Your contacts never reach the model

No stored contact value is put into a prompt for an AI model, or into the output of a tool that an AI assistant reads. The AI features work on aggregates (counts, rates, statuses), identifiers, and the content you write yourself: briefs, templates, your brand kit.

This holds for Spark (the in-app assistant), the campaign strategist and weekly proposals, the AI segment builder, the Design Assistant, AI landing pages, copy and subject-line generation, and for AI assistants you connect to your workspace over MCP (Claude, ChatGPT and others).

One feature works per contact: AI personalisation in automations rewrites an AI text block for groups of contacts who share the same coarse traits — engagement tier, language, country, time zone, purchase-count and recency buckets, list and segment names, the option a contact has in a non-sensitive dropdown or yes/no field, and short trigger values the operator allows. It never sends who they are: no email address, name, phone number, postal address, company, free-text or sensitive field reaches the model, and the first name is filled in by the template after the text is written.

• Aggregate-only tools. Every tool Spark or an MCP client can call is written to select counts, statuses and IDs, never contact rows. A message-log entry names the recipient's domain, not the address.
• A PII firewall on every tool result. Before any tool result reaches a model, it passes a redaction layer that masks email addresses, phone numbers and personal fields such as names, addresses and company. It is deliberately lossy: when in doubt, it hides.
• Text rendered for a person is scrubbed or never shown. A template preview a model reads is rendered for a stand-in contact, never a real one, and a sent subject line is scrubbed of the recipient's own stored values before a model sees it.
• What you type is masked too. Email addresses and phone numbers typed into Spark or the AI segment builder are masked before the model sees them.
• Tools that take an address never return it. The few MCP tools that act on a contact you name (add to a list, record an event) look the address up and answer with an ID. Spark has no such tool: its model never sees an address.
• Tested. An automated test runs representative tool outputs and prompt builders against seeded contact data and fails the build if any personal value appears.

Any custom contact field can be marked sensitive. A sensitive field still renders in your emails and works in segments, but its options and description are withheld from every AI tool output, and any segment or automation rule value that uses it is shown to a model as a placeholder.

InstantCampaign uses two AI providers, chosen per capability (text, images) by our platform operators: Google's Gemini API, and Amazon Bedrock (Anthropic Claude, Amazon Nova and Stability models). The choice is binding: a call to the selected provider that fails returns an error rather than being sent to the other provider, unless the platform operator has explicitly allowed fallback.

The platform can enforce a residency mode: UK (inference only in London), EU (only EU regions) or UK + EU. Under an enforced mode, a model hosted outside the boundary is refused, and so is any fallback to Gemini's global API. Gemini itself is a global API. Bedrock image models (Stability) run in the US. Your workspace shows which models are in use, and whether a residency mode is on, under Settings → Privacy → AI & data.

What the providers' own terms say, as of the date above:

• Google Gemini API. For paid services, Google states it does not use prompts or responses to improve its products, and logs them for a limited period only to detect policy violations (Gemini API Additional Terms of Service, “Paid Services”). The unpaid tier is different: Google may use that content to improve its products.
• Amazon Bedrock. AWS states that inputs and outputs are not used to train AWS or third-party models and are not shared with model providers (Amazon Bedrock FAQs, Data protection). Some models retain traffic for up to 30 days for abuse detection inside AWS (Abuse detection).
• Pollinations. A third-party image service used only if a platform operator turns on provider fallback. It is off by default, and it only ever receives image prompts.

Under any of these, what is sent is the content described in section 1 — never your contacts.

Your workspace keeps a history of AI generations (the prompt you wrote and what came back) so you can find and reuse them. It is kept for as long as the workspace exists and is deleted with it. Spark conversations are not stored on our servers; they live in your browser tab.

Calls from MCP assistants are recorded for 90 days in your workspace's API request log, which only people who manage API keys can open. That log is never shown to a model.

• Which custom fields are sensitive (Contacts → Custom fields).
• Which AI assistants are connected over MCP, and revoking them (Settings → Connected apps).
• What the AI can see of contacts is fixed at aggregates only. There is no setting that widens it.

• Content you write — a brief, a template, your brand voice — is sent to the model as written. If you type a customer's name into a brief, the model sees it.
• Raw contact data stays available through the REST API to integrations you authorise with an API key. That surface is for your systems, not for models.
• An MCP assistant you connect runs on its own provider. It receives only the aggregate-only tool outputs described here, but what it does with your own messages is governed by that provider's terms.

Questions: see our privacy policy or the AI data privacy guide.