What happens to your AI chats if the company is sold: 12 privacy policies read

The Morse teamPublished November 10, 202610 min read

If an AI company is sold, your chats can usually go to the buyer along with the rest of its assets. As of November 10, 2026, ten of the 12 AI apps we checked have a privacy policy that lets the company pass your personal data, including what you type into the chatbot, to a new owner in a merger, acquisition, or bankruptcy. None of the 12 promises that the new owner will keep the privacy policy you signed up under, and only Google promises outright to tell you before your information moves.

We read the business-transfer clause in each app's consumer privacy policy on November 10, 2026, checked what each policy says it collects from your conversations, and noted each policy's date. For what happens when a sale is real, we went to the record: the FTC's letters, 23andMe's announcements of the court-approved sale, the state attorneys general who sued to stop it, Character.AI's Chapter 11 notice, and Limitless's own page on its sale to Meta. Most of these clauses are boilerplate, but Google, Perplexity, and Proton each go further than the rest in one respect. This isn't legal advice.

Can an AI company sell my chats to a buyer?

Yes, in most cases, and the permission is written into the privacy policy you accepted. OpenAI says that in a "Transaction," which includes bankruptcy and receivership, your Personal Data may be "transferred to a successor or affiliate as part of that Transaction along with other assets," and its policy counts "your prompts and other content you upload" as Personal Data (OpenAI). Anthropic says that in "a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets," it "will receive or disclose your personal data" (Anthropic). Replika's policy lists "Messages and content," which it defines as "the messages you send and receive through the Apps," among the data it uses for "transfers of assets, branch of business, acquisitions, mergers" (Replika).

Under these clauses, your data moves with the business to whoever takes it over. How that differs from "selling" your data under California law is covered in does ChatGPT sell your data.

What 12 AI apps' privacy policies say about a sale, as of November 10, 2026

"Chats included" means the clause covers a category of data that the same policy says includes your prompts or conversations.

For comparison, Morse's own privacy policy says that if we're involved in a merger, acquisition, or sale of assets, "This policy, or one at least as protective, would continue to apply to your data," a promise none of the 12 policies above makes.

Google is ahead of the others in one place. It is the only company of the 12 that promises to "give affected users notice before personal information is transferred or becomes subject to a different privacy policy" (Google). The same sentence admits a buyer's policy may differ from Google's.

Perplexity earns partial credit too. Its notice says that after a material change, "the Notice that was in place when you submitted personal data to us will generally govern that data unless you consent to the new Notice" (Perplexity). That protects you from Perplexity rewriting its own notice, but it doesn't say a buyer is bound.

Mistral's privacy policy, effective September 3, 2026, names no merger or sale at all, and lists only team members, financial institutions, regulators, professional advisers, and service providers as parties it shares with (Mistral). Its consumer terms still let it pass the contract to a "successor in interest of any business associated with our Mistral AI Products" (Mistral). Proton has the strongest structural answer. Proton AG's "primary shareholder is the non-profit Proton Foundation" (Proton), and Lumo's policy says chats you save are encrypted so that "we as a provider are not able to decrypt it anymore" (Proton).

Grok's own policy now carries a different company name: as of its October 27, 2026 update, it is titled "SpaceXSI Privacy Policy" and names "SpaceX Super Intelligence LLC" as the company behind it (xAI).

Does the buyer have to keep the old privacy policy?

None of the 12 policies says so, but the FTC says a buyer can't drop the promises. In 2014, as Facebook was buying WhatsApp, the director of the FTC's consumer protection bureau wrote to both companies that "regardless of the acquisition, WhatsApp must continue to honor these promises to consumers," and that before any material change to how they used data already collected, "the companies must get affirmative consent" (FTC). In February 2024, FTC staff wrote that a business "cannot then unilaterally renege" on the commitments it collected data under (FTC). We cover that warning, and how much notice each app gives of a change, in AI privacy policy changes.

The FTC holds a buyer to what the policy promised, and most AI policies promise only that your data "may be disclosed" in a deal. 23andMe's privacy statement promised more: "this Privacy Statement will apply to your Personal Information as transferred to the new entity." FTC Chairman Andrew Ferguson quoted that sentence in a March 31, 2025 letter to the US Trustee in 23andMe's bankruptcy, and wrote that any purchaser "should expressly agree to be bound by and adhere to the terms of 23andMe's privacy policies and applicable law" (FTC).

Will you be told before your chats change hands?

Only Gemini users have a clear promise. Grok's policy comes next: "If required by applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third-party" (xAI). The other companies promise notice of policy changes in general. Microsoft, for example, gives "prominent notice" before a material change takes effect (Microsoft), and Anthropic will notify you of material changes "as appropriate" (Anthropic). Apart from Google and xAI, no policy we read ties a notice to a sale, and none of the 12 gives you a set window to delete your data before a transfer.

That window is what 40 state attorneys general asked for in Character.AI's bankruptcy. Their October 14, 2026 notice lists "allowing all consumers the opportunity to delete their data prior to any sale of that data" among the conditions for any buyer (states' notice). The states filed it as a notice and "reserved their rights to challenge any proposed sale or bankruptcy plan" (Massachusetts Attorney General).

What happens to your chats if an AI company goes bankrupt?

A bankruptcy court approves the sale, and the privacy policy sets its terms. Section 363(b)(1) of the Bankruptcy Code adds a privacy check, a sale "consistent with such policy" or a consumer privacy ombudsman, only where the company promised not to transfer personal data to unaffiliated companies, and none of the ten policies above that allow a transfer makes that promise (11 U.S.C. § 363).

Character.AI is in this position now. Character Technologies started a Chapter 11 case on October 12, 2026 "to facilitate a court-supervised sale of the company," and expects the sale to be complete "by the end of November or perhaps early December 2026" (Character.AI). Its privacy policy allows it to disclose "certain information" in a "sale of company assets" (Character.AI).

What happened to 23andMe customers' data?

It went to the buyer with the company. A court approved the sale of 23andMe to TTAM Research Institute, a nonprofit, for $305 million (23andMe); our page on AI and your DNA results covers the sale and what 23andMe's privacy statement allows today. Before the approval, Oklahoma and 27 other states sued, arguing that DNA data and medical records are "too sensitive to be sold without each person's express, informed consent" (Oklahoma Attorney General). When the court approved the sale, 23andMe said "All customers will be emailed in advance of the transaction closing with a notice of the sale," and that TTAM "is committed to adhering to 23andMe's existing privacy policies in perpetuity" (23andMe, June 30, 2025).

Should you delete your AI chats before a sale?

If you don't want a buyer to have them, yes, and before the deal closes. None of these clauses comes with an opt-out, so deleting is the control you have. Mistral, for example, keeps your inputs and outputs "until you delete your account or until you delete the conversation" (Mistral). Export anything you want to keep first; how to download your AI chat data has the steps app by app. Deadlines can be short: after Meta acquired Limitless, the AI pendant maker gave users in the regions it pulled out of until December 19, 2025 to download their data before their accounts were deleted (Limitless).

Deleting an account doesn't always erase everything. Replika keeps billing records, including your email address and plan, "for 10 years from the end of the year in which the transaction took place, because tax and accounting laws require it" (Replika).

How to keep your AI chats out of the next sale

A buyer gets what the seller holds, and every clause in the table reaches data that sits on the company's servers, tied to your account. Morse keeps your chat history in your browser, encrypted, instead of on our servers. Our servers don't keep your messages or log what you write, and your account holds data such as your sign-in details, plan, balance, and a usage ledger with no content.

Our privacy policy plans for a sale. It lists "a buyer or successor, if we're involved in a merger, acquisition, or sale of assets" among those we'd share data with, and adds: "This policy, or one at least as protective, would continue to apply to your data." What a buyer could receive is the account data section 2 of our privacy policy lists, none of it your chats, and it would stay under this policy or one at least as protective. Your chat history sits in your browser, not in that account. You don't need advance notice to delete in time: deleting a chat removes it from your device, and Morse holds no other copy. And if a court ever weighs in, because we don't store chats, we usually have very little to give.

Each chat runs in a privacy mode you choose:

• Private, so the hosts that run the model keep nothing to pass on either. It's the default for a new chat. Morse has zero data retention agreements with its inference, search, and other providers, and where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for chats no one but you should read. E2EE runs open-weight models, without web search or image generation. Before a message leaves your device, your browser verifies the secure enclave's hardware attestation and encrypts the text for that enclave alone. Morse's servers pass along ciphertext they can't read. Third-party providers, not Morse, operate the enclaves, and this guarantee depends on the enclave hardware and attestation working as designed.
• Anonymous, to use GPT, Claude, and Gemini with no account of yours on the provider's books. Morse's proxy removes your account, email, and IP address and sends the message under Morse's own account, so the provider reads what you wrote without knowing it's you. The provider may hold the message for a limited time to check for abuse, under its own policy.

Whichever mode you pick, Morse doesn't use your chats to train AI, doesn't sell your data, and runs no ads. A stolen or copied browser database isn't enough to read your history, because unlocking it needs a key that stays on your device plus a second key our server issues when you sign in. Morse holds no copy of your history, so clearing your browser or deleting your account removes your chats beyond our reach to restore; copy out anything you want to keep. Our privacy policy lists what the account holds.

Try a chat from the Morse home page without an account, or start free with no card needed. End-to-end encrypted chats come with Pro, at $19 a month.