Calm
· Calm Privacy Policy
Third-party tracking extends beyond Calm's own services and may result in your browsing behavior across other websites being collected and used to target you with ads.
Webull
· Webull Privacy Policy
Automated collection of device identifiers and detailed behavioral data creates a persistent profile of how you use the platform, which the policy permits to be used for analytics and potentially shared with third parties.
eBay
· eBay Privacy Notice
Behavioral tracking across eBay's platform creates a detailed picture of your interests, purchasing patterns, and preferences that is used for advertising targeting, including sharing with advertising partners.
This provision goes beyond standard usage analytics to assert the right to profile users on psychological and aptitude dimensions, which has implications for how your data is categorized and potentially shared.
Affirm
· Affirm Privacy Policy
Behavioral profiling means Affirm uses your financial activity to make inferences about you that go beyond your loan transactions, which can affect what products you are shown and potentially how you are assessed.
GOAT
· GOAT Privacy Policy
Behavioral inferences are a distinct category of personal data that can reveal sensitive information about your lifestyle, spending habits, and interests, and their use for marketing or sharing with partners may go beyond what users expect from a shopping platform.
Your neighborhood conversations, neighbor connections, and browsing behavior within Nextdoor are tracked and used for profiling, meaning your community activity generates advertising data.
Session replay tools can capture detailed behavioral data including form inputs, navigation patterns, and potentially sensitive content entered during a session, going beyond standard analytics into detailed behavioral surveillance of platform use.
Windsurf
· Windsurf Security & Data Handling
The document explicitly states that no zero-data retention agreement exists with Bing, meaning data derived from user code and conversation history sent via web search queries may be retained by Microsoft's Bing service, with no contractual guarantee of deletion.
Biometric data carries heightened legal protection in several states, and the 90-day vendor destruction timeline is a contractual commitment rather than a statutory minimum, meaning enforcement depends on Wealthfront's vendor contracts rather than direct regulatory obligation in all jurisdictions.
This clause clarifies that privacy protections in the policy do not extend to on-chain data, which is permanently and publicly visible by anyone including data brokers, analytics firms, and regulators.
Bluesky collects detailed behavioral data about your activity within the app, including content you view but do not interact with, which goes beyond what many users expect from a social media platform and may be used for analytics, product development, and marketing purposes.
The scope of automatic collection is broad, covering behavioral and location data even when you are not connected online, and includes granular in-game actions, which goes beyond what many users expect from a gaming platform.
The collection of advertising identifiers and application installation data alongside usage behavior enables detailed user profiling that goes beyond basic service delivery.
The breadth of data categories collected across all Disney services means that activity on one platform can be linked to your profile on others, building a detailed picture of your preferences, habits, and household.
The breadth of data types collected across Samsung's device ecosystem means that users of multiple Samsung products may have significantly more personal data collected about them than users of a single product or service.
The breadth of data collected across multiple touchpoints (console, mobile, web, retail) means Nintendo builds a detailed profile of each user's gaming behavior, spending patterns, and device usage, which informs advertising targeting and product decisions.
The scope of automatic data collection means that even casual browsing of Eventbrite creates a detailed behavioral profile that may be used for advertising or shared with third parties.
Chime
· Chime Privacy Policy
The combination of sensitive financial identifiers, government identification, and behavioral tracking data creates a comprehensive profile; understanding what is collected helps you assess your exposure if there were a data breach or unauthorized use.
The breadth of Usage Data collected, including behavioral inferences, feeds both personalization and advertising functions and represents the primary data set shared with third-party advertising and analytics partners, making it the most operationally significant category in the policy.
Cursor
· Cursor Privacy Policy
The policy states that administrators can access and manage a user's service activity, which may include visibility into usage patterns or account-level data beyond just email and account status.
PayPal
· PayPal User Agreement
This provision establishes ongoing consent for credit report pulls tied to PayPal's unilateral determination of elevated risk, without defining specific criteria for what constitutes an increased risk level, which creates indefinite authorization for credit inquiries during the life of a business account.
Employees using a work email for a personal Claude account may have their conversations visible to their employer's IT administrator without realizing it, particularly if the notice came through a general workplace IT policy rather than a specific Claude-related notification.
Users who access Claude.ai with a corporate email address may have their conversations (Materials) visible to their employer's administrator, and the terms permit Anthropic to forego individual notice to the user if the employer has already notified them of monitoring policies.
Adobe
· Adobe Terms of Use
Personal users who used a work email for their Adobe account risk losing control of their account and all associated content if their employer subsequently joins Adobe as a business customer, even retroactively for content created before the takeover.
This provision establishes that personal data including submitted content and user identifiers may be disclosed to prospective acquirers or transaction counterparties prior to any transaction closing, without specifying conditions or limitations on that disclosure.
The policy authorizes transfer of personal data to a successor entity in a business transaction; while notice is promised, the policy does not specify how far in advance notice will be given or what rights users have to object or delete their data before the transfer.
Canva
· Canva Privacy Policy
This provision authorizes transfer of user personal data to third parties in the context of a corporate transaction. The notice commitment provides some protection, but the practical ability of users to withdraw consent or delete data prior to a transfer depends on response timelines and how notice is delivered.
This provision states that user personal data is an asset that may be transferred to a new entity in a corporate transaction, and the receiving party may operate under different data practices than the current policy describes.
This provision permits the transfer of your personal data to an entirely different company in a corporate transaction, with the only protection being a general consistency commitment rather than specific contractual obligations or user notification requirements.