Private equity and portfolios
Inherited AI tool contracts after an acquisition: data-use terms to check
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
An acquired company's AI vendor contracts should be reviewed after closing for five terms: whether the vendor may train on your data, how long it keeps inputs and outputs, which sub-processors receive them, where any opt-out lives, and who controls the account. Start with tools that touch customer calls, source code and support tickets, because they carry the most exposure.
Key takeaways
- Find every AI tool first, including notetakers, coding assistants and browser add-ons bought on personal cards or free plans.
- Read the terms that actually govern each account, because an order form or enterprise agreement can override online terms.
- Opt-outs often live in admin or account settings rather than the contract, so confirm the setting, not just the clause.
- Record the terms version and date reviewed, because vendors change terms and continued use may count as acceptance.
Why inherited AI tools need their own review#
Inherited AI tools need their own review because most were adopted from the bottom up, outside procurement, under click-through terms nobody negotiated. A notetaker joins customer calls, a coding assistant sits inside every developer's IDE, and AI features get switched on inside the help desk and CRM. Each can send customer, employee or source code data to a vendor on terms the acquirer has never read.
Those terms also move. Zoom added a sentence to Section 10.4 of its terms of service in August 2023, after backlash over earlier changes, saying it would not use audio, video or chat customer content to train its AI models without consent. TechCrunch reported in May 2024 that Slack's privacy principles allowed customer data to be used for its machine-learning models unless an organization emailed Slack to opt out; Slack said it did not train its generative AI models on customer data. Both show why the version and date reviewed matter.
Finding every AI tool the company uses#
Finding every AI tool takes several sources, because no single system sees them all. Procurement records catch the enterprise purchases; card statements, identity provider logs and calendar invites catch the rest.
- Expense reports and company card statements for AI subscriptions.
- SSO and identity provider app lists, plus OAuth grants in Google Workspace or Microsoft 365.
- Browser extension and IDE plugin inventories from device management.
- Calendar invites showing notetaker bots on internal and customer meetings.
- AI features enabled inside existing SaaS admin consoles, such as help desk, CRM and documentation tools.
- A short questionnaire to team leads asking what they use and on which accounts.
The clause checklist for each tool#
The clause checklist below applies to every tool on the register, starting with the ones that process customer calls, source code and support tickets. For each term, record where it was found, the version date and the action taken.
| Term | Where to look | What to look for | Action if unclear |
|---|---|---|---|
| Training rights | Terms of service, AI addendum, DPA | Whether the vendor or its affiliates may train models on inputs or outputs | Get written confirmation or move to a plan that excludes training |
| Retention | DPA, privacy documentation, trust center | How long prompts, recordings, transcripts and outputs are kept | Set retention in admin and document it |
| Sub-processors | Sub-processor list, DPA | Which model providers receive data and under what limits | Save the list version; subscribe to change notices |
| Opt-out location | Admin settings, account settings, email request | Whether opting out is a setting, a contract term or a request | Confirm the setting is on and keep a screenshot |
| Plan and agreement tier | Order form, enterprise agreement | Whether business terms replace individual or consumer terms | Move accounts onto company-controlled plans |
| Ownership and license grants | Customer content section | Who owns inputs and outputs and what license the vendor receives | Compare with promises in customer contracts |
| Change of terms | Updates clause | How changes are notified and whether continued use is acceptance | Assign an owner to watch notices |
| Account control | Admin console, terms on transfer | Who the account owner is and whether it can be transferred | Transfer to a company admin and remove departed users |
What published vendor terms show#
Published vendor terms show why the plan tier and the settings matter as much as the contract. GitHub's terms of service grant GitHub and its affiliates a license to use AI-feature inputs and outputs to train models, with an opt-out in account settings, while customers under a GitHub Customer Agreement or volume licensing agreement are excluded from that training license. An acquired company with developers on individual accounts may be in a different position from one on a company agreement.
Retention follows the same pattern. Notion's AI security page says that by default Notion and its AI sub-processors do not train models on customer data, and that embeddings are deleted within 60 days after a page or workspace is deleted. Gong says its standard retention for existing customers is the lesser of three years and the time the company is a customer, covering emails, calls and transcripts. Have counsel confirm each against the live text.
Matching vendor terms to customer promises#
Vendor terms have to be read against the acquired company's own promises to its customers. Customer contracts, DPAs and privacy policies may commit the company not to use customer data for AI training, to list every sub-processor, or to give notice before adding one. An inherited notetaker or support copilot can quietly put the company out of step with those commitments.
The same caution applies if the acquirer wants to widen its own data uses after closing. FTC staff warned in February 2024 that adopting more permissive data practices, such as using consumers' data for AI training, and disclosing them only through a surreptitious, retroactive change to terms or a privacy policy may be unfair or deceptive. Laws that may apply depend on the data and the customers involved and are assessed with counsel.
Illustrative: a notetaker on every sales call#
Illustrative: a fictional software acquirer closes on a vertical SaaS company and finds, through calendar invites, that a notetaker bot has joined most sales and customer success calls for years on accounts paid by individual reps. The tool's individual plan terms allow the vendor to use recordings to improve its services, and several enterprise customers' DPAs require notice of new sub-processors.
The acquirer's counsel moves the team onto a company-controlled business plan whose terms exclude training, sets the shortest workable retention, asks the vendor for deletion of recordings held under the old accounts, and updates the sub-processor list with notice to the affected customers. The AI tool register now names an owner for each tool and the terms version reviewed.
Sequencing the review and the SourceX connection#
The review is easiest in three passes: inventory every tool and rank by data sensitivity, read terms and confirm settings for the highest-risk tools, then consolidate accounts and adopt a group AI use policy. Notetakers, coding assistants and support copilots usually go first.
Vendor terms also matter later if the company considers licensing its records. In the SourceX five-step transaction of Supply, Rights, Preparation, Approval and Delivery, the Rights step reads vendor terms alongside customer contracts to confirm records can be exported and used, and the SourceX Evidence Packet records the result.
Frequently asked questions
Do enterprise plans always prohibit training on our data?
Not always. Many business and enterprise plans exclude training by default, but the actual agreement, any AI addendum and the admin settings decide the answer. Read the governing document for each account rather than relying on marketing pages, and keep a copy of the version you relied on.
Should we ban notetakers after an acquisition?
A blanket ban is rarely needed. A better approach is to approve specific tools on company-controlled plans, set retention, require announcement to call participants, and block personal accounts. Where customer contracts restrict recording or sub-processors, configure the tool to respect them.
What if a vendor changed its terms after the account was opened?
Check the vendor's change clause and the notices actually sent. Some terms treat continued use as acceptance. Record which version applied when, ask the vendor to confirm how earlier data was treated, and move to negotiated terms if the change is not acceptable.
Do free accounts employees opened count as company contracts?
They can still bind how company data was handled, even if no one signed for the company. Treat them as part of the inventory, move the work onto approved accounts, and ask for deletion of company data held in personal accounts where possible.
Who should own the AI tool register after closing?
Usually the acquired company's IT or security lead, with counsel reviewing terms and the group's head of portfolio operations setting the policy. The register should name an owner per tool and the date its terms were last reviewed.
Sources
- On August 7, 2023, after backlash over March 2023 changes to its terms, Zoom added to Section 10.4 of its Terms of Service a sentence saying Zoom will not use audio, video or chat Customer Content to train its artificial intelligence models without consent. Source
- TechCrunch reported on May 17, 2024 that Slack's privacy principles allowed customer data to be used to train Slack's machine-learning models unless an organization emailed Slack to opt out, and Slack responded that it does not use customer data to train its generative AI large language models. Source
- GitHub's Terms of Service (Section J, AI features) grant GitHub and its affiliates a license to use AI-feature inputs and outputs to train AI models, which users can opt out of in account settings, and customers under a GitHub Customer Agreement or volume licensing agreement are excluded from this training license. Source
- Notion's AI security page states that by default Notion and its AI Subprocessors do not use Customer Data to train any models, and that embeddings stored in vector databases are deleted within 60 days after a page or workspace is deleted. Source
- Gong's standard data retention period for existing customers is the lesser of three years and the time the company is a customer, and the retained data includes emails, calls and transcripts stored in Gong. Source
- On February 13, 2024, FTC staff warned that a company that adopts more permissive data practices, such as using consumers' data for AI training, and tells consumers only through a surreptitious, retroactive change to its terms of service or privacy policy may be engaging in unfair or deceptive practices. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.