Glossary

The point at which a buyer confirms that delivered data meets the agreed specification. Many data licenses tie payment to acceptance rather than to signing.

Check how long the buyer has to accept, what counts as a defect, and what happens if the buyer neither accepts nor rejects in that time. A clause that treats the data as accepted after a set period without a written rejection protects the company.

Milestone payment · Data manifest · Revenue share · Read the guide

A bulk export of a workspace that an administrator runs from the tool's own settings, for example a Slack or Google Workspace export. What it includes, such as private channels or direct messages, depends on the tool, the plan and sometimes a separate approval.

eDiscovery export · OAuth connection · Scope · Read the guide

Recorded sequences of the steps an AI agent or a person takes to complete a task, such as each action, tool call, input and result. They are used to train and evaluate AI agents.

RL environment · Training data · Evaluation data

A company that pays a business for its data and then licenses that data, usually de-identified, to AI labs or other buyers. The business signs with the aggregator and may never deal with the end buyers.

Data broker · Closure marketplace · Non-exclusive license · Revenue share · Read the guide

Processing data so that the people it describes can no longer be identified by any reasonably likely means, even with other data. It is hard to achieve with rich text such as email and chat, and the word is often used loosely.

Under the EU GDPR, truly anonymous data falls outside the regulation, while pseudonymized data is still personal data. US laws use their own terms and tests, such as "deidentified" data in state privacy laws and the HIPAA de-identification standard for health information.

De-identification · Pseudonymization · Re-identification · PII (personally identifiable information) · Read the guide

A state-law alternative to bankruptcy in which a company transfers its assets to an assignee, who turns them into money and pays creditors. The assignee, not the former management, then controls the assets, data included.

Dissolution and wind-down · Chapter 7 · Trustee · Read the guide

Attorney-client privilege protects confidential communications between a client and its lawyer made to get legal advice. Work product protection covers material prepared in anticipation of litigation.

Disclosing privileged communications to a third party, such as a data buyer, can waive the privilege, and disclosure can also weaken work product protection. Legal advice, matter files and litigation drafts belong outside any data license unless a lawyer has reviewed the question.

Rule 1.6 (client confidentiality) · Trade secret · Scope · Read the guide

The rules a referral program uses to decide which referrer gets credit for a company, such as a tracked link, a cookie window, a registered introduction or first valid referral wins.

Referral fee · Sub-affiliate · FTC Endorsement Guides

The US federal law that sets rules for commercial email, including no misleading headers or subject lines, a valid physical postal address, a clear way to opt out, and honoring opt-outs within 10 business days. It applies to business-to-business email too.

FTC Endorsement Guides · Referral fee · Attribution

Reorganization under the US Bankruptcy Code. The company usually stays in control as debtor in possession, but using or selling assets outside the ordinary course of business needs court approval after notice and a hearing.

Chapter 7 · Trustee · Consumer privacy ombudsman · Read the guide

Liquidation under the US Bankruptcy Code. A trustee takes control of the debtor's property, turns it into money and distributes the proceeds to creditors.

For a company in Chapter 7, the trustee, not the founders, decides whether to license or sell its data. If the company's privacy policy restricted transfers of personal information, the Bankruptcy Code limits a sale of that information.

Chapter 11 · Trustee · Consumer privacy ombudsman · Assignment for the benefit of creditors (ABC) · Read the guide

A service that helps closing or closed companies find licensees or purchasers for their remaining assets, such as code, workspace data, domains and intellectual property.

Aggregator · Data broker · Dissolution and wind-down · Read the guide

A disinterested person appointed, on a bankruptcy court's order, when a debtor proposes to sell personally identifiable information in a way its privacy policy does not allow. The ombudsman reports to the court on the privacy effects of the proposed sale.

Chapter 7 · Chapter 11 · PII (personally identifiable information) · Read the guide

Information the US government creates or possesses, or that a contractor creates or holds for it, that a law, regulation or government-wide policy requires or permits to be safeguarded or limited in distribution, even though it is not classified.

Defense contractors that handle CUI are generally subject to DFARS safeguarding clauses and CMMC requirements in their contracts. Records that contain CUI should be kept out of any data license.

ITAR (International Traffic in Arms Regulations) · EAR (Export Administration Regulations) · Scope · Read the guide

In this market, an intermediary that introduces companies to data buyers for a fee and does not pay the company itself. In privacy law the term means something else: a business that sells personal information about consumers it has no direct relationship with.

Some states, including California and Vermont, require data brokers in the privacy-law sense to register. Check which meaning a document uses before relying on it.

Aggregator · Closure marketplace · Referral fee · Read the guide

A written inventory of the data offered in a deal: which systems, workspaces, date ranges, file types and volumes are in, and what is excluded. It can become part of the license agreement.

Scope · Acceptance · License · Read the guide

How long a party keeps data and what happens to it after that period. In a data license, retention terms say how long the buyer may keep raw data, working copies and backups.

Deletion certificate · Derived model · Term · Read the guide

Removing or altering information that identifies people, such as names, email addresses, phone numbers and account numbers, so the remaining data is harder to link to them. It lowers the risk of identification but does not always remove it.

Legal standards differ by law. HIPAA, for example, recognizes two methods for health information: removing a list of specified identifiers (the Safe Harbor method) or a documented expert determination.

Anonymization · Pseudonymization · Re-identification · PII (personally identifiable information) · Read the guide

A signed statement from a recipient that it has deleted specified data, including copies, by a given date. A license can require one at the end of the term or on request.

Data retention · Derived model · Term · Read the guide

An AI model, or other output, created by training on or otherwise using licensed data. A license may let the buyer keep derived models after the data itself is deleted, so read the clause on derived works alongside the deletion clause.

Deletion certificate · Training data · Data retention · License · Read the guide

Dissolution is the formal decision or filing that ends a company's regular business under state law. Winding up, often called the wind-down, is the process of collecting and selling assets, paying or providing for debts, and distributing what is left to the owners.

In many states a dissolved company continues to exist only for winding up. In practice, a wind-down often starts before the formal filing, which is why records should be preserved early.

Assignment for the benefit of creditors (ABC) · Chapter 7 · Closure marketplace · Read the guide

A contract that sets how a service provider may process personal data on behalf of another company, covering security, subprocessors, assistance and deletion. The EU GDPR requires one between a controller and a processor, and several US state privacy laws require similar contracts.

NDA (nondisclosure agreement) · MSA (master services agreement) · PII (personally identifiable information)

US Commerce Department rules (15 CFR Parts 730 to 774) that control exports of dual-use items, software and technology. Releasing controlled technology to a foreign person, even inside the US, can count as an export.

ITAR (International Traffic in Arms Regulations) · CUI (Controlled Unclassified Information) · Trade secret · Read the guide

An export made with a tool's legal and compliance features, such as Microsoft Purview eDiscovery or Google Vault, which can search and export mail, chat and files across an organization. These tools are built for legal holds and investigations and can reach data that an ordinary user export does not.

Admin export · OAuth connection · Data retention · Read the guide

Data used to test how well an AI model or agent performs, rather than to train it. It is kept separate from training data so that test results stay meaningful.

Training data · Agent trajectories · RL environment

A license under which the licensor agrees not to license the same data to anyone else, for a set period or for the whole term. Some exclusive licenses also limit the licensor's own use.

Buyers may pay more for exclusivity, and it limits your later options. Check how long exclusivity lasts, whether it covers all of the data or only part, and what happens to it if the buyer does not pay.

Non-exclusive license · Sole seller period · Perpetual license · Term · Read the guide

The Federal Trade Commission's guidance on endorsements and testimonials in advertising (16 CFR Part 255). A connection between the person recommending a product and the company behind it, such as being paid for referrals, must be disclosed clearly and conspicuously when the audience would not expect it.

Referral fee · Sub-affiliate · CAN-SPAM Act

A section of the US Internal Revenue Code that makes it a crime for a tax return preparer to knowingly or recklessly disclose or use tax return information without the taxpayer's consent, except as the regulations allow.

Treasury regulations at 26 CFR 301.7216 set the form and content of a valid consent. In practice, tax return information belongs outside any data license.

NPI (nonpublic personal information) · PII (personally identifiable information) · Scope · Read the guide

US State Department rules (22 CFR Parts 120 to 130) that control defense articles, defense services and related technical data. Sharing ITAR technical data with a foreign person, even inside the US, generally requires authorization.

EAR (Export Administration Regulations) · CUI (Controlled Unclassified Information) · Trade secret · Read the guide

Permission to use something, here a copy of specific data, for a defined purpose and period, while the owner keeps ownership. Licensing data differs from selling it: the company keeps the original and can set limits on use.

Exclusive license · Non-exclusive license · Scope · Term · Read the guide

A payment made when a defined step in a deal is reached, such as signing, delivery of a batch of data, or acceptance. A deal can split the total price across several milestones.

Acceptance · Revenue share · Data manifest · Read the guide

A framework contract that sets general terms for a relationship, such as liability, confidentiality and payment, with specific deals added later as orders or statements of work.

NDA (nondisclosure agreement) · DPA (data processing agreement) · License · Read the guide

A contract in which one or both parties agree to keep shared information confidential and use it only for a stated purpose. In a data deal, it can cover samples and pricing shared before the license is signed.

MSA (master services agreement) · DPA (data processing agreement) · Trade secret

A license that leaves the licensor free to license the same data to other buyers. Several buyers can then hold copies of the same data.

Exclusive license · Sole seller period · License · Read the guide

Under the Gramm-Leach-Bliley Act (GLBA), personally identifiable financial information that a financial institution collects about consumers. GLBA limits sharing it with nonaffiliated third parties and requires safeguards to protect it.

The definition of financial institution under GLBA is broad and covers many businesses that are not banks, including tax preparers. Treat consumer financial information as out of scope.

PII (personally identifiable information) · IRC Section 7216 · De-identification · Read the guide

A way to give an app access to an account, such as Slack or Google Workspace, through the provider's own authorization screen instead of sharing a password. Access is limited to the permissions you approve and can be revoked.

Admin export · eDiscovery export · SOC 2 Type II · Read the guide

A license with no end date. The buyer may use the data under the license terms indefinitely, though the license can still be limited in scope and may end for breach if the agreement says so.

Term · Exclusive license · Derived model · Deletion certificate · Read the guide

Individually identifiable health information held or sent by a HIPAA covered entity, such as a health plan or health care provider, or by its business associate. HIPAA limits how it can be used and disclosed.

PII (personally identifiable information) · De-identification · DPA (data processing agreement) · Read the guide

Information that can identify a person directly, such as a name or email address, or indirectly when combined with other data. Each law defines it differently, so check the definition in the law that applies.

PHI (protected health information) · NPI (nonpublic personal information) · De-identification · Anonymization · Read the guide

Replacing identifiers such as names with codes or tokens, while a separate key that could reverse the process is kept. Under the EU GDPR, pseudonymized data is still personal data.

Anonymization · De-identification · Re-identification

Linking de-identified or pseudonymized data back to the people it describes, for example by combining it with other data or spotting unique details. Free text such as email and chat can carry identifying details that automated tools miss.

De-identification · Anonymization · Pseudonymization · PII (personally identifiable information) · Read the guide

A payment a program makes to a person or firm that introduces a customer, here usually a company that goes on to license data. It is paid by the program, not by the company referred, and the referrer should disclose it.

Attribution · Sub-affiliate · FTC Endorsement Guides · Read the guide

A payment structure in which the data owner receives a percentage of what the licensee earns from licensing the data on to others, paid as each deal happens rather than as one sum.

A revenue share keeps paying for as long as the data keeps being licensed, so someone on the company side has to be there to receive and account for the payments. That matters for a company that is closing.

Milestone payment · Aggregator · Non-exclusive license · Read the guide

A reinforcement learning environment: a simulated setting, such as a mock CRM or help desk, in which an AI agent attempts tasks and receives a score or other feedback on its actions. Company workflows and records can be used to make these environments realistic.

Agent trajectories · Training data · Evaluation data · Synthetic data

The ABA Model Rule of Professional Conduct that bars a lawyer from revealing information relating to the representation of a client without the client's informed consent, unless an exception applies. State bars adopt their own versions, such as Florida's Rule 4-1.6.

The rule covers far more than privileged communications. A buyer's promise to de-identify data does not by itself satisfy it.

Attorney-client privilege and work product · Trade secret · Scope · Read the guide

The written definition of exactly what a license covers: which systems, workspaces, channels, date ranges and data types are included, and which are excluded.

Data manifest · License · Term · Read the guide

A Slack feature that lets people from different organizations work together in shared channels and direct messages. These conversations include other organizations' people and information, so they need separate treatment in a data license.

Admin export · Scope · PII (personally identifiable information) · Read the guide

An independent auditor's report, under AICPA criteria, on whether a service organization's controls for security and related principles operated effectively over a review period. A Type I report looks at the design of controls at a single date.

DPA (data processing agreement) · NDA (nondisclosure agreement) · OAuth connection · Read the guide

A period in which only one party, often an aggregator, may offer or license a dataset, even though the license is otherwise non-exclusive. What happens when it ends, renewal or freedom to license elsewhere, depends on the agreement.

Exclusive license · Non-exclusive license · Aggregator · Term · Read the guide

A referrer recruited by another referrer. Some programs pay the recruiting referrer a share of what the sub-affiliate earns, on top of the sub-affiliate's own payment.

Referral fee · Attribution · FTC Endorsement Guides

Data generated by a model or program to imitate real data, rather than collected from real activity. It can fill gaps or reduce privacy risk, but it may miss the detail and irregularity of real records.

Training data · Evaluation data · RL environment

How long a license lasts: a fixed period, such as a number of years, or perpetual. The term sets when use must stop and, often, when data must be deleted.

Perpetual license · Data retention · Deletion certificate · Scope · Read the guide

Business information that has value because it is not generally known and that the owner takes reasonable steps to keep secret, such as pricing models or process parameters. Disclosing it without confidentiality protections can end its protection.

NDA (nondisclosure agreement) · Attorney-client privilege and work product · Scope

Data used to teach an AI model by adjusting it to fit examples. In this market, company records such as email, tickets and code are licensed as training data for AI agents that do office work.

Evaluation data · Synthetic data · Derived model · Agent trajectories · Read the guide

A person who holds and manages property for the benefit of others. In a Chapter 7 bankruptcy, the trustee takes control of the estate's property, data included, and decides whether to license or sell it, subject to the court.

Chapter 7 · Chapter 11 · Assignment for the benefit of creditors (ABC) · Consumer privacy ombudsman · Read the guide