Andy Garcia · freelance dev
FRENES
Back to the blog
AI & Data

Google Won a $10 Million Auction for Spirit Airlines' Emails and Chats. A Software Vendor Says Some of That Data Belongs to It.

October 19, 2026 7 min read

On October 13, MIT Technology Review published a piece on a market it says took off last year: AI labs buying the code, emails and chat archives of startups that shut down. SimpleClosure, a company that handles startup wind-downs, added data sales in April. Its AssetHub has handled more than 150 deals, and 47 percent of SimpleClosure's deals now include code or data sales. One founder quoted in the piece netted about $25,000 for his crypto startup's code base, with a still-pending amount, likely around $15,000, for its workspace data in Google, Notion, Figma and Slack.

The largest deal in the piece is not a startup. On August 14, Google won Spirit Airlines' bankruptcy auction for its internal data at $10 million, ahead of the AI data company Mercor at $7.5 million. Several headlines say Google bought or paid for the data. It has not, yet. On October 9, Spirit adjourned the court hearing on the sale again, this time to November 6.

As CTO of a LegalTech built on Claude, I sit on both sides of a software contract: my company sells software, and it runs on other people's. So I read the docket summaries rather than the headlines, with one question. When a company dies, whose data is sitting in its inbox?

What is on the table

As scoped at the auction, the package included about 100 million emails across 80,000 accounts, 500 million Teams items, more than 17 million OneDrive items, more than 20 million SharePoint items and about 176,000 employee records going back to 1986, according to the flight attendants' union's objection. Passenger profiles and loyalty program data were never in it.

Ten million dollars for roughly 600 million emails and Teams items, before counting anything else in the package, is about 1.7 cents each. Cheap per unit. Whether it is cheap per result, nobody can say: MIT Technology Review notes that no company has released tests comparing training on real-world archives with the alternatives.

Supply is growing anyway. On September 3, SimpleClosure opened AssetHub to companies "at any stage, including those that are operating, pivoting, winding down or discontinuing a product line," and moved its WorkspaceData product to general availability. Upstarts Media, in a piece with SimpleClosure's CEO the same day, described what fetches top dollar: code with context from Jira, Linear or Figma, or "the full loop of related emails, customer records and support logs."

Customer records and support logs. If you buy software from a startup, part of that loop is you.

The vendor's objection

Most reporting on Spirit focused on employees, and the unions' objections deserve it. But the filings also contain a software story.

Springshot was a Spirit vendor from 2022 until the morning of its final flights on May 2. Its platform pulled operational data together so staff knew which tasks to complete and when. It objected to the sale on August 21. Its Master Software as a Service Agreement with Spirit, dated April 1, 2022, gives it ownership of "any data or information generated by the Service or Software," with Spirit holding "a non-transferable and limited right to use." On paper, a vendor could hardly ask for more.

The auction happened anyway, because Springshot's problem is physical before it is legal. Its data does not sit in a database with its name on it. In a supplemental objection on October 9, it pointed to data shared through email, Teams and SharePoint, data its platform pushed daily to Spirit's own URLs, and Spirit's internal analyses derived from both. It sent sample reports and data payloads so the debtors could find and exclude that material. Springshot's CEO, Doug Kreuzkamp, told the Miami Herald that Spirit's representatives "agreed they have data in their possession that belongs to Springshot." Also: "We're not there yet."

International Aero Engines objected on the strength of confidentiality provisions in its agreements with Spirit, and the Navitaire and Amadeus parties paired their objection with a cross-motion to enforce confidentiality agreements. IAE's filing contains the sentence every vendor should read twice: "Given the liquidation of the Debtors' businesses, IAE would have no meaningful remedy from the Debtors for such breach of the confidentiality provisions."

A confidentiality clause is a promise from a counterparty. When the counterparty becomes an estate selling assets to pay creditors, the promise is worth what your next court filing can get for it.

Then there is the clock. The objection deadline was 4:00 p.m. on August 17, three days after the auction. Springshot filed on August 21.

Who the safeguards are built for

Google says it will not receive any personal information and that a third party will scrub the data before transfer. On October 5, the consumer privacy ombudsman in the case, Lucy Thomson, recommended approval, after the parties removed the passenger transaction systems from the deal and engaged Tonic.ai as an independent deidentification agent, which must file an affidavit with the court before each transfer.

Read what that machinery measures. The sale agreement defines deidentification by whether data can be linked to "a particular consumer," and requires the work to be done "while preserving referential integrity across the data set." The ombudsman's mandate covers consumers, and she expressly did not investigate risks to employees or third parties. The flight attendants' union put it in one line: "The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing." For a vendor, it is not facing anything.

In a revised proposal sent on August 31, Spirit agreed to exclude several of the most sensitive employee categories, including health, disability, and drug and alcohol testing data. On October 8, 121 members of Congress wrote to the CEOs of Google and Spirit that "removing names, email addresses, or other direct identifiers does not necessarily make a dataset anonymous."

From Europe, that sentence reads like Recital 26 of the GDPR, which judges identifiability against "all the means reasonably likely to be used," taking into account "technological developments." A dataset delivered with its referential integrity intact is not one I would call anonymous without a lawyer's written opinion.

A price on who holds the scrubber

One detail from the auction shows that process can outweigh money. In the first round, Mercor offered $5.2 million under Google's terms, or $7 million if it could deidentify the data with its own tools. Spirit decided that $5.2 million "was the highest bid for that round despite the lower price." Mercor also offered $10 million with in-house deidentification. Spirit designated its $7.5 million bid as the backup instead, and the declaration supporting the auction results says non-economic factors such as a documented deidentification process "may be outcome-determinative."

Mercor's first-round bids put a price on doing the scrubbing itself: $1.8 million. Its $10 million in-house offer sat $2.5 million above the $7.5 million bid Spirit kept as the backup. On September 3, a third company, micro1, filed notice of a $12.5 million competing bid, also with in-house deidentification. The ombudsman has asked for further review if the court considers it.

In a court-supervised sale, who does the scrubbing is part of the price.

What I would check

As a vendor whose outputs live in customers' systems:

  1. The ownership clause, plus an explicit line that data generated by the service and confidential material we share are excluded from any sale of the customer's assets, insolvency included, and must be returned or deleted. Springshot's objection cites the first half. A clause gives you something to argue in court. It does not stop an auction.
  2. Outputs a search can find. If a liquidator cannot tell your exports from the customer's own spreadsheets, neither can a deidentification agent.
  3. Fewer confidential details in chat. What you paste into a customer's Teams becomes their archive.
  4. Customers' bankruptcy dockets. Deadlines are counted in days.

As a buyer of startup software:

  1. The processor clause. Article 28(3)(g) of the GDPR requires a processor, at the controller's choice, to delete or return all the personal data after the end of the services. The day a vendor announces a wind-down, I would ask for it in writing, with a certificate.
  2. The shared channels. Your support tickets and your messages in a vendor's Slack live in the vendor's workspace, which is now a sellable asset.

In LegalTech, the confidentiality of client documents is the product. The Spirit file made me think less about databases and more about everything around them: the threads, the tickets, the chat messages where a client's name and a sentence from their file end up by accident.

On October 1, I wrote about SimpleClosure's report on the first half of 2026, where SaaS was the largest category of shutdowns it processed. That report counted endings. This market prices them, your messages included.

A dead company's inbox is now a lot at auction. Make sure the parts that belong to you carry your name before the auctioneer arrives.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk