Can you license your company's Intercom conversations to AI companies?

Intercom data rights at a glance

Who owns your Intercom data under Intercom's terms?

Your company keeps its rights in Intercom data. Section 3.2 of the Intercom Terms of Service (effective September 8, 2026) says "Customer will retain all of Customer's Intellectual Property Rights" in Customer Data, which section 1 defines to include chat and message logs about the people you talk to.

The same section grants Intercom a broad license to use Customer Data, expressly including "Intercom AI model training," and section 3.4 lets Intercom de-identify Customer Data and own the anonymized result. Section 3.3 says "Intercom does not provide an archiving service," and section 8.3 ends your access 30 days after termination.

Keeping your rights against Intercom does not clear your customers' rights in what they wrote. Our guide on whether you can legally sell company data covers that.

What can you export from Intercom?

Intercom's help article Export your Intercom data lists several routes, and only some include message content:

• Dataset export to CSV covers reporting metadata only. Intercom says conversation and message content is not included
• Transcript exports from the Inbox give the full message chronology as PDF or text, in bulk batches of about 200 to 300 conversations. Internal notes are left out
• Amazon S3 export delivers JSON with message content and attachments, historical for up to two years or periodic, but without a transcript
• The Conversations API retrieves full content one conversation at a time

Do Intercom's terms restrict AI training on conversation data?

Intercom's terms say nothing direct about AI training by customers. We found no clause in the Terms of Service that stops you licensing your own Customer Data for that purpose. The Intercom Developer Terms do not mention AI either, but they apply to anyone building a developer app, including private apps, which section 4.6 allows without approval.

Section 3.2.1(g) says you will not "scrape, or otherwise create copies of any data obtained using the Intercom Service" except as necessary, and section 3.2(e) bars using the platform to "develop any products or services similar to or competing with the Intercom Service." A dataset built through the Conversations API for an AI buyer may run into both.

We treat API extraction as unclear and the S3 and Inbox exports as the routes with fewer open questions. Intercom shows no last-updated date on the Developer Terms, so check the version in force when you extract.

Which Intercom permissions do you need?

Each export route has its own permission, according to Intercom's help center.

• Can export conversation data permission and an Inbox seat for saved view exports
• Can access Chart drill-in and Can export CSV permissions for dataset exports
• Access to Settings, then Data, then Imports and exports, to set up the S3 export
• Exports finished before the 30-day post-termination cut-off in section 8.3

Intercom conversations are written by your customers and leads. They carry names, email addresses, company names, locations and free text about accounts, billing and problems, plus anything a customer types into the Messenger.

The US position

In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired.

Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our de-identification guide explains how to meet that standard, and our guide to the CCPA and state privacy laws covers the other states.

Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules.

If your customers are patients or account holders, assume conversations may contain HIPAA or GLBA-covered information until a review shows otherwise. HHS recognizes two de-identification methods under 45 CFR 164.514(b), Expert Determination and Safe Harbor, which removes 18 types of identifiers. The FTC says financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties.

Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected.

If you hold UK or EU data

UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel.

What third-party content is in an Intercom export?

Every conversation includes the customer's own words, and many include attachments, screenshots and replies from bots. Bot and AI agent replies were generated by Intercom's service, so record which messages are machine-written.

Your customer terms and privacy notice decide whether you can license this content. Buyers of support ticket data will ask what those documents said at the time.

How do you prepare a licensable Intercom export?

Preparing a Intercom export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order.

1. 1

   Choose the export route

   Prefer the S3 or Inbox transcript exports, and get counsel's view on the Developer Terms before any API pull.

2. 2

   Rebuild transcripts if needed

   Combine the S3 JSON with transcript exports so each conversation reads in order, and document how you did it.

3. 3

   Label machine-written messages

   Flag bot and AI agent replies so buyers can include or exclude them.

4. 4

   Remove third-party content

   Take out customer attachments and screenshots that show other companies' information unless the other party has agreed in writing, and keep privileged legal material out entirely.

5. 5

   De-identify and test

   Replace names, user IDs and email addresses across the Intercom export, then run a re-identification test on a random sample, as our de-identification guide describes.

6. 6

   Write the manifest

   Record record counts, date ranges, systems, exclusions and the export method in a data manifest that matches what you deliver.

7. 7

   Get counsel's sign-off

   Ask your own counsel to review the Intercom terms, your order form and your privacy notices together before any buyer sees a sample.

If you want a view on whether your Intercom data is licensable and what buyers might pay, start with a data valuation. We are a broker, not a law firm, so take independent legal advice before you sign any license.