AI Disclosure

What our AI features do

AI assists with drafting assessment reports, follow-up plans, metric and portfolio insights, application cohort summaries and similar decision-support content. AI output is a starting point for an authorized human reviewer — it is never an automated final decision.

What data is used

Generation uses programme data you have entered for the relevant startup or cohort: for example startup name, sector, stage, business model, assessment and dimension scores, follow-up status and metrics. The data used is scoped to the organization and the specific item being worked on.

What data is minimized or redacted

Before any prompt reaches an AI provider, a no-bypass sanitizer redacts obvious personal data and replaces it with neutral placeholders:

• email addresses → [EMAIL]
• phone numbers → [PHONE]
• LinkedIn and social profile links → [LINKEDIN] / [SOCIAL_PROFILE]
• other URLs → [URL]
• obvious physical addresses → [ADDRESS]
• explicitly-flagged personal names → [PERSONAL_NAME]

Personal fields (such as founder contact details) are removed or redacted by default, and confidential fields are sanitized.

How Safe AI, Full AI and No AI work

• Safe AI (default) — personal data is removed or redacted and confidential data is sanitized before generation.
• Full AI — richest context, intended for organizations that explicitly authorize AI processing of personal context; the regex PII sanitizer still runs as a last safety net.
• No AI — AI generation is disabled; ProgramLoop uses deterministic, non-AI fallbacks and sends no data to an AI provider.

The policy is set per organization by an owner or admin in Settings → Organization → AI Policy.

What audit metadata is stored

For accountability and cost governance, each AI request is logged with metadata only: the feature, the AI provider and model, request status, token counts, duration, the applied policy mode, a count of redactions, and a timestamp — scoped to the organization.

What is not stored

Audit logs do not contain raw prompts, raw AI completions, or the personal-data values that were redacted. Only counts and metadata are kept.

Your responsibility

Please do not submit unnecessary personal or sensitive data. Use the organization AI policy and data-minimization practices that fit your context, and review AI output before relying on it.