AI Policy

We use AI where it makes a product genuinely better and we can explain what it is doing. We do not use it to make decisions about people without a person involved, and we do not treat customer data as training material.

We do not use customer content to train, fine-tune or improve any AI model — ours or a third party’s. Where a feature sends content to an AI provider to produce a result for you, we use that provider’s zero-retention arrangement where one is available, and we say so in the product.

Any AI provider we send personal data to appears in our subprocessor list, with the transfer safeguard covering it, like any other processor.

We do not make decisions that produce legal effects for you, or that similarly significantly affect you, by automated means alone. The Personal Data Privacy Protection Law does not spell this out the way some other regimes do, so we state it as a commitment you can hold us to rather than as a restatement of the statute.

Where AI contributes to a decision that affects you — such as flagging content for review — a person makes the final call. If you believe an automated system has affected you unfairly, ask for a review through our data rights centre and a person will look at it.

AI output can be wrong, and can be wrong confidently. Where a product presents AI-generated content, we label it. You should check anything you rely on, and you remain responsible for what you do with the output.

We assess a feature’s data protection impact before it ships where it processes personal data at any scale, keep a record of which models are used for what, and review that record as models change. We prefer providers who will contract to the standard the Personal Data Privacy Protection Law requires of us and who will tell us where processing happens.