Recent policy changes

Why it matters: The updated DPA restructures how subprocessor disclosures are communicated and managed, shifting from static document amendments to a live online registry that customers must actively monitor. The introduction of product-specific data postures for Embeddings API and Perplexity Search creates a more complex compliance model where different services operate under different rules, which organizations subject to GDPR or UK GDPR must carefully track to ensure their own data controller obligations are met.

Why it matters: The updated pricing reflects a material increase in per-token costs for mistral-medium-3-5 API consumption and a shift in the primary pricing currency to USD. Organizations that budget for Mistral API expenses, embed the model in production systems, or operate on margins sensitive to inference costs should evaluate the impact on their cost structure and contract terms.

Why it matters: The updated policy removes an explicit, prominent reassurance that personal data is not sold and user conversations are not shared with advertisers. While the document may retain substantive privacy protections elsewhere, the removal of this upfront commitment changes what assurances are immediately visible to users and may affect how privacy commitments are represented in third-party vendor assessments or customer-facing disclosures.

Why it matters: The updated terms fundamentally restructure dispute resolution from a private, streamlined arbitration process to mandatory public litigation in Texas courts with strict filing deadlines. Users in other states or countries face significantly increased friction and cost to pursue claims, and claims not filed within 1-2 years are permanently barred. This change affects access to justice and the practical enforceability of user rights under the agreement.

Why it matters: The updated terms substantially expand Perplexity's unilateral authority to modify which services are covered, introduce marketing data sharing outside the data processing agreement, and establish automatic acceptance of changes through continued use. For organizations with vendor governance frameworks, data processing agreements, or privacy representations tied to specific product scope and processor-only data handling, these changes create new compliance review obligations and potential gaps between what the organization has represented to customers or regulators and what Perplexity's terms now permit.

Why it matters: The updated terms establish broader authority for Indeed to process personal data for fraud, abuse, and security purposes beyond illegal activity, and explicitly permit sharing with law enforcement and government agencies where lawful, including voluntary sharing. Job seekers should understand that device information is now included when applications are transferred to employers' systems, expanding the data shared in the recruitment process.

Why it matters: The revised policy broadens the categories of personal data Indeed may process and the parties with whom it may share that data. The explicit authorization for voluntary law enforcement and regulator sharing represents a change from prior language focused only on illegal activities. The inclusion of device information in candidate data transfers expands the scope of data shared with third-party hiring platforms.

Why it matters: The updated terms explicitly authorize Twitch to use personal data to develop and deploy generative AI models and services, a purpose that was not previously stated in the policy. This change affects how Twitch may process customer data and establishes a new disclosed use case for personal information. Organizations that process Twitch user data or maintain privacy commitments about data use restrictions may need to assess alignment between their own disclosures and Twitch's expanded stated purposes.

Why it matters: The updated terms now explicitly disclose that personal data is used for machine learning and generative AI model development, establishing transparency around a significant data processing activity. This disclosure affects how customer data flows through Amazon's systems and aligns with emerging regulatory requirements around AI transparency in the EU and other jurisdictions.

Why it matters: The updated policy removes explicit documentation of how user data and AI interactions are used, and removes FAQ guidance on critical account control functions. This reduces transparency in the policy document itself, though the underlying data practices may not change. For users seeking to understand AI training use or locate instructions on account deletion, these removals mean the information is no longer in the privacy policy footer.

Why it matters: The restructured training framework directly affects how and when Mistral can use customer data, which is material for organizations subject to GDPR, CCPA, or internal data governance policies. The narrowed liability cap reduces recourse for confidentiality breaches and may shift risk allocation unfavorably in vendor relationships. These changes require review by compliance and legal teams to assess alignment with privacy obligations and risk tolerance.

Why it matters: The updated terms establish that Mistral AI's API and Studio products are no longer available to consumers on personal accounts. This is operationally significant because it eliminates a previously available service tier, requiring consumers who depend on these features to either convert to a business account or switch to alternative providers.

Why it matters: The updated terms establish that Hims & Hers can determine billing frequency (monthly or multi-month) and that refunds for partially used membership or medication periods are discretionary rather than contractually guaranteed. This materially shifts financial predictability and refund eligibility from fixed, contractual terms to company discretion, which may affect how subscribers budget for the service and plan cancellations.

Why it matters: The updated policy separates fraud-prevention data collection from analytics, establishes it as mandatory and non-optional, and identifies it as a distinct legal basis (legitimate interest in platform protection). This clarifies that users creating or accessing Fly.io accounts will have device and browser data processed by third-party services with no opt-out available, materially different from the previous implicit statement that non-analytics third-party collection was not permitted.

Why it matters: The updated terms establish explicit authority for Snap to require age verification as a condition of service use and clarify that account suspension and content removal decisions are made in Snap's sole discretion rather than under codified procedural guarantees. This creates material changes to how account disputes are processed and shifts responsibility for understanding appeal rights to external documents, which may affect how users can contest restrictions or challenge compliance decisions, particularly in jurisdictions with online platform safety laws.

Why it matters: The updated terms establish a new product feature (Bitcoin Auto-Withdrawal) that expands the functionality of Cash App's virtual currency services by enabling scheduled automated transfers, while also codifying hold periods that previously were described only in vague terms. This provides users with greater control over bitcoin transfers but also introduces operational requirements (address verification) and explicit timeframes (7-60 day holds) that users should understand before using the feature.

Why it matters: The updated terms shift primary responsibility for AI transparency compliance to developers deploying Meta's models in their own products, requiring them to implement disclosure and labeling obligations where applicable law mandates such measures. The expanded definition of Inputs also broadens what content Meta claims the right to process for product safety and improvement, which may affect organizations that submit proprietary code, databases, or sensitive data through API integrations.

Why it matters: The updated terms materially narrow dispute resolution options and limit Meta's financial accountability. The consolidation of all disputes to exclusive California jurisdiction removes a material protection for non-US users who previously could pursue claims in their home countries. The removal of the 30-day advance notice requirement for term changes reduces opportunity for users to review and respond to material modifications before enforcement. The explicit $100 liability cap means Meta's maximum exposure for service failures, data loss, or other harms is capped at a fixed amount regardless of actual injury. These changes together reduce the practical remedies available to users in the event of disputes, service failures, or alleged violations.

Why it matters: The updated terms clarify operational responsibilities and limits that directly affect how developers manage API access and how promotional credits function. The API credential provisions establish user responsibility for account security and unauthorized activity, while the promotional credit restrictions establish non-refundability and expiration rules that affect how credits can be used and retained. Organizations offering or using promotional credits should ensure their customer communications and contracts reflect these restrictions to avoid disputes.

Why it matters: The updated terms establish mandatory individual arbitration as the sole mechanism for resolving any dispute with Replit, eliminating access to court and class action remedies that users previously could have pursued. The agreement also imposes explicit statutory compliance obligations on developers who publish content collecting personal data, creating new privacy law exposure and shifting responsibility upstream from Replit to the developer. The lowered minimum age to 13 with explicit parental consent requirements creates new parental liability and governance considerations for families and schools using the platform.

Why it matters: The removal of the explicit Data Processing Agreement reference creates a documentation gap for organizations subject to GDPR Article 28, which requires a written contract establishing the data controller-processor relationship. The reorganized data categories improve transparency for all users but do not materially expand collection scope. The explicit location consent requirement provides clarity but may not reflect a substantive operational change if Replit already practiced consent-based collection.

Why it matters: The updated terms clarify actual FDIC deposit insurance protections available to Acorns Checking customers by specifying that deposits are held at and insured by member banks up to $250,000 per depositor, rather than the prior ambiguous statement that the product itself is not FDIC-insured. This clarification affects how customers understand the safety and insurance coverage of their deposits.

Why it matters: The ten-fold increase in the deposit requirement materially reduces the accessibility of the referral bonus, requiring new account holders to commit significantly more capital within the same timeframe. The added payment processing validation for SoFi Plus adds a specific technical requirement beyond subscription enrollment, potentially creating scenarios where subscribers miss the bonus despite subscribing within the deadline.

Why it matters: The updated terms materially change the financial activation cost for referral bonuses, raising the minimum deposit requirement tenfold while keeping the bonus amount at $50. This significantly affects the promotional value proposition and return on deposit for new account holders. The addition of explicit payment validation requirements for SoFi Plus subscribers also creates a more stringent eligibility condition than previously stated.

Why it matters: The updated terms establish clearer boundaries around multi-account use by permitting legitimate separate business accounts while explicitly targeting enforcement against evasion and identity concealment. This change affects how users operating multiple brands can structure their presence on Gumroad and introduces verification requirements that Gumroad may invoke during account reviews or enforcement actions.

Why it matters: The updated terms now explicitly authorize Perplexity to remove any user content at any time without notice and clarify that while the Company does not own user-submitted content, it retains ownership of the platform and underlying technology. This establishes clear operational authority for content moderation and defines the intellectual property boundary between user contributions and platform infrastructure, which affects how users should understand their data persistence and modification rights on the platform.

Why it matters: The fund-hold provision materially alters the finality and timing of seller payouts. Previously, the agreement specified conditions under which accounts could be suspended (25% refund rate) but did not explicitly authorize holds on earned funds pending settlement. The new language establishes broad discretion to withhold payouts indefinitely based on subjective factors (suspected violations, chargeback risk, misleading marketing, incomplete verification), creating potential cash-flow disruption for suppliers and impacting the operational reliability of Gumroad as a payment partner.

Why it matters: The updated terms establish automatic renewal as the default state for paid plans, meaning users must take affirmative action to prevent recurring charges. This shifts the burden from Ford to affirmatively charge to the user to affirmatively cancel, which is material to how subscribers manage their accounts and budgets. The explicit pricing variability clause also signals that subscription fees are not guaranteed to remain static, which may affect long-term cost planning for subscribers.

Why it matters: The revised language introduces an explicit contingency on Shein's return offer: returns are now 'subject to our Fair Use Policy,' which is referenced but not detailed in the policy text. This means return eligibility may depend on criteria defined outside the visible return policy, which could affect customer expectations if returns are denied based on Fair Use grounds not previously disclosed.

Why it matters: This change clarifies which legal entity merchants contract with and which courts have exclusive jurisdiction to resolve disputes, based on the store's billing region. The reorganized format makes the regional assignments more transparent and reduces ambiguity about the correct contracting party and dispute forum for each geographic market. For merchants involved in disputes or those managing contracts referencing Shopify as a counterparty, confirming the correct entity and jurisdiction under the updated table is operationally important.