Training-rights clauses: who can train AI on your data

A training-rights clause is the language in a vendor's terms, privacy policy, or DPA that governs whether the vendor — or its AI subprocessors — may train machine-learning models on the data you submit. In the AI era it is one of the highest-signal clauses in any vendor agreement.

Why it matters now

Before generative AI, "how a vendor uses your data" was mostly about analytics and product improvement. Now it can mean your data becoming training input for a model whose outputs you cannot control or recall. A permissive training-rights clause can turn confidential inputs into a permanent contribution to someone else's model.

Where the clause hides

• The privacy policy, under "how we use data" or an "AI features" section.
• The DPA, in the processing-purposes or subprocessor terms.
• Product-specific terms for an AI feature, separate from the master agreement.

Reading it well

Look for whether training is on by default or opt-in, whether it applies to customer content or only aggregated data, whether it extends to subprocessors, and whether enterprise plans carve it out. The same vendor often treats free, pro, and enterprise tiers differently.

Monitoring it across vendors

A training-rights posture is not static — vendors add AI features and revise these terms frequently. Tracking it once is not enough; you need to know when it changes. Driftline extracts each vendor's training-rights posture from their live documents and alerts you when it shifts, so "who can train on our data" is a question you can answer at any moment, not reconstruct during an incident.