Sprinklr, Inc.

Previous wording

Our revenue was $212.0 million and $197.2 million for the three months ended July 31, 2025 and 2024, respectively, and $417.5 million and $393.2 million for the six months ended July 31, 2025 and 2024. You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. Even if our revenue continues to increase, our revenue growth rate may decline in the future as a result of a variety of factors, including the maturation of our business. Overall growth of our revenue depends on a number of factors, including our ability to:

Current wording

Our revenue was $219.1 million and $200.7 million for the three months ended October 31, 2025 and 2024, respectively, and $636.6 million and $593.9 million for the nine months ended October 31, 2025 and 2024. You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance. Even if our revenue continues to increase, our revenue growth rate may decline in the future as a result of a variety of factors, including the maturation of our business. Overall growth of our revenue depends on a number of factors, including our ability to:

Previous wording

We have incurred significant losses in the past, and we had an accumulated deficit of $756.4 million and $626.1 million as of July 31, 2025 and January 31, 2025, respectively. While we have experienced revenue growth in recent periods and periods of profitability, we are not certain whether or when we will obtain a high enough volume of sales to sustain or increase our growth or maintain profitability in the future. We expect that our costs will increase over time and we could incur future losses, as we expect to invest significant additional funds in our business. To date, we have financed our operations principally through subscription payments by customers for use of our Unified-CXM platform and equity and debt financings. We have expended and expect to continue to expend substantial financial and other resources on:

Current wording

We have incurred significant losses in the past, and we had an accumulated deficit of $763.5 million and $626.1 million as of October 31, 2025 and January 31, 2025, respectively. While we have experienced revenue growth in recent periods and periods of profitability, we are not certain whether or when we will obtain a high enough volume of sales to sustain or increase our growth or maintain profitability in the future. We expect that our costs will increase over time and we could incur future losses, as we expect to invest significant additional funds in our business. To date, we have financed our operations principally through subscription payments by customers for use of our Unified-CXM platform and equity and debt financings. We have expended and expect to continue to expend substantial financial and other resources on:

Previous wording

While we do not believe that any of our competitors currently offer a full suite of Unified-CXM solutions that competes across the breadth of our Unified-CXM platform, certain features of our Unified-CXM platform compete in particular segments of the overall Unified-CXM category. Our main competitors include, among others, experience management solutions, including social media management and social listening solutions, home-grown tools, adjacent Unified-CXM solutions, such as social messaging, conversational and Agenic AI, CCaaS solutions, customer service and support solutions, customer feedback management and Voice of the Customer solutions, content marketing, and social advertising solutions, and consulting firms and customer relationship management and enterprise resource planning solutions. Further, other established SaaS providers and other technology companies not currently focused on Unified-CXM may expand their services to compete with us. Some of our competitors may be able to offer products or functionality similar to ours at a more attractive price than we can or do, including by integrating or bundling such products with their other product offerings. Additionally, some potential customers, particularly large organizations, have elected, and may in the future elect, to develop their own internal Unified-CXM solutions.

Current wording

While we do not believe that any of our competitors currently offer a full suite of Unified-CXM solutions that competes across the breadth of our Unified-CXM platform, certain features of our Unified-CXM platform compete in particular segments of the overall Unified-CXM category. Our main competitors include, among others, experience management solutions, including social media management and social listening solutions, home-grown tools, customer service and support solutions, such as social messaging, conversational and Agentic AI, CCaaS solutions, customer feedback management and Voice of the Customer solutions, content marketing, and social advertising solutions, and consulting firms and customer relationship management and enterprise resource planning solutions. Further, other established SaaS providers and other technology companies not currently focused on Unified-CXM may expand their services to compete with us. Some of our competitors may be able to offer products or functionality similar to ours at a more attractive price than we can or do, including by integrating or bundling such products with their other product offerings. Additionally, some potential customers, particularly large organizations, have elected, and may in the future elect, to develop their own internal Unified-CXM solutions.

Previous wording

We currently serve our customers from third-party data centers and cloud computing providers located around the world. Some of these facilities are located in areas prone to natural disasters and may experience events such as earthquakes, floods, fires, severe weather events, power loss, computer or telecommunication failures, service outages or losses, and similar events. They also may be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct or cybersecurity issues, including attacks enhanced or facilitated by artificial intelligence (“AI”), human error, terrorism, improper operation, unauthorized entry and data loss. Our data center operations also rely heavily on the availability of electricity, which also comes from third-party providers. If we or the third-party data center and cloud computing provider facilities that we use to deliver our services were to experience a major power outage or if the cost of electricity were to increase significantly, our operations and financial results could be harmed. If we or our third-party data centers and cloud service provider facilities were to experience a major power outage, we or they would have to rely on back-up generators, which might not work properly or might not provide an adequate supply during a major power outage. Such a power outage could result in a significant disruption of our business. In the event of significant physical damage to one of these data centers, it may take a significant period of time to achieve full resumption of our services, and our disaster recovery planning may not account for all eventualities. We also may incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the data centers and equipment that we or the third parties with whom we work use. Although we carry business interruption insurance, it may not be sufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business that may result from interruptions in our services or products.

Current wording

Our data center operations also rely heavily on the availability of electricity, which also comes from third-party providers. If we or the third-party data center and cloud computing provider facilities that we use to deliver our services were to experience a major power outage or if the cost of electricity were to increase significantly, our operations and financial results could be harmed. If we or our third-party data centers and cloud service provider facilities were to experience a major power outage, we or they would have to rely on back-up generators, which might not work properly or might not provide an adequate supply during a major power outage. Such a power outage could result in a significant disruption of our business. In the event of significant physical damage to one of these data centers, it may take a significant period of time to achieve full resumption of our services, and our disaster recovery planning may not account for all eventualities. We also may incur significant costs for using alternative equipment or taking other actions in preparation for, or in reaction to, events that damage the data centers and equipment that we or the third parties with whom we work use. Although we carry business interruption insurance, it may not be sufficient to compensate us for the potentially significant losses, including the potential harm to the future growth of our business that may result from interruptions in our services or products.

Previous wording

Use of AI or generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development, maintenance and operation of deep learning datasets. Further, some of our customers, especially those in highly regulated industries, may be reluctant or unwilling to adopt AI or generative AI products. Accordingly, adoption of generative AI features in our products and marketing our products as AI or generative AI products could reduce or delay customer adoption. For example, AI and generative AI use machine learning techniques, including, but not limited to, algorithms, natural language processing and/or content creation which, depending on the model and the intended use case, may lead to flawed, biased, unexplained, and inaccurate results or outputs, which could lead to customer rejection or skepticism of such products or even potentially claims against us arising from customer reliance on erroneous output to its detriment. Emerging ethical issues surround the use of AI and generative AI, or if our deployment or development of AI or generative AI becomes controversial or is successfully and adversely challenged by our current or prospective customers, we may be subject to reputational risk. Any sensitive information (including confidential, competitive, proprietary, or personal data) that our customers input into the third-party generative AI features in our products (or that we input into generative AI tools that we use) could be leaked, disclosed to others or used for improper purposes, including if sensitive information is used to train our own AI or the third parties’ generative AI models, in breach of our contractual agreements. While we have processes and practices designed to ensure that we have the necessary rights to use source training data for training our AI, we may not in every instance be able to confirm that all of the information contained in such datasets has been obtained with the necessary permissions for us to use for purposes of our AI. For example, we may use publicly available data to train our AI that contains information that was unlawfully acquired from third parties without our knowledge. While we have some tools that can be leveraged to help us avoid using personal data to train or fine-tune our AI, it may be difficult for us to avoid or identify all instances where personal data may be in the scope of the training data, even though it is not necessarily required. If we were to receive claims from third parties asserting rights against our use of certain datasets used to train our AI, it may be difficult or impossible to disentangle our trained models from the subject matter of the claims.

Current wording

Use of AI or generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development, maintenance and operation of deep learning datasets. Further, some of our customers, especially those in highly regulated industries, may be reluctant or unwilling to adopt AI or generative AI products. Accordingly, adoption of generative AI features in our products and marketing our products as AI or generative AI products could reduce or delay customer adoption. For example, AI and generative AI use machine learning techniques, including, but not limited to, algorithms, natural language processing and/or content creation, which, depending on the model and the intended use case, may lead to flawed, biased, unexplained, and inaccurate results or outputs, which could lead to customer rejection or skepticism of such products or even potentially claims against us arising from customer reliance on erroneous or infringing outputs to its detriment. Emerging ethical issues surround the use of AI and generative AI, and if our deployment or development of AI or generative AI becomes controversial or is successfully and adversely challenged by our current or prospective customers, we may be subject to reputational risk. Any sensitive information (including confidential, competitive, proprietary, or personal data) that our customers input into the third-party generative AI features in our products (or that we input into generative AI tools that we use) could be leaked, disclosed to others or used for improper purposes, including if sensitive information is used to train our own AI or the third parties’ generative AI models, in breach of our contractual agreements. While we have processes and practices designed to ensure that we have the necessary rights to use source training data for training our AI, we may not in every instance be able to confirm that all of the information contained in such datasets has been obtained with the necessary permissions for us to use it for purposes of our AI. For example, we may use publicly available data to train our AI that contains information that was unlawfully acquired from third parties without our knowledge. While we have some tools that can be leveraged to help us avoid using personal data to train or fine-tune our AI, it may be difficult for us to avoid or identify all instances where personal data may be in the scope of the training data, even though it is not necessarily required. If we were to receive claims from third parties asserting rights against our use of certain datasets used to train our AI, it may be difficult or impossible to disentangle our trained models from the subject matter of the claims.

Previous wording

Uncertainty in the legal regulatory regime relating to AI, as well as variation on AI regulations from jurisdiction to jurisdiction, may require significant resources to modify and maintain business practices to comply with U.S. and foreign laws, the nature of which cannot be determined at this time as they continue to rapidly evolve and solidify. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted or are considering laws or guidelines governing the development and use of AI, such as the EU’s Artificial Intelligence Act (“EU AI Act”) and Colorado’s Artificial Intelligence Act. For example, the EU AI Act imposes a number of obligations on various parties related to the development and use of certain AI-based systems, and additional jurisdictions are beginning to adopt or prepare for adoption of similar laws. These laws may be more restrictive than the EU AI Act and may render the use of such technologies challenging. While we aim to develop and use AI responsibly by attempting to identify and mitigate any issues associated with fairness, bias, transparency, or ethical or legal use of AI, we may be unsuccessful in identifying or resolving such issues. Further, use of our AI systems for unintended or improper use cases by customer users may alter the associated legal obligations upon Sprinklr, without our knowledge. We may not be able to detect, mitigate and remediate such misuse, and limitations of liability in contracts may be inadequate to address legal liability, fines, penalties and other regulatory actions resulting from such misuse. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI, particularly training AI using personal data. These obligations may make it harder for us to conduct our business using AI, develop innovative AI models and create potential for regulatory fines or penalties, require us to change our business practices, retrain our AI, prevent or limit our creation and use of AI or generative AI, or delete or require us to disgorge certain algorithms. For example, the U.S. Federal Trade Commission has required other companies to turn over or delete or disgorge valuable insights or trainings generated through the use of AI, or the AI models or algorithms themselves, where they allege the company has violated privacy and consumer protection laws.

Current wording

Uncertainty in the legal regulatory regime relating to AI, as well as variation on AI regulations from jurisdiction to jurisdiction, may require significant resources to modify and maintain business practices to comply with U.S. and foreign laws, the nature of which cannot be determined at this time as they continue to rapidly evolve and solidify. Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted or are considering laws or guidelines governing the development and use of AI, such as the European Union’s Artificial Intelligence Act (“EU AI Act”) and Colorado’s Artificial Intelligence Act. For example, the EU AI Act imposes a number of obligations on various parties related to the development and use of certain AI-based systems, and additional jurisdictions are beginning to adopt or prepare for adoption of similar laws. These laws may be more restrictive than the EU AI Act and may render the use of such technologies challenging. While we aim to develop and use AI responsibly by attempting to identify and mitigate any issues associated with fairness, bias, transparency, or ethical or legal use of AI, we may be unsuccessful in identifying or resolving such issues. Further, use of our AI systems for unintended or improper use cases by customer users may alter the associated legal obligations upon Sprinklr, without our knowledge. We may not be able to detect, mitigate and remediate such misuse, and limitations of liability in contracts may be inadequate to address legal liability, fines, penalties and other regulatory actions resulting from such misuse. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI, particularly training AI using personal data. These obligations may make it harder for us to conduct our business using AI, develop innovative AI models and create potential for regulatory fines or penalties, require us to change our business practices, retrain our AI, prevent or limit our creation and use of AI or generative AI, or delete or require us to disgorge certain algorithms. For example, the U.S. Federal Trade Commission has required other companies to turn over or delete or disgorge valuable insights or trainings generated through the use of AI, or the AI models or algorithms themselves, where they allege the company has violated privacy and consumer protection laws.

Previous wording

In some cases, we rely on negotiated agreements with social media networks and other data providers. These negotiated agreements may provide increased access to application programming interfaces (“APIs”) and data that allow us to provide a more comprehensive solution for our customers. These agreements are subject to termination in certain circumstances, and there can be no assurance that we will be able to renew those agreements or that the terms of any such renewal, including pricing and levels of service, will be favorable. We cannot accurately predict the potential impact of the termination of any of our agreements with social media networks and other data providers, including the impact on our access to the related APIs. There can be no assurance that following any such termination we would be able to maintain the current level of functionality of our platform in such circumstances, as a result of more limited access to APIs or otherwise, which could adversely affect our results of operations. In addition, there can be no assurance that we will not be required to enter into new negotiated agreements with data providers in the future to maintain or enhance the level of functionality of our platform, or that the terms and conditions of such agreements, including pricing and levels of service, will not be less favorable, which could adversely affect our results of operations. In particular, X (formerly known as Twitter) provides us with certain data that supports our Unified-CXM platform pursuant to an agreement that expires on December 31, 2026. If our agreement with X expires, is not renewed on the same or similar terms or at all, or if it is terminated due to the failure or unwillingness of either party to perform its obligations thereunder, we may not be able to provide the same level of Unified-CXM insights to our customers and our business, results of operations and financial condition may be materially and adversely affected. In addition, we obtain data from data aggregators who, despite their commercial commitments to us, may not have the right to provide that data to us, and so could expose us to claims in the future, from the data sources or data owners.

Current wording

In some cases, we rely on negotiated agreements with social media networks and other data providers. These negotiated agreements may provide increased access to APIs and data that allow us to provide a more comprehensive solution for our customers. These agreements are subject to termination in certain circumstances, and there can be no assurance that we will be able to renew those agreements or that the terms of any such renewal, including pricing and levels of service, will be favorable, which may lead us to choose not to renew such agreements. We cannot accurately predict the potential impact of the termination of any of our agreements with social media networks and other data providers, including the impact on our access to the related APIs. There can be no assurance that following any such termination we would be able to maintain the current level of functionality of our platform in such circumstances, as a result of more limited access to APIs or otherwise, which could adversely affect our results of operations. In addition, there can be no assurance that we will not be required to enter into new negotiated agreements with data providers in the future to maintain or enhance the level of functionality of our platform, or that the terms and conditions of such agreements, including pricing and levels of service, will not be less favorable, which could adversely affect our results of operations. In particular, X (formerly known as Twitter) provides us with certain data that supports our Unified-CXM platform pursuant to an agreement that expires on December 31, 2026. If our agreement with X expires, is not renewed on the same or similar terms or at all, or if it is terminated due to the failure or unwillingness of either party to perform its obligations thereunder, we may not be able to provide the same level of Unified-CXM insights to our customers and our business, results of operations and financial condition may be materially and adversely affected. In addition, we obtain data from data aggregators who, despite their commercial commitments to us, may not have the right to provide that data to us, and so could expose us to claims in the future, from the data sources or data owners.

Previous wording

During the six months ended July 31, 2025, approximately 45% of our sales were to customers outside of the Americas. As part of our growth strategy, we expect to continue to expand our international operations, which may include opening additional offices in new jurisdictions and providing our Unified-CXM platform in additional languages and on-boarding new customers outside the United States. Any new markets or countries into which we attempt to sell subscriptions to our Unified-CXM platform may not be receptive to our business development activities. We currently have sales personnel and sales and customer and product support operations in the United States and certain countries across Europe, the Asia Pacific region and the Americas. We believe that our ability to attract new customers to our Unified-CXM platform and to convince existing customers to renew or expand their use of our Unified-CXM platform is directly correlated to the level of engagement we achieve with our customers in their home countries. To the extent that we are unable to effectively engage with non-U.S. customers, we may be unable to effectively grow in international markets.

Current wording

During the nine months ended October 31, 2025, approximately 44% of our sales were to customers outside of the Americas. As part of our growth strategy, we expect to continue to expand our international operations, which may include opening additional offices in new jurisdictions and providing our Unified-CXM platform in additional languages and on-boarding new customers outside the United States. Any new markets or countries into which we attempt to sell subscriptions to our Unified-CXM platform may not be receptive to our business development activities. We currently have sales personnel and sales and customer and product support operations in the United States and certain countries across Europe, the Asia Pacific region and the Americas. We believe that our ability to attract new customers to our Unified-CXM platform and to convince existing customers to renew or expand their use of our Unified-CXM platform is directly correlated to the level of engagement we achieve with our customers in their home countries. To the extent that we are unable to effectively engage with non-U.S. customers, we may be unable to effectively grow in international markets.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, and consumer protection laws (such as Section 5 of the Federal Trade Commission Act), and other laws, including wiretapping laws. For example, some privacy laws and other obligations require us or our customers to obtain consent to process personal data in certain circumstances. Some of our data processing practices may be subject to challenges or lawsuits under data privacy and communication laws, including, for example, under wiretapping laws, if we share customer information with third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. In addition, we must comply with the FCC’s regulations that require us to protect private customer information about their use of telecommunications services, known as customer proprietary network information. Our, or the third parties with whom we work, inability or failure to adhere to applicable requirements could result in adverse consequences, including class action litigation, mass arbitration demands and statutory fines for noncompliance. In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making, which, even if not directly applicable to Sprinklr as a data processor, may be applicable to our customers. The exercise of these rights may impact our business and ability to provide our products and services. These state laws also allow for statutory fines for noncompliance. For example, under the California Consumer Privacy Act of 2018 (“CCPA”), noncompliance carries fines and also allows for a private right of action for certain data breaches. These laws, as well as other laws or regulations relating to data privacy and security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, may result in further uncertainty with respect to data privacy and security issues and will require us to incur additional resource, costs and expenses in an effort to comply. The enactment of various laws has prompted similar legislative developments in other states, which has created a patchwork of overlapping nuanced state laws, as certain state laws may be more stringent, broader in scope or offer greater individual rights with respect to personal data than federal, foreign or other state laws, which complicate compli…

Excerpt shortened here; the source contains the full paragraph.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, and consumer protection laws (such as Section 5 of the Federal Trade Commission Act), and other laws, including wiretapping laws. For example, some privacy laws and other obligations require us or our customers to obtain consent to process personal data in certain circumstances. Some of our data processing practices may be subject to challenges or lawsuits under data privacy and communication laws, including, for example, under wiretapping laws, if we share customer information with third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. In addition, we must comply with the FCC’s regulations that require us to protect private customer information about their use of telecommunications services, known as customer proprietary network information. Our, or the third parties with whom we work, inability or failure to adhere to applicable requirements could result in adverse consequences, including class action litigation, mass arbitration demands and statutory fines for noncompliance. In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making, which, even if not directly applicable to Sprinklr as a data processor, may be applicable to our customers. The exercise of these rights may impact our business and ability to provide our products and services. These state laws also allow for statutory fines for noncompliance. For example, under the California Consumer Privacy Act of 2018 (“CCPA”), noncompliance carries fines and also allows for a private right of action for certain data breaches. These laws, as well as other laws or regulations relating to data privacy and security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, may result in further uncertainty with respect to data privacy and security issues and will require us to dedicate additional resources and incur additional costs and expenses in an effort to comply. The enactment of various laws has prompted similar legislative developments in other states, which has created a patchwork of overlapping nuanced state laws, as certain state laws may be more stringent, broader in scope or offer greater individual rights with respect to personal data than federal, foreign or other state laws,…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Europe and other jurisdictions have proposed or enacted laws requiring data to be localized in some limited circumstances or limiting the transfer of personal data to other countries. In addition, some customers have internal policy requirements which may differ from, or be more burdensome than, applicable regulations. For example, European and other data protection laws, including the GDPR, place some restrictions on the ability of companies to freely transfer personal data to countries deemed to be inadequate for privacy purposes, and there are fairly rigorous restrictions regarding transfers of personal data from China. Other jurisdictions may also adopt stringent data localization and cross-border data transfer requirements and, in many circumstances, these may be requirements outside of the scope of privacy law, including industry-specific or national security requirements. With respect to data transfers under the GDPR, although there are currently various mechanisms that may be used to enable the transfer of personal data from the European Economic Area (“EEA”) and UK to the United States in compliance with the law, such as the EU-US Data Privacy Framework and the UK extension thereto (to which we are an active participant) and the EU’s standard contractual clauses, these mechanisms continue to be subject to legal challenges, and there is no continued assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States or other countries with “inadequate” data protection regimes without the potential for future challenge. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions outside of the origin territory, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the prohibition on further transfers (including remote access by employees in support teams in certain regions), the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of …

Excerpt shortened here; the source contains the full paragraph.

Current wording

Europe and other jurisdictions have proposed or enacted laws requiring data to be localized in some limited circumstances or limiting the transfer of personal data to other countries. In addition, some customers have internal policy requirements or impose contractual obligations that may differ from, or be more burdensome than, applicable regulations. For example, European and other data protection laws, including the GDPR, place some restrictions on the ability of companies to freely transfer personal data to countries deemed to be inadequate for privacy purposes, and there are fairly rigorous restrictions regarding transfers of personal data from China. Other jurisdictions may also adopt stringent data localization and cross-border data transfer requirements and, in many circumstances, these may be requirements outside of the scope of privacy law, including industry-specific or national security requirements. With respect to data transfers under the GDPR, although there are currently various mechanisms that may be used to enable the transfer of personal data from the European Economic Area (“EEA”) and United Kingdom (“UK”) to the United States in compliance with the law, such as the EU-US Data Privacy Framework and the UK extension thereto (to which we are an active participant) and the European Union’s standard contractual clauses, these mechanisms continue to be subject to legal challenges, and there is no continued assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States or other countries with “inadequate” data protection regimes without the potential for future challenge. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions outside of the origin territory, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the prohibition on further transfers (including remote access by employees in support teams in certain regions), the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered “foreign persons” and are majority owned by, organized under …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We are or may become directly or indirectly subject to new laws in the EEA that regulate cybersecurity and non-personal data, such as the EU Data Act, the EU Digital Operational Resilience Act (DORA) or the so-called “EU NIS2 Directive.” Depending on how new laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements and products to comply with such obligations.

Current wording

We also may become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and services to comply with such obligations. In addition, some of our customers may be subject to the European Union’s Digital Operational Resilience Act (DORA) and similar UK regulatory requirements on operational resilience. These laws may obligate our customers to impose contractual provisions on us, including certain mandatory third-party risk management provisions. If we fail to materially comply with these contractual requirements, we may be subject to investigations, audits or other adverse consequences. Moreover, in Europe, the European Union’s Network and Information Security Directive (“NIS2”) regulates resilience and incident response capabilities of entities operating in a number of sectors. Non-compliance with NIS2 may lead to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. While NIS2 has not been transposed in all Member States of the European Union, we may become directly or indirectly subject to NIS2. Depending on how these new laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements and products to comply with such obligations.

Previous wording

We sometimes rely on certain data obtained from third-party data suppliers, and the sale of data to third parties has become subject to increased regulatory scrutiny. Therefore, obtaining information from third parties carries risk to us as a data purchaser and onward provider to our customers. Regulators are increasingly scrutinizing the activities of third-party data suppliers, as well as those using the data from those third parties, and laws in the United States (including the CCPA and California Delete Act) and other jurisdictions, such as Europe (including GDPR and the ePrivacy Directive), are likewise regulating such activity. These laws pose additional, material compliance risks to such suppliers, and these suppliers may not be able to supply us with personal data in compliance with these laws. Such laws may make it difficult for our suppliers to provide the data as the costs associated with the data materially increase. For example, some data suppliers are required to register as data brokers under California, Vermont, Texas and Oregon law and file reports with regulators, which exposes them to increased scrutiny. Additionally, the California Delete Act requires the California Privacy Protection Agency to establish by January 1, 2026 a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal data held by all registered data brokers and their service providers. Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws. These laws and challenges may make it so difficult for our suppliers to provide data to us that the costs associated with the data materially increase or may materially decrease the availability of data that our data suppliers can provide us. In addition, we may face compliance risks and limitations on our ability to use certain data provided by our third-party suppliers if those suppliers have not complied with applicable privacy laws, for example, where necessary by providing appropriate transparency notices to data subjects, obtaining necessary consents or where the data is not lawfully made available to us. In addition, there may be restrictions in their terms of use of which we are not aware.

Current wording

We sometimes rely on certain data obtained from third-party data suppliers, and the sale of data to third parties has become subject to increased regulatory scrutiny. Therefore, obtaining information from third parties carries risk to us as a data purchaser and onward provider to our customers. Regulators are increasingly scrutinizing the activities of third-party data suppliers, as well as those using the data from those third parties, and laws in the United States (including the CCPA and California Delete Act) and other jurisdictions, such as Europe (including GDPR and the ePrivacy Directive), are likewise regulating such activity. These laws pose additional, material compliance risks to such suppliers, and these suppliers may not be able to supply us with personal data in compliance with these laws. Such laws may make it difficult for our suppliers to provide the data as the costs associated with the data materially increase. For example, some data suppliers are required to register as data brokers under California, Vermont, Texas and Oregon law and file reports with regulators, which exposes them to increased scrutiny. Additionally, the California Delete Act requires the California Privacy Protection Agency to establish by January 1, 2026 a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal data held by all registered data brokers and their service providers. Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws. These laws and challenges may make it so difficult for our suppliers to provide data to us that the costs associated with the data materially increase or may materially decrease the availability of data that our data suppliers can provide to us. In addition, we may face compliance risks and limitations on our ability to use certain data provided by our third-party suppliers if those suppliers have not complied with applicable privacy laws, for example, where necessary by providing appropriate transparency notices to data subjects and obtaining necessary consents or where the data is not lawfully made available to us. In addition, there may be restrictions in their terms of use of which we are not aware.

Previous wording

In addition to data privacy and security laws, our contractual obligations relating to data privacy and security have become increasingly stringent due to changes in data privacy and security and the expansion of our service offerings. For example, certain data privacy and security laws, such as the GDPR and the CCPA, require us to impose specific contractual restrictions on our service providers, and our customers are requiring broader and more extensive commitments.

Current wording

In addition to data privacy and security laws, our contractual obligations relating to data privacy and security have become increasingly stringent due to changes in data privacy and security market practices and the expansion of our service offerings. For example, certain data privacy and security laws, such as the GDPR and the CCPA, require us to impose specific contractual restrictions on our service providers, and our customers are requiring broader and more extensive commitments. Failure to comply with such contractual obligations could increase our exposure to adverse customer actions, regulatory enforcement action, increase our compliance costs, and adversely affect our business.

Previous wording

Business partners and other third parties with a strong influence on how consumers interact with our products, such as Apple, Google, Meta, Microsoft and Mozilla, have and may continue to create new privacy controls or restrictions on their products and platforms, limiting the effectiveness of our services. With obligations relating to data privacy and security changing and imposing new and stringent obligations, and with some uncertainty over the interpretation and application of these and other obligations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

Current wording

Business partners and other third parties with a strong influence on how consumers interact with our products, such as Apple, Google, Meta, Microsoft and Mozilla, have and may continue to create new privacy controls or restrictions on their data, products and platforms, limiting the effectiveness of our services. With obligations relating to AI, data privacy and security changing and becoming increasingly stringent, and with some uncertainty over the interpretation and application of these and other obligations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.

Previous wording

In addition, our Unified-CXM platform or other internal systems used for operating our business may be misconfigured or contain significant unmitigated weaknesses or vulnerabilities, resulting in a heightened exposure to internal and external threats. The processes used to implement technical and administrative controls to protect our systems and the data they contain may be ineffective, either in parts or entirely. Our employees, contractors, partners, vendors and customers could create situations whereby critical controls are bypassed, deactivated or otherwise reduced in effectiveness, which could lead to the inadvertent exposure of confidential information, intellectual property or other sensitive information and heighten our exposure to security threats. Moreover, we may not have access to any effective control mechanisms that could mitigate these concerns or address new or advanced concerns. In the event that such weaknesses or vulnerabilities were exploited by internal or external threats, we could face adverse consequences, such as significant interruptions in our operations, loss of customers, loss of data and income, reputational harm, and diversion of funds.

Current wording

In addition, our Unified-CXM platform or other internal systems used for operating our business may be misconfigured or contain significant unmitigated weaknesses or vulnerabilities, resulting in a heightened exposure to internal and external threats. The processes used to implement technical and administrative controls to protect our systems and the data they contain may be ineffective, either in part or entirely. Our employees, contractors, partners, vendors and customers could create situations whereby critical controls are bypassed, deactivated or otherwise reduced in effectiveness, which could lead to the inadvertent exposure of confidential information, intellectual property or other sensitive information and heighten our exposure to security threats. Moreover, we may not have access to any effective control mechanisms that could mitigate these concerns or address new or advanced concerns. In the event that such weaknesses or vulnerabilities were exploited by internal or external threats, we could face adverse consequences, such as significant interruptions in our operations, loss of customers, loss of data and income, reputational harm, and diversion of funds.

Previous wording

We rely upon third parties and third-party technologies to operate critical business systems to process confidential information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, and other functions. While we require the third parties with whom we work to process confidential information on our behalf to meet certain security requirements and give contractual commitments to us regarding their data processing activities, our ability to monitor these third parties’ information security practices is limited, and despite such assurance and commitments, these third parties may not have, or may not continue to have, adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if these third parties fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages or protect our reputation, or we may be unable to recover any such awarded damages. Moreover, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or in the third parties’ with whom we work supply chains have not been compromised or that they do not contain exploitable vulnerabilities, defects or bugs that could result in a breach of or disruption to our information technology systems (including our products and services) or the third-party information technology systems that support us and our services.

Current wording

We rely upon third parties and third-party technologies to operate critical business systems and to process confidential information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, and other functions. While we require the third parties with whom we work to process confidential information on our behalf to meet certain security requirements and give contractual commitments to us regarding their data processing activities, our ability to monitor these third parties’ information security practices is limited, and despite such assurance and commitments, these third parties may not have, or may not continue to have, adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if these third parties fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages or protect our reputation, or we may be unable to recover any such awarded damages. Moreover, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or in the third parties’ with whom we work supply chains have not been compromised or that they do not contain exploitable vulnerabilities, defects or bugs that could result in a breach of or disruption to our information technology systems (including our products and services) or the third-party information technology systems that support us and our services.

Previous wording

Additionally, the reliability and continuous availability of our platform and services is critical to our success. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware, software, and products, and those of the third parties with whom we work). However, our information systems may contain errors, defects, security vulnerabilities, or software bugs, some of which may be difficult to detect and correct, and some of these may pose a significant risk to our business and ability to provide our products and services, at any point in the product lifecycle, including when such vulnerabilities are first introduced or when new versions or enhancements of our platform are released. We have not always been able in the past and may be unable in the future to detect and remediate all such vulnerabilities in our information systems including on a timely basis, and sometimes customer permission to remediate certain vulnerabilities may be required, which could result in further delays in timely remediation. Despite our efforts to identify and remediate vulnerabilities and related unauthorized access in our information technology systems (including our products), our efforts may not be successful. Further, in some cases, these vulnerabilities may require immediate attention, but we may still experience delays in developing and deploying remedial measures designed to address any such vulnerabilities. Even if we have issued or otherwise made patches or information for vulnerabilities in our information systems, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident.

Current wording

Additionally, the reliability and continuous availability of our platform and services is critical to our success. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware, software, and products, and those of the third parties with whom we work). However, our information systems may contain errors, defects, security vulnerabilities, or software bugs, some of which may be difficult to detect and correct, and some of these may pose a significant risk to our business and ability to provide our products and services, at any point in the product lifecycle, including when such vulnerabilities are first introduced or when new versions or enhancements of our platform are released. We have not always been able in the past and may be unable in the future to detect and remediate all such vulnerabilities in our information systems, including on a timely basis, and sometimes customer permission to remediate certain vulnerabilities may be required, which could result in further delays in timely remediation. Despite our efforts to identify and remediate vulnerabilities in, and related unauthorized access to, our information technology systems (including our products), our efforts may not be successful. Further, in some cases, these vulnerabilities may require immediate attention, but we may still experience delays in developing and deploying remedial measures designed to address any such vulnerabilities. Even if we have issued or otherwise made patches or information for vulnerabilities in our information systems, our customers may be unwilling or unable to deploy such patches or use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident.

Previous wording

Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our confidential information. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our Unified-CXM platform and our services, lead to the termination of our contracts by our customers and/or vendors and monetary penalties based on our agreements with said customers and/or vendors. We may expend significant resources or modify our business activities to try to remediate and protect against security incidents. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We have in the past and may in the future be subject to attempted or successful cybersecurity attacks by third parties seeking unauthorized access to our or our customers’ confidential information or to disrupt our ability to provide our Unified-CXM platform.

Current wording

Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our confidential information. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our Unified-CXM platform and our services and lead to the termination of our contracts by our customers and/or vendors and monetary penalties based on our agreements with said customers and/or vendors. We may expend significant resources or modify our business activities to try to remediate and protect against security incidents. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We have in the past and may in the future be subject to attempted or successful cybersecurity attacks by third parties seeking unauthorized access to our or our customers’ confidential information or to disrupt our ability to provide our Unified-CXM platform.

Previous wording

Our data privacy and security obligations under certain applicable laws and our customer agreements require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and confidential information. We have in the past and may in the future fail, or be perceived to have failed, in implementing these privacy and security obligations. Such actual or perceived non-compliance by us or the third parties with whom we work could result in adverse consequences. In addition, we operate our products for the benefit of our customers who have certain documented responsibilities to maintain certain security controls, such as provisioning and deprovisioning users, in their respective environments without oversight or control by us. Our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. In certain cases, our customers may reject, weaken or incorrectly configure security controls provided by us to maintain the security of their environments, resulting in a loss of confidentiality or integrity of such customer’s data or processes. Such an event also may result in a compromise to our information technology systems or a security incident, or public disclosures and negative publicity for us and such customer, which may have a negative impact on our ability to achieve our corporate goals and could adversely affect our business, reputation, results of operations and financial condition. Such an event may also result in a compromise to our information technology systems or a security incident.

Current wording

Our data privacy and security obligations under certain applicable laws and our customer agreements require us to implement and maintain specific security measures, industry standards or reasonable security measures to protect our information technology systems and confidential information. We have in the past and may in the future fail, or be perceived to have failed, in implementing these privacy and security obligations. Such actual or perceived non-compliance by us or the third parties with whom we work could result in adverse consequences. In addition, we operate our products for the benefit of our customers who have certain documented responsibilities to maintain certain security controls, such as provisioning and deprovisioning users, in their respective environments without oversight or control by us. Our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. In certain cases, our customers may reject, weaken or incorrectly configure security controls provided by us to maintain the security of their environments, resulting in a loss of confidentiality or integrity of such customer’s data or processes. Such an event also may result in a compromise to our information technology systems or a security incident, or public disclosures and negative publicity for us and such customer, which may have a negative impact on our ability to achieve our corporate goals and could adversely affect our business, reputation, results of operations and financial condition. Such an event may also result in a compromise to our information technology systems or a security incident.

Previous wording

Additionally, our tax obligations and effective tax rate in the jurisdictions in which we conduct business could increase as a result of international tax developments, including the implementation of the Two-Pillar framework led by the Organization for Economic Co-operation and Development (“OECD”). This framework involves the reallocation of taxing rights in respect of certain multinational enterprises above a fixed profit margin to the jurisdictions in which they carry on business (referred to as “Pillar One”) and the imposition of a minimum effective corporate tax rate (referred to as “Pillar Two”). A number of countries in which we conduct business have enacted, or are in the process of enacting, core elements of the Pillar Two rules. Based on our understanding of the applicable minimum revenue thresholds and applicable safe harbor and transitional rules, we expect that we do not currently fall within the scope of either Pillar One or Pillar Two rules. However, we anticipate that we may become subject to the Pillar Two rules in the foreseeable future, which could increase our overall tax obligations and result in additional material compliance costs. We are monitoring developments and evaluating the potential impact of the Pillar Two rules on our tax obligations, including our effective tax rate.

Current wording

Additionally, our tax obligations and effective tax rate in the jurisdictions in which we conduct business could increase as a result of international tax developments, including the implementation of the Two-Pillar framework led by the Organization for Economic Co-operation and Development. This framework involves the reallocation of taxing rights in respect of certain multinational enterprises above a fixed profit margin to the jurisdictions in which they carry on business (referred to as “Pillar One”) and the imposition of a minimum effective corporate tax rate (referred to as “Pillar Two”). A number of countries in which we conduct business have enacted, or are in the process of enacting, core elements of the Pillar Two rules. Based on our understanding of the applicable minimum revenue thresholds and applicable safe harbor and transitional rules, we expect that we do not currently fall within the scope of either Pillar One or Pillar Two rules. However, we anticipate that we may become subject to the Pillar Two rules in the foreseeable future, which could increase our overall tax obligations and result in additional material compliance costs. We are monitoring developments and evaluating the potential impact of the Pillar Two rules on our tax obligations, including our effective tax rate.

Previous wording

Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share. The holders of our Class B common stock as of July 31, 2025 beneficially held approximately 41.5% of our outstanding capital stock, but controlled approximately 87.6% of the voting power of our outstanding capital stock. Therefore, the holders of Class B common stock have control over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of us or our assets, for the foreseeable future.

Current wording

Our Class B common stock has ten votes per share, and our Class A common stock has one vote per share. The holders of our Class B common stock as of October 31, 2025 beneficially held approximately 41.2% of our outstanding capital stock, but controlled approximately 87.5% of the voting power of our outstanding capital stock. Therefore, the holders of Class B common stock have control over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of us or our assets, for the foreseeable future.

Previous wording

As of July 31, 2025, our directors, executive officers and their respective affiliates beneficially owned, in the aggregate, approximately 98.5% of our Class B common stock, and controlled approximately 88.3% of the voting power of our outstanding capital stock. As a result, our directors, executive officers and their respective affiliates, if acting together, are able to determine or significantly influence all matters requiring stockholder approval, including the elections of directors, amendments of our organizational documents and approval of any merger, sale of assets or other major corporate transaction.

Current wording

As of October 31, 2025, our directors, executive officers and their respective affiliates beneficially owned, in the aggregate, approximately 98.9% of our Class B common stock, and controlled approximately 87.8% of the voting power of our outstanding capital stock. As a result, our directors, executive officers and their respective affiliates, if acting together, are able to determine or significantly influence all matters requiring stockholder approval, including the elections of directors, amendments of our organizational documents and approval of any merger, sale of assets or other major corporate transaction.