Ownership disclosure: I run Indie Affiliate and howmuchismycompanydataworth.org, which introduces companies to AI data buyers and earns a referral fee from the buyer when a deal closes.
AI companies now pay businesses for real work records. If you run a SaaS, you are sitting on two piles of data. One pile is yours. The other pile mostly is not.
This guide is about telling them apart before a buyer, a customer or a regulator does it for you. It is not legal advice. It is the homework to finish before you pay for legal advice.
Key takeaways
- Two piles, two answers. Your own operating records (team chat, internal tickets, specs) are usually yours to license, with care. Data your customers put into your product usually is not.
- Your paperwork decides. Your terms of service, privacy policy and data processing agreements set the limits. Read them before you read a buyer's offer.
- You can't rewrite the past. The FTC has warned that quietly changing your terms to use old data for AI training may be unfair or deceptive.
- B2B is not a free pass. Data about companies is mostly a contract question. Data about the people at those companies is personal data.
- Deleting a column is not anonymizing. Summaries are safer than records.
The market is real
When Reddit filed to go public in 2024, its Form S-1 disclosed $203 million in data licensing contracts. Text people typed into a website had become a revenue line.
Now buyers want the ordinary work inside ordinary companies: how a support team answers a ticket, how engineers scope a bug, how a rep handles an objection. On October 9, 2026, micro1 announced a $1 billion, 12-month commitment to buy company data. Scale AI lists Slack or Teams, email, CRM, Jira and Zendesk records among the data it wants.
Even a failed company's records draw bids. In the Spirit Airlines bankruptcy, Google won an August 2026 auction for the airline's internal records at $10 million. At last report, court approval was still pending after the flight attendants' union raised a privacy objection. Remember that objection. The people in the records get a say.
One honest note for small teams. Most buyers set size floors. micro1 looks for 30 or more employees. Handshake AI asks for 20 or more employees and at least three years in business. Replay's smallest published band is $10,000 to $100,000, for companies with 20 to 50 employees. A three-person SaaS will often fall short on its own records. That makes the customer data look tempting. That is where the trouble starts.
Pile one: your own operating data
Your Slack, your Jira, your internal docs and sales notes. You created these records running your business, and in most cases the company owns them.
Owning them doesn't make them clean. Three things hide inside:
- Your team's words. Chat logs are full of people. Check your employment agreements and tell your team before you license anything. A deal your team hears about from someone else is a trust problem even when it is legal.
- Customer details. Support tickets quote customers. Sales notes name them. Those slices carry the same limits as pile two.
- Other people's secrets. NDAs, partner pricing, a client's roadmap pasted into a channel. Your contracts may bar you from passing those on.
The work here is scrubbing and scoping. Pick the channels and date ranges you can defend. Strip customer names, emails and any pasted keys or passwords. Keep a written record of exactly what went out.
Pile two: your customers' data
This is what your users put into your product. Their documents, their CRM records, their own customers' emails. For most SaaS companies, this pile is not yours to sell. Check three documents.
Your terms of service. Many SaaS terms say the customer owns its content and gives you a license to use it to provide the service. If yours say that, selling it to an AI lab sits outside the license. Watch for phrases like "to improve our services" too. Training someone else's model is not improving your service.
Your privacy policy. If it says you don't sell or share personal information, a sale breaks a public promise. Regulators treat broken privacy promises as deception.
Your data processing agreement. If you sell to businesses in Europe or the UK, you have probably signed one. Under GDPR, a processor handles personal data only on the documented instructions of its customer, the controller. A side deal with a data buyer is not one of those instructions.
If all three are silent or vague, you don't have a green light. You have a question for a lawyer.
You can't quietly change the rules
The obvious shortcut is a "we've updated our policies" email. The FTC saw this coming. In February 2024 its staff published a warning that quietly changing your terms of service could be unfair or deceptive. The point was plain. A company that collected data under one set of promises can't switch to looser practices, such as sharing with third parties or training AI, through a quiet, retroactive change.
The FTC pointed back to its 2004 case against Gateway Learning, which changed its privacy policy to share customer data without notice or consent.
Real consent looks like this:
- Forward, not backward. New terms cover data collected after the change. Old data stays under the old promises unless people agree.
- Clear notice. Say what data, what kind of buyer and what use. Not a clause buried on page nine.
- A real choice. For consumer users, an opt-in. For business customers, a signed amendment or a new clause they accept at renewal.
- A way out. Let customers pull out of future licensing.
Expect most customers to say no. Plan for that.
B2B and consumer data are different problems
If your users are businesses, much of what you hold is about companies: deal sizes, workflows, usage patterns. That is mostly a contract question. If the contract allows it, you are in decent shape.
The people at those companies are another matter. A contact's name and work email is personal data under GDPR. California's privacy law covers it too, since its business-to-business exemption ended in January 2023.
If your users are consumers, the bar is higher. California defines "selling" broadly, including sharing personal information for anything of value. Selling means notices, a "Do Not Sell or Share My Personal Information" link and honoring opt-outs. Many other states give residents a right to opt out of sales. Health, financial, student and children's data carry their own federal rules. If your app touches those, assume selling records is off the table.
Anonymize, or sell summaries instead
Most legal data deals don't hand over raw customer records. They sell de-identified data or aggregates.
Deleting the name column is not de-identification. If someone can work out who a person is by combining fields, regulators still treat it as personal data. California also expects a public commitment not to re-identify de-identified data.
Aggregates are safer. "Median time to close a support ticket, by plan tier" is a very different asset from ten thousand ticket transcripts. Either way, put limits in the contract: no re-identification, no resale, deletion when the deal ends.
A quick map
| What you hold | Who usually controls it | Realistic path |
|---|---|---|
| Internal chat, internal tickets, specs, sales notes | Your company, subject to employee and confidentiality terms | Scrub, scope and license with care |
| Customer content stored in your product | Your customers, under your terms and DPA | Off limits without new, explicit customer agreement |
| Personal data about users or their contacts | The people themselves, under privacy law | Consent, or proper de-identification |
| Usage metrics and aggregates | Your company, if your terms allow analytics | Often the safest thing to license |
Before you talk to a buyer
- Read your terms, privacy policy and DPA. Highlight every line about ownership, use and sharing.
- List your data piles. Mark each one: ours, theirs or mixed.
- Set aside anything you promised not to sell.
- Decide what you would offer: scrubbed internal records, aggregates, or nothing.
- Book one hour with a privacy lawyer and bring the list.
For a longer version of that lawyer's checklist, Company Data has a plain write-up of the six legal questions to answer before selling customer data. It goes deeper on state laws, data broker registration and industry rules.
FAQ
Can I sell my SaaS customers' data if my terms say I own it?
Ownership language helps, but it doesn't override privacy law or a signed DPA. Personal data inside it still needs a legal basis, and data you already hold stays under the promises you made when you collected it.
Is my company's Slack data mine to sell?
Usually the company owns it. It still contains your team's and your customers' personal details, and maybe other companies' confidential information. Scrub and scope it, and tell your team first.
Can I update my privacy policy to allow AI training?
For data you collect after a clear, prominent change, often yes. For data you already hold, the FTC has warned that a quiet, retroactive change may be unfair or deceptive. Get consent for the old data.
Sources and disclosure
Reviewed October 24, 2026: the FTC staff post and Reddit's Form S-1 linked above. Buyer size floors and payout bands are the buyers' own published figures and change often. They are not an offer or a prediction of what any company will be paid. If you want to know how introductions to buyers work, the Company Data FAQ explains who can ask and who pays the referral fee.