{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"23ea4dfb-622d-44fc-a2bc-d2f5f9fd4921","screeningDate":"2026-11-05T18:41:42.673Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-11-05T18:41:42.652Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":9,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-10-24T12:42:50.454Z"},"current":{"version":10,"sha256":"4a657d52b892cf5ee07854c9c370530139178527c45a908ede0b265cb9c46276","capturedAt":"2026-11-05T18:41:42.652Z"}},"analysisLineage":{"status":"verified","requestSha256":"0001298efff3086fc093ac5b7cc0c62a821437e6454ffce48a273a3866dc58e9","responseSha256":"df887d5694f39b91ea17014ef262419752b80a2b62182890d1404ddd9b12c0cd","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","charLength":140513,"byteLength":140911,"rangeUnit":"utf16-code-unit","includedRanges":[[0,140513]],"excludedRanges":[]},"new":{"sha256":"4a657d52b892cf5ee07854c9c370530139178527c45a908ede0b265cb9c46276","charLength":140238,"byteLength":140636,"rangeUnit":"utf16-code-unit","includedRanges":[[0,140238]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"captured","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","requestedUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","finalUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","capturedAt":"2026-10-24T12:42:50.454Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","requestedUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","finalUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","capturedAt":"2026-11-05T18:41:42.652Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The PayPal User Agreement received a minor date update; no significant changes were made to the policy content.","overallRisk":"Medium","overallScore":5,"previousPublicChange":{"id":"48d1072d-dff1-448b-af7c-8dc587906e03","overallRisk":"High","overallScore":7,"screeningDate":"2026-10-24T12:42:50.476Z"},"scoreDelta":-2,"direction":"lower","reasons":[{"icon":"info","textEn":"No new data collection clauses were added, maintaining existing privacy terms.","textIt":"Nessuna nuova clausola di raccolta dati è stata aggiunta, mantenendo i termini di privacy esistenti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"info","textEn":"No changes to third-party sharing practices, keeping data sharing consistent.","textIt":"Nessuna modifica alle pratiche di condivisione con terze parti, mantenendo la condivisione dei dati coerente.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"info","textEn":"No new restrictions on user rights or liabilities were introduced.","textIt":"Nessuna nuova restrizione sui diritti o responsabilità degli utenti è stata introdotta.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiRightToDeletion","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"No new clauses or modifications to existing terms were identified in this update.","textIt":"Nessuna nuova clausola o modifica ai termini esistenti è stata identificata in questo aggiornamento.","sentiment":"neutral"},{"textEn":"The policy continues to outline standard financial service terms and conditions for users.","textIt":"La politica continua a delineare i termini e le condizioni standard dei servizi finanziari per gli utenti.","sentiment":"neutral"},{"textEn":"Users are still bound by the same rules regarding account usage, fees, and dispute resolution.","textIt":"Gli utenti sono ancora vincolati dalle stesse regole relative all'uso dell'account, alle commissioni e alla risoluzione delle controversie.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must continue to comply with GDPR and PSD2 obligations, especially concerning data processing and payment services. The Digital Services Act (DSA) content moderation clause is noted.","complianceNoteEn":"GDPR, PSD2, DSA"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy remains consistent with GDPR principles regarding data processing and consumer rights, though specific data retention periods are not detailed. PSD2 consumer protections are also maintained.","complianceNoteEn":"GDPR, PSD2"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global businesses using PayPal must maintain compliance with existing terms and local regulations. The update does not introduce new international operational changes.","complianceNoteEn":"International Commerce"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users worldwide continue to operate under the established PayPal user agreement, with no new global privacy or financial risks introduced by this update.","complianceNoteEn":"Global Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses must continue to adhere to PayPal's terms for payment processing and fraud prevention. No new compliance burdens or operational changes are introduced.","complianceNoteEn":"Financial Regulations"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy maintains existing consumer protections and dispute resolution mechanisms. Users should remain vigilant about account security and review terms for any changes.","complianceNoteEn":"Consumer Protection Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 10?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/23ea4dfb-622d-44fc-a2bc-d2f5f9fd4921","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"81d5e73d08d57aec121f40ac09af94cfde12a7d2ef289729975850f1af5b715d"}