Giving their policy an (admittedly quick) skim there doesn't seem to be any section that mentions AI, LLMs, training any kind of model, using image data from barcode pictures, etc. I'd be very curious to see the explanation of how this is baked into the policy.

I’m not exactly shocked that it could exist. But this usage (beyond the scope of processing barcodes) seems like it couldn’t be construed to fit into the normal avenues of data collection under a privacy policy. Also with regard to training specifically, this policy was created in late 2020 so I don’t know how it would cover generative models.