AI Policy

We use AI where it makes a product genuinely better and we can explain what it is doing. We do not use it to make decisions about people without a person involved, and we do not treat customer data as training material.

We do not use customer content to train, fine-tune or improve any AI model — ours or a third party’s. Where a feature sends content to an AI provider to produce a result for you, we use that provider’s zero-retention arrangement where one is available, and we say so in the product.

Any AI provider we send personal data to appears in our subprocessor list, with the transfer safeguard covering it, like any other processor.

Article 22 of the UK GDPR gives you the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not make decisions of that kind by automated means alone.

Where AI contributes to a decision that affects you — such as flagging content for review — a person makes the final call. If you believe an automated system has affected you unfairly, ask for a review through our data rights centre and a person will look at it.

AI output can be wrong, and can be wrong confidently. Where a product presents AI-generated content, we label it. You should check anything you rely on, and you remain responsible for what you do with the output.

We assess a feature’s data protection impact before it ships where it processes personal data at any scale, keep a record of which models are used for what, and review that record as models change. We prefer providers who contract on UK GDPR terms and who will tell us where processing happens.