What you're agreeing to when you license company data

In our view, five terms decide most of what you give up when you license your company's records to an AI data buyer: whether you can license the same records to anyone else (exclusivity), how long the buyer keeps its rights (the term), who the buyer can pass the data to, who owns the de-identified copy, and what happens to models already trained on the data. The buyers we track publish these terms unevenly. Some state them plainly, and some say nothing about them on the pages we read. This guide compares what each says on its own pages, as of 2026-11-02.

What does "exclusive" mean in a data license?

At SourceX, an exclusive license means you agree not to license the same records to another party for AI training. SourceX says its licenses are exclusive for AI training: "you agree not to license the selected data to anyone else for that purpose." The restriction binds the seller, and SourceX's right to distribute or sublicense the de-identified dataset is unaffected. The exclusivity covers only the data selected in the deal. Future data and records you did not select sit outside it. SourceX also calls these "typical terms" and says final terms are in each agreement.

Our view: exclusivity matters most because of how it interacts with comparing programs. Under an exclusive license like SourceX's, a second offer for the same records, for the same use, is off the table for the period the agreement sets. If a buyer asks for exclusivity, ask whether it applies to all uses or only to AI training, and whether it covers records you create after signing. Our guide to how to license your company's data to AI companies covers how to compare programs before that point.

Which buyers state exclusivity, and which say nothing?

Three of the five buyers below state exclusivity on their public pages, and two do not. Labelbox Prism says licenses are "structured as exclusive by default" and tailored to the scope, sensitivity and strategic value of the data. Polyshares describes four selected case studies as perpetual exclusive licenses; that is a description of those deals, not a stated standard term. SourceX states exclusivity for AI training. Replay and Handshake AI do not mention exclusivity on the pages we read, so ask before assuming.

Sources: each buyer's own pages, read 2026-11-02, summarized on its page in our buyer index. "Not stated" means not on the pages we read.

How long does the buyer keep the license?

For the buyers that say, the answer is long. Polyshares describes each of its four selected case studies as a "perpetual exclusive license to the operational record," and says the record is anonymized before delivery. SourceX says that once the fee is paid, its license to the de-identified dataset is permanent and survives termination of the agreement. Replay describes only its revenue share as perpetual. Labelbox Prism and Handshake do not publish a term.

SourceX says the term and any alternatives are set in each deal's confirmation, and that the term runs from closing. As we read it, that term governs the exclusivity, so the exclusive part can end while SourceX's license to use the data does not. Read the term clause for two things: the length of any exclusivity, and whether the buyer's right to keep and use the data ends when the agreement does.

Can the buyer resell or pass the data on?

Only SourceX states a right to pass the data on. It says its right to distribute or sublicense the de-identified dataset is unaffected by the seller's exclusivity promise, and its process page says SourceX signs its own onward agreement with a partner before it gives the go-ahead to prepare the data. Replay says its data is only sold to frontier AI and data labs, and never sold to foreign adversaries or resold through brokers. Handshake says you can review who may receive the data and how it may be used before you commit. Polyshares and Labelbox Prism say nothing on this on the pages we read.

Our view: "who may receive it" is a clause, not a promise on a marketing page. Ask each buyer for the permitted-use and permitted-recipient language in the draft agreement, and ask whether the buyer can sublicense to anyone other than the lab named in the deal.

Who owns the de-identified copy?

Ownership of your original records and ownership of the de-identified dataset made from them can differ. SourceX says you keep ownership of your original licensed data, and that under the signed agreement SourceX owns the de-identified dataset, subject to your underlying intellectual property rights. Labelbox Prism says you keep full ownership and oversight, without addressing the de-identified copy. Polyshares, Replay and Handshake say nothing on ownership after the deal on the pages we read. When a buyer says "you keep ownership," ask whether that covers the de-identified copy or only the originals.

What happens to models already trained on my data?

Our view: deleting data does not undo training, so deletion rights are worth less than they sound. SourceX says that once the fee is paid, models already trained on the dataset are not retrained or deleted. It says data that has not closed by the deadline is treated as declined and deleted within 30 days. On SourceX's published terms, then, deletion applies to data that does not close, and after payment its license is permanent. The other buyers we read do not describe what happens to trained models. A buyer's answer to "what survives termination" is the clause to read first.

When do you get paid, and how firm is the estimate?

Early numbers are estimates, and the firm number comes late. SourceX says the exact payout is fixed only in the signed Dataset Deal Confirmation, an earlier estimate is indicative only, and data that does not reach closing earns no payment. It says payment is due within 60 calendar days after it receives a valid invoice, unless different terms are signed. Polyshares says payment follows net 30 to 60 once terms are signed and the data is anonymized and delivered. Labelbox Prism says scoping is free and non-binding, with a written quote within 48 hours. Because of these timelines and non-binding estimates, we advise owners to treat an early range as a reason to continue the conversation, not as income.

What do you promise the buyer?

At SourceX you confirm four things: you have the rights to license the data, personal data was collected lawfully (it names GDPR and CCPA), the data has not been licensed for AI training before, and it was not created or altered with AI for the sale. Ask the other buyers what they require. In our view, the third confirmation matters if you have already worked with another program. Before you sign anything, check your customer and vendor contracts and privacy notices for limits on reuse. That is a question for your own counsel, not for us or for a buyer.

What this means for an owner

Our view: the headline offer matters less than four clauses: exclusivity scope, term, permitted recipients, and ownership of the de-identified copy. Of the five buyers here, the two that describe a license length (Polyshares and SourceX) describe it as perpetual or permanent, three state exclusivity, and the only one that states an onward right, SourceX, keeps it. In our view nothing here is unusual, but it should be a choice you make with the clauses in front of you.

Before you apply, write down which records you would never license exclusively, and which buyers state their terms publicly. Then ask each buyer the same five questions: Is it exclusive, and for what use? How long does the license last? Who can receive the data? Who owns the de-identified copy? What survives termination?

We are an independent advisory firm, not a broker, and we do not give legal advice. Participating buyers may pay us referral fees. Nothing is shared with any buyer until you approve a specific, named buyer. To see how these programs compare on size, history and records, start with our buyer programs for October 2026, read how the market for company data works, or check where you fit.