Data Ownership Clause Explained: Who Owns Your Data and What They Can Do With It
This page is general information, not legal advice.
A data ownership clause says who owns the information you put into a service or share under a contract. A data use clause says what the other side may do with it. That can include files, messages, customer lists, usage logs and anything a tool generates from them. Many terms start by saying "you own your data." The clauses that follow can still give the provider broad rights to copy, analyze, share, keep and train AI models on it. This page covers six common versions that move control away from you. For each one you get an illustrative example, why it matters, and wording you can propose. How far these clauses can go depends on privacy and contract law where you live, so rules vary by jurisdiction.
The example clauses below are illustrative. They are not taken from any real company's terms or contract.
1. "You own your content" with a broad definition of what they own
A typical clause might read: "Customer retains ownership of Customer Content. Provider owns all Usage Data, Outputs, metadata and any information derived from Customer's use of the Services."
Why it works against you
The ownership promise only covers what fits inside "Customer Content." Everything else goes to the provider, and that can be a lot. Usage data can show how your business runs. "Derived" information and outputs can include reports, summaries or generated material built straight from your files. If you need those outputs for your own work, a narrow definition can leave you without clear rights to them.
What to ask for instead
Sample wording to propose: "Customer Content includes all data Customer submits and all Outputs generated from it. Customer owns Customer Content. Provider may use Usage Data only to operate, secure and bill for the Services."
2. A perpetual, irrevocable license to your data
A typical clause might read: "Customer grants Provider a worldwide, perpetual, irrevocable, royalty-free, sublicensable license to use, reproduce, modify and distribute Customer Content for any purpose."
Why it works against you
You may still own the data on paper, but a license this broad lets the provider do almost anything an owner could, forever, even after you leave. "Sublicensable" means they can pass those rights on to others. "For any purpose" removes any link to the service you actually paid for. See perpetual content license explained and IP assignment clauses explained.
What to ask for instead
Sample wording to propose: "Customer grants Provider a limited, non-exclusive license to use Customer Content solely to provide the Services to Customer during the Term. This license ends when the Agreement ends."
3. Permission to train AI models on your data
A typical clause might read: "Provider may use Customer Content to develop, train and improve its products, including machine learning and artificial intelligence models."
Why it works against you
Phrases like "improve our services" can quietly include AI training. Once your data has been used to train a model, it may not be possible to pull it back out, and patterns from confidential material could show up in what the model produces for others. This matters most for client files, contracts, health or financial records, and anything covered by an NDA. Look for an opt-out, and check whether it is on or off by default.
What to ask for instead
Sample wording to propose: "Provider will not use Customer Content or Outputs to train or fine-tune any machine learning or AI model, including models offered to other customers, without Customer's prior written opt-in consent."
4. A broad carve-out for "aggregated" or "anonymized" data
A typical clause might read: "Notwithstanding anything to the contrary, Provider may create, use and commercialize aggregated or de-identified data derived from Customer Content without restriction."
Why it works against you
"Notwithstanding anything to the contrary" lets this clause override the protections elsewhere in the contract. The terms often don't explain what counts as de-identified, and small or detailed datasets can sometimes be linked back to a person or business. "Commercialize" means your data can become something the provider sells.
What to ask for instead
Sample wording to propose: "Provider may use aggregated data only if it cannot reasonably identify Customer, its users or its clients, is combined with data from multiple customers, and is used only to measure and improve the Services. Provider will not sell such data."
5. Sharing with affiliates, partners and "service providers"
A typical clause might read: "Provider may share Customer Content with its affiliates, partners and third-party service providers as Provider deems appropriate."
Why it works against you
"As Provider deems appropriate" puts no real limit on who receives your data or why. You may not know which companies hold it, where they are, or whether they have their own rights to use it. If you handle other people's personal data, this can also put you at odds with your own privacy duties. A data processing agreement often covers this in more detail. See data processing agreement red flags.
What to ask for instead
Sample wording to propose: "Provider may share Customer Content only with subprocessors listed in [Schedule X], only as needed to provide the Services, and under written obligations at least as protective as this Agreement. Provider will give notice before adding a subprocessor."
6. No right to export or delete your data when you leave
A typical clause might read: "Upon termination, Provider may delete or retain Customer Content at its discretion and has no obligation to return it."
Why it works against you
If the contract ends, or the provider ends it, you could lose access to records you rely on with no time to get them out. Or the provider could keep everything forever. Pair this with a clause that lets the provider end the deal early and the risk grows. See termination for convenience clauses explained.
What to ask for instead
Sample wording to propose: "For 30 days after termination, Customer may export all Customer Content in a standard format. Provider will then delete Customer Content, including copies, within a set period and confirm deletion in writing on request, except where retention is required by law."
Also worth a look
Check how long confidentiality duties last after the contract ends (see confidentiality survival clauses explained), and whether a liability cap leaves you with almost nothing if your data is leaked (see limitation of liability clauses explained). Also check whether the provider can change its data terms just by posting an update, what security and breach-notice promises it makes, and where your data is stored. For business software, see SaaS subscription agreement red flags.
Scan your own terms free
One word like "derived" or "improve" can decide whether your data trains someone else's AI. Upload your terms or contract (PDF, DOCX, TXT or MD, or just take a photo) to the ScanMyTerms terms of service checker. In about a minute you get a list of the clauses that work against you, each with its risk level, the exact wording, why it hurts and how to change it. The free preview needs no sign-up and shows the risk count and the first two findings. The full report is $5. ScanMyTerms does not use your documents to train AI models, and reports are deleted after 7 days.
This page is general information, not legal advice. Data and privacy rules vary by jurisdiction, so for decisions about a specific contract, talk to a qualified lawyer where you live.
Sources
- All clause examples on this page are illustrative and written for this guide. They are not quoted from any real company's terms or contract.
Scan your terms free: see the risk count and first two findings, no sign-up →