Customer Data

What is customer data?

Customer data is the defined term a vendor's contract uses for the data you put into its service. That can be files, records, messages, contacts and anything your users type or upload.

The word matters because of where it sits. Many of the protections in a SaaS contract attach to this one defined term. Promises such as "we will only use it to provide the service," "we will delete it when you leave" and "we will not train AI on it" often say "Customer Data." Whatever falls outside the definition may not get those promises.

Vendors use different names for the same idea. Salesforce and Atlassian say "Customer Data." Zoom says "Customer Content." Some say "Your Content" or "Customer Materials." The name matters less than the words that follow it.

Where customer data ends and usage data begins

Many vendors also collect data about how you use the service: logins, clicks, feature use, error logs and performance metrics. Contracts often call this usage data, telemetry or service data. It is often defined separately, with much wider rights for the vendor.

Zoom's terms of service show the split. Section 10.1 defines Customer Content as what you or your users generate or provide. Section 10.5 then says that for service generated data, "Zoom owns all rights, title, and interest."

The line between the two is not always clean. Metadata about a meeting, the names of your files or the email addresses of your users can sit on either side, depending on the wording.

What it looks like in a vendor's terms

A typical clause reads like this:

"Customer Data" means electronic data and information that Customer or its Users submit to the Services. Customer Data does not include Usage Data, Feedback or any data Provider generates about the operation of the Services.

• "Submit to the Services": only what you send in is covered. Data the vendor collects from other sources may not be.
• "Customer or its Users": covers your staff and anyone you authorize, so check how "Users" is defined.
• "Does not include": the exclusions list is where the definition gets narrow. Each excluded item falls under looser rules.

For a real example, Salesforce's Main Services Agreement defines Customer Data as "electronic data and information submitted by or for Customer" and leaves out some third-party content and apps.

A real change we caught

Venpo flagged this change: Stripe expanded what counts as Transaction Data. Stripe's January 2026 privacy policy update widened transaction data to include fulfillment details, subscription lifecycle data, taxes and refunds, chargebacks and support interactions about a transaction. When a vendor redraws a defined data term, the rules attached to it move with it. A wider or narrower definition changes which of your data the vendor's promises cover.

Why it matters to you

If a piece of your data falls outside "Customer Data," the vendor's limits may not apply to it. It could be kept longer, shared with partners or used to build products, depending on the rest of the terms.

This flows down to your own customers. You may promise them that their data is used only to deliver your service. That promise is only as strong as the definitions in each vendor contract behind it.

What to check

• The exact definition of customer data and every item it excludes.
• How usage data, telemetry or service data is defined, and what the vendor may do with it.
• Whether the vendor may create aggregated data from your customer data and use it freely.
• Whether promises on retention, deletion and AI training refer to customer data or to a narrower term.
• Who counts as a "User" and which of your companies count as the "Customer."

Affiliate Definition

An affiliate is a company linked to another through ownership or control, such as a parent, a subsidiary or a sister company. Contracts define the word, and the definition decides who can use the service and whose data is covered.

Salesforce's MSA is a common pattern. It defines control as owning or controlling "more than 50% of the voting interests." Under that test, a company you own 40% of is not an affiliate. The same agreement lets an affiliate join by signing its own order form.

A narrow definition can leave out a group company that uses the service. Its data may then fall outside the protections you negotiated, or its use may breach the license.

The word also cuts the other way. Vendors may share data with their own affiliates. Salesforce's license to use your data, for example, runs to Salesforce and its affiliates. A broad definition widens who on the vendor's side can see your data. See data sharing with affiliates.

Check the ownership test, whether affiliates may use your account, and whether a later acquisition by either side changes who counts.

How Venpo helps

Venpo monitors your vendors' terms, DPAs and privacy policies and emails you when a defined term such as customer data or affiliate changes. Each alert explains what changed and why it matters, and a change history per vendor shows how the wording moved over time.