Legal

The on-device prompt-injection classifier runs by default. Section 5.2's bullet about it is rewritten: the Software carries the classifier as part of the web-content firewall, it is on unless the user turns it off in the Trust Center, and the deterministic chain runs ahead of it in every case. Everything else the bullet stated is unchanged -- the text is scored on the machine, nothing about a page is sent anywhere for that purpose, a page the deterministic chain did not already reject and the classifier scores as hostile is withheld from the model once the shipped model's measured accuracy has cleared the bar the Software sets, and a pass that could not run is recorded as not having run rather than presented as coverage. No clause about storage or transmission changed: the default of a control that transmits nothing is not a change in transmission, so the DPIA records the change in R3's mitigation and in no risk rating. Nothing else in either master changed.