Can you license support conversations under your own privacy policy?

This is the question that ends more ticket deals than price does. A support archive can be large, old and well organized, and still not be yours to license, because of what you told your customers years ago. This post is general information, not legal advice. It sets out what to read and what to ask, so the conversation with your lawyer is short.

What does your privacy policy actually say?

Open the version that was live when the tickets were written, not just today’s. Look for three things.

• What you collect. Does it mention support communications, chat transcripts or call notes?
• How you use it. Does it list improving services, training systems, or sharing with partners? A line about “improving our services” was written for a different purpose; whether it stretches to licensing conversations to a third party for AI training is a question for counsel.
• Who you share it with. Most policies list service providers and legal requests. Licensing to an AI company is a different kind of sharing.

If the policy changed over the years, the archive may split into periods with different rules. That is common and workable, but it has to be known before scoping.

What about your customer terms and contracts?

Consumer terms

Terms of service sometimes grant the company rights over content customers submit. They rarely contemplate support messages specifically. Read what they say about customer content and how long the grant lasts.

Business customers

B2B support is harder. If you serve companies, your contracts or data processing agreements may say you handle their users’ data on their behalf and only for agreed purposes. In that case licensing those conversations could be off the table for you, names removed or not. Check every enterprise contract with a data clause.

Work you did for clients

If you run support for other brands, under an outsourcing or agency contract, those tickets usually belong to the client. What you can license is limited to data that is yours, or data a contract plainly lets you license.

Does removing personal data solve it?

It solves a lot, not everything. All four buyers we follow promise de-identification in some form: Scale AI places its anonymization on the seller’s systems before extraction, and Nyne commits to de-identifying ahead of any release. That shrinks the privacy risk carried by the dataset.

It does not change what you promised. If your policy said support messages would be used only to answer the customer, a de-identified copy licensed for training may still sit outside that promise. And de-identification is never perfect in free text: a rare product fault, a small town and a date can point at one person.

So the order stays the same: rights first, removal second, price last.

How have other companies handled it?

The public examples are platforms and publishers, not helpdesks, but they show how much rests on the legal basis.

Company	Figure in the reporting	Who reported it
Reddit	$203.0 million aggregate contract value across its data licensing deals, running two to three years each	Reddit’s S-1 filing, covered by TechCrunch on 22 Feb 2024
Spirit Airlines	A $10 million Google bid for business records such as staff emails and Teams messages, which were to be de-identified first; Mercor had bid $7.5 million; court sign-off was outstanding	Reuters report of 17 Aug 2026

The Spirit case is the useful one for support leads. Even in that sale, the data was to be de-identified first and the deal needed a court’s approval. Internal communications are not treated as a simple asset.

Who else has a stake?

Your agents. Their names, writing and internal notes are in every ticket. Employment agreements and internal policies may cover how their work product is used; it is worth telling your team before a dataset leaves, even when the law does not require it.

Investors, or an acquirer after a sale, may also hold rights over company assets, which matters most when a company is winding down.

What should you take to your lawyer?

Bring a short pack, not the archive:

1. Every version of the privacy policy that covered the ticket years.
2. Your consumer terms of service, with dates.
3. A list of business customer contracts that have data clauses.
4. Any outsourcing contracts where you ran support for someone else.
5. A description of the archive: platform, years, volume, channels, languages, and whether card or health details could appear.
6. The buyer’s draft agreement, once there is one.

Ask two questions: can we license de-identified support conversations from these periods, and what must the agreement say about scope, exclusivity and deletion.

Where to go from here

If the answer is yes for some or all of the archive, the next step is fit: which buyers’ published rules your company meets. Our homepage on how to sell support tickets lists them, and the redaction checklist covers the removal step.

Your policy was written for your customers; start there, and the rest of the deal gets easier.