{ "dataset": "What software terms allow for AI training data", "description": "For each business system on file: whether the holder can export its data, what the vendor's API terms say about training AI on data pulled through them, and our reading of the rights risk of the content (not legal advice), with quotes.", "reviewed": "2026-10-11", "license": { "name": "CC BY 4.0", "url": "https://creativecommons.org/licenses/by/4.0/", "covers": "our compilation of the tables", "excludes": "quotes keep their sources' terms, and article text is not covered" }, "rows": [ { "id": "slack", "name": "Slack (Salesforce)", "exportAllowed": "limited", "exportRule": "Workspace Owners and Admins can export messages and file links from public channels in JSON format. [Private channels and DMs: Not available on Free and Pro; on Business+] For legal and regulatory compliance, Workspace Owners can apply to access a self-serve data export tool. Workspace Owners and Org Owners must apply to use these export types. Applications require approval from the Workspace Primary Owner. Workspaces on the Free plan can only export links to files from the last 90 days.", "apiRule": "Slack API Terms of Service (Effective: October 10, 2025), Data Usage by Third Parties: you may not \"(A) use API Data to train a large language model;\" or \"(B) bulk export Slack message and file data except where expressly allowed by an additional agreement\". Data Access API and Real-Time Search API: \"you may not create persistent copies, archives, indexes, or long-term data stores of other organizations' API Data.\"", "byPlan": "Free and Pro: public channels only (Free: file links from last 90 days only). Business+: public channels; full export of private channels and DMs only by application approved by the Primary Owner, framed as for legal and regulatory compliance. Enterprise: Org Owners/Admins, Workspace Owners and members with the Export Admin role; full exports require application.", "notes": "Two separate questions. (1) The admin export is a feature of the customer contract; Slack frames full (private and DM) export as a legal and regulatory compliance tool, so a holder should not assume the export button grants a licence-for-AI purpose, and the export contains every employee's and every external Slack Connect participant's messages. (2) Any pipeline that pulls Slack data through the API (including a broker's connector) is barred from LLM training and bulk export by the 2025 API terms. Hunton (28 July 2025): customers who built internal LLMs on Slack archives may need to redesign unless they negotiated limits on unilateral amendments. In practice the safer route is the JSON export run by the workspace owner rather than an API tool, and the content should be treated as personal data of employees and of other organisations (Slack Connect).", "apiLimit": "bars-ai-training", "risk": "high", "sources": [ { "title": "Slack API Terms of Service", "url": "https://slack.com/terms-of-service/api", "date": "2025-10-10 (effective); read 2026-10-11", "quote": "(A) use API Data to train a large language model;" }, { "title": "Slack Help: Export your workspace data", "url": "https://slack.com/help/articles/201658943-Export-your-workspace-data", "date": "read 2026-10-11", "quote": "Workspace Owners and Org Owners must apply to use these export types." }, { "title": "Hunton Andrews Kurth: Salesforce locks down Slack data", "url": "https://www.hunton.com/insights/legal/salesforce-locks-down-slack-data-time-to-review-your-slack-api-terms", "date": "2025-07-28", "quote": "Salesforce recently modified its Slack API Terms of Service (the Terms) to prohibit (i) bulk exporting of data accessible through the Slack application programming interfaces (APIs), (ii) the creation of persistent copies, archives, indexes or long-term data stores, and (iii) the usage of such data in large language models (LLMs)." } ] }, { "id": "microsoft-365", "name": "Microsoft 365 / Teams / Exchange / SharePoint", "exportAllowed": "yes", "exportRule": "Microsoft Products and Services DPA (May 2026): \"As between the parties, Customer retains all right, title and interest in and to Customer Data and Professional Services Data.\" \"At all times during the term of Customer's subscription ... Customer will have the ability to access, extract and delete Customer Data stored in each Online Service\". Data is retained \"in a limited function account for 90 days after expiration or termination of Customer's subscription so that Customer may extract the data.\"", "apiRule": "Microsoft APIs Terms of Use (Last Updated October 2025, covers Microsoft Graph, Teams, Exchange, SharePoint, OneDrive APIs): you may NOT \"Scrape, build databases or otherwise create copies of any data accessed or obtained using the Microsoft APIs, except as necessary to enable an intended usage scenario for your Application\" and may not \"Redistribute or resell, or sublicense access to, the Microsoft APIs, any data obtained using the Microsoft APIs\". Email protocols and APIs may only be used for \"syncing\" or \"backing up\" mail, calendar and contacts unless customers expressly grant other permissions. Product Terms change (1 May 2026, Office and Microsoft 365 Applications): \"outputs generated through Robotic Process Automation, bots, or other similar technologies may not be used to develop, train, evaluate, improve AI or machine learning models, or to replicate product functionality.\"", "byPlan": "Customer can extract Customer Data during the subscription and for 90 days after it ends (DPA). Bulk mailbox and Teams chat export for an organisation is usually done through Microsoft Purview eDiscovery; Microsoft Learn says premium eDiscovery features require Office 365 E5 or Microsoft 365 E5 (or E5 add-ons); a vendor guide says standard eDiscovery content search and export is in E3 and above (not verified against Microsoft licensing docs). Teams export APIs were protected and metered; Microsoft says they are no longer metered as of 25 August 2025.", "notes": "The customer's ownership and extraction right are strong, so the blocker is not Microsoft's contract but what is inside the mailboxes and chats (third-party and employee personal data, counterparties' confidential material). The API terms restrict a third-party app (for example a broker connector) from building a copy of the data beyond its intended scenario and from reselling data obtained through the API. The May 2026 Product Terms clause targets bot or RPA outputs of the Office apps used for AI training; it does not on its face bar a customer from licensing its own documents. Prefer customer-run eDiscovery or admin export over a third-party Graph app.", "apiLimit": "bars-copying", "risk": "medium", "sources": [ { "title": "Microsoft Products and Services Data Protection Addendum (Word document, last updated May 22, 2026)", "url": "https://www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx", "date": "2026-05-22", "quote": "As between the parties, Customer retains all right, title and interest in and to Customer Data and Professional Services Data." }, { "title": "Terms of Use: Microsoft APIs", "url": "https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use", "date": "Last Updated October 2025", "quote": "Redistribute or resell, or sublicense access to, the Microsoft APIs, any data obtained using the Microsoft APIs, or any other Microsoft Offering accessed through the Microsoft APIs" }, { "title": "Microsoft Product Terms: changes (Office and Microsoft 365 Applications)", "url": "https://www.microsoft.com/licensing/terms/product/changes/SS", "date": "2026-05-01", "quote": "outputs generated through Robotic Process Automation, bots, or other similar technologies may not be used to develop, train, evaluate, improve AI or machine learning models, or to replicate product functionality." }, { "title": "Microsoft Learn: Metered APIs and services in Microsoft Graph", "url": "https://learn.microsoft.com/en-us/graph/metered-api-list", "date": "read 2026-10-16 (change dated 2025-08-25)", "quote": "Starting August 25, 2025, the Teams APIs are no longer metered, and no billing configuration is required to use these APIs." } ] }, { "id": "google-workspace", "name": "Google Workspace (Gmail, Drive, Docs, Chat)", "exportAllowed": "yes", "exportRule": "Google Workspace Admin Help, Export all your organization's data: \"These steps initiate a full export of your organization's data and are available in all Google Workspace editions.\" Requires a \"Google Workspace or Cloud Identity super administrator account that is at least 30 days old\" with 2-Step Verification. \"The export is available no earlier than 48 hours after you start the export.\"", "apiRule": "Google Workspace API User Data and Developer Policy (last updated 2026-09-03), prohibited: \"Transferring, selling, or using user data to create, train, or improve a machine learning or artificial intelligence model beyond that specific user's personalized model for the appropriate use case or user-facing feature.\" Also prohibited: \"Transferring or selling user data to third parties like advertising platforms, data brokers, or any information resellers.\"", "byPlan": "Full organisation export: all editions, by a super admin (30-day-old account, 2SV). Export for specific users or filtered exports: \"If available\"; advanced editions such as Enterprise Plus or Education Plus use a separate \"Choose the Workspace data you want to export\" flow. Organisations over 1,000 users or with FedRAMP authorisation must contact support first. Google Vault is the eDiscovery export route on editions that include it.", "notes": "Admin export of the organisation's own data is clearly allowed. The hard restriction is on apps that obtain Workspace data via Google APIs (OAuth apps, including any broker or labelling connector): they may not use it to train generalised AI models or transfer it to data brokers. So the holder should export with the native Data Export tool or Vault and transfer the files under its own licence, rather than authorise a third-party app to pull the data.", "apiLimit": "bars-ai-training", "risk": "medium", "sources": [ { "title": "Google Workspace API User Data and Developer Policy", "url": "https://developers.google.com/workspace/workspace-api-user-data-developer-policy", "date": "last updated 2026-09-03", "quote": "Transferring, selling, or using user data to create, train, or improve a machine learning or artificial intelligence model beyond that specific user's personalized model for the appropriate use case or user-facing feature." }, { "title": "Google Workspace Admin Help: Export all your organization's data", "url": "https://knowledge.workspace.google.com/admin/migrate/export-all-your-organizations-data?hl=en", "date": "read 2026-10-11", "quote": "These steps initiate a full export of your organization's data and are available in all Google Workspace editions." } ] }, { "id": "atlassian", "name": "Atlassian (Jira, Confluence, Jira Service Management)", "exportAllowed": "yes", "exportRule": "Atlassian Customer Agreement (effective October 1, 2026), section 13: \"As between the parties, Customer owns all intellectual property and other rights in Customer Data\"; section 4.4: \"The Documentation describes how Customer may retrieve its Customer Data from the Cloud Products.\" After termination: \"Following expiration or termination, unless prohibited by Law, Atlassian will delete Customer Data\".", "apiRule": "No clause found in the Atlassian Customer Agreement barring a customer from using its own data to train AI; section 2.2 bars using \"the Products to develop a similar or competing product or service\". Atlassian Developer Terms were not retrievable (404) when read, so restrictions on Marketplace or API apps are unverified. Separately, Atlassian's own use: \"Changes to how Atlassian will use metadata and in-app data to improve apps and experiences for all customers went into effect on August 17, 2026.\"", "byPlan": "Jira Cloud: Backup manager (Administration, System, Import and Export) produces a site backup with issues, users and optional attachments; one backup at a time, regenerable every 24 hours (older Atlassian docs). Confluence: space and site exports. Data contribution defaults (metadata / in-app data): Free On/On, Standard On/On, Premium On/Off, Enterprise On/Off. Only an organization with an active Enterprise plan can opt out of metadata contribution (\"If your Atlassian organization has an active Enterprise plan, you can opt-out of metadata contribution\"), and \"every customer has the option to opt out of contributing in-app data\" (read 16 Oct 2026).", "notes": "Export of own data is permitted and documented. Two points for the holder: (1) Jira and Confluence hold customer tickets (JSM), contractor and partner content and personal data, so content review is the gate, not Atlassian's terms. (2) Since 17 August 2026 Atlassian itself uses de-identified, aggregated in-app content (on Free and Standard by default) to improve its AI features, so a buyer asking for exclusivity should be told that the platform vendor may already have derived value from the same content; it is not an exclusive grant Atlassian holds over the data, but it is worth disclosing. Atlassian says data is de-identified and aggregated before use.", "apiLimit": "unclear", "risk": "low", "sources": [ { "title": "Atlassian Customer Agreement", "url": "https://www.atlassian.com/legal/atlassian-customer-agreement", "date": "effective 2026-10-01", "quote": "As between the parties, Customer owns all intellectual property and other rights in Customer Data" }, { "title": "Atlassian Trust: Data contribution", "url": "https://www.atlassian.com/trust/ai/data-contribution", "date": "read 2026-10-16 (change effective 2026-08-17)", "quote": "If your Atlassian organization has an active Enterprise plan, you can opt-out of metadata contribution. If your Atlassian organization’s highest active plan is Free, Standard, or Premium, metadata contribution is always on, and you’re not able to opt-out. ... every customer has the option to opt out of contributing in-app data." }, { "title": "Atlassian Support: Data contribution settings", "url": "https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/", "date": "read 2026-10-16", "quote": "To view your settings, navigate to Atlassian Administration, then Security, and then Data contribution. ... Atlassian will begin to use data according to the data contribution settings on August 17, 2026." } ] }, { "id": "github", "name": "GitHub", "exportAllowed": "yes", "exportRule": "GitHub Terms of Service (Effective date: April 27, 2026), D.3: \"You own Your Content.\" Repositories can be cloned in full with git, and organisation and user migration archives are available to owners.", "apiRule": "No clause found in the GitHub Terms of Service or Acceptable Use Policies barring a repository owner from licensing its own code for AI training. The API terms (section H) restrict abuse: \"Abuse or excessively frequent requests to GitHub via the API may result in the temporary or permanent suspension\" and \"You may not use the API to download data or Content from GitHub for spamming purposes.\" Acceptable Use, section 7: \"Researchers may use public, non-personal information from the Service for research purposes, only if any publications resulting from that research are open access.\" Scraping \"does not refer to the collection of information through our API.\"", "byPlan": "Any owner can clone repositories. Organisation owners can run migration exports. No plan gate on getting your own code out.", "notes": "GitHub's terms are not the blocker; the content is. A repository mixes the holder's own code (sellable only if IP assignment from employees and contractors is clean) with vendored third-party and open-source code whose licences travel with it, plus issues, pull request comments and commit metadata containing contributors' names and emails (personal data). Public repositories already carry a licence to other users under D.5. Since 24 to 27 April 2026, GitHub may use Copilot inputs and outputs on Free, Pro and Pro+ to train AI models unless the user opts out (J.3), and this does not apply where a GitHub Customer Agreement governs; disclose this to a buyer seeking exclusivity over code written with Copilot. Commentary (Heise, March 2026) reports private repository content at rest is not used for training.", "apiLimit": "none-found", "risk": "low", "sources": [ { "title": "GitHub Terms of Service", "url": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service", "date": "effective 2026-04-27", "quote": "You own Your Content." }, { "title": "GitHub Terms of Service, J.3 (Inputs and Outputs)", "url": "https://docs.github.com/en/site-policy/github-terms/github-terms-of-service", "date": "effective 2026-04-27", "quote": "a license to collect and use your Inputs and Outputs to develop, train and improve artificial intelligence ... unless (a) you opt out through your account settings" }, { "title": "GitHub Acceptable Use Policies", "url": "https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies", "date": "read 2026-10-11", "quote": "Researchers may use public, non-personal information from the Service for research purposes, only if any publications resulting from that research are open access." }, { "title": "Heise: Only with opt-out, GitHub will train Copilot models with user data", "url": "https://www.heise.de/en/news/Only-with-opt-out-GitHub-will-train-Copilot-models-with-user-data-in-the-future-11226787.html", "date": "2026-03-27", "quote": "GitHub is changing its terms of use and will use user interactions with Copilot for its AI model training starting April 24, 2026. ... The change affects the Free, Pro, and Pro+ plans, but not Business and Enterprise." } ] }, { "id": "gitlab", "name": "GitLab", "exportAllowed": "yes", "exportRule": "GitLab Subscription Agreement, 8.4: \"Customer represents it shall be responsible for, and retain all right, title, and interest in and to, Customer Content, subject to a limited license to GitLab necessary for GitLab's provision of the Software and its development and improvement.\" For GitLab Dedicated, on termination \"Customer shall be solely responsible for migrating any and all Customer Content and Customer Confidential Information off of GitLab's selected infrastructure\".", "apiRule": "No clause found restricting a customer's use of its own content for AI training. Use restrictions target the software: customer may not \"disassemble, reverse engineer, or decompile the Software or access it to: (a) build a competitive product or service\". Section 12 (U.S. Government Matters): \"Customer shall not export, reexport, or transfer the Controlled Subject Matter except as authorized by these laws and regulations.\"", "byPlan": "Self-managed: the customer holds the data. GitLab.com and Dedicated: project and group exports by maintainers and owners; the customer must migrate content off before termination.", "notes": "Like GitHub: the blocker is open-source licences, contributor personal data and contractor IP assignment, not GitLab's terms. Self-managed GitLab instances are the cleanest source because no SaaS vendor terms sit between holder and data. GitLab's AI Transparency Center states (per a search excerpt, not contract language) that inputs to and outputs from GitLab Duo are not currently used to train GitLab models.", "apiLimit": "none-found", "risk": "low", "sources": [ { "title": "GitLab Subscription Agreement (handbook)", "url": "https://handbook.gitlab.com/handbook/legal/subscription-agreement/", "date": "read 2026-10-11", "quote": "Customer represents it shall be responsible for, and retain all right, title, and interest in and to, Customer Content" }, { "title": "GitLab AI Functionality Terms V3", "url": "https://handbook.gitlab.com/handbook/legal/ai-functionality-terms-v3/", "date": "read 2026-10-16", "quote": "both Input and Output constitute additional Customer Content as that term is defined in the Subscription Agreement. Customer will retain all ownership of Customer Content, as permitted under applicable law." } ] }, { "id": "notion", "name": "Notion", "exportAllowed": "yes", "exportRule": "Notion Master Subscription Agreement (updated effective August 17, 2026), 3.1: \"As between Customer and Notion, Customer retains all right, title, interest and ownership of the Customer Data\" and \"At any time during the Subscription Term, Customer may export Customer Data from the Services using Notion's self-service export functionality in an industry-standard format\". 10.4: \"Upon any termination of this Agreement, Notion will make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days.\"", "apiRule": "No clause in the MSA bars the customer from using its own exported data to train AI. Use restriction 2.1(8): customer will not \"access the Services for the purpose of building a competitive product or service or copying its features or user interface\". Notion's Developer Terms were not reviewed when read (unverified).", "byPlan": "Help Center: \"You can export all your pages as HTML, Markdown, or CSV (for databases)\" from Settings, General; \"Pages that the exporter doesn't have access to, such as private pages of other users, will not be included in the export.\" Workspace owners can disable export (Settings, Security). Admin API for workspace-level exports is in beta on Enterprise. Download link \"will expire after 7 days.\"", "notes": "Clean contractually. Watch two things: a full export by one admin can miss other users' private pages, so the holder must state what is and is not in the export; and wikis often embed customer documents, contracts and HR pages. The April 2026 MSA update also notes that enabling integrations (APIs, MCP connectors) may require sharing Customer Data with third parties, so a broker connector is a disclosure the holder authorises.", "apiLimit": "unclear", "risk": "low", "sources": [ { "title": "Notion Master Subscription Agreement", "url": "https://notion.notion.site/master-subscription-agreement", "date": "updated effective 2026-08-17", "quote": "At any time during the Subscription Term, Customer may export Customer Data from the Services using Notion's self-service export functionality in an industry-standard format then-supported by the Services" }, { "title": "Notion Help: Export your content", "url": "https://www.notion.com/help/export-your-content", "date": "read 2026-10-11", "quote": "Pages that the exporter doesn't have access to, such as private pages of other users, will not be included in the export." }, { "title": "Notion MSA Update Summary, April 2026", "url": "https://notion.notion.site/Master-Subscription-Agreement-Update-Summary-April-2026-333efdeead0580888fded0cd3459d8f0", "date": "2026-04", "quote": "Customers continue to own their Customer Data. The updated language makes that clearer and confirms Customer Data is treated as Customer Confidential Information under the MSA." } ] }, { "id": "salesforce", "name": "Salesforce (Sales Cloud, Service Cloud, platform)", "exportAllowed": "yes", "exportRule": "Salesforce Main Services Agreement (SFDC-MSA, October 15, 2026): \"Upon request by Customer made within 30 days after the effective date of termination or expiration of this Agreement, SFDC will make Customer Data available to Customer for export or download as provided in the Documentation. After such 30-day period, SFDC will have no obligation to maintain or provide any Customer Data\".", "apiRule": "The MSA has no clause barring a customer from using its own Customer Data to train AI. Customer must use Services in accordance with \"the Acceptable Use and External Facing Services Policy and the Artificial Intelligence Acceptable Use Policy\" and may not \"access it to (1) build a competitive product or service\" or \"use any Services to access, copy or use any of SFDC intellectual property except as permitted\". The restrictive API-level AI terms Salesforce adopted in 2025 apply to Slack (see slack), not found for core CRM.", "byPlan": "Data Export Service in Setup: weekly exports on Enterprise, Performance and Unlimited; every 29 days on Professional and Developer (Salesforce Trailhead); download links reportedly expire after 48 hours (third-party guides). Data Loader and Bulk API for full object exports.", "notes": "The contract lets the customer take its data out. What blocks a sale is what the CRM holds: customers' and prospects' personal data (names, emails, call notes), customer confidential deal terms, and data bought from list vendors whose licence usually forbids resale. Treat CRM records as presumptively non-sellable except aggregated or properly de-identified, and check any third-party enrichment data (ZoomInfo and similar) licence before including it.", "apiLimit": "none-found", "risk": "high", "sources": [ { "title": "Salesforce Main Services Agreement (PDF, SFDC-MSA, October 15, 2026)", "url": "https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/salesforce_MSA.pdf", "date": "2026-10-15", "quote": "Upon request by Customer made within 30 days after the effective date of termination or expiration of this Agreement, SFDC will make Customer Data available to Customer for export or download as provided in the Documentation. After such 30-day period, SFDC will have no obligation to maintain or provide any Customer Data" }, { "title": "Salesforce Trailhead: Learn Data Export Methods and Steps for Salesforce", "url": "https://trailhead.salesforce.com/content/learn/modules/lex_implementation_data_management/lex_implementation_data_export", "date": "read 2026-10-16", "quote": "It allows you to export data manually once every 7 days (for weekly export) or 29 days (for monthly export). You can also export data automatically at weekly or monthly intervals. Weekly exports are available in Enterprise, Performance, and Unlimited Editions. In Professional Edition and Developer Edition, you can generate backup files only every 29 days, or automatically at monthly intervals only." } ] }, { "id": "hubspot", "name": "HubSpot", "exportAllowed": "yes", "exportRule": "HubSpot Customer Terms of Service (Last Modified: September 16, 2026), 5.1: \"You own and retain all rights to the Customer Materials and Customer Data.\" 5.7 points to \"Retrieval of Customer Data\" in the Product Specific Terms (not read).", "apiRule": "HubSpot Developer Terms update (announced and effective May 4, 2026) restricts \"using data accessed through the APIs to train, fine-tune, or improve AI or machine learning models\" \"with a clear carve-out for legitimate single-customer use cases\"; the Technology Partner Program Agreement will \"explicitly exempt all technology partners in good standing from the new restriction\". HubSpot's own use (Customer Terms 5.3.1): \"We may also use Customer Data to train our AI models in compliance with our obligations under the Agreement.\" \"You may opt out of having your Customer Data used for this purpose by updating your settings in your HubSpot account.\"", "byPlan": "Record exports from the CRM by users with export permission; Super Admins see an audit log of all exports and can set large-export alerts (up to 275,000 records). Plan-level detail for a full account export not verified.", "notes": "Export by the account owner is fine. Any app or connector that pulls HubSpot data through the API to build a multi-customer training set (a broker's pipeline, a data marketplace connector) falls within the May 2026 restriction. Content is mostly contacts' personal data and marketing email history, so the privacy layer is the real blocker. HubSpot itself trains on Customer Data unless opted out.", "apiLimit": "bars-ai-training", "risk": "high", "sources": [ { "title": "HubSpot Developer Changelog: Our ecosystem vision for the agent era, updated Developer Terms", "url": "https://developers.hubspot.com/changelog/our-ecosystem-vision-for-the-agent-era-updated-developer-terms", "date": "2026-05-04", "quote": "using data accessed through the APIs to train, fine-tune, or improve AI or machine learning models" }, { "title": "HubSpot Customer Terms of Service", "url": "https://legal.hubspot.com/terms-of-service", "date": "last modified 2026-09-16", "quote": "We may also use Customer Data to train our AI models in compliance with our obligations under the Agreement." } ] }, { "id": "zendesk", "name": "Zendesk", "exportAllowed": "limited", "exportRule": "Zendesk help (Exporting ticket, user, or organization data from your account): \"To protect the data in your Zendesk account, data exports are not enabled by default in Zendesk accounts.\" \"The account owner must contact Zendesk Customer Support to enable data exports in your account.\" Available on Suite Growth, Professional, Enterprise and Enterprise Plus, and Support Professional and Enterprise; not on Team plans (which can use the REST API).", "apiRule": "Zendesk Developer Terms (Effective Date: August 12, 2025), 3.6(iii): developer must \"not use API Data for any purpose other than to provide its Application functionality\", \"including creating, training, or improving any general AI model, such as, but not limited to, a large language model\", \"or sanitizing API Data for such purposes;\" 3.6(iv): \"not directly or indirectly use the APIs to develop Applications that allow bulk export of API Data;\" 3.6(v): \"not create persistent copies, archives, indexes, or long-term data stores using API Data\". 3.3(iv): may not \"repackage or resell the Services, APIs, or API Data;\"", "byPlan": "Native JSON, CSV or XML export after the account owner asks Support to enable it; exports can be restricted to certain admins by email domain. AI agent tickets cannot be exported. Team plans: REST API only, which is bound by the Developer Terms above.", "notes": "Its Developer Terms are among the most restrictive we read. A connector or script that pulls tickets through the API to build a training set, or to sanitise them for that purpose, appears to fall within clause 3.6; that would include a Team-plan customer whose only route out is the API. The native export, enabled by the account owner, is the route least exposed to those terms. Content is customer conversations: the end customers' personal data and often the holder's own customers' confidential information, usually covered by a DPA. Treat it as hard to sell unless properly de-identified and permitted by customer contracts.", "apiLimit": "bars-ai-training", "risk": "high", "sources": [ { "title": "Zendesk Developer Terms", "url": "https://www.zendesk.nl/company/agreements-and-terms/zendesk-developer-terms/", "date": "effective 2025-08-12", "quote": "including creating, training, or improving any general AI model, such as, but not limited to, a large language model" }, { "title": "Zendesk help: Exporting ticket, user, or organization data from your account", "url": "https://support.zendesk.com/hc/en-us/articles/4408886165402-Exporting-ticket-user-or-organization-data-from-your-account", "date": "read 2026-10-11 from a search excerpt", "quote": "To protect the data in your Zendesk account, data exports are not enabled by default in Zendesk accounts." } ] }, { "id": "servicenow", "name": "ServiceNow", "exportAllowed": "yes", "exportRule": "ServiceNow Subscription Service Agreement (copy filed on UK G-Cloud 15, 30 January 2026): \"Upon written request by Customer within 45 days after termination or expiration of this Agreement (or termination or expiration of a Use Authorization), ServiceNow will provide any Customer Data in the Subscription Service to Customer in ServiceNow's standard database export format at no additional charge.\"", "apiRule": "No clause found restricting a customer's use of its own Customer Data for AI training; restrictions in the agreement target the ServiceNow Core Technology (for example no use in \"competition with ServiceNow Core Technology\", no reverse engineering). ServiceNow's own use: \"ServiceNow uses customer data sharing to improve its Now LLMs continuously.\" \"Customers have the option to opt out of data sharing to prevent their usage data from contributing to model improvements.\"", "byPlan": "During the subscription: instance admins export tables (XML, CSV, Excel) and use the REST/Table API. After termination: 45-day window to request a database export. Now Assist data sharing opt-out is per instance from the Now Assist Admin console and needs a data steward role (search excerpt; reportedly opted in by default and not available for GCC or self-hosted instances).", "notes": "Contract allows retrieval. Content is IT and HR tickets: employee personal data, often sensitive HR cases (health, grievances, investigations), security incident details and vendor confidential data. HR Service Delivery and security incident tables should be excluded by default. Disclose whether the customer was opted in to Now Assist data sharing.", "apiLimit": "none-found", "risk": "medium", "sources": [ { "title": "ServiceNow Subscription Service Agreement (UK G-Cloud 15 filing)", "url": "https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-15/documents/92331/724835305645807-terms-and-conditions-2026-01-30-1008.pdf", "date": "2026-01-30", "quote": "ServiceNow will provide any Customer Data in the Subscription Service to Customer in ServiceNow's standard database export format at no additional charge." }, { "title": "ServiceNow docs: User data usage policy for Now Assist (Zurich)", "url": "https://www.servicenow.com/docs/r/zurich/intelligent-experiences/user-data-usage-policy-now-assist.html", "date": "read 2026-10-11", "quote": "ServiceNow uses customer data sharing to improve its Now LLMs continuously." }, { "title": "ServiceNow docs: Opt out of data sharing for Now Assist", "url": "https://www.servicenow.com/docs/r/intelligent-experiences/opt-out-of-data-sharing-for-now-assist.html", "date": "read 2026-10-11 from a search excerpt", "quote": "You must opt out of data sharing to turn off ServiceNow ability to gather Customer data for AI and data products." } ] }, { "id": "intercom", "name": "Intercom", "exportAllowed": "unclear", "exportRule": "Customer terms not reviewed. Intercom offers conversation and user exports in-product and via API, but the plan gating and contractual export clause were not verified.", "apiRule": "Intercom Developer Terms (no date shown): no AI-training clause found. 3.2.1(g): \"You will not scrape, or otherwise create copies of any data obtained using the Intercom Service\"; 1.5.2: \"Developer shall not collect or store any Developer Data without end-user's authorization.\" Intercom contractually restricts \"Third Party LLM Providers from using Customer Data for training or otherwise improving Third Party LLM Provider's services\" (Additional Product Terms, from a search excerpt).", "byPlan": "Unverified.", "notes": "The developer terms bar a third-party app from scraping or copying data obtained through the Intercom Service, which catches a broker connector even without an explicit AI clause. Content is the holder's customers' support chats: their personal data and the holder's customers' confidential information, usually under a DPA. Treat as hard to sell unless properly de-identified and permitted by customer contracts.", "apiLimit": "bars-copying", "risk": "high", "sources": [ { "title": "Intercom Developer Terms", "url": "https://developers.intercom.com/docs/publish-to-the-app-store/intercom-developer-terms", "date": "read 2026-10-11 (no date on page)", "quote": "You will not scrape, or otherwise create copies of any data obtained using the Intercom Service" }, { "title": "Intercom Additional Product Terms", "url": "https://www.intercom.com/legal/terms-and-policies/additional-product-terms", "date": "read 2026-10-16", "quote": "Intercom contractually restricts Third Party AI Providers from using Customer Data for training or otherwise improving Third Party AI Provider's services." } ] }, { "id": "zoom", "name": "Zoom (meetings, recordings, transcripts, chat)", "exportAllowed": "yes", "exportRule": "Zoom Terms of Service, section 10: \"You retain all ownership rights in your Customer Content subject to any license or other rights granted herein.\" \"Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content (such as poll results, whiteboard and reactions) to train Zoom or third-party artificial intelligence models.\"", "apiRule": "Zoom API License and Terms of Use (Last Updated: July 16, 2025): \"You may not use any Customer Content (as defined in the Zoom Terms of Service) accessed or obtained using the Zoom APIs or your Application to train, develop, evaluate, test, improve, or modify artificial intelligence or machine learning models (including language models) (\"AI Training\"), nor allow such data to be used for those purposes, except with Zoom's express written permission. Notwithstanding the foregoing, if you obtain explicit consent from a Zoom Account Owner to use their Customer Content for AI Training, you may use such Customer Content solely for AI Training specifically for their use. For clarity, the resulting customized model may only be used by the Customer who consented to the use of their Customer Content and not by any other party.\"", "byPlan": "Cloud recordings and transcripts are downloadable by hosts and account admins from the web portal; local recordings sit on hosts' computers (plan-level detail not verified).", "notes": "Zoom does not stop the account owner downloading recordings, but any API-based pipeline (including a broker's or labeller's app) is barred from using the content for multi-customer AI training without Zoom's written permission. The heavier blockers are outside Zoom: every participant's voice and face (BIPA voiceprint and face-geometry exposure for Illinois participants), all-party consent wiretap laws for recordings (California, Illinois, Pennsylvania, Washington, Florida and others), and external participants (clients, candidates, patients) who never agreed to anything beyond the meeting. Treat recordings as audio-speech and video with the highest consent bar.", "apiLimit": "bars-ai-training", "risk": "high", "sources": [ { "title": "Zoom API License and Terms of Use", "url": "https://explore.zoom.us/en/legal/zoom-api-license-and-tou/", "date": "last updated 2025-07-16", "quote": "You may not use any Customer Content (as defined in the Zoom Terms of Service) accessed or obtained using the Zoom APIs or your Application to train, develop, evaluate, test, improve, or modify artificial intelligence or machine learning models (including language models)" }, { "title": "Zoom Terms of Service", "url": "https://www.zoom.com/en/trust/terms/", "date": "read 2026-10-11", "quote": "You retain all ownership rights in your Customer Content subject to any license or other rights granted herein." } ] }, { "id": "quickbooks", "name": "QuickBooks Online / Intuit", "exportAllowed": "yes", "exportRule": "Intuit Terms of Service (Platform Terms, Version 02122026): \"Your Content remains yours, which means that you retain any intellectual property rights that you have in your Content.\" QuickBooks help (from a search excerpt): \"your data will be available in read-only access for 1 year from the date of cancellation\" and \"as long as you're within the read-only access period of your cancelled account, you'll still be able to export your data.\"", "apiRule": "Intuit Terms of Service, Prohibited Uses: \"Engage in unauthorized access, monitoring, interference with, or use of the Platform or third party accounts, information (including personal information), computers, systems or networks, including scraping, accessing, or downloading content that doesn't belong to you, or training or developing artificial intelligence or machine learning models or related technology using information derived from the Platform without authorization;\". The Intuit Developer Terms (QuickBooks API) could not be read (client-rendered page); their AI clause is unverified.", "byPlan": "Export to Excel (Settings, Tools, Export Data) during the subscription and for one year read-only after cancellation for paid plans (90 days for trials), per Intuit help and community answers.", "notes": "Ambiguous clause: the prohibition is on training AI \"using information derived from the Platform without authorization\". It is unclear whether a customer's own exported books count as \"information derived from the Platform\"; the safer reading is that exported ledger data is the customer's Content, but derived reports, Intuit categorisation and benchmark fields may be Platform-derived. Accounting data also contains customers' and vendors' names, bank details and employee payroll (sensitive), so heavy de-identification is needed. Have a lawyer read the clause before selling QuickBooks-derived data.", "apiLimit": "unclear", "risk": "medium", "sources": [ { "title": "Intuit Terms of Service (QuickBooks Online, US)", "url": "https://www.intuit.com/legal/terms/en-us/quickbooks/online/", "date": "Platform Terms Version 02122026; Product Specific Terms Version 09222026", "quote": "or training or developing artificial intelligence or machine learning models or related technology using information derived from the Platform without authorization;" }, { "title": "QuickBooks help: What happens to my data after cancelling", "url": "https://quickbooks.intuit.com/learn-support/en-au/help-article/access-permissions/happens-quickbooks-online-data-cancel/L6qDpbE1B_AU_en_AU", "date": "read 2026-10-11 from a search excerpt", "quote": "your data will be available in read-only access for 1 year from the date of cancellation" } ] }, { "id": "xero", "name": "Xero", "exportAllowed": "limited", "exportRule": "Customer-side export terms not reviewed. Xero supports report and data exports in-product; the restriction below governs any app or API route.", "apiRule": "Xero Developer Platform Terms and Conditions (Last updated: 4 December 2025): \"You must not use API Data sourced from the Xero developer platform to train or fine tune any artificial intelligence models\"; clause 7(b)(i): \"API Data cannot be used to train, fine tune, adapt, or enhance any AI Models.\" 7(b)(ii): \"API Data shall not be passed to another third party without consent from the associated user.\" Clause 29 bars developers from: \"Sell any user data (but you can charge users a fee for your app).\"", "byPlan": "Unverified. Terms apply immediately to developers registered on or after 4 December 2025 and from 2 March 2026 to earlier registrants.", "notes": "Of the accounting platforms we read, Xero's terms are the most restrictive: data pulled through the Xero API may not be used to train or fine-tune any AI model at all, with no single-customer carve-out stated in the quoted text. A holder should use native exports rather than an API connector, and should still expect a buyer's counsel to ask how the data left Xero. Accounting data carries counterparties' names, bank and payroll data.", "apiLimit": "bars-ai-training", "risk": "high", "sources": [ { "title": "Xero Developer Platform Terms and Conditions", "url": "https://developer.xero.com/xero-developer-platform-terms-conditions", "date": "last updated 2025-12-04", "quote": "API Data cannot be used to train, fine tune, adapt, or enhance any AI Models." }, { "title": "Xero Developer: Pricing and Policy Updates FAQ", "url": "https://developer.xero.com/faq/pricing-and-policy-updates", "date": "read 2026-10-11 from a search excerpt", "quote": "apps must not use bots or browser extensions to undermine our security controls or simulate user actions." } ] }, { "id": "netsuite", "name": "Oracle NetSuite", "exportAllowed": "unclear", "exportRule": "EU Data Act Addendum for NetSuite Cloud Services: Oracle will \"allow You to retrieve or delete Customer Data from the eligible Cloud Service (i) at any time up to the Switch Date, including within the Notice Period, in accordance with the functionality described in the User Guides\"; \"The available self-service tools and processes to retrieve exportable data in a structured, machine-readable format from an eligible Cloud Service are described in its applicable User Guides\". The general NetSuite terms of service could not be retrieved (403/404).", "apiRule": "Not found. The current NetSuite terms of service and SuiteTalk/REST API terms could not be retrieved when read.", "byPlan": "Saved searches and CSV export, SuiteTalk and REST APIs during the subscription; post-termination access reportedly ends unless a paid read-only arrangement is bought (consultancy blog, unverified).", "notes": "Treat as unverified. ERP data includes customers, vendors, pricing, payroll and employee records, plus counterparties' confidential terms. The EU Data Act addendum shows Oracle documents structured export for switching, which supports the view that the customer can get its own data out; whether NetSuite terms restrict AI use was not established.", "apiLimit": "unclear", "risk": "medium", "sources": [ { "title": "Oracle: EU Data Act Addendum for NetSuite Cloud Services", "url": "https://www.oracle.com/contracts/docs/eu-data-act-addendum-netsuite-cloud-services.pdf", "date": "read 2026-10-11", "quote": "The available self-service tools and processes to retrieve exportable data in a structured, machine-readable format from an eligible Cloud Service are described in its applicable User Guides" } ] }, { "id": "figma", "name": "Figma", "exportAllowed": "yes", "exportRule": "Figma Terms of Service (Effective Date: March 11, 2026), 2.8: \"As between Customer and Figma, Customer retains all right, title, and interest in Customer Content, and Figma owns all right, title, and interest in the Services.\" Exception: on termination for breach of the export-control clause \"you lose all right, title, and interest to Customer Content\".", "apiRule": "Figma Developer Terms (Effective Date May 5, 2026): no clause found on using API or MCP data to train AI. Section 8(a): \"Figma owns all right, title, and interest in the Developer Resources, the Services, and any data derived from either\". Figma's own use: content training is an admin setting; per Figma help (via search) Starter and Professional teams default to content training on and Organization and Enterprise default to off; training began 15 August 2024.", "byPlan": "Files can be saved locally as .fig and assets exported (PNG, SVG, PDF) by editors; bulk organisation export not verified.", "notes": "Design files are usually the company's own work product and low personal-data risk, but often embed client brand assets, licensed fonts, stock imagery, and third-party UI kits whose licences forbid redistribution. If the team was on Starter or Professional with content training on, Figma may already have trained on the files: disclose to a buyer seeking exclusivity.", "apiLimit": "none-found", "risk": "low", "sources": [ { "title": "Figma Terms of Service", "url": "https://www.figma.com/legal/tos/", "date": "effective 2026-03-11", "quote": "As between Customer and Figma, Customer retains all right, title, and interest in Customer Content, and Figma owns all right, title, and interest in the Services." }, { "title": "Figma Developer Terms", "url": "https://www.figma.com/developer-terms/", "date": "effective 2026-05-05", "quote": "Figma owns all right, title, and interest in the Developer Resources, the Services, and any data derived from either" }, { "title": "Figma Help: Control AI features and content training settings", "url": "https://help.figma.com/hc/en-us/articles/17725942479127", "date": "read 2026-10-11 from a search excerpt", "quote": "content training does not affect access to AI features" } ] }, { "id": "linear", "name": "Linear", "exportAllowed": "yes", "exportRule": "Linear Terms of Service (Effective date: June 09, 2026), 10.2: \"Except for the limited rights and licenses granted in this Agreement, Customer will own all right, title and interest in and to the User Submissions and there are no implied licenses under this Agreement.\" 5.3: \"Within thirty (30) days of termination of this Agreement for cause, upon Customer's request following termination, or if Customer deletes its workspace within the Service, Linear will delete Customer's User Information, including passwords and all related information, files, and User Submissions\".", "apiRule": "No clause found barring a customer from using its own User Submissions for AI training. Restriction (g): customer may not \"use or access the Service to build or support and/or assist a third party in building or supporting products or services competitive to the Service\". AI features are governed by a separate AI Services Addendum (not read).", "byPlan": "Not verified (Linear offers CSV export of issues and a public GraphQL API).", "notes": "Contractually clean. Content is engineering tickets: product roadmap, bug reports that may quote customers, and employee names. The contract has no post-termination retrieval window, so export before cancelling. Linear owns aggregated and anonymised Service Data, which is not part of what the customer can license.", "apiLimit": "none-found", "risk": "low", "sources": [ { "title": "Linear Terms of Service", "url": "https://linear.app/terms", "date": "effective 2026-06-09", "quote": "Customer will own all right, title and interest in and to the User Submissions and there are no implied licenses under this Agreement." } ] } ] }