Who owns the code and data when an AI platform builds your business?

What does "you own your code" usually mean in practice?

That the vendor is not claiming copyright in what was generated for you. It does not necessarily mean the code is in your accounts, that you can run it elsewhere, or that you have a copy right now. Ownership and possession are different things, and only one of them helps in a hurry.

A concrete example from published terms: Polsia states that you retain ownership of the source code and data within provisioned cloud resources, and also that those resources are provisioned under Polsia-managed accounts unless you connect your own provider credentials. Both statements are true at once. You own something that lives somewhere you do not control.

That is not unusual or improper — it is how most managed platforms work. It just means the ownership clause answers a narrower question than founders think it does.

Does your data train the vendor’s models?

Frequently yes, and it is usually stated plainly in the terms. Polsia’s terms, for example, license your inputs for use in training and improving their models and workflows. Whether that matters depends on your business, but you should know it rather than discover it.

For most small businesses this is genuinely fine. For a business whose data is the product, or one operating under confidentiality obligations to its own customers, it is a real constraint and worth checking before rather than after.

The related question is what your own customers were told. If you are processing personal data, your obligations to those people do not change because a platform is doing the processing for you.

What should you do about it?

Take a copy now, while nothing is wrong. Export the code and the data, confirm you can actually run or read them outside the platform, and repeat it on a schedule. A backup you have never restored is a plan, not a backup.

Three clauses to find in any platform agreement:

• Where it lives. Whose cloud accounts, whose repositories, whose ad accounts.
• What happens on termination. Polsia’s terms give 30 days of continued access and export before resources may be permanently deleted.
• What license you granted. Specifically whether inputs are used for training.

None of these are unusual terms. They are just the ones that determine what you actually have.

What about your customers data specifically?

That is not only an ownership question. If you hold personal data, you have obligations to those people that do not transfer to a platform because the platform does the processing. You need to know where the data sits, who can access it, and what you told your customers.

Most platform agreements in this category are explicit that the customer is the controller of their own end-user data and the platform is a processor acting on instruction. That allocation is normal, and it means the compliance work is yours: the privacy notice, the lawful basis, the deletion requests.

Two things to check specifically. Whether your inputs are used to train the vendor’s models, which several platforms state plainly in their terms. And whether any part of your business is publicly visible by default — some platforms enable public dashboards showing business activity unless you turn them off.

None of this is an argument against using a platform. It is an argument for reading the two or three clauses that determine what you have actually agreed to on your customers’ behalf.

Where newc0 stands, including what is not settled

newc0 builds an application the founder owns: the data model, the customer records, the workflows and the code. That is recorded on the claim sheet.

What is not published yet is the handover mechanic — what specifically happens to a founder’s application if they stop paying, and how they take it with them. Rather than imply a better answer than has been confirmed, this site says so plainly, including in the comparison with Polsia, where that row sits blank on newc0’s side.