Say you run a small physio clinic and, last spring, you signed up for a new AI tool. It reads your appointment emails, drafts the reminders and keeps notes. Young company, friendly founders, a price you could live with. Six months later the tool's website says "we are winding down." You export what you can find, close the tab and forget about it.
Where does everything the tool held go? Until this month I would have said "deleted, probably." That answer got shakier.
Dead startups have something to sell
On 13 October, MIT Technology Review reported that failing startups are selling their leftover data to AI companies: code, emails, chats, documents, workspace archives from tools like Google, Notion and Slack. Wind-down firms broker the deals. One of them, SimpleClosure, told the magazine it has handled more than 150 of them, and that 47% of its deals now include code or data.
Why would anyone buy a dead company's Slack history? Because AI labs want to teach agents to do office work, and real offices are messier than anything you can invent. One buyer said he looks for archives with disagreements and judgment calls. That is the stuff a synthetic data set gets wrong.
The biggest example so far is Spirit Airlines. During its bankruptcy this August, Google reportedly won the airline's data for about $10 million, including 100 million emails and 500 million Teams messages. The flight attendants' union objected on privacy grounds. A lawyer quoted in the piece called this kind of data "legally radioactive."
Back in April, Gizmodo had already carried the privacy critique in one line. Marc Rotenberg of the Center for AI and Digital Policy said: "It's not generic data. It's identifiable people."
What this has to do with you
Be careful here, because the reporting is narrower than the worry it creates. The sales described are mostly a company's own internal archive: its team's chats, its code, its documents. Neither article says customer data is being sold, and neither says it is not.
But look at your clinic again. The tool was a young company's product, and the data you fed it sat on their servers. If that company shuts down, someone is deciding what happens to those servers: a founder, a liquidator, a broker. You are not in that room.
In the EU you have a footing most people do not. When a tool processes personal data for you (your patients' names and appointments), you are the controller and the tool is your processor. Article 28 of the GDPR says the processor may act only on your documented instructions, and that when the service ends it must, at your choice, delete the data or hand it back. If a vendor tried to treat your patients' data as a company asset to sell, it would be stepping outside that role. The same article says a processor that decides its own purposes is treated as a controller for that use, with all the duties that come with it.
What I could not verify is how well this holds in a real insolvency, when nobody is left to answer the phone. The articles do not cover GDPR at all, and I will not pretend to a legal conclusion. Ask a lawyer or your gestor if patient data is involved.
When this does not matter
If the tool only ever saw things you would happily post on your front door, such as opening hours and a menu, relax. If it is run by a large, established company, the risk of a sudden shutdown and fire sale is far lower, though never zero. This is a question about young vendors holding data that identifies people.
One thing to do this week
Pick the newest AI tool that touches customer or patient data and ask the vendor in writing: "If you close, what happens to my data, and can I get a full export today?" Look for a data processing agreement that says deletion or return at the end of the contract. No agreement, or a vague answer, is itself the answer.
Then do the unglamorous part. Export a copy now, while the company is alive and answering email. A backup you did not need costs an afternoon. One you needed and did not take costs a lot more.
I wrote about the everyday version of this, whether your data trains someone's model while the vendor is healthy, in Is Your Business Data Training Someone Else's AI?. And if the tool was built quickly with AI, Is Your AI-Built App Leaking Customer Data? is the other thing worth asking about.
Sources: MIT Technology Review, 13 Oct 2026; Gizmodo, 17 Apr 2026; GDPR Article 28.