Customer Data Ownership and License

What it is

Your data remains yours. Amplitude can only use the data you send it to provide the services you have paid for, not for any other purpose.

Why it matters (compliance & governance perspective)

This clause protects businesses by confirming that Amplitude does not acquire ownership of or broad rights over the customer behavioral and product usage data sent to the platform, limiting Amplitude's license strictly to service delivery.

Consumer impact (what this means for users)

Businesses retain ownership of all data they upload or send to Amplitude, and Amplitude's license to use that data is limited to providing the contracted services. This is a meaningful protection against broader commercial use of your customers' behavioral data by Amplitude.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision is directly relevant to GDPR's controller/processor framework, confirming that Customer acts as data controller and Amplitude as data processor for Customer Data. Under CCPA and CPRA, this framing supports the characterization of Amplitude as a service provider rather than a third party for purposes of Customer Data, which has significant implications for the Customer's own privacy disclosures. The relevant enforcement authorities are EU supervisory authorities under GDPR and the California Privacy Protection Agency under CPRA. (2) GOVERNANCE EXPOSURE: Low for the Customer Data license itself, as the restriction to service delivery purposes is a standard and protective term. The governance exposure arises from ensuring this characterization is consistently applied in the DPA and that Amplitude's contractual obligations as processor are fully documented in that separate agreement. (3) JURISDICTION FLAGS: EU/EEA customers should confirm that the DPA incorporates the Standard Contractual Clauses or other lawful transfer mechanism where Customer Data is processed outside the EEA. The characterization of Amplitude as a service provider (not a third party) under CPRA depends on the DPA including appropriate restrictions on Amplitude's use of Customer Data for its own purposes, which the ToS supports but the DPA must implement. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that the DPA's processor obligations align with this ToS provision and that Amplitude's sub-processor list is disclosed and manageable. The non-exclusive, royalty-free license is appropriate and standard; the key due diligence item is ensuring the DPA's deletion and return of data provisions are adequate upon termination. (5) COMPLIANCE CONSIDERATIONS: Data mapping exercises should record Amplitude as a data processor for Customer Data, with the Customer as controller. Privacy notices to end users should accurately reflect the sharing of behavioral data with Amplitude as a service provider. Compliance teams should confirm the DPA includes obligations regarding sub-processor changes, audit rights, and breach notification timelines.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Operational Data Use medium
• Limitation of Liability medium
• Service Suspension and Termination medium
• Mutual Indemnification medium
• Acceptable Use and Restrictions medium
• DPA Incorporation by Reference medium

Related Analysis

• Robinhood's Agreement Authorizes Position Liquidation Without Prior Notice

  Buried in Robinhood's customer agreement is broad authority to close your positions, suspend your account, and force arbitration. Here is what it actually says.

• Stripe's Reserve and Hold Authority: What the Terms Authorize

  Stripe's terms authorize fund reserves, payout withholding, and account termination. Here is what the agreement states and what business owners should review.