{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"9a82fb33-2c23-4d10-94dc-fc07121bcd9f","screeningDate":"2026-10-21T10:40:51.337Z","publicationGate":"published","company":{"id":"fc0a9a77-eb4b-432a-8229-00185c53d30e","name":"Klarna","slug":"klarna","industry":"FinTech"},"policy":{"id":"f4168900-e4f5-4f91-b69d-9127a145335c","name":"Terms of Service","type":"terms","jurisdiction":"US","sourceUrl":"https://www.klarna.com/us/terms-of-use/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-23T11:39:01.381Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"9ca89b723985b58fd109edc5a9257f02af2d4b1bc547b21a206cba6c90331337","capturedAt":"2026-08-18T02:27:27.180Z"},"current":{"version":3,"sha256":"a35d83d22e87a8e7570db5f8d9f7e81d0ede08993bb5876ec679d2060ea07312","capturedAt":"2026-10-21T10:40:51.325Z"}},"analysisLineage":{"status":"verified","requestSha256":"16d7621191d6779405c80046cf715ced9cfba3f1747a41655efac2e76341f096","responseSha256":"6a097acfbd1c57682e0fd1e78a2f85588da5a9bd416b65cbb902a6d4fb87b674","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"9ca89b723985b58fd109edc5a9257f02af2d4b1bc547b21a206cba6c90331337","charLength":111615,"byteLength":112015,"rangeUnit":"utf16-code-unit","includedRanges":[[0,111615]],"excludedRanges":[]},"new":{"sha256":"a35d83d22e87a8e7570db5f8d9f7e81d0ede08993bb5876ec679d2060ea07312","charLength":111663,"byteLength":112063,"rangeUnit":"utf16-code-unit","includedRanges":[[0,111663]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-08-18T02:27:27.180Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://www.klarna.com/us/terms-of-use/","requestedUrl":"https://cdn.klarna.com/1.0/shared/content/legal/terms/en-us/user","finalUrl":"https://cdn.klarna.com/1.0/shared/content/legal/terms/en-us/user","capturedAt":"2026-10-21T10:40:51.325Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Klarna's Terms of Service update is minor, changing 'Balance account' to 'Personal account' with no impact on user rights or data practices.","overallRisk":"Medium","overallScore":6,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Mandatory arbitration waives user rights to jury trials and class actions.","textIt":"L'arbitrato obbligatorio rinuncia ai diritti degli utenti a giurie e azioni collettive.","deltaScore":-2,"evidenceQuote":"YOU WAIVE YOUR RIGHT TO A JURY TRIAL AND YOUR RIGHT TO BRING OR RESOLVE ANY DISPUTE AS OR TO PARTICIPATE IN A CLASS, CONSOLIDATED, PRIVATE ATTORNEY GENERAL, REPRESENTATIVE, OR COLLECTIVE ACTION IN COURT OR IN ARBITRATION","evidenceSide":"old","relatedKpi":"kpiRegulatoryCompliance","anchorStatus":"verified"},{"icon":"warning","textEn":"Extensive collection of personal and financial data for various services and personalization.","textIt":"Ampia raccolta di dati personali e finanziari per servizi e personalizzazione.","deltaScore":-2,"evidenceQuote":"Financial Insights, allowing you to import transactions from your external bank accounts. We then use this information to provide an overview of monthly budget, income and spending, visualization of balances (e.g. the savings or purchases),","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"AI assistant retains user inferences indefinitely, raising privacy concerns.","textIt":"L'assistente AI conserva le inferenze utente a tempo indeterminato, sollevando preoccupazioni sulla privacy.","deltaScore":-2,"evidenceQuote":"These inferences are retained in your memory profile for as long as you use the Service.","evidenceSide":"old","relatedKpi":"kpiDataRetention","anchorStatus":"verified"}],"keyPoints":[{"textEn":"The term 'Klarna Balance account' has been updated to 'Klarna Personal account' in relevant sections.","textIt":"Il termine 'Klarna Balance account' è stato aggiornato a 'Klarna Personal account' nelle sezioni pertinenti.","sentiment":"neutral"},{"textEn":"No changes were made to how Klarna collects, uses, or shares your personal data.","textIt":"Nessuna modifica è stata apportata a come Klarna raccoglie, utilizza o condivide i tuoi dati personali.","sentiment":"neutral"},{"textEn":"The mandatory arbitration clause, waiving jury trials and class actions, remains in effect.","textIt":"La clausola di arbitrato obbligatorio, che rinuncia a giurie e azioni collettive, rimane in vigore.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Klarna must carefully assess data sharing and AI usage to ensure compliance with GDPR, especially regarding cross-border data transfers and automated decision-making. The lack of explicit AI training opt-out is a concern.","complianceNoteEn":"GDPR Art. 28, 44"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The policy's broad data collection and AI data retention practices pose a high risk for EU individuals, potentially conflicting with GDPR principles like data minimization and purpose limitation. Mandatory arbitration clauses are generally not enforceable in EU consumer contracts.","complianceNoteEn":"GDPR Data Minimization"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises must ensure Klarna's data handling practices, especially for AI and third-party sharing, meet diverse international data protection regulations. The lack of explicit AI output ownership and audit mechanisms adds complexity.","complianceNoteEn":"International Regulations"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, individuals face medium risk due to Klarna's extensive data collection and AI assistant's indefinite retention of inferences. Transparency regarding cross-border data transfers is not explicitly detailed, which can be a concern.","complianceNoteEn":"Global Data Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"US enterprises integrating with Klarna need to manage data flows and ensure their use of Klarna's services aligns with state privacy laws. The broad third-party sharing and AI data retention require careful vendor assessment.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"US individuals face medium risk due to the mandatory arbitration clause, which waives class action rights. Extensive data collection for personalization and credit reporting is common but raises privacy concerns under state laws like CCPA/CPRA.","complianceNoteEn":"CCPA/CPRA Rights"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Partial"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Terms of Service source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/9a82fb33-2c23-4d10-94dc-fc07121bcd9f","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"62e92015a12ac5acf00afc3226eee14737b0e1df28a3caa89c953a1ee9fee39d"}