One of the most negotiated provisions in any software, AI, or data licensing agreement is the vendor's right to use customer data. You see it everywhere, from your coding software to your notetaking software. And it's where consumer privacy and AI governance quietly collide.
Say the agreement defines "Customer Data" to include your inputs and anything derived from them, and the software processes personal information - names, items purchased, anything tied to a person. Your ability to grant the vendor that use right isn't yours to give freely. It's capped by what you disclosed in your consumer-facing privacy notice.
Here's why.
The vendor is your service provider; it processes the data on your behalf, so the consumer-facing obligation stays with you. You're the one who told the consumer how their data would be used, and you're bound by that.
It makes sense, right? Here's the visual:
I buy a pie. I hand the bakery my contact and payment information. The bakery can now charge me and ship me the pie — that's the service the notice covered. What the bakery can't do is turn around and grant a downstream software company the right to use my information (that Victoria purchased a key lime pie) to build AI features. It never disclosed that use, and it never offered me the chance to opt out of it. I have no nexus to the software company.
So if you're the bakery, the data-use right you grant your vendor can't exceed the uses you disclosed and made opt-out-able to the consumer.
Why this matters
You should always identify and negotiate the vendor's right to use your data down to fit your notice.
