Selling CRM data for AI training: Salesforce and HubSpot records, consent and price

Yes, a company can license its CRM history to an AI buyer, but CRM records are customer data first: the privacy notice the company published, its customer contracts and the data broker laws decide what can be licensed, long before price does. Buyers ask for CRM by name (a buyer's revenue chief said in October 2026 that without Slack, CRM or email records the rest of a corpus is worth less), and what they want is the activity history: the calls, emails, notes, stages and outcomes that show how a sale or a renewal actually happened. The contact list itself is the riskiest part of a CRM and the least useful to a model, so it is usually removed. Both big CRMs let the company take its own records out: Salesforce's contract makes customer data available for export or download and has no clause barring a customer from training AI on its own data, and HubSpot's terms say "You own and retain all rights to the Customer Materials and Customer Data". What HubSpot forbids since May 2026 is an app using data accessed through the APIs to train, fine-tune, or improve AI or machine learning models, so the export has to be your own. Buyers price CRM as part of the company's whole working record: the median of the per-company sales on record is $28.3K per company, and Labelbox prices operational data from systems such as Salesforce starting around $50K. The steps are: export it yourself before any subscription lapses, take out the contact list, licensed list data and anything your notices or contracts rule out, de-identify the activity history, and put a description of it before every buyer that fits at once.

This guide is for a founder, officer or trustee of a company, operating or closed, whose sales and customer history lives in Salesforce or HubSpot. It covers what a CRM holds and what buyers value in it, how each system lets an administrator export its records and what the records say about deadlines, the law on customers' personal data and why the contact list is usually removed, de-identification of activity history, what CRM history fetches as part of a company's records, preparing and delivering, the case of a closed company, and how a sale through AIData.Broker works. Every quote comes from the page or filing it names, read on the day shown in its record.

This guide is research from public sources, not legal advice.

Contents

1. What a CRM holds, and what buyers value in it
2. What comes out of a CRM export before anything is licensed
3. Exporting your records from Salesforce
4. Exporting your records from HubSpot
5. Customers' personal data and the law
6. Why the contact list is the riskiest part, and usually stays out
7. De-identifying CRM history
8. What CRM history fetches as part of a company's records
9. Preparing and delivering a CRM export
10. A closed company's CRM
11. How a sale through AIData.Broker works
12. Questions people ask
13. What this means for you

1. What a CRM holds, and what buyers value in it

A CRM is the company's memory of its customers and of the work of winning and keeping them. Most people picture it as a contact list, and it does hold one: names, job titles, companies, email addresses and phone numbers. But in a company that has used Salesforce or HubSpot for some years, the contact list is the smallest and least interesting part. Around each contact and each company sits the history of the relationship: every opportunity opened, the stage it moved through and when, the amount, the products quoted, the reason it was won or lost; every call logged with its notes, every email synced from a rep's inbox, every meeting booked, every task set and completed; and on the service side, every case opened, escalated and resolved. That history is a record of how a business sells and serves, written down by the people who did it, step by step, with the outcome attached.

That is what buyers mean when they ask for CRM. Nyne, which buys companies' historical business records, names "Salesforce or HubSpot CRM, service histories, support tickets, and the record of how requests and issues got resolved". micro1's company data program lists "SOPs, knowledge bases, internal documentation, CRM data, project histories, and QA processes". Ooak Data includes CRM and sales data beside documents, project management records, financial records and code. Polyshares names Slack, email, tickets, CRM and files as the operating record it prices, Corpus prices a company's workspace data: email, chat, meetings and CRM, and Mode, through BizBuyData, describes the operating history a business already owns: email, documents, chat, calls, CRM, billing and operations. Labelbox's Prism names Salesforce first in the systems whose operational data it licenses, beside Jira, SAP and ServiceNow. The largest records sale on record, Spirit Airlines' sale to Google, included CRM among the de-identified systems in scope.

Why buyers want it is plain from what AI labs are building. An analysis of the reinforcement learning environment market by Epoch AI quotes a builder saying that after maths and code, "we're now seeing significant growth in enterprise workflows: tasks like navigating Salesforce, filing reports, or manipulating spreadsheets". A model that is meant to work inside a sales or service team has to learn what that work looks like: how a lead becomes a qualified opportunity, which follow-up comes after which reply, what a rep writes after a call, how a stalled deal is revived or abandoned, how an angry customer's case is closed. Public text holds very little of it, because companies do not publish their pipelines.

Four things in a CRM move its value most.

Activity tied to an outcome. An opportunity with its full activity history (the first call, the demo, the proposal, the objections, the negotiation, the close or the loss reason) is a complete example of a sales process, with the result attached. A case that runs from a customer's first message to its resolution is the same for service. A record with a name and a phone number and nothing else is close to worthless to a model. The value lies in sequences: what happened, in what order, and how it ended.

Notes written by experienced people. Call notes, meeting notes, deal reviews and the free-text fields where reps explain a decision are short, dense and written in the words of people who do the work. Buyers pay more for the work of white-collar specialists than for general traffic: Mode.Inc's chief executive told reporters that value rises with the number of white-collar employees. A CRM full of thoughtful notes from senior account executives is worth more than one where fields were filled with a single word to satisfy a manager.

Years and volume. Estimators price years directly, and CRM history is often one of the few systems that reaches back to the company's early customers. Ooak's estimator values a 51 to 100 person operating company with four or more years and six tools, HubSpot among them, at $85k to $121k, and the same company with seven or more years at $99k to $139k.

Links to the rest of the company. A CRM rarely stands alone. Opportunities link to the emails reps sent, the quotes and contracts in a document store, the invoices in the billing system, the tickets in the support desk. A wind-down firm told Forbes that a record tied to the work it produced is worth more than a standalone document, and Ooak's estimator shows the effect in numbers: six tools including Gmail and Drive at $85k to $121k, against $16k to $22k for the same company with only Jira, GitHub and HubSpot. HubSpot without the mail and documents around it is priced low; HubSpot as the spine that ties them together is part of what lifts the whole package.

What lowers value is the opposite: a CRM used only as an address book, a few months of history, a pipeline that was never kept up to date, or a system migrated so often that the old activity was dropped. A plain count before you talk to anyone (records per object, activities per year, the share of opportunities with a recorded outcome, how far back the history reaches) tells you most of what a buyer will ask first.

2. What comes out of a CRM export before anything is licensed

A CRM export holds everything at once: the work, and the material nobody may license. Buyers and their counsel expect the second kind to be found and excluded before anything leaves, and one law firm advising holders on these sales tells them to exclude high-risk data entirely rather than relying on de-identification. Salesforce's own record in our register says it plainly: what blocks a sale is what the CRM holds, namely customers' and prospects' personal data (names, emails, call notes), customer confidential deal terms, and data bought from list vendors whose licence usually forbids resale. The categories that come out of a CRM are the same in almost every company.

Two of those rows are particular to CRMs and catch holders out.

Bought lists. Many companies seeded their CRM with contacts from a list vendor or an enrichment service, and kept enriching records as they went. Our Salesforce record advises to check any third-party enrichment data (ZoomInfo and similar) licence before including it. Buyers' counsel ask that bought and licensed material is identified and removed before packaging, with a provenance file showing that what remains is the company's own. In practice that means knowing which fields and which records came from outside: an import batch, a lead source value, an enrichment timestamp. If your CRM cannot tell you, the safer course is to treat contact fields as out of scope altogether, which most holders do anyway (section 6).

Customers' deal terms. An opportunity record often carries the exact price, discount and terms a named customer agreed, and sometimes the signed order form as an attachment. Even with the customer's name removed, a buyer could read your price book and your negotiating history from it. Your customer contracts may also make those terms confidential. Buyers' counsel want customer content (support tickets, customer files, CRM notes, customer email) excluded, unless each customer contract expressly permits the use or the data is anonymised and the contract does not forbid that. Amounts can often be kept in bands rather than exact figures, and attachments left out, without losing what makes the history valuable.

Exclusion does not have to cost much value. The Spirit sale is the reference case: after the auction, the estate and Google agreed that passenger transaction, refund and inflight sales systems would not be transferred in any form, which left the corporate systems in scope under an independent de-identifier, and the sale is still described at the same price. Taking out what cannot be licensed is part of what makes the rest sellable.

3. Exporting your records from Salesforce

Salesforce controls the gate for its own CRM, and its contract and help pages set out how a customer takes its data out. The full reading is in our Salesforce terms record.

The contract lets you take your data out. Salesforce's Main Services Agreement, dated October 15, 2026, says that upon request made within 30 days after the effective date of termination or expiration, Salesforce will make customer data available for export or download, and that after that period it will have no obligation to maintain or provide any Customer Data. During the subscription, the export tools are yours to use.

The tools. Salesforce's Trailhead material describes the Data Export Service in Setup: an export you can run manually once every 7 days (for weekly export) or 29 days (for monthly export), or on a schedule. Weekly exports are available in Enterprise, Performance, and Unlimited Editions; in Professional and Developer editions, backups can be generated only every 29 days. Our record adds that the download links reportedly expire after 48 hours, a point taken from third-party guides rather than Salesforce's own pages, so download promptly once an export is ready. For full exports of particular objects, Salesforce offers Data Loader and Bulk API. Two practical consequences follow. On a Professional edition, a missed export can mean waiting weeks for the next one, so plan the timing. And the export should be run by your own administrator, from your own org, which is the route buyers' counsel want to see: each system exported by its own admin with the vendor's native export tool, the method recorded per system, and no third-party connector touching it.

What the contract says about AI. Our reading of the MSA found no clause barring a customer from using its own Customer Data to train AI. The customer must use the services in line with Salesforce's acceptable use policies, including its Artificial Intelligence Acceptable Use Policy, and may not use the services to build a competitive product or to copy Salesforce's own intellectual property. The restrictive API-level AI terms Salesforce adopted in 2025 apply to Slack, not found for core CRM. That matters, because Slack is also a Salesforce product and many holders assume the same rule covers both. On the records we hold, it does not. Read the current version of each policy before you plan, because terms change; of the 18 business systems whose terms we have read, 6 now bar training AI on what an app pulls through their API.

What a Salesforce export holds and does not hold. A CRM export is a set of tables, one per object (accounts, contacts, leads, opportunities, cases, tasks, events, notes and any custom objects), linked by record IDs. Keep those IDs: they are what lets a buyer rebuild the sequence of an opportunity from its tasks and events, and they are also what you will use to remove contacts cleanly (section 6). Our record does not hold how Salesforce treats field history, attachments and files in each export method, or the size limits of a single export. Read the current Salesforce documentation for those, and confirm that the export includes the activity objects and notes, not only the main records, because the activity is where the value lies.

4. Exporting your records from HubSpot

HubSpot's position starts from ownership. Its Customer Terms of Service, last modified September 16, 2026, say in section 5.1: "You own and retain all rights to the Customer Materials and Customer Data." Section 5.7 points to a retrieval clause in HubSpot's Product Specific Terms, which our record notes was not read. The full reading is in our HubSpot terms record.

The export route. HubSpot lets users with export permission export records from the CRM, and Super Admins see an audit log of all exports and can set large-export alerts. Our record notes that the plan-level detail for a full account export was not verified, so check what your own plan offers before you plan around it. As with Salesforce, the export should be run by your own administrator inside your own HubSpot, with the date, the objects and the settings recorded, which keeps it on the route buyers' counsel ask about ( the export route). The audit log helps here: it is a record, kept by HubSpot, of who exported what and when.

What the API terms forbid. HubSpot's Developer Terms update, announced and effective May 4, 2026, restricts using data accessed through the APIs to train, fine-tune, or improve AI or machine learning models, with an exception for legitimate single-customer use cases, and HubSpot said its Technology Partner Program Agreement would exempt technology partners in good standing. Our record draws the consequence: any app or connector that pulls HubSpot data through the API to build a multi-customer training set falls within the May 2026 restriction, a broker's sync tool included. Some buyers offer read-only connectors to source systems ( Labelbox's Prism says it uses them); for HubSpot, the safe course is the export your own administrator runs, with the files then licensed under your own agreement. Never authorise a buyer's or a broker's app on your HubSpot to pull records for training.

HubSpot trains on your data unless you opt out. HubSpot's terms also say, in section 5.3.1: "We may also use Customer Data to train our AI models in compliance with our obligations under the Agreement." and that customers may opt out of having your Customer Data used for this purpose by updating your settings. This matters for a sale in two ways. A buyer that asks for exclusivity will want to know who else has already trained on the records, and buyers' counsel ask exactly that: has a software vendor already used this content to train its own AI, with each vendor's setting and the date it was switched off listed, and exclusivity stated only against third parties you control. And it is one more reason to look at your settings now, before any buyer conversation, and note what they were and since when.

What a HubSpot export holds and does not hold. Exports come out by object (contacts, companies, deals, tickets and the activities and engagements linked to them). As with Salesforce, keep the record IDs and associations: they carry the structure a buyer pays for. Our record does not hold how HubSpot treats email engagement history, call recordings and attachments in an export, or what happens to an account's data after cancellation. Check those against HubSpot's current documentation before you cancel anything.

5. Customers' personal data and the law

Ownership is rarely what stops a CRM sale: both vendors say the data is the customer's. What stops it is the people in the records and the promises made to them. The customer data guide walks through every layer in depth; what follows is what matters most for a CRM.

Your own promises come first. The first question a buyer's counsel asks is what your privacy policy, terms and notices said about sharing data at the time it was collected. The FTC's position is that a business that collects user data based on one set of privacy commitments reneges on its user privacy commitments risks running afoul of the law if it changes course, and that adopting more permissive practices through a quiet, retroactive change to its policy may be unfair or deceptive under the FTC Act's ban on unfair or deceptive acts or practices in or affecting commerce. A CRM is built from many sources, each with its own notice: website forms, event sign-ups, demo requests, newsletter subscriptions, trade show scans, imports. If the notice on your demo form said you would never share contact details, the contacts it produced cannot be licensed in identifiable form without fresh consent, whatever the current policy says. The acceptable answer, in counsel's words, is that the policies in force allowed the transfer, or affected people gave fresh affirmative consent, or the data is fully anonymised.

Customer contracts. For a business-to-business company, much of the CRM describes its customers and their staff. Customer contracts and data processing agreements may limit how that information is used. Where the company acts as a processor for a customer, using the customer's data for its own purpose can turn it into a controller: GDPR says a processor that determines the purposes and means of processing is treated as a controller for that processing. Read your standard terms and your largest customers' negotiated terms for confidentiality, data use and AI clauses before you plan the scope.

California sets the standard for business contacts. Most state privacy laws exclude people acting in a business role. The Virginia model defines a consumer in a way that "does not include a natural person acting in a commercial or employment context", and Texas says the same in nearly the same words. For a business-to-business company, that takes much of the CRM outside every state law except California's. California's privacy agency says consumers include employees, job applicants and contacts at business customers and vendors, so a purchasing manager in your HubSpot who lives in California has the Act's rights. Licensing personal information for money is a sale under the Act's definition, "for monetary or other valuable consideration", and consumers have a right to opt out of sale or sharing, which a business must honour and announce. For a consumer-facing company, every state law in the customer data guide's table applies to the contact list, with their own opt-out and sensitive-data rules.

De-identified records are outside the Act. California's Act says that personal information does not include consumer information that is deidentified, and its definition of deidentified sets three conditions: reasonable measures, a public commitment not to re-identify, and contracts that contractually bind every recipient to the same. Buyers' counsel ask for exactly that: reasonable measures documented, a published commitment not to re-identify, and the licence obliging the buyer (and anyone it passes data to) to do the same. This is why most holders take the contact list out and de-identify the activity history, rather than seek consent from thousands of former prospects.

Data broker laws. Several states require data brokers to register. As of 30 September 2026, California, Oregon, Texas and Vermont had active registration procedures, as reported by one law firm's survey. For most holders licensing their own CRM, the definitions do not fit: California defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship; Vermont's definition covers a business that "sells or licenses" such data, again only about people with no direct relationship; Oregon's excludes data about a business's own customers, subscribers or users; and Texas' definition does not include deidentified data, employee data, or publicly available information. Two cases need care with a CRM. Prospects who never became customers, especially those imported from bought lists, are people you may have no direct relationship with. And New Jersey's 2026 law creates a data collector category for a business that sells or licenses such personal data to a data broker, and says sensitive data may "in no case" be sold or licensed. Both cases are about identifiable personal data, and both fall away when the contact list stays out and the rest is de-identified.

Canada and Europe. Customers and contacts in Canada need either consent to the new use or anonymisation: under PIPEDA, a purpose not previously identified needs the individual's consent, which is why counsel ask whether each person consented to this new use, or the data will be anonymised to the Canadian standard before it leaves. For contacts in the EU and UK, anonymisation itself remains subject to the GDPR, and counsel expect an independent provider's documented test. Holders with many European contacts usually exclude them.

Bulk data and the buyer. The US Justice Department's data security rule restricts transfers of bulk US sensitive personal data to countries of concern, and its thresholds include covered personal identifiers collected about or maintained on more than 100,000 U.S. persons. A large CRM can pass that. The Justice Department's own guidance says the rule applies regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted, so de-identification does not settle it: the buyer has to be screened for ownership by or location in a country of concern, and the licence needs an onward-transfer clause.

6. Why the contact list is the riskiest part, and usually stays out

Every rights question in section 5 lands hardest on the contact list. It is the part of the CRM that is personal data by definition, the part most often built from bought lists, the part your privacy notices and opt-out promises speak to most directly, the part the data broker laws are written about, and the part the bulk data rule counts. It is also the part a model needs least. A training set does not learn how a sales process works from a name and a phone number; it learns from the sequence of activities and the outcome. So the contact list carries almost all of the risk and almost none of the value, and the sensible default is to remove it.

The history of customer lists in court shows why buyers and regulators treat them as the sensitive core. In 2000 the FTC challenged the bankrupt toy retailer Toysmart's attempt to sell a customer list collected on the company Web site in violation of its own privacy policy. In 2015 the RadioShack estate's plan to sell its customer data drew objections from 38 states, led by Texas, over records that included 8.5 million customer email addresses. Both were sales of contact data as such. An AI buyer has no use for the list itself, which is what makes the cleaner structure possible: keep the history, drop the identities.

Buyers have already done it this way. In one wind-down sale on record, a buyer had agreed to bid on an asset schedule that expressly excluded personally identifiable information, and the records moved with the personal information excluded. That is the model for a CRM: the contact and lead objects stay with you, and what leaves is the activity, stage and outcome history with each person replaced by a stable pseudonym.

Removing the list is more than deleting a table. Personal details recur throughout a CRM export:

• Names and addresses on every activity. Tasks, events, emails and calls carry the contact's name, email and phone in their own fields and in their subject lines ("Call with Jane Smith").
• Free text. Notes and descriptions mention people by name, quote email addresses, and record personal details reps thought useful ("back from maternity leave", "his son goes to the same school").
• Synced email. Where reps' mailboxes are synced to the CRM, the full text of emails with customers sits on the activity records, with signatures, quoted replies and attachments.
• Company records. For a small business customer, the company name is the person (a sole trader, a family business), and an address or a website can identify them.
• Custom fields. Over the years, companies add fields for whatever they needed: a personal mobile, a birthday, a LinkedIn link, a lead score built from personal attributes.

Most holders keep the account and opportunity structure with names replaced, keep activity types, dates and outcomes, de-identify free text, and leave synced email bodies, attachments and custom personal fields out unless they can be cleaned to the same standard. The email archives guide covers synced mail in depth, since the same rules apply.

7. De-identifying CRM history

Every buyer that takes company records expects personal data to be removed before or as part of delivery. The question is who does it, to what standard, and when. Buyers differ. Scale says it anonymises inside your own systems before anything is extracted. Turing removes personal data and secrets itself, in isolated processing, and you approve the scope first. Polyshares says that identifying fields, customer names, emails and account numbers are stripped before it or any buyer sees the record. Corpus Bridge says the standard is negotiated with the buyer and you approve it before delivery. In the Spirit sale, the estate and Google voluntarily agreed to follow the deidentification standard adopted in the California Consumer Privacy Act. Each model except the first means someone other than you reads raw customer records; decide which you accept before you choose a buyer.

A CRM is easier to de-identify than mail or chat in one way and harder in another. Easier, because much of it is structured: names, emails and phones sit in known fields that can be replaced field by field. Harder, because structured records are exactly what makes re-identification easy. A record with a job title, an industry, a city, a company size and a deal date can point to one person even with the name gone. Removing names is not anonymising: one study found that 99.98% of Americans would be correctly re-identified from a handful of attributes, and our de-identification rules note that a few ordinary details can single out 87% of the US population.

So the work on a CRM has these parts.

• Replace people and companies with stable pseudonyms. Each contact and each account gets a consistent code across the whole export, so a buyer can still see that the same customer had three opportunities and a dozen cases, which is what makes the history useful, while names, emails and phones are gone.
• Coarsen what identifies. Exact amounts become bands, exact dates can be shifted consistently per account, cities become regions, job titles become role families, and small industries are merged. The aim is that no combination of fields picks out one customer.
• Clean free text. Notes, descriptions, subject lines and call summaries carry names, numbers and personal details. They need a text de-identifier and a person's review, not only a field mapping.
• Remove secrets and payment data. Card numbers, bank details, passwords and access keys turn up in CRM notes. They come out whatever the buyer's standard.
• Screen for sensitive topics. Health, family, beliefs and financial hardship appear in reps' notes. A content screen flags records about health, children, beliefs, union membership, finances, HR matters and legal advice for a person to read and leave out.
• Bind the buyer. De-identification is not only a process but a contract term: under California's standard the recipient must be bound not to re-identify, and counsel treat a licence without that clause as one that does not meet the standard.

Our de-identification standard sets out the method we advise: removal before anything leaves you, by you or an independent provider you choose, with a group-size floor of 11 for any delivery and 300 random records read by a person before it goes. The group-size floor matters more for a CRM than for most records, because its structured fields are what make small groups. Our free de-identification tool runs in your own browser, so the records never leave your computer, and on company Slack, email and documents it measured an F1 of 86.8%, finding 95.8% of people's identifiers. No tool is perfect, which is why the standard pairs it with a person's review.

De-identification has limits. It does not cure confidentiality owed to a customer (its negotiated price is still its price without its name), it does not make a customer contract permit a use it forbids, and it does not cure a licence on bought data. So the order of work is exclusion first, then de-identification, then a person's review of a random sample.

8. What CRM history fetches as part of a company's records

No buyer we have read publishes a price per CRM record or per opportunity. They price the company's whole working record, in which the CRM is one of the systems, and they price it higher when the systems connect. Here is what the public record shows for records that name CRM.

Across every public offer for one company's records, the middle half sits at $174K to $693K per company. The middle of the buyers' offers is $316K per company, and the median of the sales that actually happened is $28.3K per company. Published ranges sit above what closes, partly because sales are disclosed more often for small closed companies; the prices guide explains the gap.

Three patterns in those rows matter for a holder of CRM history.

A CRM alone is priced low; a CRM with the systems around it is not. The two Ooak rows are the same company. With HubSpot beside only Jira and GitHub, the estimator returns $16k to $22k; with the communications and documents added, $85k to $121k. A buyer's own lever list says it bluntly: bring every connected system, especially documents and email. And micro1's revenue chief put it from the other side: without CRM, mail or Slack, the rest is worth less. CRM history is the spine that tells a buyer which email, which document and which ticket belonged to which customer journey.

Size sets the band. Replay publishes its ranges by headcount alone, and the spread from $10K to $100K for the smallest band to $1,000,000+ for the largest is the clearest public statement that a bigger sales team's history is worth more.

The first offer is rarely the best. Business Insider reported in October 2026 that small businesses receive six-figure offers that expire in 48 hours for their internal records. Buyers quote very differently because they buy on different theses, which is why refusing a short deadline and collecting several offers is the single most useful thing a holder can do. Our valuation puts a range on your own company from these records before you talk to any buyer, with no upload.

9. Preparing and delivering a CRM export

The preparation guide sets out the full order for any company's records. For a CRM, it comes down to these steps, most of which need no buyer at all.

1. Secure the administrator and the subscription. Confirm that a current officer holds a Salesforce system administrator login or a HubSpot Super Admin seat, and that the subscription stays paid until the export is complete and checked. Turing's intake accepts records only from someone with admin authority, so the person who can run the export should also be the one who starts any buyer conversation.
2. Count before you export. Records per object (accounts, contacts, leads, opportunities, cases), activities per year, the share of opportunities with a recorded outcome, how many notes have real text, how far back the history reaches. Polyshares and Turing both start from counts per system, read from the admin console, and Turing says estimates are fine at that stage.
3. Find what came from outside. Identify imported list data and enrichment fields by lead source, import batch or enrichment field, and mark them out of scope ( licensed third-party data).
4. Read the promises. Collect every privacy notice, form notice and customer contract template in force over the CRM's life, and note what each said about sharing ( earlier privacy promises). Check HubSpot's AI training setting and note its history ( vendor already trained).
5. Run the export yourself. Salesforce's Data Export Service, or Data Loader for particular objects; HubSpot's exports by an administrator. No third-party app authorised to pull records. Record the date, the tool, the person and the objects.
6. Check the export is whole. Compare record counts in the export with the counts from step 2, object by object. Keep record IDs and associations intact: they carry the sequence buyers pay for.
7. Exclude, then de-identify. Remove the contact and lead objects, bought data, attachments and out-of-scope customers from a working copy; then replace remaining identities with pseudonyms, coarsen identifying fields and clean free text (section 7). Draw any sample from the de-identified copy, never from the raw export, and never show a sample before the rights review, since a sample is itself a disclosure.
8. Write down how you did it. Who exported what, when, what was excluded and why, the notices in force, who de-identified and how it was checked. This is your rights file and your proof of title: buyers have been offered records by people who did not have the rights to sell this data.
9. Agree delivery and acceptance in the licence. The format, who de-identifies and to which standard, objective acceptance criteria and a review window, the no-re-identification clause and its flow-down. Never send CRM records or samples by email or chat: DataVendor tells holders plainly not to send data or code by chat or email.

Keep two things apart: what you describe to buyers, and what you deliver. Buyers price from the description first: counts, years, objects, the share of records with an outcome, what links to what, and what stays out. Polyshares says it reads an anonymised sample before it prices. The full export moves only after a licence is signed, and only the scope the licence names.

10. A closed company's CRM

A closed company is a common holder of a valuable CRM, and the one with the least time. Three questions decide whether its records can still be sold: do the records still exist, who can sign, and who can run the export.

Do the records still exist? Salesforce's contract gives a customer 30 days after the effective date of termination or expiration to request its data for export, and after that period Salesforce will have no obligation to maintain or provide any Customer Data. Our HubSpot record does not hold what happens to a cancelled account's data, because the retrieval clause sits in terms we have not read. In both cases the safe course is the same: keep the subscription paid until the export is done and checked. CRM history also loses value with time in a softer sense. Turing's intake warns that records lose value fast once operations cease, naming 30 days for Slack and 60 to 90 days for a CRM: the people who could explain the fields leave, the linked systems shut down, and the history goes stale.

Who can sign? The company sells, not its founders personally, and the right person signs for it. Buyers' counsel ask for the legal entity that collected the data to be the licensor, with the board's written approval, and, for a wind-down, the board's approval and any investor consents. In Delaware, where many US startups are incorporated, a dissolved corporation continues for three years to wind up its affairs, including disposing of its property, and it adopts a plan of distribution that provides for its claims. In a chapter 7 bankruptcy the trustee signs, because the trustee's duty is to collect and reduce to money the property of the estate. Buyers ask that the right officeholder signs.

The bankruptcy rule on customer lists. In bankruptcy, a sale of personally identifiable information is restricted where the debtor had told individuals of a policy prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with the debtor, and the court may appoint a consumer privacy ombudsman under section 332. The definition is narrow: under section 101(41A), it covers information an individual gave in connection with obtaining a product or service primarily for personal, family, or household purposes. A business customer's purchasing manager did not give a work email for household purposes, so much of a business-to-business CRM falls outside the bankruptcy definition, though not outside California's Act or the customer contracts. A consumer company's CRM falls squarely inside it. The bankruptcy guide walks through the rule and the precedents. For a CRM the practical answer is the same as outside bankruptcy: keep the contact list out of the sale and license the de-identified history.

Who can run the export? The Salesforce administrator or HubSpot Super Admin may have left. Transfer the role to an officer or the trustee while the subscription is live, and run the export before cancelling. If nobody with access remains, the vendor's support is the route, and the company will need to show it still exists and who acts for it. Our estates page sets out the path for trustees, assignees and dissolved companies.

A closed company's CRM carries the same rights questions as an operating one, with one difference: the customers are no longer being served, so fresh consent is impractical. That pushes closed companies toward excluding the contact list and de-identifying thoroughly, which is the structure most buyers prefer anyway. The value is still real: the market pays for a closed or closing company's records about 0.65 times what it pays for the same company operating, so a closed company's CRM, exported in time and cleaned well, still fetches a real price.

11. How a sale through AIData.Broker works

AIData.Broker represents companies selling their data to AI buyers. We act only for the holder, as its agent in the sale, for holders based in the United States, the United Kingdom and Canada. For a holder of CRM history, a sale through us runs like this.

The valuation comes first, with no upload. The valuation asks about your systems (which CRM, how many years, how many people sold and served through it, what else the company ran) and returns a range from the public records in section 8. If you add files, they are measured on your own computer. The valuation binds no one.

You keep the records and deliver them yourself. We do not hold your export, show any part of it to a buyer, or license it in our name. You, or a de-identification provider you choose, deliver directly to the buyer, and the buyer pays you directly. That keeps the export on the route both CRMs' terms allow: your own administrator's export, never a connector.

Every buyer that fits sees it at once. Every buyer whose published requirements fit your records receives a description that does not identify you; each that gives its confidentiality undertaking receives the same datasheet, with one deadline for offers. Offers come back on the same terms, so you can compare price, de-identification model, payment timing and exclusivity side by side. Our free offer check reads any offer you already have against the published terms of the buyers we track.

The fee is due only out of money you receive. It is a success fee on what you are actually paid, band by band: 15% of the first $250,000, 10% from $250,000 to $1 million, and 6% above $1 million. On a $300,000 sale the fee is $42,500. Mandates are exclusive for 2 months, with a tail of 12 months for buyers we introduced, and we do not take mandates where the expected sale is below $26,000. Several buyers publish an introduction fee; in a sale we run we decline it and ask the buyer to add it to your price instead, so we earn the same whichever buyer you choose. How it works sets out every step and term.

Questions people ask

Can a company sell its CRM data for AI training? Yes, if the company exports its own records through its CRM's admin tools, takes out the contact list, bought list data and anything its notices or contracts rule out, de-identifies the rest, and the right person signs for the company. Buyers name CRM among the systems they want ( Nyne, micro1, Polyshares), and one buyer's revenue chief said that without CRM the rest of a corpus is worth less.

Do Salesforce's and HubSpot's terms allow it? Both say the data is the customer's: Salesforce makes customer data available for export or download and its contract has no clause barring a customer from using its own Customer Data to train AI, and HubSpot's terms say you own and retain all rights to customer data. HubSpot restricts apps from using data accessed through the APIs to train AI, so the export must be your own administrator's, not a connector's.

How do we export everything from Salesforce? An administrator runs the Data Export Service in Setup, weekly on Enterprise, Performance and Unlimited, every 29 days on Professional and Developer, or uses Data Loader for particular objects. Download promptly; the links reportedly expire after 48 hours.

How do we export everything from HubSpot? Users with export permission export records by object, and Super Admins see an audit log of all exports. Check what your plan includes for a full export, and do not authorise any third-party app to pull records for training.

Do our customers have to consent? Not if the contact list stays out and the rest is de-identified to the California standard ( reasonable measures, a public commitment, binding contracts), and your notices and contracts did not promise otherwise. Identifiable personal data needs a notice that allowed the transfer, or fresh consent ( earlier privacy promises). Canadian contacts need consent or anonymisation ( the Canadian standard).

Are business contacts personal data? In California, yes: the state's privacy agency counts contacts at business customers and vendors as consumers. Most other state laws exclude people acting in a commercial or employment context.

Can we sell our customer list? It is the riskiest part of a CRM and the least useful to an AI buyer. Customer lists sold as such have drawn FTC action ( Toysmart) and objections from 38 states (RadioShack). Most holders keep the list and license the de-identified history.

Do we become a data broker? Usually not, if you license records about your own customers: the California definition turns on people with whom the business does not have a direct relationship, Oregon's excludes data about a business's own customers, and Texas' excludes deidentified data. Bought prospect lists and New Jersey's data collector category need care.

How much is CRM data worth? Buyers price the whole working record rather than CRM alone. Public offers for one company's records have a middle half of $174K to $693K per company, and the median of disclosed sales is $28.3K per company. Labelbox prices operational data from systems such as Salesforce starting around $50K. The valuation gives a range for yours.

Has HubSpot already trained on our records? HubSpot's terms say it may use Customer Data to train our AI models unless you opt out in your settings. Check the setting now and note its history: a buyer asking for exclusivity will ask ( vendor already trained).

Our company has closed. Can we still sell its CRM? Often yes, if the records still exist and the right person signs. Salesforce gives 30 days after termination to request an export; in Delaware a dissolved corporation continues for three years to wind up, and in bankruptcy the trustee acts. See the estates page.

What this means for you

Your CRM is probably the most complete record of how your company sold and served, written down step by step by the people who did it, with the outcome attached. That is what buyers want from it, and they name it beside email and chat as one of the systems that lifts the value of everything else. It is also the system most full of other people's personal data, built from forms and lists with their own promises attached, and the one the privacy and data broker laws speak to most directly.

So do four things now, before any buyer conversation. Make sure a current officer holds the administrator role and that the subscription stays paid. Count your records by object and year, and find what came from bought lists. Collect the privacy notices and customer contract terms in force over the CRM's life, and check whether HubSpot has been training on it. And get a range for the whole record from the valuation, so that the first offer you see is measured against the market rather than against nothing. Then export it yourself, leave the contact list behind, de-identify the history to a standard you chose, and put it before every buyer that fits at once. The email archives guide covers the mail that usually sits beside your CRM, the support tickets guide covers the service history, and the rest of the What sells section shows the other records buyers pay for.