services — not only YouTube — can influence the ads a user sees.
Submissions to Unpaid Services—including prompts and generated responses—feed directly into Google's product and machine learning development, meaning user-submitted content actively contributes to G…
This is consequential because it distinguishes Paid Services from Unpaid Services with respect to data use, providing a data protection assurance for paying developers.
The obligation covers both misuse of existing information and the manner of collection, requiring purpose clarity, disclosure, and security measures.
The clause constrains Google Ads to processing Customer Personal Data solely within the boundaries set by the Customer's instructions and applicable law, limiting unilateral use.
Designating Google Ads as a processor means it must act only on Customer instructions and cannot determine the purposes of processing independently, with distinct legal consequences under data protec…
This use authorizes Google Cloud to process Service Data for broad security and integrity purposes that extend beyond protecting the individual user to protecting third parties and Google itself.
This clause binds Google Cloud to a defined processing document and prohibits any use of customer data beyond that scope, providing a contractual ceiling on how customer data may be handled.
The primary use of Service Data is service delivery, but this explicitly includes financial processing such as credit checks and billing which involve use of user data beyond mere service operation.
It establishes that user data is not confined to operational service delivery but also feeds into the training and development of the underlying AI and machine-learning models.
Users' actual content—as opposed to behavioral or metadata—is expressly excluded from Grammarly's marketing and advertising activities.
Sensitive data receives a use restriction tied to legal permissions rather than broader discretionary use, which limits how Grammarly can deploy that category of information.
The DPA is identified as the governing instrument for data processing obligations, meaning parties must look to it—not the MSA or other documents—for those specific responsibilities.
Greenhouse's role as a processor—rather than a controller—defines the legal framework under which it handles customer data, with significant implications for data protection responsibility.
An opt-out does not fully stop data processing; permitted processing under applicable law may continue regardless of the user's opt-out choice.
This clause authorizes Gusto to use personal information for broad internal development purposes, including AI-related activities, which extends data use beyond the immediate service delivery context.
This clause discloses that Gusto tracks users across devices to deliver targeted advertising, which involves monitoring user behavior beyond a single session or device.
This clause defines the legal basis and scope of Harvey AI's right to process your data, limiting that right to what is necessary to deliver the Service.
Because Customers are the Data Controllers, legal responsibility and accountability for Customer Data under data protection frameworks rests with the Customers, not Harvey AI.
Harvey AI may share Personal Data with third-party advertising partners for interest-based advertising, subject only to legal permissibility and opt-in consent where that is specifically required.
Data that users submit to or receive from Harvey AI's platform—likely the core of a legal professional's interaction with the service—falls entirely outside the Privacy Policy's protections and scope.
User data is leveraged to tailor advertising about Headspace that appears outside the Headspace Platform itself, through third-party channels.
While sensitive personal information is broadly used across other stated purposes, ad personalization is explicitly excluded, providing a specific and limited protection for sensitive data.
Legal compliance risk under data protection law is placed on the customer, not Contentsquare, with respect to the customer's use of the service.
The license is perpetual and worldwide, meaning Contentsquare retains the right to use Customer Data for internal development purposes even after the Agreement may otherwise end.
Interest-based advertising involves profiling user behavior and preferences to target ads, meaning user data is applied to shape the advertising experience specifically for each individual.
This clause establishes that the principal limit on Hims & Hers's use or disclosure of user information is whether it qualifies as Protected Information—information falling outside that category face…
Users' data is actively used both to power advertising on the platform and to direct marketing communications at them personally.
Because the permission explicitly covers messages and other communications, users' private in-app conversations may be accessed and used by Hinge for service development and machine learning purposes.
Although the shared data does not directly identify a consumer, device identifiers and browsing histories can be combined by third parties to build profiles that effectively identify individuals for …
User data contributes directly to the development and capability of Ideogram's AI models, meaning user interactions have a lasting effect beyond their immediate context.
Ideogram invokes 'legitimate interest' as the legal basis for processing User Input, meaning no separate user consent is required for this use of submitted data.
User data, including personal inputs, may be incorporated into AI model training by default unless the user actively opts out.
Personal information shared during interactions is not siloed; it may surface in generated outputs, raising exposure risks if outputs are shared.
The clause establishes that Inflection AI's practices fall outside the statutory definitions of sale, sharing, and targeted advertising under U.S. state privacy laws, which may carry specific legal r…
Using Personal Information for interest-based advertising means Instacart builds on user data to target individuals with tailored commercial messages, and also tracks the impact of those messages.
This prohibition expressly bars any AI-related use of Instacart's Services or derived data, covering a broad range of AI development activities.
Tax Return Information receives heightened protection: even Intuit's affiliated companies cannot receive it without legal authorization or user consent, limiting internal data flows that users might …
The use of personal data for debt collection is a consequential data use that directly affects users with outstanding balances.
Klarna uses both its own assessments and external credit checks to make eligibility decisions, meaning third-party data and internal behavioral analysis directly affect whether a user can access Klar…
The license is sublicensable and transferable, meaning Klaviyo may extend data-processing rights to third parties, while the scope is bounded by what is necessary to provide the Services.
Klaviyo retains the right to extract value from Customer Data through aggregation and to use or share that derived data commercially, as long as it is non-identifying.
This prohibition directly protects Customer Data from being used to commercially benefit LangChain's AI development, which is a material concern in AI platform agreements.
The licence is irrevocable and perpetual, meaning users cannot withdraw it after granting it, and it explicitly covers AI training use of Public Content.
Leonardo AI's advertising use of personal data extends beyond its own Service to third-party sites and platforms, meaning your data may influence advertising you encounter outside of Leonardo AI.
The claim establishes that although the licence over Private Content is limited in purpose to Leonardo AI's own obligations and rights under the Terms, it is irrevocable and cannot be withdrawn by th…
The use of facial recognition technology involves biometric data processing, which carries heightened privacy implications and may be subject to specific legal regulations.
User data may be used to train machine learning models and shared with third-party analytics providers, meaning it contributes to automated system development beyond direct service delivery.
This clause establishes that providing certain Personal Data is not optional for users who wish to access the full Services — the legal basis for processing is contractual necessity, making refusal f…
LinkedIn restricts both the form of the data (aggregate and anonymous) and the permitted purpose (assessing Campaign performance), meaning any other use of Ad Services Data is prohibited.
Ad targeting reaches beyond LinkedIn's own platform and extends to users and non-users alike, using data that may be combined across sources and delivered via third-party partners.
The qualifier 'primarily' indicates that service provision, request facilitation, and service improvement are the main but not exclusive uses of Customer Content, leaving open the possibility of addi…
LlamaIndex may combine automatic data collection with cross-device identification to deliver targeted advertising, meaning the reader's behavior may be tracked and used for commercial targeting acros…
User information submitted in support contexts or generated through service use is explicitly used to train and fine-tune AI and machine learning models, which is a significant secondary use beyond i…
Personal data is used directly to build and refine Luma AI's core AI models, meaning user data has an ongoing role in shaping the technology beyond the immediate service interaction.
Personal information is used not only to deliver the core ride service but also to drive marketing and advertising outcomes that benefit Lyft's growth.
Marqeta's use of sensitive cardholder and transaction data is contractually limited to three enumerated purposes, restricting secondary or commercial exploitation of that data.
Your data is used not only to market McDonald's own offerings but also those of third-party business partners, expanding the commercial use of your information.
The content users create or exchange on Medium — including messages and AI interactions — may be actively examined by Medium and multiple third-party entities.
The clause bounds Mercury's use and sharing of the most sensitive category of personal data to what is legally permitted, establishing a compliance-based ceiling on such activity.
Joint Controller status under Article 26 GDPR means both parties share legal responsibility for the processing, including obligations to data subjects, which expands the advertiser's GDPR liability b…
Designating the advertiser as Controller and Meta Ireland as Processor for these services means the advertiser bears primary GDPR accountability for lawfulness of processing, with Meta acting on the …
User-submitted content and generated outputs from the Unpaid Services become training material for Meta's AI development, meaning users contribute to Meta's commercial AI improvement without addition…
The prohibition covers nearly all individual-level data uses, including common advertising practices like retargeting, leaving only aggregate and anonymous analysis permissible.
This clause establishes that user data flows into advertising systems that extend beyond Microsoft's own properties to third-party platforms, and that automated profiling is part of the ad-targeting …
This prohibition prevents users from leveraging Microsoft's AI services or their outputs to build or enhance competing or derivative AI systems, including through indirect means.
Health data carries heightened sensitivity; this clause establishes explicit carve-outs preventing two of the most commercially significant uses Microsoft makes of data elsewhere in its ecosystem.
This clause extends the enumerated principles across the full AI system lifecycle—design, build, and operation—not merely at a single stage.
Data processing and security obligations for Customer Data and Personal Data are not contained in the main Azure agreement but are established in a separate document — the DPA — which both parties ar…
This clause establishes that machine learning training is a named data collection activity, meaning user data may be used in and collected during model training processes.
This license defines the legal basis on which Miro can handle Customer Content; the 'only as necessary' limitation restricts Miro's use to service provision and excludes other purposes.
Mistral AI has a contractual license to use Customer Data and Outputs for operational product purposes, but the explicit exclusion of model training limits that use and provides the Customer a define…
The designation of Mistral AI as Processor rather than Controller determines the legal framework governing its data processing obligations and limits its authority over Personal Data to what the Cust…
The enumerated purposes are illustrative rather than exhaustive, and the overarching category of 'business purposes' is broad, meaning the scope of permitted use of Usage Data extends beyond the list…
This restriction confines all processing of Personal Data to the defined Processor-Customer relationship, preventing Mistral AI from using Personal Data in any context that falls outside that relatio…
This prohibition limits Mistral AI's ability to enrich or pool Personal Data with other datasets, which would otherwise expand its informational profile of individuals beyond what the service relatio…
This restriction prevents Mistral AI from monetising or otherwise exploiting Personal Data for commercial ends that fall outside the scope of service delivery to the Customer.
The permission grant is triggered by the act of enabling the connection and extends to a broad range of actions — including deletion and modification — on Third-Party Services, all conditioned on the…
Users on free or specified plans whose data is used for training have their content incorporated into Mistral AI's models unless they affirmatively opt out.
Customer Data and Outputs submitted through Labs Models may be incorporated into Mistral AI's model training by default, with training use avoidable only by activating zero data retention.
By granting this license, the customer authorizes Mixpanel to handle Customer Content in specified ways; the scope of permitted uses directly defines how Mixpanel may interact with the customer's dat…
This clause discloses that MyFitnessPal and partners engage in cross-device tracking and behavioral data aggregation, which can create a comprehensive profile of a user's activity.
This clause establishes a consent-based legal threshold for all personal information processing of Canadian residents, making consent a prerequisite rather than a courtesy.
This clause establishes a specific prohibition on marketing and advertising use of HealthKit data by MyFitnessPal and on its transfer to third parties for those purposes, providing a defined protecti…
De-identified or anonymized data derived from user information falls entirely outside the Privacy Notice's protections, enabling unrestricted use and disclosure to third parties.
Authorized Users may not be able to rely on this Privacy Notice for protections regarding data they upload, as a separate Customer agreement governs that processing.
The clause discloses that Netflix's advertising data use extends across the full advertising lifecycle, and that the resulting advertisements may be behaviorally targeted, affecting the nature of ads…
Users have no expectation of privacy in message content sent through Netflix's chat features, as Netflix and third-party Service Providers may record and review it.
Ad targeting draws on multiple data sources simultaneously—off-platform business data, neighborhood-level demographics, and individual behavioral signals—creating a layered profile used to shape what…
This establishes that user data is applied to advertising personalisation and promotional outreach by Nintendo and a defined set of third-party relationships.
Because the right is described as absolute discretion, Nintendo is not constrained by conditions or required justification when accessing, disclosing, or preserving user information or User Content.
End users whose data is processed by Notion as a data processor on behalf of a business customer have their privacy protections determined by that customer's contract with Notion, which they may not …
Users have no ownership claim over anonymised data derived from their activity, and OnlyFans faces no restriction on how it uses that data beyond what the law requires.
The scope of data processing in customer support is bounded by the customer's explicit sharing decision, limiting OpenAI's ability to process data not affirmatively provided during a support interact…
User Content is actively monitored by OpenAI for security and fraud-prevention purposes, meaning Content is not treated as entirely private.
The clause permits automated processing of all submitted business data for purposes beyond content safety, including service usage analysis.
The clause establishes an opt-in default that protects business customer data from contributing to model training across a defined set of products and a specific time boundary.
By adopting the statutory definitions of 'sell' and 'share,' this prohibition is scoped to the specific legal meanings under U.S. Privacy Laws and the CCPA, which have distinct legal significance for…
This clause establishes Customer control over data processing as the default, with the only override being a legal obligation imposed on OpenAI—limiting OpenAI's discretion to use Customer Data for o…
The provision establishes the operational scope of data utilization within the service delivery model. It defines what uses of submitted content fall within the authorized scope of the agreement and …
The provision establishes a default authorization for content reuse unless the user takes affirmative action to opt out, which affects how user-submitted materials are incorporated into service devel…
The clause establishes that model training from business data is not an automatic practice, meaning customers must take affirmative action for such use to occur.
The clause establishes OpenAI's operational authority to incorporate user content and feedback into service development and improvement activities. This authorization permits the company to leverage …
Users' Personal Data is explicitly excluded from commercial advertising ecosystems involving sale, cross-contextual behavioral sharing, or targeted advertising processing.
Users' Content may be used for a broad range of operational and developmental purposes, including improving the Services, which may affect expectations about how submitted content is handled.
The worldwide scope and breadth of permitted uses means user Content may be used for ongoing service development and improvement, not only for delivering the immediate service to the user.
The license is perpetual and irrevocable, meaning OpenRouter retains rights to the User Content for commercial purposes even if the user later opts out or terminates their account.
Once your personal information is anonymized, deidentified, or aggregated by OpenSea, it faces no stated restriction on how OpenSea may use or share it.
Personal data processing — including inferences about health status — occurs as part of ordinary Service use, meaning using the Services necessarily involves this processing.
The creation of Inferred Data through data combination means Palantir's profile of an individual may extend beyond what that person directly provided, incorporating external sources.
Personal data may be disclosed or transferred as part of corporate transactions, including ones that are only proposed and may not be completed, and across a broad range of transaction types.
The enumerated-purposes restriction limits how Palantir may use Sensitive Personal Information, constraining it to specific categories rather than general business purposes.
The breadth of data categories used for targeting — including inferred data and data shared with third-party platforms — means a wide profile of an individual may drive advertising directed at them.
This restriction limits how sellers and other users can leverage customer data obtained through PayPal, specifically blocking marketing use without prior customer consent.
User data directly drives both content personalization and targeted advertising, meaning behavioral and interest data is used for commercial purposes beyond service delivery.
Peloton's advertising practice involves third parties who may independently track user activity across platforms using cookies and similar technologies.
Customers have no ownership interest in Usage Data and receive no compensation for Perplexity AI's use of it, regardless of how that data is applied.
The license covers a wide range of actions—including modification and promotion—beyond what is necessary purely to deliver the service, meaning user content may be used in ways that extend beyond the…
Both sides of the user interaction—inputs and generated outputs—are subject to processing by Perplexity AI, meaning the full scope of a user's engagement with the service is captured.
This establishes that user data contributes directly to AI model development, meaning user interactions may shape the capabilities of Perplexity AI's products.
If the data transfer were legally reclassified as a Sale or Share, it would trigger significantly different and more onerous obligations under US Privacy Laws for both parties; this clause makes the …
User data contributes directly to AI model development, meaning personal information may shape the behavior of Perplexity AI's core technology.
Customer Content submitted through the Services cannot be used to improve or develop Perplexity AI's or any third party's generative AI models.
These prohibitions directly constrain how Perplexity AI may handle Personal Data, preventing commercial exploitation of the data and limiting its use to the specific service context.
Restricting processing to documented instructions and a named purpose limits Perplexity AI's discretion over how it uses Personal Data, anchoring permissible processing to the Customer's direction.
This restricts Perplexity AI's permissible uses of Google account data to those allowed by Google's own policy, providing an external compliance floor beyond Perplexity AI's own privacy policy.
Email content is highly sensitive; this prohibition prevents Perplexity AI from using the substance of users' emails to develop its AI systems.
This commitment directly addresses one of the most significant concerns about AI services—that user data could be used to improve the AI—by explicitly excluding Personal Data from LLM training.
Email contents are among the most sensitive personal data; this clause confirms that linking the service triggers analysis of both incoming and outgoing messages.
This is a categorical exclusion that directly limits how Perplexity AI may use email content, distinguishing email data from other user data that may be used for AI model improvement.
The license covers a wide range of uses of user content, including modification and promotion, and explicitly extends to Output generated from that content.
The prohibition explicitly extends to third parties, preventing Perplexity AI from outsourcing model training on Customer Content to partners or vendors.
User-generated content, including everything entered into and produced by the Service, may be used to commercially develop Pika's AI systems.
Enterprise customer data processing falls entirely outside the scope of this Privacy Policy, meaning the protections and disclosures in this policy do not apply to that category of processing.
This confirmation expressly limits Pinecone's use of Customer Personal Data to Agreement-defined and CCPA-permitted purposes, providing a contractual basis for challenging any use that falls outside …
This dual constraint—necessity and documented instructions—limits Pinecone's discretion in how it handles Customer Personal Data and establishes the basis for any processing outside those bounds bein…
Third-party advertising partners are given access to Website usage data and analytics functions, meaning your data may flow to external parties for commercial purposes.
Pinterest's use of offsite browsing behavior to generate content recommendations means user activity on third-party websites influences what users see on the Pinterest platform.
Age verification through facial estimation and government ID matching involves collection and processing of biometric and identity document data, which are sensitive categories of personal informatio…
This clause incorporates additional Pinterest policy documents as binding obligations whenever data-driven targeting or measurement is used, expanding the contractual framework beyond the base guidel…
This clause strictly limits how advertisers may use data obtained via Pinterest's ad service, preventing repurposing of that data for any other business or targeting function.
The restriction covers even anonymized or aggregated data and requires written Plaid approval for each permitted use case, giving Plaid direct control over how End User data is exploited.
The grant extends beyond PlanetScale itself to its Affiliates and any third party PlanetScale chooses to authorize, giving a broad set of actors operational rights over Customer Content.
Personal information is used for advertising purposes, including personalization, which means user data informs what ads are shown to that user.
Some of Ramp's tracking technologies follow users across time and multiple services, enabling cross-context behavioral data collection that extends beyond any single interaction with Ramp.
Automated processing of Personal Information for fraud detection means users' data may be evaluated by automated systems that can flag or act on their account activity without human review.
Users cannot rely on this Privacy Policy to understand how their Personal Information is handled when Ramp acts as a Processor for their Company; a separate Agreement governs those processing activit…
Information collected through Redfin's Services may be used to shape advertising shown to users on external websites and platforms, not only within Redfin's own Services.
The license includes the right to create derivative works and publish Customer Data, which extends Replicate's permitted use beyond mere storage or processing.
Legitimate interest is a legal basis for processing personal data; Replit's assertion of it for ML training means user data may be used for model improvement without requiring explicit consent.
De-identified data falls entirely outside the Privacy Policy's protections, and Replit's use and sharing of it is unrestricted in its discretion, removing any policy-based recourse for users.
Special category data receives heightened regulatory protections under data protection frameworks like GDPR. This clause establishes the operational basis for Revolut to collect and process these sen…
The clause creates a parental gatekeeping mechanism requiring affirmative approval before child account creation and establishes a data minimization standard that constrains the scope of information …
By authorizing these uses, users grant Ring the ability to handle their content as necessary to deliver the Offerings, establishing the legal basis for Ring's processing of user content.
The restriction limits how ad partners may use personal information they receive from Riot Games, constraining those partners to a service-provision role rather than independent data use.
This commitment directly addresses a data practice that state privacy laws such as the CCPA specifically regulate, indicating Riot Games does not engage in it.
The license is broad in scope, transferable, and sublicenseable, meaning Ro can pass these rights to third parties without further user consent.
This clause establishes that personal information is used for targeted advertising and effectiveness measurement, which is significant given the sensitive nature of the health data Ro collects.
Personal Information is not used solely for account management or service delivery but also to drive advertising targeting, confirming a commercial use of user data.
Behavioral data collected through cookies by multiple parties is used to target advertising at the user, meaning RunPod's partners independently receive and act on that data.
Content users submit to or receive from the Services may be incorporated into Runway's AI training pipeline, affecting how users' data contributes to the development of commercial AI products.
User information may be used for targeted content delivery not only within the Service but also across third-party locations on the Internet, extending its reach beyond Runway's own platform.
The word 'only' limits Runway's use of biometric data to the user's specific request, restricting secondary uses such as advertising or model training.
The explicit statement that managed data belongs to the customer, not Salesforce, directly addresses data ownership and control, which has significant implications for data rights and use.
Advertising and direct marketing reach extends beyond Samsung's own platforms to third-party websites and social media, broadening the contexts in which users are targeted based on their data.
The grant is the contractual basis on which Twilio and its affiliates may lawfully process the reader's customer data, and it is scoped by both the agreement and the Data Protection Addendum.
Sub-processors are contractually bound to act on behalf of customers and follow customer instructions, establishing that customer instructions—mediated through Twilio—govern sub-processor conduct.
Identity resolution links data across devices and touchpoints into a unified profile, meaning Segment can track and associate a reader's activity across contexts.
Sensitive Personal Data is subject to a higher standard of justification for use or disclosure, requiring either specific consent where mandated or a lawful basis.
Users' personal data and content are not treated as a revenue source by Signal under any circumstances.
Customer Data use is bounded by Customer instructions and applicable law, meaning individual users' data is governed by the Customer's choices rather than the user's own.
The version of the Data Processing Addendum at term start is locked in as the governing document for personal data processing, which determines the customer's data protection rights and Smartsheet's …
This is an explicit restriction on how Snapchat uses private communications, carving them out from the personalization and ad-targeting data uses described elsewhere in the policy.
Snapchat extracts data from the substance of user-posted media—not just metadata—to personalize what content users see.
Information collected across multiple Snapchat services is combined and applied to personalize the experience, and automated tagging based on location or time of day means passive data points shape c…
User activity across separate Snapchat services is aggregated to build interest profiles that influence what is shown in unrelated features, meaning no single interaction is treated in isolation.
Consent is established by default through inaction, meaning the reader need not affirmatively agree for SoFi to rely on the user's deemed agreement to use the technologies.
Customers retain assurance that their content will not be mined or repurposed to benefit Sourcegraph's product development beyond the service they are receiving.
Customers using Cody Enterprise or Cody Pro teams are assured their code is not used to train the underlying models, protecting proprietary codebases from being incorporated into model weights.
The qualifier 'intentionally' means that inadvertent extraction, storage, or use of personal data from User Content is not excluded by this commitment, limiting the absolute scope of the protection.
It removes all Privacy Policy-based protections from de-identified data, meaning Squarespace retains broad freedom to monetize or distribute such data.
This clause identifies a legal basis for processing personal information without user consent, meaning consent is not an absolute prerequisite to processing in all circumstances.
This establishes targeted advertising as a stated processing purpose, meaning user data may be used to profile and serve individualized advertisements.
This clause establishes the legal basis for Starbucks to use personal information for behaviorally targeted advertising, a practice that relies on tracking user behavior across contexts.
An absolute prohibition on sale, with no stated exceptions, provides a firm commitment that Personal Information will not be monetized through direct sale regardless of circumstances.
The scope is unrestricted — 'any business purpose' places no ceiling on how anonymized or aggregate data may be exploited commercially.
This discloses cross-site behavioral tracking shared with third-party advertising partners, meaning user activity data leaves StockX's own environment and drives off-site ad targeting.
This provision places explicit restrictions on how a sensitive category of data—health information from integrations—can be commercialised or transferred, offering users a defined protection.
The clause constitutes the User's standing processing instruction to Stripe, meaning Stripe's data processing activities are authorised and scoped by those two documents.
Representatives' Personal Data is actively shared with third parties as part of legally mandated compliance screening, not merely processed internally.
Initiating—but not completing—a purchase triggers sharing of your Personal Data with the Business User, meaning incomplete transactions are not data-neutral.
This contractual restriction limits sub-processors from using personal data for independent purposes, providing a structural safeguard for Business Users and data subjects whose data flows to third-p…
Direct messages on Substack are accessible to Substack personnel for defined operational and enforcement purposes, meaning they are not private from the platform operator.
Biometric information — a sensitive data category — is used not only to deliver services but also to train AI models, meaning it contributes to Suno's core technology development.
Content and activity data that users generate — including Submissions — may be used to train Suno's AI models, meaning user-generated material contributes directly to Suno's core technology.
Users retain a consent-based barrier against Supabase accessing the data they store and manage within the Service.
Supabase's authority to send marketing communications is expressly limited by user consent, meaning users who have not consented should not receive such communications.
The clause establishes that user interaction and service-performance data are actively processed for Synthesia's own platform improvement and research purposes.
The clause establishes that the Customer, not Synthesia, directs how the Sample is processed, making the Customer's instructions the primary constraint on Synthesia's processing.
By framing the DPA as reflecting processor obligations, the clause positions Synthesia in the processor role with respect to Customer Data, which carries specific legal responsibilities under data pr…
The clause defines the specific purposes for which Biometric Data may be processed, which bounds the lawful scope of Synthesia's use.
The clause protects Synthesia's content and data from being used as inputs to competing or derivative AI systems.
Without consent, T-Mobile may not use sensitive personal data to build inferences or profiles about a user's characteristics.
Opting in triggers analysis by both T-Mobile and unnamed third-party partners of a broad set of sensitive data categories including precise location and CPNI.
The clause explicitly restricts Tabnine's use of a user's code to that individual user's Service improvement, prohibiting its use to benefit other users or for any other purpose.
The clause establishes that Tabnine uses user data for advertising purposes including interest-based targeting, which means user behavior or profile data may influence the ads served to them.
This is a direct statement that user data is not applied for targeted or behaviorally driven advertising, distinguishing Telegram's stated practice from many other platforms.
The legitimate interests basis is a specific legal justification under data protection law that does not require user consent, meaning Telegram does not need your permission to process data on this g…
Personal information — including an individual's identity — may be embedded as metadata or tags within published news content, potentially making it persistently and publicly associated with that con…
Thomson Reuters's use of personal information for interest-based advertising means user data is applied to target individuals with commercial messages tailored to their inferred preferences.
The data use is not confined to Threads alone but extends to other Meta Products, and the governing purposes are defined by the broader Meta Privacy Policy rather than solely by Threads' own policy.
The explicit inclusion of advertising within business services confirms that user data collected on Threads is used to support ad-related purposes.
The absolute restriction on use or disclosure of sensitive personal information, subject only to two defined exceptions, limits Ticketmaster's ability to monetize or share that data for other purpose…
Attendees' biometric and identifying characteristics may be recorded and published in commercial marketing contexts without an additional opt-in at the point of capture.
User behavior data is applied to improve TikTok's AI systems, meaning routine platform use directly contributes to the development of TikTok's proprietary technology.
Users' identities can be associated with commercial content without their case-by-case consent and without payment, which affects how users may appear to be endorsing products or offers.
The prohibition prevents advertisers from leveraging TikTok's data to construct audience profiles or targeting segments, restricting a common data-monetization practice.
This cross-platform identity matching allows TikTok Ads to connect a user's real-world and third-party digital activity directly to their TikTok identity, expanding the scope of the data profile buil…
User data is not used solely for delivering a service to the user but also to develop and refine TikTok Ads' proprietary AI systems.
Users' own content may be repurposed by TikTok Ads for commercial promotion of the platform, meaning content created for personal or creative purposes can be used as marketing material.
Users' data is protected from being used in model training unless they have affirmatively opted in and consented, establishing a clear barrier against default use of user data for training.
Identity resolution means Twilio links data about an individual across multiple devices and interactions into a unified profile, expanding the scope of personal data aggregation.
This grant authorises Twilio and its affiliates to process Customer Data, with the scope of that processing bounded by the Agreement and the Data Protection Addendum.
This confirms that automatically collected data is actively used for targeted advertising and marketing analytics, directly affecting the commercial use of user behavioral data.
Personal data is used for behavioral profiling that directly drives personalized advertising shown to users within Uber's platforms.
User data is used not only for immediate service delivery but also to build and improve the underlying AI models that drive Uber's platform.
Uniswap commits to not cross-referencing information users voluntarily provide with identifying data points such as wallet or IP address, limiting profile-building.
This clause allows UnitedHealthcare to enrich its data holdings on a user by merging their information with additional data from vendors and other sources, potentially expanding the profile held abou…
Unity obtains a broad license to use User Data not only for the Offering the user is directly accessing but also for developing and improving other Unity services and products.
This commitment directly addresses two of the most commercially significant uses of consumer data, providing a basis for users to assess the commercial use of their information.
The claim establishes both a broad use of user information for product development and the existence of a customer control mechanism specific to AI product training.
The claim establishes that user information and tracking technologies may be used for targeted advertising purposes involving third parties, which has direct implications for user data flows outside …
This clause discloses that Verizon actively uses mobile browsing and app usage data—potentially sensitive behavioral information—to shape the marketing and recommendations users receive.
The permission is unlimited in purpose and the listed uses are non-exhaustive, meaning Visa faces no restriction on how it may use material users send to the site.
This clause establishes that Walmart's view of a consumer is not siloed by channel or entity — data from across the corporate family and across touchpoints can be merged into a unified profile.
User inputs are not limited to answering only the submitting user's questions but may also be used to respond to other users and to train or improve the AI system, expanding the scope of data use bey…
This clause establishes that targeted advertising is an explicit stated purpose for which Walmart uses consumers' personal information.
This clause establishes that personal information may be used to train Walmart's AI systems, meaning consumer data directly informs the development of automated systems.
Walmart applies an opt-in rather than opt-out standard for these two categories of data use, meaning no action occurs without the consumer's prior affirmative agreement.
Personal data is used directly to power targeted advertising, meaning your information shapes which ads you are shown.
The act of linking an account or directing retrieval functions as affirmative consent to data processing, binding the user without any separate consent step.
Customer Data is used not only to deliver the service but also to build new products and improve AI Features, meaning the reader's data contributes to Weights & Biases' broader commercial development.
Free and academic customers' data is available to Weights & Biases for internal testing and development, meaning it is used beyond service delivery for product-building purposes.
The clause permits use of user data for targeted and cross-context behavioral marketing, meaning data may be used to track and target users across different platforms and services for commercial purp…
The clause establishes a broad set of internal purposes for which customer data may be used, including product development and optimization that extend beyond delivering the immediate service.
Data shared from WhatsApp with Meta Companies is used for targeted advertising across Meta's product ecosystem.
End-to-end encryption, as described, limits even WhatsApp's own ability to read message content, which affects the scope of data WhatsApp can access or share.
Customer Data may be used to train Windsurf's AI models by default; the opt-out right exists only for paid-tier subscribers, meaning free-tier customers have no opt-out mechanism.
This clause establishes that model training on customer data is an active default practice, meaning customers who do not take affirmative steps to opt out are subject to this use of their data.
This clause establishes an absolute prohibition on model training using Enterprise customer data absent express prior written consent, providing a stronger protection than the default opt-out availab…
The controller/processor distinction determines who bears primary legal responsibility for data protection decisions and to whom individuals must direct rights requests.
This establishes that user data is used for personalized advertising by both Writer and third-party advertising partners, meaning user data flows to advertising partners for ad personalization.
It establishes that no customer-provided or platform-generated content is used to improve or build Writer's models.
This is an absolute prohibition on using user-provided data for model training, which directly addresses a common concern about AI services using user content to improve their systems.
Consent unlocks Wyze's ability to use identifiable video footage and AI-generated descriptions as training data, directly linking user content to the development of Wyze's AI systems.
Wyze uses user data to deliver targeted advertising outside of its own Services, on third-party platforms and websites.
The clause establishes that Xfinity's use of personal information extends to advertising third parties' products and services, not solely its own offerings.
Once information is aggregated or deidentified, Xfinity faces no stated restriction on how it uses, shares, licenses, or sells that data, including commercial sale to third parties.
The clause permits Xfinity to create comprehensive data profiles by merging internally held data with third-party information and usage data across all of its platforms.
Account information — not just browsing behavior — may be used for advertising and ad attribution purposes, broadening the scope of data applied to commercial uses.
Personal Information is used to support cross-context behavioral advertising, meaning it may inform targeted advertising based on activity tracked across different websites or services.
Framing the data use as a customer instruction means the customer has formally authorized Zendesk's use of service data for product improvement, not just service delivery, which broadens the scope of…
Tracking technologies enable data collection that persists across browsing sessions, and the involvement of third-party partners extends data access beyond Zillow itself to external entities.
This statement directly addresses a common concern about data broker practices, asserting that ZipRecruiter does not engage in selling personal data for profit.
These representations and warranties expose the client to legal liability if they use the Resume Database or its personal data in violation of applicable laws.
Characterizing disclosures as a potential 'sale' or 'use for targeted advertising' under privacy law may trigger statutory rights for users under those laws.
Subprocessors are contractually required to follow Customer instructions as relayed by Zoom, meaning Zoom acts as the conduit for Customer control over how personal data is processed.
Employee access to Customer Content is prohibited by default and limited to two defined exceptions: account owner authorization and legal, safety, security, or support necessity.
Customer Content is expressly excluded from Zoom's marketing and promotional activities, providing users a defined protection against that specific use.
The voluntary nature of research participation and the IRB consent requirement are the two conditions governing whether a user's data may be used for research.
Adobe's analytics on Cloud Content means user-generated content—not just behavioral metadata—may be processed to study usage patterns, though opt-out rights exist.
The existence of a Cookie Preferences mechanism indicates users may have some ability to control cookie-based tracking.
The disassociation provides only conditional anonymity: Anthropic preserves the operational capacity to re-identify flagged content, meaning the separation is not permanent and can be reversed for en…
Personal information you provide or generate may be used directly to shape the advertising and content Anyscale delivers to you, subject to applicable law.
The clause establishes that feature improvement occurs at an aggregated level, explicitly excluding collection of individual user data or content.
Your personal information and usage data are used not only to operate the Services but to target you with advertising and support Atlassian's business development.
Communications you send through online banking — including secure messages and transaction notes — may be reviewed by the bank, and this consent is a condition of using the service.
This clause establishes that marketing use of Personal Data is active by default and requires the user to affirmatively opt out to stop it.
User information is actively used for targeted marketing across multiple communication channels, meaning personal data drives promotional outreach.
This establishes a conditional prohibition on training use of cached files, tied specifically to privacy mode being active.
Collected user and product data is used for ongoing product improvement, meaning usage data informs Datadog's development decisions.
User information is used not only for service delivery but also for marketing and advertising purposes, including personalization of ads.
User information is actively applied to select and deliver sponsored content, meaning personal data shapes the commercial promotions a user sees.
DoorDash is using third parties' behavioral data—your contacts' ordering history—to influence what merchants you see, without those contacts' activity being directly attributed to them in communicati…
The clause authorizes ElevenLabs to process personal data beyond merely delivering the service, extending to internal business functions such as product development and benchmarking.
FanDuel's authority to use both personal and non-personal information across a broad set of communication channels means users may receive unsolicited marketing through virtually every major contact …
Garmin's use of tracking technologies for both content personalisation and ad measurement means user behaviour on its sites informs advertising evaluation.
It identifies the infrastructure provider and a security mechanism underlying the service, which affects where data is processed and how it is protected.
Combining Service Data with data from other Google products can result in a broader profile of users than any single service would generate alone.
It establishes a current restriction on ad-targeting use of chat data and a commitment to give clear notice before that restriction is lifted.
The any-purpose scope means anonymized derivatives of user data face no use restriction, so data collected for one reason can underpin entirely unrelated activities.
Customers interacting with Greenhouse's support, marketing, or sales functions are subject to specific data use permissions and restrictions.
User information is used not only for Groq's own marketing but also to promote third-party products and services, expanding the scope of commercial use.
Publicly available information about individuals or entities may be incorporated into Harvey AI's training data without those individuals being Harvey AI customers or having any direct relationship w…
Users' personal information is used not only for Headspace's own marketing but also to surface third-party opportunities, meaning data serves promotional purposes beyond the core service.
Legitimate interests is a self-assessed lawful basis that allows Leonardo AI to process personal data without consent, covering a broad range of commercial activities including marketing and advertis…
LlamaIndex can build a profile of inferred characteristics about users beyond what users directly provide, expanding the scope of personal data held about them.
Users' personal data and behavioral data are used not only for service delivery but also for targeted advertising, meaning usage data fuels commercial marketing.
Personal data is used for marketing and advertising purposes, which is conditioned on either legal permission or user consent, meaning the scope of this use varies by jurisdiction and individual cons…
Participation in MetaMetrics analytics allows MetaMask to connect behavioral event data to identifiable on-chain identifiers, increasing the specificity of data associated with a user.
This clause establishes marketing and advertising as an explicit purpose for data use, and conditions that use on consent only where applicable, not universally.
Services Data is used not only to operate the service but also to personalize it and improve AI Features, meaning user data actively shapes product development and individual experience.
This clause establishes OpenAI's operational rights to process and utilize user-submitted content across service functions. The broad scope of authorized uses—including modification and derivative wo…
Users' personal data is actively applied to advertising decisions, meaning data collected through use of the service is fed back into targeting users with promotional content.
Personal information is used not only for service delivery but also to market products and services from outside parties, meaning your data reaches third-party partners for promotional purposes.
The act of clicking submit functions as legally operative consent to commercial email use of the user's email address, binding the user without a separate opt-in step.
The act of clicking submit functions as consent to email marketing, meaning users who do not want marketing communications must be aware of this consequence before clicking.
The act of clicking submit is treated as affirmative consent to email marketing, meaning the user grants Paramount+ permission to use their email address for ongoing commercial communications.
Once data is aggregated or deidentified, all Privacy Policy protections cease to apply, and Peacock faces no stated restriction on how it may commercially exploit that data.
Once data is anonymized or de-identified, Pinecone faces no restriction on how it uses or shares that data, including for commercial purposes.
Users' personal data is applied to marketing activity, meaning information collected through service use may be directed toward promotional purposes.
This identifies a specific sub-processor and the defined purpose for which personal data is processed, limiting that sub-processor's use to that stated function.
Users' detailed on-platform behavioral activity — not just purchases — is used to build personalized advertising, meaning routine browsing generates data with advertising value.
User communications — which may include personal details shared in customer service contexts — are used as training and development material for an AI system.
Slack's use of Other Information to shape search results means user behavior and metadata can influence what content is surfaced to Authorized Users.
It establishes that account and subscription data are actively used to shape what advertising users receive, not merely held passively.
Once data is anonymized or de-identified under this standard, it is no longer treated as customer information, potentially removing it from the privacy protections that apply to customer information.
Users' individual activity data contributes to publicly visible aggregate features, meaning personal movement data has uses beyond the user's own account.
Users' personal information is actively used to target them with marketing, not merely to deliver the core service.
This use extends beyond TaskRabbit's own services to include partner advertising, meaning user data may be used to promote third-party commercial interests.
Consolidating data across offerings means TurboTax can build a broader profile of a user's financial situation and use it to surface recommendations.
User information is used as training data for machine learning systems, meaning it contributes to automated moderation infrastructure beyond any immediate operational use.
It establishes that a single overarching program is responsible for protecting all information Visa collects and uses, without carve-outs.
Your information is actively applied to track your online activity and target you with advertising tailored to your interests.
Personal data is used not only to deliver services but also to build and refine AI systems, extending the scope of data use beyond immediate transactions.
This clause establishes an explicit permitted use of customer data for operational purposes, meaning customer data may be accessed or processed during incident response and debugging activities.
A persistent app-level identifier is used to profile a child's viewing and search behavior for recommendation purposes, meaning behavioral data is actively used to shape the child's content experienc…
Signing out of the app does not stop YouTube Kids from using existing watch and search history for recommendations; a parent must take the additional affirmative step of clearing and pausing history …
Monitor emails you the same day a platform you choose changes these clauses.
A data usage clause is a provision in a platform's terms of service or privacy policy governing data usage-related rights, obligations, or restrictions.
ConductAtlas tracks 279 platforms with data usage clauses - roughly 79% of platforms in the archive. 881 are classified as high severity.
Severity reflects the magnitude of rights waived, availability of opt-out, breadth of users affected, financial or legal exposure created, and the degree of discretion retained by the platform.