I looked closely but I cannot find anything that says that paying customers are excluded. So I would assume it is included. It makes sense, though, to enforce

I looked closely but I cannot find anything that says that paying customers are excluded. So I would assume it is included. It makes sense, though, to enforce one single policy: otherwise, just becoming a paying customer would be a loophole to circumvent phishing etc policies. I guess the crux here is when, exactly, they start scanning the content. Is that perhaps the moment the content is first shared? It doesn’t seem to be documented.