If I sell my company's data for AI, who actually ends up with it?

Where can a copy of my records go after a deal?

Once a copy of your records leaves your hands, it is a file. Files can be copied, merged and moved. A licence is the agreement that sets the rules for that file. It does not stop a copy existing in someone else's systems.

In a loose deal, a copy could pass through several hands:

• The buyer you signed with. This may be an AI developer, or a data company that prepares records for developers.
• The buyer's customers. A data company may build your records into a dataset or training environment and license that to others.
• Contractors and vendors. People who clean, label or store the data on the buyer's behalf.
• A new owner. If the buyer is bought or merges, its data may move with it.

None of this is unusual. It is how data businesses often work. The question is whether your contract allows each step, and whether you hear about it.

Could my data be resold to labs in other countries?

This is a real worry online. One post on X said some data companies sell training data to labs in other countries, including operational data from businesses, without telling the owners. In a Reddit thread in r/ArtificialInteligence, one person asked why private training datasets were being sold overseas and called it a security concern.

These are opinions, not established facts. But the risk they describe is plain enough to plan for. If a contract says nothing about resale, sublicensing or where the data may go, you may have little say later.

Operational records also say more than people expect. Years of chats, tickets and emails show how your company decides, handles exceptions and solves problems. That is what makes them useful. It is also why you should care who learns from them.

What contract terms should I ask for?

You can ask for terms that keep control with you. Ask for each one in writing:

1. A named licensee. The contract should say exactly which company gets the copy, not "the buyer and its affiliates" with no limit.
2. No resale or sublicensing without your written consent. Sublicensing means the buyer granting someone else rights to your data. If they want to, they should have to ask you first.
3. Limits on where the data goes. You can ask for a list of countries or regions where the data may be stored or used, or a list where it may not.
4. A stated purpose. For example, training or testing AI models only. Anything else needs a new agreement.
5. Notice on a change of owner. If the buyer is sold, you should be told, and the licence terms should travel with the data.
6. Contractor rules. Anyone handling your data for the buyer should be bound by the same limits.
7. Retention and deletion. How long the buyer keeps the copy, and written confirmation when it is deleted.
8. Exclusive or non-exclusive. An exclusive licence means only one buyer gets the copy. A non-exclusive licence lets you license it to others too. Our guide on choosing your licence explains the trade-off.

Good terms reduce risk. They do not remove it. A contract gives you rights if something goes wrong; it cannot pull back a copy that has already spread. So the next question matters just as much.

What should be removed before anything leaves?

The less sensitive the copy, the less it matters where it ends up. Before any deal, ask exactly what will be taken out.

With Korra, names, companies, emails and other private details are removed or replaced before anything leaves. Sensitive records, such as health or payment records, stay out. Records you do not own, such as client files, stay out unless the owner has given written permission.

Be clear about what this means. Removing names is not the same as making data anonymous. People can sometimes be recognised from context, writing style or unusual details. Removal lowers the risk; it does not end it. Our guide on what to check before sharing data covers this in more detail.

Do I give up ownership or access to my systems?

You should not have to. A licence lets someone use a copy under set terms. You keep ownership of the original records.

Buyers should never need live access to your email, chat or CRM. A prepared copy is enough. If anyone asks for logins at the start, treat that as a reason to slow down.

The way Korra works, nothing is shared until you approve the terms in writing, and the first step is only a description of your records: no files, no logins. The buyer pays Korra's fee, so the business pays nothing. Deals in a typical range run from $200K to $2M, though any figure depends on the records and the buyer, and no amount is promised.

How do I check who really ended up with it?

Ask for these in the contract, not as a favour later:

• A right to ask, in writing, who holds a copy.
• Notice before any new party gets access.
• Confirmation of deletion at the end of the term.
• A clear contact for questions after the deal.

If a buyer will not agree to say who gets your data, that tells you something useful.

If you want a rough sense of whether your records are worth the effort before thinking about terms, try the value calculator. It is free and asks for a description, not files.