{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"5f802eed-6d0d-453b-8678-01077a1c1a2d","screeningDate":"2026-10-20T09:41:40.514Z","publicationGate":"published","company":{"id":"c0caa75b-cc98-45c5-9b6b-198af2014025","name":"PayPal","slug":"paypal","industry":"FinTech"},"policy":{"id":"dc8f08a1-4c7e-4b31-a1cd-c3f8597c965a","name":"User Agreement","type":"terms","jurisdiction":"EU","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-10-23T11:41:08.980Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":7,"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","capturedAt":"2026-08-06T03:51:47.284Z"},"current":{"version":8,"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","capturedAt":"2026-10-20T09:41:40.497Z"}},"analysisLineage":{"status":"verified","requestSha256":"1d3c08726279073697dbcd2821d652683aa89f36393b522d6ea6c50bd5b804df","responseSha256":"35a6ed5992a8039b39b74ce95844888d2bfd5f535795054e33ee57f07d4251a7","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"dcc651853121f39a69abe965fdc1aa7b74abee98a7ce2a4a039a11821a93bea1","charLength":140513,"byteLength":140911,"rangeUnit":"utf16-code-unit","includedRanges":[[0,140513]],"excludedRanges":[]},"new":{"sha256":"3e217da9e7ae7a1db9b349adc236cadeadd301a3ed9218ab56117447e2280894","charLength":140512,"byteLength":140910,"rangeUnit":"utf16-code-unit","includedRanges":[[0,140512]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-08-06T03:51:47.284Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","requestedUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","finalUrl":"https://www.paypal.com/lu/legalhub/paypal/useragreement-full","capturedAt":"2026-10-20T09:41:40.497Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"No changes were found in the PayPal User Agreement, maintaining existing terms for account management, payments, and dispute resolution.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"36648bad-1292-4f57-8b69-47df3f84c652","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-08-06T03:51:47.292Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"info","textEn":"No changes were introduced in this policy update.","textIt":"Nessuna modifica è stata introdotta in questo aggiornamento della politica.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"Existing data collection and sharing practices remain consistent.","textIt":"Le pratiche esistenti di raccolta e condivisione dei dati rimangono invariate.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"User rights and responsibilities are maintained as in the previous version.","textIt":"I diritti e le responsabilità degli utenti sono mantenuti come nella versione precedente.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"PayPal collects extensive personal and financial data for service operation and risk management.","textIt":"PayPal raccoglie dati personali e finanziari estesi per il funzionamento del servizio e la gestione del rischio.","sentiment":"negative"},{"textEn":"Funds held in PayPal accounts are electronic money, not bank deposits, and lack interest or deposit protection.","textIt":"I fondi detenuti negli account PayPal sono moneta elettronica, non depositi bancari, e non maturano interessi né godono di protezione dei depositi.","sentiment":"negative"},{"textEn":"PayPal retains broad rights to place holds, limitations, or reserves on accounts based on its risk assessment.","textIt":"PayPal mantiene ampi diritti di imporre blocchi, limitazioni o riserve sugli account in base alla propria valutazione del rischio.","sentiment":"negative"},{"textEn":"Users must keep contact information updated and maintain strong security for their account access.","textIt":"Gli utenti devono mantenere aggiornate le informazioni di contatto e garantire una forte sicurezza per l'accesso al proprio account.","sentiment":"neutral"},{"textEn":"The policy details processes for resolving disputes and escalating complaints to independent services.","textIt":"La politica descrive in dettaglio i processi per la risoluzione delle controversie e l'escalation dei reclami a servizi indipendenti.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes were found. Businesses are subject to specific terms, including PSD2 exemptions for Corporate Customers and obligations under the Digital Services Act for content moderation. PayPal retains broad rights for account management and data use.","complianceNoteEn":"PSD2, Digital Services Act"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes were found. The policy, governed by Luxembourg law, outlines consumer protections like the right of withdrawal and access to ECC-Net/CSSF for complaints, aligning with GDPR and PSD2. However, extensive data collection and PayPal's discretion on account actions remain.","complianceNoteEn":"GDPR, PSD2"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes were found. Global businesses must navigate PayPal's broad terms, data practices, and account management rights, while also ensuring compliance with their local and international regulations.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes were found. The policy's global reach implies users worldwide are subject to its terms, including extensive data handling and PayPal's discretion over accounts. Local consumer laws may offer additional protections.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"No changes were found. US businesses using PayPal are subject to its broad terms, including data collection and PayPal's rights to manage accounts. Compliance with US financial regulations would be external to this EU-focused agreement.","complianceNoteEn":null},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"No changes were found. While primarily EU-focused, the policy's broad data collection and retention clauses could impact US users, though specific US consumer protection laws are not explicitly mentioned. Users should be aware of PayPal's discretion in account management.","complianceNoteEn":null}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Transparent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original User Agreement source still match the recorded public snapshot version 8?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/5f802eed-6d0d-453b-8678-01077a1c1a2d","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"db1b950656c9b92fb11bc1bfed263b204e441788b33222d4915cbb3a17b67e07"}