Can you license your company's HubSpot data to AI companies?

HubSpot data rights at a glance

Who owns your HubSpot data under HubSpot's terms?

Your company owns its HubSpot data. Section 5.1 of the HubSpot Customer Terms of Service (General Terms last modified September 16, 2026) says "You own and retain all rights to the Customer Materials and Customer Data."

HubSpot keeps a right to learn from that data. Section 5.3.1 says "We may also use Customer Data to train our AI models," and "You may opt out of having your Customer Data used for this purpose" in your account settings. Section 5.7 refers to your right to retrieve Customer Data, with details in the Product Specific Terms.

Ownership against HubSpot does not clear the rights of the contacts in your CRM. Our guide on whether you can legally sell company data covers that question.

What can you export from HubSpot?

HubSpot's record export is the native route. Its knowledge base article Export records says:

• You can export appointments, calls, contacts, companies, deals, listings, payments, tickets and custom objects, with current property values and associations
• Files come as CSV, XLS or XLSX, split above 1,000,000 rows for CSV and XLSX
• Up to 300 exports run per rolling 24 hours, and download links expire after 30 days
• Email bodies, notes and most activities are not part of record exports. HubSpot points you to contact-level exports, activity reports or the engagements API

That last point matters. The email and call history behind each deal often sits in activities, and HubSpot's documented bulk route for those is an API.

Do HubSpot's terms restrict AI training on CRM data?

HubSpot's terms restrict AI training on anything handled through its developer tools. Section 4.B.8 of the HubSpot Developer Terms (last modified May 4, 2026) says you "must not use Customer Data or Content to train, fine-tune, improve" or otherwise develop AI.

There is a narrow exception for fine-tuning "solely on a single Customer's Customer Data" with that customer's express permission. The terms cover "a Customer building a Solution for your own use," so a script your own team writes to pull activities is inside them.

A record export from the HubSpot interface is a different route, and the Customer Terms carry no AI-training restriction on your own data. Treat API-sourced activity data as restricted and ask counsel about the rest.

Which HubSpot plan and permissions do you need?

Any HubSpot account can export records, but the user needs export permissions.

• Export permissions on the user's seat
• Exports are recorded in an export log kept for 3 years
• For API pulls, a private app or developer account, which brings the Developer Terms into play

A HubSpot export is personal data almost line by line: contact names, emails, phone numbers, job titles, form submissions and email engagement history. Many contacts gave consent for marketing only, which is a narrow purpose to stretch to AI training.

The US position

In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired.

Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our de-identification guide explains how to meet that standard, and our guide to the CCPA and state privacy laws covers the other states.

Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules.

If the export could hold health information from a HIPAA covered entity or business associate, HHS recognizes two de-identification methods under 45 CFR 164.514(b): Expert Determination, and Safe Harbor, which removes 18 types of identifiers. Financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties, according to the FTC.

Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected.

If you hold UK or EU data

UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel.

What third-party content is in a HubSpot export?

Contacts in HubSpot belong to other companies, and imported lists may come from event partners or data vendors with their own terms. Ticket and conversation inboxes add customers' own words.

Record where each list came from before you include it. Buyers of CRM and sales data will ask for that provenance.

How do you prepare a licensable HubSpot export?

Preparing a HubSpot export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order.

1. 1

   Export records through the interface

   Use record exports for objects and associations, and log each export file.

2. 2

   Treat activity data with care

   If emails, notes or calls must come through the engagements API, get counsel's view on section 4.B.8 of the Developer Terms first.

3. 3

   Record the AI opt-out setting

   Note whether you opted out of HubSpot's own AI training under section 5.3.1, so buyers know how the data has been used.

4. 4

   Remove third-party content

   Take out purchased or partner lists and customer attachments unless the other party has agreed in writing, and keep privileged legal material out entirely.

5. 5

   De-identify and test

   Replace names, user IDs and email addresses across the HubSpot export, then run a re-identification test on a random sample, as our de-identification guide describes.

6. 6

   Write the manifest

   Record record counts, date ranges, systems, exclusions and the export method in a data manifest that matches what you deliver.

7. 7

   Get counsel's sign-off

   Ask your own counsel to review the HubSpot terms, your order form and your privacy notices together before any buyer sees a sample.

If you want a view on whether your HubSpot data is licensable and what buyers might pay, start with a data valuation. We are a broker, not a law firm, so take independent legal advice before you sign any license.