How to read a data licensing offer before you sign

Read this first

This guide is not legal advice. Data Licensing Index is an independent index, not a law firm. Use this page to find the clauses that need attention, then have a lawyer who knows your customer contracts review the offer before anyone signs.

The headline number sits on page one of an offer. What it is worth sits in about a dozen clauses further down: what you grant, for how long, to whom, when money actually moves, who touches the raw data and what happens to it afterward.

Every company example below quotes that company’s own published page as we read it on October 18, 2026. We quote terms to show what to look for, not to rank anyone. Full rows for each buyer are on the buyer index, and how we collect and date them is on our methodology page. Terms change often, so check the live page before relying on any of them.

1. License or sale: what you are granting

Start with the grant clause. It tells you whether you are licensing a copy, which normally leaves you free to license again, or transferring rights outright. Published language varies:

• Troveo says of the data: “ownership never transfers.”
• SuperAnnotate: “You’re licensing rights for a set period, not selling the data.”
• Polyshares describes “A license to defined operational data” and “Defined material for a defined term.”
• Mode: “Mode buys the agreed, filtered copy directly from you; the agreement defines its scope and any exclusivity.”
• SourceX: “You retain ownership of your original licensed data,” but “SourceX owns the deidentified dataset,” and its license “is permanent and survives termination of the agreement, and models already trained on it aren’t retrained or deleted.”

Labels can mislead, so read what the buyer may actually do:

1. Ownership. You keep title to the underlying records. The buyer gets rights to a copy.
2. Sublicensing. Can the buyer pass the copy on? To whom, and does that pay you again?
3. Derived works. Deleting a dataset at the end of a term does not remove what a model already learned from it. Ask whether the buyer may keep using models, embeddings or synthetic data made from your data after the license ends.
4. Your own use. Nothing in the license should limit how you keep using your own records.

2. Exclusivity

Exclusivity is the clause most likely to cost you money you never see, because it shuts out every later buyer.

• SourceX: “As standard, exclusivity is perpetual.” “If you push back, a 24-month or 12-month term can be agreed instead,” and “non-exclusive licensing is available at a substantially lower price.” It adds: “The restriction binds you; SourceX’s own right to distribute or sublicense the deidentified dataset is unaffected.”
• Labelbox Prism: “Licenses are structured as exclusive by default.”

Exclusivity has a price, and the offer should show it. Ask for the non-exclusive figure next to the exclusive one, then narrow the grant:

• What: the dataset you deliver, or all data of that type, including records you create next year?
• Against whom: every buyer, or only the buyer’s direct competitors?
• How long: a fixed number of months is easier to price than “perpetual.”
• Use it or lose it: exclusivity ends if the buyer has not used or paid for the data within a set period.

3. Field of use and the end buyer

The field-of-use clause says what the buyer may do with the data. “Training and evaluating machine learning models” is much narrower than “any lawful purpose.” Look for permitted uses, prohibited uses (re-identifying people, contacting anyone named in the data, competing with you, targeting your customers) and whether the buyer may resell or share the copy with affiliates and customers.

Then ask who the end user is. Many companies in this market sit between you and the AI lab that finally uses the data, and some do not name labs. Polyshares says “we do not disclose which labs take which data.” Troveo says your company is never named publicly and that buyers are introduced confidentially after an agreement is signed. Maryah’s privacy policy says that, with the authorization given at submission, opportunity information “may be shared with selected licensing providers.”

Keeping end buyers private is a legitimate choice, but it stops you from checking the end user against your own restrictions. Ask for a right to approve each end licensee, or at least a written list of excluded parties. Each row in the buyer index shows whether the company names its end buyers.

4. Term and renewal

The term sets how long the buyer may hold and use the copy. Ooak Data says “Only the anonymized dataset is retained for the licence term.” SuperAnnotate says data is “Retained for an agreed period, then deleted.”

Check what starts the clock (signing, delivery or acceptance), whether the term renews automatically and whether a renewal pays you again. If no term is stated, ask for one in writing.

5. One-time payment or revenue share

Maryah sets out the trade-off on its homepage: a one-time payment is “Usually a lower total than the potential from revenue share,” while revenue share has “Potential to earn more, but no guaranteed amount or timing.” Published structures include:

Which is better depends more on your situation than on the buyer. A revenue share needs a company that still exists to receive payments and enforce the agreement for years, which suits an operating company. A company that is winding down usually needs money now and an entity that can close; read what to do with company data when you shut down first.

If you take a revenue share, pin down:

• The base: gross receipts, or a net figure after a closed list of deductions?
• Duration: every sale forever, or a set number of years?
• A floor: a minimum guarantee, or an upfront payment credited against future shares.
• Counterparty risk: if an intermediary collects the money and passes your share on, you carry its credit risk.

6. Payment triggers and timing

The trigger clause decides when money moves, and whether it moves at all. Published triggers differ widely:

Words like “acceptance,” “review” and “selection” each hide a test you have to pass. Get these in writing:

• Criteria. Format, volume, date range and de-identification standard, not “satisfactory to buyer.”
• A deadline. A delivery not rejected with reasons within a set number of days counts as accepted.
• Partial acceptance. You are paid for the part that is accepted.
• Pay-when-paid. If an intermediary pays you only after its customer pays it, set an outside date after which payment is due regardless.
• Payee. The company’s account, never an individual’s. Ooak Data states “Payment goes to the entity, not to individuals.” This matters most when creditors or a liquidator have a claim.

Treat estimator output as a range, not an offer. Mode’s own FAQ calls its calculator “illustrative, not a guaranteed offer.” Only the written offer counts.

7. Who extracts the data and who de-identifies it

Someone has to pull records out of your systems and strip names, contact details, credentials and client identities. The offer should say who does each step, where it happens and to what standard. Published approaches:

• Scale AI: “Scale anonymizes everything inside your environment, before any data is extracted,” with “0 bytes shared without your explicit, per-package approval.”
• Mercor: “The extraction and anonymization process is fully automated,” and its engineering team “does not manually review your data.”
• Grepped: “We handle extraction, cleaning, and de-identification,” connecting “read-only to the approved sources.”
• Appen: “Appen covers extraction, anonymisation and transfer.”
• SourceX “de-identifies the data, directly or through its processing partner, before it is used or shared.”
• Labelbox Prism: “we first remove all personally identifiable information (PII)” before data moves to its infrastructure.
• SuperAnnotate removes identifying detail “to the standard your team sets.”

The questions that separate these:

• Where: inside your environment before anything leaves, or on the buyer’s systems after a raw copy has left?
• Which standard, in writing, covering customers, vendors and guests in shared channels, not only employees?
• Who else handles raw data: named subprocessors and their locations.
• Sample approval of de-identified output before each package ships.
• Access: read-only, limited to approved sources and revoked when delivery ends.

8. Ingestion method and platform terms

Data leaves your systems one of two ways. In an owner export, your own administrator runs the platform’s export tool and hands over the files. With a connector, the buyer’s app connects through the platform’s API after an admin approves access. Connectors are governed by the platform’s developer terms, which bind the buyer’s app.

What three major workplace platforms say, as of October 18, 2026:

Owner exports have their own rules:

• Google’s Data Export tool exports “your organization’s data to a Google Cloud Storage archive.” It needs a super administrator account “that is at least 30 days old,” organizations with more than 1,000 users should contact support first, and files in Google’s bucket are deleted 60 days after the export begins.
• On Slack’s Business+ plan, exporting private channels and DMs takes an application that the Workspace Primary Owner must approve and Slack then reviews, and Slack presents this export as “For legal and regulatory compliance.” On Enterprise plans, Org Owners must ask Slack Support to enable it. On Free and Pro plans, private channels and DMs are not available for export.

Ask every buyer in writing which route it uses for each system, and get a warranty that its collection method complies with each platform’s terms. Read your own agreement with each platform before relying on an export for a licensing deal. We have not yet reviewed the developer terms of Atlassian, Zendesk, HubSpot or Salesforce; ask any buyer that wants to connect to them to show you the clause it relies on. Each buyer’s Ingestion column shows its published method. Cancelling Google Workspace? Export first: see how to cancel Google Workspace without losing your data.

9. Warranties, indemnities and liability caps

The seller warrants that it has the right to license the data, so most of the legal risk starts with you. Before you give that warranty, check:

• Customer contracts and data processing agreements, which can restrict customer data sitting in your email and tickets.
• Third parties in the data: vendors, customers and guests in shared channels.
• Employee privacy law where your staff sit. Employee email or chat from staff based in the EU, UK or Canada, and client data from law, accounting, tax or health firms, usually need consent or anonymization first, and some cannot be licensed at all.
• Regulated data. One US example: 26 U.S.C. § 7216 makes it a misdemeanor for anyone in the business of preparing income tax returns to knowingly or recklessly disclose information furnished for a return, or use it for any other purpose, unless a listed exception or Treasury regulation permits it.
• Bankruptcy. Under 11 U.S.C. § 363(b)(1), if a debtor gave individuals a policy against transferring their personally identifiable information to unaffiliated parties, and that policy was in effect when the case began, the trustee may sell or lease that information only consistently with the policy, or after a consumer privacy ombudsman is appointed and the court approves following notice and a hearing.

Then balance the contract:

• Knowledge qualifiers. Your warranties hold “to the seller’s knowledge” and cover only the data you deliver.
• A cap on your liability, for example the amount you received, with a fixed survival period.
• Mutual indemnities. The buyer covers claims from its own misuse, any re-identification, its security breaches and any breach of platform terms by its collection method.
• Insurance. Ask your broker whether your policies respond to claims arising from a data license.

10. Retention and deletion

A license should say what happens to each copy: the raw extract, the de-identified dataset, subprocessor copies, backups and trained models. Ooak Data publishes a specific clause: the raw archive “is deleted within 30 days of delivery,” described as “a contract obligation, not a policy,” with written confirmation, while “Only the anonymized dataset is retained for the licence term.”

Ask for a deletion deadline for raw data, deletion of the de-identified set at the end of the term, the same duties for subprocessors, a backup purge schedule and a signed certificate of deletion. Track your own copies too: an export file in a shared drive is still your responsibility.

11. Audit and reporting rights

A promise you cannot check is worth less. Platform owners write these clauses for themselves: Microsoft’s API terms let it audit apps that use its APIs, including through “an independent auditor acting on our behalf.” Ask for proportionate versions:

• Revenue share: periodic statements and an audit right, with the buyer paying for the audit if it underpaid beyond an agreed margin.
• Use restrictions: written compliance confirmation on request, incident notice within a fixed number of days and the deletion certificate.
• Onward transfers: a current list of end licensees.

12. Confidentiality

Confidentiality runs both ways. You want the buyer to keep your data, your name and the deal confidential. The buyer will usually want the same for its price and terms.

Read that second part closely. A broad clause can stop you from showing the offer to your lawyer, accountant, board, investors, lenders, or a liquidator or trustee, and from comparing offers. Ask for carve-outs for advisers and anyone with a legal right to see the deal.

If you send us an existing offer through /get-offers, the form asks you to confirm you are allowed to share its terms. If you are not sure, describe the structure instead.

13. Referral fees in the chain

Introductions in this market are often paid. Several buyers publish programs that pay whoever introduces a company:

Referral fees are common. They do mean the person introducing you may earn different amounts depending on where you sign. Some programs require disclosure: Grepped’s terms (clause 2.3) require referrers to tell the owner “that you may be paid for the introduction,” and Mode’s agreement (section 4.2) requires written disclosure before the company signs. Ask anyone in your chain, whether adviser, broker or comparison site: which buyers pay you for this introduction, how much, and does any of it come out of my price? An intermediary may itself be paid by a vendor or lab above it, so ask one level up too.

Our own revenue model works the same way: buyers may pay us a referral fee when a company we introduced signs. The “Pays us” column in the buyer index shows the status for every row, we name a paying buyer to you before any introduction, and our disclosure page has the full rules.

Red flags

None of these is proof of bad faith. Each is a reason to stop and ask before you sign.

• No legal entity, address or governing law in the offer.
• Payment on “acceptance,” “review” or “selection” with no written criteria and no deadline.
• Payment that waits on someone else paying first, with no outside date.
• Exclusive, perpetual and one-time, with no non-exclusive price to compare.
• A field of use of “any purpose,” or unlimited resale and sublicensing.
• Raw data leaves your environment before de-identification, and no one will name the standard or the subprocessors.
• Requests for admin passwords, or for API access to Slack, Google Workspace or Microsoft 365 without addressing those platforms’ terms.
• No deletion deadline for the raw extract.
• An uncapped indemnity from you while the buyer’s liability is capped at a token amount.
• Payment directed to a personal account instead of the company.
• Someone in the chain will not say who pays them.
• A signing deadline that leaves no time for a lawyer.

Printable checklist

Print this page or copy the table, then mark each line against the written offer, not the sales call.

Questions to ask every buyer

Send these in writing and keep the answers with the offer.

1. What is your legal entity, where is it registered, and which law governs the agreement?
2. Who will use our data in the end, and may we approve each end user?
3. Is this offer exclusive? What is the non-exclusive price?
4. What exactly triggers payment, who decides it has happened, and by when?
5. If someone else pays you first, what is the latest date you will pay us regardless?
6. For each system, will you use our admin export or an API connection, and which platform terms does that rely on?
7. Where does de-identification happen, to which written standard, and can we approve a sample?
8. Which subprocessors will see raw data, and where are they?
9. When will the raw extract be deleted, and will you certify it?
10. May you keep using models trained on our data after the term ends?
11. May you resell or sublicense the data, and are we paid when you do?
12. For revenue share: a share of what, after which deductions, with what statements and audit rights?
13. What must we warrant, and what is our maximum liability?
14. What will you warrant about security, re-identification and platform compliance?
15. Can we share this offer with our lawyer, accountant, board and creditors?
16. Does anyone in this chain receive a referral fee, from whom, and how much?
17. How many companies like ours have you paid, and how long did signing to payment take?

Next steps

• Compare every buyer’s published terms side by side in the buyer index.
• If your company is closing, read what to do with company data when you shut down before you sign anything.
• To compare offers, tell us what you have on /get-offers. We never ask for data, credentials or exports.

This checklist is general information as of October 18, 2026. It is not legal, tax or financial advice. Have a qualified lawyer review any data licensing agreement before you sign it.