Who owns the data and intellectual property in a custom software project?

The client should control its business data and be able to export it completely. Ownership or licensing of custom source, designs, and documentation follows the contract. Personal information is not an ordinary asset that either party may use at will, and third-party material or pre-existing Wavesteam components do not transfer automatically with project delivery.

Data governance and intellectual property answer different questions. Who stores orders, equipment records, and operating data, decides their use, and can export them is a data-control issue. Whether source, interfaces, images, and documents may be copied, modified, or sublicensed is a copyright and contract issue. A single phrase such as “everything belongs 100% to the client” fails when an employee requests access, an open-source component is distributed, or a new supplier takes over.

When agreeing deliverables, handover, and ownership boundaries, also compare Who should own cloud resources, domains, and third-party service accounts?; the linked guidance adds context that should be considered in the same decision.

Define each asset class

Asset	Recommended arrangement	Capability the client needs	Boundary to preserve
Business database and records	Client controls them as business operator, in its account or a portable environment	Query, backup, export, deletion, and audit	Personal-data processing still needs lawful basis and minimum scope
Source, design, and documents created specifically for the project	Contract states assignment or a perpetual licence, including territory, term, modification, and sublicensing	Independent operation, maintenance, and extension	Unwritten rights should not be inferred from a verbal promise
Pre-existing Wavesteam frameworks and reusable components	Wavesteam normally retains rights and grants the agreed project licence	Continued operation and maintenance of the project	No automatic right to sell the component separately
Open source, fonts, images, and commercial SDKs	Original licence or commercial agreement continues	Inventory, version, source, and authorization status	No copying or distribution beyond third-party terms

China's current Copyright Law provides the legal framework for ownership, licensing, and assignment. A commissioned-development contract should identify pre-existing and newly created work, which economic rights transfer, whether reusable non-client-specific methods remain reusable, and whether the client may give source to a new maintenance team. Software copyright registration can support evidence but does not replace the agreement or override third-party rights.

Personal information cannot simply be described as client-owned and freely usable. Under China's Personal Information Protection Law, processing requires a clear, reasonable purpose and minimum necessary scope, while individuals retain statutory rights. The client normally determines business purpose and rules; Wavesteam processes information only within authorization for development, migration, or operations. At exit, collaboration identities are disabled and copies returned or deleted as agreed, with verifiable records.

An actionable rights clause answers five questions: what the deliverables are, when rights transfer, whether the client may modify and engage another team, how pre-existing work is licensed, and who handles infringement or licence incompatibility. Open-source dependencies can use an SPDX-based inventory; purchased media needs its order, licence text, and permitted media retained. Calling a commercial font, map, or payment SDK from source does not transfer the account or content licence.

At acceptance, the client should log into its repository and cloud account, export a database backup, receive editable designs, API documentation, the dependency inventory, and an index to third-party contracts, and confirm that temporary Wavesteam data access has been revoked. The real test is whether the client can migrate, modify, authorize a replacement team, and know which party retains data after exit.

Wavesteam establishes an asset-boundary register at initiation and updates it through milestones rather than debating ownership at launch. Our Transparent Delivery Standard describes the related handover approach.