{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"1d90686c-956f-44f2-ada7-af1d4fcc0b90","screeningDate":"2026-11-07T19:43:20.200Z","publicationGate":"published","company":{"id":"149c83d1-89a6-43b9-ade7-bd33a1cada68","name":"Stripe","slug":"stripe","industry":"FinTech"},"policy":{"id":"775c0c08-14f0-4e3f-b3e0-293dc8a4965c","name":"Services Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://stripe.com/it/legal/ssa"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-07T19:43:20.182Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"b515d0ee1571110505e323960a118fcbf8da3c6d9df076d1740a290ed8319c93","capturedAt":"2026-10-01T20:02:48.720Z"},"current":{"version":3,"sha256":"61d6c16199eb4e0c9d4ef7513fb22ef86d099d987adf0e26e022df7645479092","capturedAt":"2026-11-07T19:43:20.182Z"}},"analysisLineage":{"status":"verified","requestSha256":"2666e326211d6b928119cb2d1892333fb083bcbd2442bfc7f8561649ff599b2a","responseSha256":"66087c9de72c6ff3f051a4a8ee015901ee4385e2143ad419f4cd8bf9f2bf325e","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"b515d0ee1571110505e323960a118fcbf8da3c6d9df076d1740a290ed8319c93","charLength":111803,"byteLength":112802,"rangeUnit":"utf16-code-unit","includedRanges":[[0,111803]],"excludedRanges":[]},"new":{"sha256":"61d6c16199eb4e0c9d4ef7513fb22ef86d099d987adf0e26e022df7645479092","charLength":111920,"byteLength":112917,"rangeUnit":"utf16-code-unit","includedRanges":[[0,111920]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-01T20:02:48.720Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://stripe.com/it/legal/ssa","requestedUrl":"https://stripe.com/it/legal/ssa","finalUrl":"https://stripe.com/it/legal/ssa","capturedAt":"2026-11-07T19:43:20.182Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The updated Stripe agreement explicitly warns users that mandatory arbitration limits their legal rights and options for seeking relief.","overallRisk":"High","overallScore":8,"previousPublicChange":{"id":"4961a031-d13e-4e25-b878-22fe5e890e52","overallRisk":"High","overallScore":8,"screeningDate":"2026-10-01T20:02:48.727Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"New explicit arbitration requirement for certain disputes.","textIt":"Nuovo requisito esplicito di arbitrato per alcune controversie.","deltaScore":1,"evidenceQuote":"as it requires User to arbitrate certain disputes with Stripe","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"},{"icon":"warning","textEn":"Clearer statement on limitations to how users can seek relief.","textIt":"Dichiarazione più chiara sulle limitazioni al modo in cui gli utenti possono chiedere risarcimento.","deltaScore":1,"evidenceQuote":"limits how User may seek relief from Stripe","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"},{"icon":"info","textEn":"Stronger emphasis on the arbitration clause affecting user rights.","textIt":"Maggiore enfasi sulla clausola arbitrale che incide sui diritti dell'utente.","deltaScore":0.5,"evidenceQuote":"and affects User's rights under this Agreement","evidenceSide":"new","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The agreement now explicitly states that users are required to arbitrate certain disputes with Stripe.","textIt":"L'accordo ora dichiara esplicitamente che gli utenti sono tenuti a risolvere determinate controversie con Stripe tramite arbitrato.","sentiment":"negative"},{"textEn":"It clarifies that the arbitration clause limits how users can seek legal relief from Stripe.","textIt":"Chiarisce che la clausola arbitrale limita il modo in cui gli utenti possono chiedere risarcimento legale a Stripe.","sentiment":"negative"},{"textEn":"The policy emphasizes that the arbitration provision affects users' fundamental legal rights.","textIt":"La politica sottolinea che la disposizione arbitrale incide sui diritti legali fondamentali degli utenti.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"For enterprises, mandatory arbitration can be a preferred dispute resolution method, but the broad data use and IP licensing terms require careful review for GDPR compliance. The mention of the EU AI Act highlights regulatory awareness for high-risk AI systems.","complianceNoteEn":"GDPR, EU AI Act"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The explicit warning about mandatory arbitration and class action waiver raises high risk for individuals, potentially limiting access to justice under EU consumer protection laws. While the EU AI Act is mentioned, specific user protections regarding AI data are not detailed.","complianceNoteEn":"GDPR, EU AI Act"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises should carefully review the broad data use and IP licensing terms, especially concerning AI development, to ensure alignment with internal policies and international data transfer regulations. The policy's attempt to cover various regional laws is noted.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Globally, individuals face high risk due to the mandatory arbitration and class action waiver, which can override local consumer protection laws. The policy's broad data collection and sharing practices, without explicit opt-out for AI training, are also concerning.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises may find mandatory arbitration beneficial for dispute resolution. The policy's references to CCPA and FCRA indicate an effort towards regulatory compliance, but broad data use and IP terms still warrant careful internal assessment.","complianceNoteEn":"CCPA, FCRA"},{"region":"US","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The reinforced arbitration clause with a class action waiver presents a high risk for US individuals, significantly limiting their ability to pursue collective legal action. While CCPA is mentioned, specific consumer rights like data deletion are not explicitly detailed.","complianceNoteEn":"CCPA, FCRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Services Agreement source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/1d90686c-956f-44f2-ada7-af1d4fcc0b90","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"f7fff21190e18055d55dfed33ca161d6c5871f003cc87a3b636c8a7ec6f94c59"}