Telling customers your software company was acquired: what to say about data

What customers want to know about their data#

Customers who learn your software company was acquired want to know whether anything about their data changes. Their questions are predictable: where data is stored, who can access it, whether sub-processors change, whether the new owner will use it for other products, and whether it will train AI models.

The concern has recent history behind it. Zoom faced a public backlash in 2023 over changes to its terms, and on August 7 of that year it added an explicit promise not to train its artificial intelligence models on customers' audio, video or chat content without their consent. A February 2024 post from FTC staff went further, cautioning that quietly and retroactively rewriting terms or a privacy policy to permit broader data use, AI training included, could amount to an unfair or deceptive practice. Customers read acquisition letters with that background.

Facts to confirm before the letter goes out#

Facts about the deal structure decide what the letter can truthfully say, so confirm each one with counsel and the buyer's integration lead first. Whether notices or consents apply depends on each contract and on the privacy laws that may apply to the data involved.

Template: the customer letter#

The template customer letter below fits a stock acquisition where nothing changes at closing. Every sentence in it is a commitment, so rewrite or delete any line that is not true for your product, and adapt it for an asset deal.

• 1Opening: Today we are sharing that [Company] has been acquired by [Buyer]. Your contract, your account and your support team stay the same, and the product continues under its current name.
• 2Your data: Your data stays in the same hosting regions, under the same security controls and the same data processing addendum. No new sub-processors are being added as part of this transaction.
• 3AI and data use: We do not use your data to train AI models, and this acquisition does not change that. Any future change to how we use customer data will come with advance notice and, where your agreement requires it, your consent.
• 4Access: [Buyer] staff will not access customer data except under the same controls and agreements that apply to our own team today.
• 5What happens next: If anything about hosting, sub-processors or terms changes, we will tell you in advance through the notice process in your agreement.
• 6Contact: Questions go to [named contact] or your account manager, and a detailed FAQ is available at [FAQ page].

Customer FAQ answers to publish with the letter#

Customer FAQ answers should be published the same hour as the letter, on a page support and sales can link to. Each answer follows a pattern: state the current fact, then state how customers will hear about any change.

Promises to avoid in an acquisition letter#

Promises in an acquisition letter bind the company, and often the buyer, so avoid commitments nobody has approved. Absolute promises are the classic error: a letter saying data will never be used for anything else invites a dispute when the combined company later updates its terms through a proper process.

Also avoid describing integration plans that do not exist yet, claiming certifications the combined company has not completed, and using vague phrases such as industry-standard security in place of the specific controls customers can check. Vague reassurance tends to generate more security questionnaires, not fewer.

Sending it: timing, signer and channels#

The customer letter should usually go out the same day as the public announcement, before customers read the news elsewhere. Contracts with change-of-control notice clauses may set a specific timing, method or address, so send those formal notices alongside the friendly letter rather than instead of it.

Most customers trust the team they already know, so the founder or CEO of the acquired company usually signs, often with a short note from the buyer. Send it by email from a monitored address, add an in-app notice for users who never read vendor email, and update the trust page and sub-processor page on the same day so every document says the same thing.

Illustrative: a field service software company announces its acquisition#

Illustrative: a fictional field service software company serving HVAC contractors is acquired by a vertical software group in a stock deal. Its customers include large contractors whose security teams ask about AI after every vendor change.

The founder and the group's counsel confirm that the entity, contracts, hosting and sub-processors stay the same. The letter says so, states that customer data is not used for AI training, and commits to advance notice before any change. The FAQ goes live the same hour, and support receives the same answers.

When a customer later asks whether the group will license data, the answer is ready: customer data is not licensed, and any licensing of the company's own engineering or support records would exclude customer content.

How SourceX treats records after a change of ownership#

What customers were told in an acquisition letter shapes what the acquired company can later do with its own records. SourceX reviews acquired-company archives through the SourceX five-step transaction, and in the Rights step customer announcements, trust pages and terms are read alongside contracts, so nothing licensed conflicts with a promise already made.

The SourceX Evidence Packet records that check under licensing rights and permitted use, and the company approves every step. Customer content stays out unless a customer contract permits the use.