If you sell a copy of your Slack, Teams or email history, most of it was written by your staff. This guide covers notice, consent, works councils, what to leave out and how to tell people before a buyer asks you to confirm that you did.
Last checked: October 7, 2026. For companies, not for individuals selling their own data.
Buyers of company data are not after your logo or your customer list. micro1's page says it wants SOPs, knowledge bases, project histories, QA processes and "decision-making patterns." The sources the buyer programs list include Gmail, Outlook, Slack, Microsoft Teams, Zoom recordings and transcripts, Jira, Asana and Zendesk. Decisions in a 40-person company are made in those places, in messages typed by employees.
So the part of your archive that makes it worth something is also the part that holds your staff's names, opinions, jokes, complaints, sick days and side conversations. A buyer can remove names. It cannot make the archive stop being a record of what specific people said at work. That is why the employee question deserves its own plan, separate from the customer question covered in our guide to client confidentiality and data sales.
Any message, email, recording, transcript, ticket comment, document or record that an employee or former employee wrote, appears in, or can be identified from. That includes metadata such as who sent what to whom and when.
These are the programs' own statements. They describe the buyer's process. They do not replace your own duties to your staff.
Two points follow. First, scope is yours to set: both statements describe an agreed scope or an agreed copy, so you decide whether direct messages, HR channels or recordings are in it. Second, de-identification happens after you hand over the copy. Your own notice to staff, and any promises you make in the contract about consent, come before that. Our guide to de-identification before selling data covers what to verify on the buyer's side.
Which rules apply depends on where your staff work and what your policies already say. Bring this table to your lawyer.
| Topic | Why it comes up | Question for your lawyer |
|---|---|---|
| Existing policies | Handbooks, acceptable-use policies and employee privacy notices often say work systems belong to the company. Few mention licensing content to a third party for AI training. | Do our current policies cover sharing a copy of work communications with an outside buyer, or do we need a new notice first? |
| Notice vs consent | Some laws focus on telling people, others on a lawful basis. In an employment relationship, consent may not be treated as freely given. | Would you rely on notice, consent or another basis here, and why? |
| EU and UK staff (GDPR, UK GDPR) | Purpose limitation, transparency and the right to object apply to employee data too. | Is AI training compatible with the purposes we collected this data for? See our GDPR guide. |
| California staff (CCPA/CPRA) | California's privacy law has notice and rights provisions that can reach employee data. | Does CCPA/CPRA apply to us and to this use, and what notice or opt-out must we give? |
| Recordings and transcripts | Zoom recordings and transcripts are listed sources. Some places require all parties to agree to a recording. | Were our recordings made lawfully, and does selling a copy need anything beyond what we had when we recorded? |
| Works councils and unions | Many EU employers have works councils; some US employers have collective bargaining agreements. | Must we inform, consult or agree with employee representatives before sharing? Does our union contract say anything about employee data? |
| Former employees | Archives hold years of messages from people who left. | Did our policies at the time cover this use? Should we exclude their messages? |
The cheapest privacy protection is data you never export. Draft an exclusions list before you share a manifest with any buyer.
Chat archives get their own treatment in our guide to Slack and Teams messages, including the difference between channels and direct messages.
No buyer page we checked addresses this. It is your decision, and it is easier to make before the money arrives.
You tell staff what is being shared, what is excluded and how it is protected. Simplest, and it may be all your lawyer says is needed. It can still feel abrupt to people who learn their messages had a price.
Staff can ask to have their direct messages or all their content removed within a set window. It costs some data and some admin work. It shows you took the question seriously.
Part of the proceeds goes to a staff bonus pool or a team benefit. Some owners see it as fair, since staff wrote the material. Decide the rule before you know the final price.
Public attention is real. Forbes (April 16, 2026, "AI's New Training Data: Your Old Work Slacks And Emails"), Fast Company and Gizmodo covered shut-down startups selling Slack and email archives. In the reported Spirit Airlines matter, micro1 said it held a session with former Spirit employees. Employees are part of the story whether or not the law requires you to ask them.
Deals take weeks to months. Use that time so staff hear it from you, in writing, before any export.
List sources, date ranges and exclusions. Without a scope you cannot write an honest notice.
Take the table above to counsel. Ask what notice, basis and representative consultation your situation needs.
A buyer NDA may limit what you can disclose. Make sure it allows the notice you need to give your own staff.
Follow whatever process your lawyer identifies before the agreement is signed, not after.
Say what is shared, what is excluded, how it is de-identified, who receives it, for what use, and who answers questions.
If you offer an opt-out, apply it before export. Keep a record of what was removed.
After acceptance, confirm deletion of whatever the contract says is deleted and tell staff it is done.
A single all-staff email rarely works. Different groups need different information at different times.
Brief team leads a day or two before the staff notice. They will get the questions. Give them the scope, the exclusions, the opt-out process and one named person who answers anything they cannot.
The written notice itself. Plain words, no legal jargon, sent before any export. Say what is shared and what is not, and give a real deadline for opt-outs if you offer them.
People who handle grievances, payroll or health matters need to know exactly which of their channels and folders are excluded, and how that exclusion is checked.
You may not be able to reach them. Ask your lawyer whether you should try. Many sellers simply exclude former staff's direct messages and personal threads.
If you expect further deals, update the handbook and privacy notice so people who join later know from day one how work records may be used.
Where one exists, it usually needs to hear before the rest of the staff. Your lawyer will tell you whether it must be informed, consulted or asked to agree.
Every detail below is invented to show the sequence. It is not a real company, a real buyer or a real deal.
The owner of a fictional 60-person freight brokerage has seven years of Slack history, Outlook mailboxes and a ticketing system. A buyer program has asked for a manifest. Before sending one, the owner and the operations lead draft a scope: public Slack channels about loads, carriers and exceptions; the shared operations mailbox; and ticket histories. They exclude the HR channel, all direct messages, the leadership channel, payroll exports and anything with a legal hold.
Their lawyer reads the handbook and finds that it says work systems belong to the company and may be monitored, but says nothing about licensing a copy to a third party. The lawyer recommends a new written notice and a 14-day window in which anyone can ask to have their messages removed. Because two staff members work in California, the lawyer also checks the CCPA/CPRA notice question. The company has no works council and no union contract.
The draft agreement asks the company to warrant that all employees consented. After the lawyer's review, the owner asks the buyer to change it to a statement that employees were notified under a described process, which is what actually happened. Managers are briefed on a Monday, the notice goes out on Wednesday, and four people opt out. Their messages are filtered before export, and the filter is logged. The owner also sets aside a fixed share of whatever the final license fee turns out to be for a staff bonus, and says so in the notice.
Nothing in this example guarantees an offer, a price or a timeline. It shows the order: scope, lawyer, contract wording, staff, export.
Staff who learn about a deal after the export has happened rarely accept the explanation. Notice belongs before export, and ideally before signature.
"The company owns its systems" is not the same as "the company may license our messages to an AI buyer." Ask your lawyer to read the actual wording.
Exporting everything and hoping de-identification catches the personal content puts the hardest material in the copy for little extra value.
Do not tell staff they can withdraw at any time if the agreement makes the delivered copy final. Match the notice to the contract.
These are generic questions every seller should check. They are not claims about any named buyer.
Does the agreement ask you to state that employees consented or were notified? Can you truthfully say that today? Read our guide to indemnities and warranties.
If an employee's personal detail survives into a dataset, who carries the cost? Is liability capped, and does it expire?
Can you see a sample of the de-identified output, or get a report on the method, before acceptance?
Training only, or evaluation too? Which downstream buyers? Your staff notice must match what the contract allows.
When are originals and the buyer's working copy deleted, and will you get written confirmation to pass on to staff?
If an employee objects after delivery, can anything be removed? Ask now, so your notice does not promise what the contract cannot deliver.
It depends on where your staff work, what your handbook and privacy notices already say, and what the data contains. Some laws focus on notice, some on a lawful basis, and in some places consent from an employee may not be treated as freely given. Ask your lawyer which basis they would rely on before you sign anything that says you have consent.
Only if you agree to include them. micro1 says on its page that scope is agreed in writing, and Mode says it buys an agreed copy. Many sellers draw the line at public channels and exclude direct messages entirely, because private conversations carry the most personal content.
If you have a works council or other employee representatives, ask your lawyer whether sharing work communications with a third party requires information, consultation or an agreement before it happens. The answer differs by country and by your existing agreements.
We are not aware of a general rule that requires it, and none of the buyer pages we checked mentions it. It is a business and reputation decision. Some owners choose a staff bonus pool, an opt-out window, or both. Decide before you announce the deal, not after.
Former employees are in every archive. You usually cannot ask them easily, and their exit paperwork rarely mentions AI training. Ask your lawyer whether your policies covered this use when they worked for you, and consider excluding their direct messages and personal threads.
The buyers publish de-identification statements: micro1 says sensitive and confidential information is scrubbed, and Mode says it de-identifies before onward delivery. Ask what is replaced, who checks it, and what happens if something is missed.
Whether staff have a legal right to object depends on where they work and on the basis your lawyer relies on. Separately, you can choose to offer an opt-out. If you do, apply it before export, keep a log of what was removed, and make sure the contract does not promise the buyer content you have since removed.
Staff will reasonably ask who receives the copy. Check what your NDA with the buyer allows you to disclose before you write the notice. If you cannot name the buyer, describe what kind of company it is and the use the contract permits.
The eligibility checker runs in your browser and sends nothing. It compares your headcount, country and systems with each program's published rules. Applying starts a review; it is not an offer.
Independent site. Some links are referral links: if your company signs with a buyer through them, the buyer may pay us a fee. You are not charged, and we never see your data.