Subprocessors are downstream vendors who also access or process personal data. The terms governing how and when customers are notified of new subprocessors affect whether businesses can maintain adequate oversight of their data supply chain.
Pinecone
· Pinecone Data Processing Addendum
This clause limits Customer's contractual remedies on subprocessor disputes to termination with prepaid refund, foreclosing other remedies such as damages or injunctive relief. The 15-day objection window is operationally tight for organizations with complex procurement or legal review processes.
The 10-day objection window is short for enterprise procurement cycles, and the remedy for an unresolved objection rests with Mistral AI, which retains the right to terminate the agreement rather than being required to find an alternative. This asymmetry places practical risk on customers who depend on Mistral AI services and cannot easily substitute vendors.
Stash
· Stash Terms of Use
The clause establishes the data collection and sharing mechanism necessary for subscription account administration, specifying both the categories of information required and the parties who may access it for discrete operational functions.
Runway
· Runway Privacy Policy
The provision establishes the operational framework for data sharing with third-party advertising and analytics partners as a standard business practice within the service. This authorization affects how user information flows through the service ecosystem and enables cross-platform advertising coordination.
Hinge
· Hinge Privacy Policy
This provision establishes the operational framework through which Hinge facilitates data sharing with advertising partners for behavioral profiling and audience targeting. The hashing mechanism described allows advertisers to conduct audience matching and lookalike targeting while the provider claims the resulting identifier cannot re-identify the user.
Your Disney account data, including what you watch, your demographics, and inferred interests, may follow you around the internet through targeted advertising on third-party platforms unless you actively opt out.
Target
· Target Privacy Policy
This provision establishes that Target Plus marketplace transactions involve personal information disclosure to third-party sellers who are not directly subject to Target's privacy policy, creating a data flow that consumers may not associate with a Target-branded transaction and that may require evaluation under applicable data sharing and service provider frameworks.
The clause conditions access to third-party account data retrieval on explicit consent and specifies the scope of permitted uses—both for service delivery and, if applicable, for account management purposes. This establishes the legal basis under which Wealthfront processes credentials and account data obtained from external financial institutions.
Linking your external bank or investment accounts shares your financial credentials and account data with Wealthfront and unnamed third-party aggregators, and the terms disclaim any responsibility for the accuracy or security of that data.
This provision authorizes cross-site behavioral tracking by third-party advertisers, meaning information about your browsing habits may be collected and used by companies other than Pinecone to target you with advertising.
This authorization establishes the operational framework under which GM discloses user data to external advertising and analytics partners. The provision defines the categories of third parties who may receive personal information and the specific uses—targeted advertising and usage analytics—for which such sharing is permitted.
This provision establishes the operational framework for data monetization and service analytics. It defines which categories of third parties receive access to user data and the purposes for which such sharing is authorized within the service delivery model.
The provision establishes the operational framework for data acquisition across multiple collection channels, which directly enables the advertising and analytics functions described in the policy. This multi-source collection mechanism determines the scope of data available for third-party sharing and targeting operations.
This provision establishes a data-sharing relationship with third-party advertising partners that may constitute 'selling' or 'sharing' of personal data under CCPA and CPRA, triggering opt-out rights for California residents and requiring specific disclosures. Under GDPR, sharing behavioral data with advertising partners for targeted advertising requires a valid lawful basis and, in many interpretations by EU supervisory authorities, explicit consent.
Sharing personal data with advertising and analytics partners may constitute a sale or sharing of personal information under CCPA, triggering opt-out rights for California residents, and requires valid consent under GDPR for cookie-based tracking.
The clause establishes the operational scope of data sharing within Grammarly's service delivery and marketing functions, specifying that user information flows to external parties who provide analytics, advertising, and platform integration services.
Your browsing behavior on AI21's website is shared with multiple advertising platforms, which may use it to build profiles about you and target you with ads on other websites and apps, often without requiring your awareness.
Zoom
· Zoom Privacy Statement
The clause establishes the operational framework for Zoom's use of third-party service providers in advertising and analytics functions. This practice affects which entities receive access to user personal data and the purposes for which that data is processed.
This clause establishes the operational framework under which Nintendo engages third-party service providers for data collection and advertising delivery. The provision specifies that data sharing occurs for targeted advertising purposes, which constitutes a material business practice affecting how user information flows within the service infrastructure.
Twilio
· Twilio Privacy Notice
The clause establishes the operational mechanism by which Twilio shares customer data with marketplace partners. This data sharing is structured as integral to enabling integrated services that customers select, rather than as a separate or optional disclosure practice.
For a developer infrastructure platform, sharing user data with advertising partners may not be expected by users who assumed their data would only be used to operate the service they signed up for.
Canva
· Canva Privacy Policy
The clause establishes a data-sharing framework that enables cross-platform advertising measurement and targeting. This practice is operationally significant because it extends data use beyond Canva's direct service delivery to support its advertising and performance assessment infrastructure.
Cross-site tracking by advertising partners is one of the more privacy-sensitive data sharing practices, and users who do not adjust cookie settings may have their behavior tracked across the web without realizing it.
The clause establishes Zendesk's operational practices for data collection and distribution to external partners, defining the scope of data sharing that occurs during website usage and informing the technical infrastructure for personalization and advertising delivery.
Figma
· Figma Privacy Policy
The provision establishes Figma's operational practice of permitting advertising partners direct access to user activity data for interest-based advertising purposes. This mechanism enables cross-website tracking and targeted ad delivery coordinated through third-party advertising networks.
Waze
· Waze Privacy Policy
This provision authorizes the disclosure of user data, including potentially location and behavioral data, to third-party advertising and analytics partners who may independently track users across digital environments beyond the Waze app.
Lime
· Lime Privacy Policy
Your usage data, device identifiers, and potentially location data are shared with advertising networks that can combine this information with data from other sources to build detailed profiles used for ad targeting across platforms.
This provision establishes the operational framework for data monetization and measurement activities. The authorization permits integration with external advertising and analytics systems, which affects the scope of data flows and third-party access to user information collected during service use.
Notion
· Notion Privacy Policy
The policy authorizes sharing personal information including usage data and identifiers with advertising and analytics partners, which combined with the tracking technologies observable in the page source (Facebook Pixel, Google Ads, LinkedIn Insight, Twitter) means user data may be transmitted to multiple third-party ad platforms.