Usage Data

What is usage data?

Usage data is information a vendor collects about how you and your team use its product. It covers which features you click, how often you log in, how long tasks take, what device and browser you use, and similar signals. Engineers often call it telemetry.

Usage data is different from customer data. Customer data is what you put into the product: your files, records, messages and contacts. Usage data is the trail you leave while using it.

The difference matters because contracts often treat the two very differently. Your customer data is usually protected by the data processing agreement (DPA), where the vendor acts for you. Usage data is often governed by the vendor's privacy policy, where the vendor acts for itself.

What usage data usually includes

Here are the kinds of usage data vendors describe in their policies, using two privacy policies we opened as examples (as of October 2026):

• Feature use. HubSpot's privacy policy mentions "what product features you use the most" and when a ticket is opened and closed.
• Actions and collaboration. Atlassian's privacy policy lists features you use, actions you take, content types you interact with and who you collaborate with.
• Device and connection data. Atlassian also lists device type, operating system, browser, IP address, referring pages and crash data.
• Cookies and tracking tools. Atlassian says it and its partners, including advertising and analytics providers, use cookies, pixels and similar tools.
• Login signals. Atlassian describes device details and behavior signals, such as mouse movements, used to confirm you are human.

Much of this can identify a person. The GDPR, the EU privacy law, lists "an online identifier" among the things that can make data personal data (Article 4(1)). So usage data tied to a user account or an IP address is often personal data, even though it feels technical.

Why vendors get broad rights over usage data

When a vendor processes your customer data for you, it is your data processor. It may only use that data on your instructions, under GDPR Article 28.

Usage data is often handled differently. Many vendors say they collect it as a data controller, meaning they decide for themselves how to use it. For example, Atlassian's DPA says it acts as a controller under its privacy policy, and that the DPA "does not limit or prohibit" it from acting in that role. HubSpot's DPA points to the "Usage Data" section of its privacy policy for some processing.

The result: the limits you rely on in the DPA may not reach usage data at all. The privacy policy decides, and the vendor can update it.

Some DPAs also let the vendor turn customer data into aggregated or de-identified data and use it freely. Atlassian's DPA allows de-identified and aggregated data to be used to improve its cloud products, once it cannot reasonably be linked to a person.

How usage data can travel

Usage data rarely stays in one place. Here is a common path, step by step, based on the kinds of uses vendors describe in their policies:

1. A person on your team logs in and uses a feature. The product records the click, the time, the device and the IP address.
2. The vendor stores those events in its own analytics systems, often with help from outside tools. HubSpot's privacy policy says third-party providers help it collect usage data.
3. The vendor's product team studies the events to find trends and plan features.
4. Some of the data may feed AI models, if the policy lists training as a purpose.
5. Cookie and pixel data from the vendor's website or app may go to advertising and analytics partners.
6. The vendor's subprocessors and service providers may touch the data at each step.

Each step is a place where the purpose can widen. That is why the list of purposes in the policy matters more than the list of data types.

What it looks like in a vendor's terms

A typical clause reads like this:

We collect information about how you and your users interact with the services, such as features used, actions taken, device and browser details, and log data. We use this information to provide, maintain and improve our products, to develop new features, to train our machine learning models, and to market our products to you.

• "How you and your users interact" means data about every person on your account, not only the admin.
• "Device and browser details, and log data" often includes IP addresses, which can identify people.
• "Improve our products" is broad. It can cover almost any analysis.
• "Train our machine learning models" means usage data may feed the vendor's AI.
• "Market our products to you" means the data can shape the ads and emails you receive.

HubSpot's privacy policy, for example, says it may process personal data "to train our AI models".

How usage data is used for AI and advertising

AI training. Usage data shows how people work, which is valuable for building AI features. Atlassian's privacy policy lists "machine learning and artificial intelligence model training" among its purposes. HubSpot's says it may process personal data to improve its AI features and train its AI models. Whether this reaches your account depends on settings, plans and the exact wording, so check your vendor's version. See AI training on customer data for the related question about your content.

Advertising. Usage data can feed targeted advertising. Atlassian's privacy policy says usage data may inform marketing, including "targeted advertising of products that may interest you". Tracking tools such as a tracking pixel on a vendor's app or website can send signals to ad partners.

Sale and sharing under California law. Under the CCPA, "sharing" means sharing for cross-context behavioral advertising, which is ads based on activity across many sites. The California Attorney General's CCPA page says people can ask businesses to stop selling or sharing their data, and that covered businesses must honor a Global Privacy Control signal as a valid opt-out request.

A real change we caught

Usage data terms move. Venpo flagged that HubSpot now collects your email engagement data for its commercial dataset. Email engagement, such as opens and clicks, is a kind of usage signal.

Venpo also caught that Mixpanel added 150% overage fees and removed the AI data opt-in. Its June 2026 Supplemental Terms replaced an AI improvement opt-in with a standing right to use AI inputs and outputs in de-identified form. When an opt-in disappears, how your data can be used for AI may change without you doing anything. Definitions can grow too: Venpo noted that Stripe expanded what counts as Transaction Data.

Why it matters to you

Your team's behavior is data about your business. Usage data can show which customers you work on, how fast your team responds and which features run your operations. Even without your files, it says a lot.

Your promises to your own staff and customers. If your users include your customers, their usage data may be shared or used in ways your own privacy notice does not mention. That can create a gap between what you told people and what your vendor does.

Changes can be retroactive. A vendor may widen how it uses data it already collected by updating a policy. In a February 2024 staff blog post, which is guidance and not a rule, the FTC warned that quietly changing terms to use data in new ways, such as for AI training, could be unfair or deceptive.

It shows up in your vendor reviews. Security and privacy reviews often ask what a vendor does with data. The honest answer often sits in the usage data section, not the DPA.

What to check

• Find the usage data section in the vendor's privacy policy and list what it collects.
• Check whether the DPA covers usage data, or whether the vendor says it acts as a controller for it.
• Look for AI training, advertising, sale or sharing among the listed purposes.
• Check whether customer data can become aggregated or de-identified data and be used freely.
• Find any admin settings that limit collection or opt you out of AI training.
• Ask the vendor whether usage data is shared with ad partners or affiliates.

How Venpo helps

Venpo monitors your vendors' privacy policies, DPAs and cookie policies and emails you a plain-English alert when usage data terms change. The Fine Print Scan answers, for each vendor, whether it trains AI on your data and whether it sells data or uses it for ads.