# Customer data referral objection reply script | SourceX

Canonical: https://refer.sourcex.si/guides/when-an-owner-asks-is-this-selling-my-customers-data
Last updated: 2026-11-04

Answer in three parts. First, what is licensed: the company's own records of how its team works, under a license rather than a sale, with the company keeping ownership of the originals. Second, what stays out: records that belong to customers or that the company holds for them, and personal details, which are removed before anything is delivered. Third, what you cannot promise: whether a contract, privacy notice or law limits any record is decided in SourceX's rights review and by the company's counsel. Then admit what does leave, and offer a step the owner can decline.

The owner is usually asking two questions at once. One is commercial: are we handing over our customers? The other is about trust: would our customers feel betrayed if they found out? A good reply answers both without claiming more certainty than a partner has.

## Why "no" is the wrong answer, and so is "yes"

A flat "no, nothing is being sold" breaks in two places. Something does leave the building if a deal closes. SourceX's process page says data is de-identified through approved processing routes and delivered; under the signed agreement SourceX owns the de-identified dataset, subject to the company's underlying intellectual property rights; and once the fee is paid, SourceX's license is permanent and models already trained on the data are not retrained or deleted. An owner who later learns that from the agreement will remember who told them otherwise.

The word "sell" also has a legal meaning the partner cannot rule on. California's attorney general explains that consumers can direct businesses to stop selling or sharing their personal information, and businesses that sell it must offer a "Do Not Sell or Share" link. Whether any part of a particular license falls under a rule like that is a question for the company's counsel.

A flat "yes" is just as wrong. What SourceX licenses is the company's own operating record, and its screening page says personal consumer data and material belonging to the company's clients are usually not a fit. The accurate answer sits between the two, and it is more reassuring than either because it can be checked.

## The three ownership boundaries

Illustrative. A 180-person managed IT services provider with eleven years of service-desk tickets in one ticketing system. Most tickets concern client environments, its client contracts include confidentiality clauses, and the founder is the CEO.

| Boundary | What sits there at this company | What you can say | What you must not say | Who decides |
|---|---|---|---|---|
| A. The company's own work records | How engineers diagnosed, escalated and resolved tickets; runbooks; internal chat between engineers | "These are what SourceX looks at, with personal details removed before delivery" | "It's all anonymous, so there's no risk" | SourceX's review, with the CEO approving the scope |
| B. Personal details inside those records | End-user names, email addresses, phone numbers and account numbers in ticket fields | "Removed through approved processing routes before anything is delivered, and the company confirms its personal data was collected lawfully" | "Your customers will never know" | SourceX's rights review and the company's counsel |
| C. Records that belong to clients or that the company holds for them | Files in client tenants, client-owned deliverables, backups stored for clients | "Out. Material that belongs to clients is usually not a fit" | "If it's de-identified we can probably include it" | The client contract; in practice, out |
| Where A meets C | The company's own tickets describing client networks, configurations and incidents | "This is exactly what the rights review reads, against your client contracts" | "Tickets are yours, so it's fine" | The company's counsel, in SourceX's rights review |

The fourth row is where an IT services firm's honest answer gets interesting. The tickets are the company's own records, but their contents may be confidential information under client contracts. SourceX's screening page frames the test as whether the company can license the material without breaching client confidentiality, employee privacy or third-party contracts. A partner names the question and leaves the reading to counsel; the live guide to [customer contract data use restrictions](/guides/customer-contract-data-use-restrictions) shows the clauses counsel usually checks.

## The ownership-boundary response script

The core reply, three lines plus a choice:

> "It's a license of your company's own records, mainly how your team does its work, not a sale of your customer list, and you keep ownership of the originals.
> Anything that belongs to your clients, or that you hold for them, stays out, and personal details are removed before anything is delivered.
> What I can't tell you is how your contracts and privacy notice apply; SourceX's rights review and your counsel decide that. If it's worth a look, the first step is a few questions with no files. If not, I'll leave it there."

Owners rarely stop at one question. The branches below keep every answer inside what SourceX publishes.

| If the owner then asks | Say | Basis |
|---|---|---|
| "So is it a sale or not?" | "It's a license. You keep the originals, and under the signed agreement SourceX owns the de-identified dataset. Whether a privacy law would treat any part of it as a sale or sharing of personal information is for your counsel; I won't guess." | SourceX process page; California attorney general |
| "Will our clients find out?" | "Neither side publicizes the deal. But plan as if they might: whatever your contracts or privacy notice promise governs." | SourceX process page; FTC staff, February 2024 |
| "What if a client objects after we sign?" | "Settle scope before signing. You approve scope and terms before any data is delivered, and once the fee is paid the license is permanent, so a later objection can't pull the data back." | SourceX process page |
| "Who ends up with it?" | "SourceX is your counterparty and licenses datasets onward to AI developers in its own name. I don't know or name buyers." | SourceX investor overview |
| "What do you need from me?" | "Nothing from your systems. I never ask for records, exports or logins; if you explore it, you answer SourceX's questions yourself." | SourceX referral page |
| "What do you get out of it?" | "A referral reward from SourceX: the greater of $50,000 plus 5% and 15% of what it actually pays your company, with no cap. It never comes out of your payout." | Program terms |

On the second branch, FTC staff have written that it may be unfair or deceptive for a company to adopt more permissive data practices, such as sharing consumers' data or using it for AI training, and tell people only through a quiet, retroactive change to its terms or privacy policy. That is the company's issue to manage with counsel, but a partner who says "your customers will never know" is pointing the owner straight at it. Once a company has decided, what it says to its own customers is covered in [what to say when a customer asks about AI and their data](/resources/customer-asks-if-you-sell-their-data-to-ai).

## Before and after, for the same owner (Illustrative)

> Before: "No, it's not selling anything. It's all anonymized, your clients will never know, and SourceX just wants the ticket text."

That reply makes three promises the partner cannot keep: that de-identification removes every risk, that clients will never learn of it, and that the scope is already settled.

> After: "Fair question. It's a license of your own records, mainly how your engineers diagnosed and resolved tickets, and you keep ownership of the originals. Anything that belongs to your clients, or that you hold for them, stays out, and names and contact details are removed before anything is delivered. What I can't tell you is how far your client confidentiality clauses reach into tickets about their systems; SourceX's rights review and your counsel decide that. And to be straight about what does leave: if you did a deal, a de-identified copy of the selected tickets would be delivered, and SourceX's license to it would be permanent once paid. If that's worth a look, the first step is a few questions with no files. If not, I'll leave it there."

The second version is longer and more reassuring, because every sentence can be checked against the agreement the owner would eventually read.

The same owner may also ask why you care. A "before" that says "I don't really get anything out of it", when a reward exists, poisons every other answer. The "after" is the last branch in the table, said early and without being asked. FTC staff guidance on endorsements treats a financial relationship as a material connection that should be disclosed clearly when the audience may not know about it; a referral email is not an advertisement, but the principle is the right one.

## Where the licensing opportunity and your reward fit in

Keep them in one place and in plain view. SourceX licenses business data directly from the company and pays it, acting as its counterparty from agreement through delivery and payment. The company controls whether to proceed, what scope to offer and the terms it accepts, and nothing is shared without its approval. Your part is the introduction, and you never export, upload or describe confidential records. Your reward is paid by SourceX separately and depends on the company completing a deal and being paid; it is never deducted from what the company receives.

## One step the owner can decline

Offer one thing: the non-binding [company fit checker](/tools/company-fit-checker), or the first assessment step, which asks a few questions and takes no files. Do not attach a deadline unless the company has a documented one of its own, such as a ticketing-system migration with a date. If the owner wants depth before deciding, three live pages go further: the record-type table in [the customer data objection response](/questions/customer-data-objection-response), the consent analysis in [whether customer consent is needed to license data](/questions/do-you-need-customer-consent-to-license-data) and the no-numbers script for [what the data is worth](/resources/how-to-answer-what-is-my-data-worth). If the conversation stalls, the next message should still add an answer, as in [the follow-up that adds a useful answer](/guides/the-follow-up-that-adds-a-useful-answer). More scripts sit in the [guides library](/guides).

## Next step

> **Refer a company. No cap on rewards.** Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

When the owner has heard where the boundaries are and still wants to explore, [register for a partner link](/register), measure the company against [who qualifies](/who-qualifies) and read the reward wording in the [program terms](/terms) before you introduce the CEO.

## Sources

- https://refer.sourcex.si/terms
- https://refer.sourcex.si/how-it-works
- https://refer.sourcex.si/who-qualifies
- https://sourcex.si/how-it-works
- https://sourcex.si/investors
- https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive
- https://oag.ca.gov/privacy/ccpa
- https://www.ftc.gov/business-guidance/resources/ftcs-endorsement-guides-what-people-are-asking