Recent policy changes

Why it matters: The updated terms expand when Eventbrite shares attendee email addresses with organizers, now including those who affirmatively opt into marketing communications. This affects how attendee data flows through the platform and clarifies the data governance roles between organizers and Eventbrite, which may require updates to vendor agreements and privacy notices for organizations using Eventbrite.

Why it matters: The updated policy establishes explicit authority for Faire to collect inferred business attributes, use automated decision-making to set credit limits and payment terms, and share sensitive financial data with a third-party banking partner. These practices create new compliance obligations under privacy laws that regulate automated decision-making (GDPR Article 22, CCPA/CPRA) and may require organizations using Faire to update vendor agreements and privacy frameworks. The expanded sharing of retailer business information with other marketplace participants also broadens the scope of data visibility on the platform.

Why it matters: The updated terms expand financial transaction capabilities for minors through Sponsored Accounts and introduce variable pricing for Cash App Tags that may be significantly higher than the prior flat fee. These changes affect how parents manage youth accounts and how all users budget for Tag purchases, and may implicate regulatory compliance for youth financial products.

Why it matters: The updated terms establish a financial consequence for creators who change their payout country or payment method: unpaid earnings held in third-party payment accounts tied to a specific country will be forfeited unless Gumroad can transfer them. This affects how creators should plan account changes and manage their unpaid balance, particularly those relocating internationally or switching payment methods.

Why it matters: The updated terms establish a new account structure that automatically shares billing and activity data with team members and grants AWS authority to suspend or permanently close accounts if spending limits are exceeded. This creates new data governance obligations for project owners, shifts content ownership to project owners, and introduces account termination authority tied to spend limit enforcement, all effective August 17, 2026.

Why it matters: The updated terms establish explicit data handling controls and transparency for Cohere SaaS users, clarifying retention periods, opt-out mechanisms, and logging practices. This disclosure affects how enterprise customers evaluate Cohere's compliance posture and whether existing data processing agreements require amendment.

Why it matters: The updated terms establish a formal contractual framework for regulated data processing in AWS Bedrock professional services engagements. Previously, the terms only prohibited disclosure of regulated data except as directed; now they automatically incorporate a supplementary DPA when customers expressly direct AWS to access regulated data and data protection laws apply. This clarifies the legal and operational obligations governing how AWS processes regulated data, which is operationally significant for organizations subject to GDPR, CCPA, HIPAA, or similar frameworks.

Why it matters: The updated policy clarifies what data Uniswap collects, replacing a prior blanket statement that no personal data is collected with explicit descriptions of account data and optional email collection for specific features. This change affects how users understand their data practices when using Uniswap services, particularly for wallet features and Developer Platform access.

Why it matters: The updated policy materially expands the scope of personal data Indeed processes and shares. The explicit authorization for voluntary disclosure to law enforcement and regulators, without requiring compulsory legal process, represents a significant expansion of data sharing authority. The inclusion of device information in transfers to employer platforms broadens the categories of personal data job seekers should expect to be shared in the hiring process.

Why it matters: The updated policy establishes explicit transparency regarding AI model training as a stated purpose for personal data use. Previously, the policy described data use for content recommendations and service enhancement but did not disclose AI training. This change clarifies a material use of personal data and engages regulatory frameworks (GDPR, CCPA, EU AI Act) that require transparency and lawful basis for AI training. Organizations that rely on Twitch as a vendor or data processor should verify that their own privacy notices and data processing agreements reflect this use.

Why it matters: The updated privacy notice introduces disclosure of a new data collection practice: audio capture and window content collection for the Speak-to-Window feature on macOS. This expands the categories of personal data Gemini collects and processes, with transcripts retained for product improvement purposes. Users and organizations relying on Gemini should understand this collection occurs and how it is governed by their Keep Activity setting.

Why it matters: The updated policy introduces disclosure of a new behavioral data collection practice tied to an optional feature. Users who participate in Connection Quizzes will have their responses and optional email addresses collected and retained for 90 days, and Bumble may send them promotional communications about the feature where applicable law permits. This represents a new category of personal data collection that users should be aware of when deciding whether to participate.

Why it matters: The updated privacy notice explicitly discloses that Amazon uses machine learning and artificial intelligence to process customer data, including for generative AI model development, and collects information about ad interactions on third-party sites. These disclosures clarify the scope of data processing and AI use, which may be material for users evaluating their privacy exposure and for organizations assessing vendor data practices under privacy regulations like GDPR and CCPA.

Why it matters: The updated terms expand what Mistral AI collects as 'Customer Data' and restructure how it handles AI training consent, moving from product-specific carve-outs to a uniform opt-in/opt-out model. Most significantly, Labs and Preview Models are now explicitly carved out from data retention opt-outs, meaning training use is mandatory for these experimental models regardless of opt-out settings elsewhere; this affects organizations that use or plan to use Mistral AI's experimental features and may require updates to vendor contracts and privacy notices.

Why it matters: The updated terms contractually restrict API access to business customers only, removing prior authorization for consumer personal use. This change affects any consumer or organization that was relying on API access under the consumer terms and may require service changes or customer communication. The addition of third-party product disclaimers also clarifies that Mistral AI provides no warranty or liability protection for third-party models accessed through its platform.

Why it matters: The updated policy establishes that Fly.io collects device and browser signals through third-party fraud-prevention services as a mandatory, non-optional practice during account creation and sign-in. This is a material change from the prior language, which stated the company did not permit third-party data collection beyond optional analytics. Users cannot opt out of this processing, though the company states its legal basis is legitimate interest in protecting the platform.

Why it matters: The updated privacy notice establishes that Square collects and uses behavioral data from its Trust Center compliance portal for sales targeting. This means visitors researching Square's compliance and security posture may receive sales outreach based on which documents they viewed, creating a direct link between compliance research activity and commercial contact decisions.

Why it matters: The updated terms establish mandatory age verification as a condition of account creation and expand Snapchat's content moderation authority while explicitly disclaiming liability for content actions. These changes materially affect how users interact with the platform and how disputes over content removal or account suspension will be resolved, shifting decision-making authority entirely to Snapchat's sole discretion.

Why it matters: The updated terms establish explicit developer responsibility for AI content labeling and disclosure compliance, and expand the scope of materials developers must warrant they have rights to use. This creates material compliance obligations for developers operating in jurisdictions with AI transparency requirements, and requires careful review of third-party licensing terms for any materials included in API outputs.

Why it matters: The updated terms establish explicit liability for all account activity under API credentials and grant OpenRouter broad authority to suspend access based on its reasonable judgment. This clarifies the allocation of risk for credential security and unauthorized use, which is operationally significant for developers and organizations relying on API access. The promotional credit framework also formalizes that free credits are non-refundable and subject to expiration, affecting how users should plan their use of promotional offerings.

Why it matters: The updated terms establish mandatory individual arbitration for all disputes, eliminating access to courts and class actions unless users affirmatively opt out within 30 days. This fundamentally changes how disputes are resolved and creates an immediate compliance deadline. The lowered minimum age to 13 expands the platform's user base to minors, triggering potential COPPA considerations. The new privacy obligations for content creators impose legal compliance responsibilities on users who publish data-collecting applications.

Why it matters: The updated terms substantially increase the financial commitment required to earn referral bonuses, reducing accessibility for customers with smaller initial deposits. The addition of explicit payment processing validation for the SoFi Plus bonus creates a new condition that must be satisfied within the eligibility window, potentially affecting how customers time their subscription and deposit activities.

Why it matters: The updated terms establish Gumroad's authority to withhold supplier earnings indefinitely based on subjective risk assessments or suspected violations, with no guaranteed release timeline and discretionary notice. This materially affects cash flow predictability and payment timing for creators and merchants who depend on Gumroad for revenue distribution.

Why it matters: The updated terms clarify which Shopify corporate entity merchants contract with and which courts have exclusive jurisdiction over disputes, based on billing address. This affects how disputes are litigated and which corporate entity is responsible for payment processing and service delivery, though the geographic assignment of courts and contracting parties remains substantially aligned with prior regional designations.

Why it matters: The updated terms materially expand user financial liability by making background data usage from system services a billable expense, and introduce a payment failure clause that permits automatic charging of backup payment methods. These changes affect how subscription billing operates and what costs users may incur for device maintenance and updates.

Why it matters: The updated terms establish explicit legal boundaries on how AWS IoT SiteWise Scenario Discovery may be used, particularly prohibiting vehicle control and safety-critical applications. This clarification is operationally significant for organizations considering this service for automotive or safety-critical use cases, as it narrows the permitted scope and establishes that AWS disclaims responsibility for prohibited uses. The expanded language on data substitution reinforces that IoT data collection cannot replace human monitoring in safety-critical systems.

Why it matters: The updated policy explicitly discloses collection of cart contents, product details, and pricing information from merchant websites accessed through Affirm's browser extension, which represents a material expansion of the prior disclosure that only mentioned website domain. This change affects how much shopping behavior data Affirm collects and uses for personalization and service improvement, and may trigger compliance review under state privacy laws that require clear disclosure of personal information collection categories.

Why it matters: The updated Seller Policy formalizes and documents the operational rules governing Poshmark's marketplace, establishing explicit requirements for listing accuracy, pricing, fulfillment, and account conduct. Sellers now operate under a comprehensive, formally published set of rules with stated enforcement mechanisms including account restrictions and termination at Poshmark's sole discretion, making compliance review essential for sellers operating on the platform.

Why it matters: The updated policy clarifies that Synthesia collects voice and text inputs from demo experiences and uses 'other information you choose to provide' for AI model improvement and platform enhancement. This expanded disclosure helps users understand what personal data is collected during interactions with Synthesia's demo and roleplay features and how it is processed.

Why it matters: The updated policy establishes explicit collection of Web3 wallet data (addresses, balances, transactions, device identifiers) and permits disclosure of pseudonymous wallet identity to third parties. The shift from US-only data storage to potential cross-border storage may affect data protection standards and regulatory compliance, particularly for users in jurisdictions with strict data localization or transfer requirements.