AI Use Policy

Conversations that pass through EyesInAI are never used to train or fine-tune an AI model — not ours, and not anyone else's. There is no code path that exports conversation content into a training set, because we have never built one.

What we do measure from a conversation is its shape: which model answered, what it cost, how long it took, what category of question it was, and how the answer scored. That measurement is what lets us move work to a cheaper model without making answers worse. It carries no personal data, which is why it survives the 30-day deletion that erases the words themselves.

We select model providers on terms that do not permit training on data submitted through their APIs. Each provider operates under its own agreement, and the full list is published in Subprocessors.

Assistants we host identify themselves as AI assistants. We do not build assistants that impersonate a named human being, and we do not permit clients to configure one that claims to be a person. This is both our own rule and a transparency requirement under the EU AI Act for systems that interact directly with people.

A single question may be answered by any one of a number of models. The choice is made automatically, based on what the question needs and what each model has been measured to do well, and it changes over time as models improve or get cheaper.

The rule that governs this is that cheaper is never allowed to mean worse. A candidate model is tested against real traffic in the background before it serves anyone, and if it scores below the model currently in use, it is held back automatically. There is no setting that trades accuracy for cost.

Assistants answer from a defined body of material — a client's website, documents, and data they have given us — rather than from the model's general knowledge. When a question cannot be answered from that material, the assistant is designed to say so rather than to guess.

Questions about live data such as prices, availability, or opening hours are answered by looking the value up directly and rendering it, not by asking a model to recall it. A lookup cannot hallucinate.

AI output can be wrong, and it should not be the only basis for a consequential decision. We build to reduce error and we measure it continuously, but we do not claim it is eliminated.

Clients configure their own assistants, and some uses are prohibited regardless of what the technology could do. The full list is in the Acceptable Use Policy; the AI-specific ones are that an assistant must not be configured to impersonate a real person, to make automated decisions of legal or similarly significant effect without human review, to infer sensitive characteristics about people, to perform biometric identification or emotion inference, or to generate deceptive content presented as human-authored.

Where an assistant is involved in a decision that significantly affects someone, a person must remain in the loop — that is the client's obligation as the operator, and ours as the provider is to make it possible. If you have been affected by such a decision, you have the right to ask for human review and to contest the outcome. Under EU and UK data protection law and Thailand's PDPA this right applies directly.

Contact the business whose assistant you were using, since they decide how their assistant is used. If you cannot reach them, write to [email protected] and we will route it.

Incoming messages are screened for attempts to manipulate an assistant into ignoring its instructions, and outgoing responses are scanned for content that should not leave — including one client's configuration surfacing in another's conversation. Every deployment also has a spending limit, so neither a loop nor an abusive visitor can generate unbounded cost. The technical detail is in the Security Policy.

If an assistant gave an answer that was wrong, offensive, or harmful, tell us at [email protected]. We would rather hear about it than not — a reported failure is how the measurement improves. This is a quality channel, not a security one; security flaws go to the Vulnerability Disclosure Policy.