Customer asks 'do you sell our data?': how to answer accurately

What is the accurate answer to 'do you sell our data?'#

The accurate answer to 'do you sell our data?' is the one that matches what your company actually does with customer data, in words your contracts and privacy policy already support. For most B2B software companies that answer is no: they process customer data to provide the service and do not sell, rent or license it.

The question is rarely only about selling. Customers usually also mean: do you share our data with anyone for value, do you use it to train AI, and could it end up inside someone else's product. A good answer addresses all three without promising more than the company can keep.

Several privacy laws give 'sell' and 'share' defined meanings that can be broader than everyday use. Before a standard answer goes out, have counsel confirm it is accurate under the laws that may apply to your customers.

Three answer scripts matched to three real practices#

Three answer scripts cover most software companies, and each is accurate only for the practice it describes. Pick the script that matches the facts, adapt the details, and never borrow wording from a script that claims more restraint than your practice supports.

Script A: 'We do not sell, rent or license your data. We process it only to provide the service under our agreement with you, and our current subprocessors are listed in our trust documentation.'

Script B: 'We do not sell your data. We have licensed some of our own internal records, such as engineering history and product documentation, to an AI developer. Your account content is excluded from that license, and we can explain how the exclusion is enforced.'

Script C: 'Where our agreement with you permits it, we license de-identified support records to AI developers. Names, contact details and account identifiers are removed first, and we can point you to the clause that allows this use.'

Facts to verify before anyone answers#

The facts to verify sit in four places: signed contracts, published policies, real data flows and any data agreements the company has signed. A customer success manager answering from memory is the most common source of an inaccurate reply.

Write the results into a one-page fact sheet that legal signs off, listing each data flow and agreement. Draft the approved answer from that sheet, so a later change in practice means updating one line rather than rewriting the answer from scratch.

• 1Customer agreements and data processing agreements, including any aggregated or de-identified data clause.
• 2The privacy policy and trust page wording on selling, sharing and AI use.
• 3Data flows to third parties: analytics tools, AI model providers, enrichment vendors and support platforms.
• 4Whether product AI features send customer content to a model provider, and what that provider's terms say about training.
• 5Any data licensing, research or partnership agreement the company has signed, and what each covers.
• 6Earlier answers in security questionnaires, so the new answer does not contradict them.

Phrases that sound safe but mislead#

Phrases that sound safe mislead when they are broader than the facts. Absolute statements cause most of the trouble, because one AI feature or one vendor integration can make them untrue.

Vague wording carries its own cost. In August 2023, after backlash over earlier changes to its terms, Zoom added a sentence to its Terms of Service saying it would not use audio, video or chat customer content to train its AI models without consent. In May 2024, TechCrunch reported user backlash when Slack's privacy principles were found to allow customer data to train its machine-learning models unless an organization opted out. In both cases the public reaction followed from unclear terms, not from a confirmed data sale.

Who should own the answer inside the company?#

The answer should be owned by whoever owns privacy, usually the general counsel or a privacy lead, with customer success as its main user. Ownership means maintaining one approved text, updating it when practice changes and approving any deviation.

Put the approved answer where customers look: the trust page, the security questionnaire library, the customer FAQ and the support macro library. Train account managers to use it as written and to escalate contract questions rather than paraphrase.

Review the answer whenever the company adds an AI feature, signs a data agreement, changes subprocessors or updates its privacy policy. A dated version history shows what any customer was told at any point.

Illustrative: answering during a renewal#

Illustrative: a fictional property management software company licensed part of its Jira and GitHub history, along with internal runbooks, to an AI developer the year before. Customer content in its support tickets was excluded from the package.

During a renewal, a large customer's procurement lead asks whether the company sells customer data. The account manager is about to say 'no, never' and instead escalates to the general counsel, who sends Script B with a short list of the excluded record types.

The procurement lead asks one follow-up about subprocessors, receives the published list and closes the question. Because the answer matched the company's real practice, the same text goes into the security questionnaire library for future renewals.

How SourceX treats customer data in a licensing transaction#

SourceX treats customer data as excluded by default unless the rights review confirms the supplier may license it. In the Rights step of the SourceX five-step transaction, customer agreements, data processing agreements and privacy notices are reviewed before any records are prepared.

For each package, the SourceX Evidence Packet sets out permitted use and the privacy record alongside provenance, licensing rights and release authorization. That gives the supplier a documented basis for answering a customer precisely, including which record types were left out.