Artificial Intelligence Policy
Last updated: November 2026
This policy is for information only. It is not a contract. The binding terms are in your agreement with Paapi and our Data Processing Agreement (DPA). If this policy conflicts with them, they prevail.
SCOPE
This policy explains how Paapi uses AI, what data it uses, and how we protect that data. It reflects the UK GDPR, the Data Protection Act 2018, the EU GDPR and the EU AI Act.
HOW WE USE AI
Measurement models. We build marketing mix models, multi-touch attribution, budget optimisation and lift-study calibration. They run in Paapi’s own cloud environment. Each client’s models use that client’s data only.
Generative AI features. These use Claude models from Anthropic PBC.
Feature
What it does
AI insights
Summarises what a dashboard shows.
AI Assistant
Answers authorised users’ questions about their own advertising and measurement data.
Audience recommendations
Suggests audiences for you to consider.
Alert email summaries
Adds a short summary to alert emails.
Tracking checks
Checks your ad tracking set-up. Our team uses the results to advise you.
DATA USED BY GENERATIVE AI
The user’s question.
Aggregated performance metrics, such as spend, clicks, conversions and costs.
Names of campaigns, ads, audiences and conversion events, and ad-platform settings.
Search-term reports, which may occasionally contain text typed by members of the public.
These features are designed not to include direct identifiers of individuals, such as names, email addresses, phone numbers or device IDs.
Users must not enter personal data about individuals in questions. As controller, you are responsible for having a lawful basis for the data you provide to Paapi.
OUR AI PROVIDER
Anthropic PBC is our sub-processor for generative AI. It processes data in the United States under its Commercial Terms and Data Processing Addendum. The transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Naming Anthropic does not imply any partnership or endorsement.
Under its terms with Paapi, Anthropic commits not to use client data to train its models. Paapi does not use client data to train generative AI models.
We do not sell client data or use it to build products for other clients.
We will notify you before adding a new AI sub-processor, and you will have 30 days to object.
WHERE DATA IS STORED AND FOR HOW LONG
Paapi hosts its service with Amazon Web Services in the EU (Ireland).
Data
How long we keep it
Dashboard data prepared for AI insights
2 hours
AI insights
24 hours
Audience recommendations
90 days
Tracking check results
90 days
AI Assistant conversations
Not saved to a database. Held in server memory only, and cleared when the service restarts.
AI summaries in alert emails
Not saved to a database after the email is sent.
AI service logs
14 days
At Anthropic
Deleted within 30 days. Up to 2 years if flagged by its safety systems.
After your contract ends
AI-related data deleted within 30 days, unless the law requires longer.
You can request deletion at any time by writing to dpo@paapi.ai.
SECURITY
We protect data used by AI features with measures designed to align with Article 32 of the GDPR. These include least-privilege access, encryption, separation of client data, logging, secure credential management and incident response. Details are in the DPA, and more is available under a non-disclosure agreement on request.
HUMAN OVERSIGHT AND LIMITS OF AI
AI features are read-only. They cannot create, change, pause or delete campaigns, budgets or audiences.
AI output is a suggestion. A person decides and acts.
Our AI features make no decisions with legal or similarly significant effects on individuals (Article 22 GDPR).
In audience recommendations and tracking checks, every figure is checked against source data before it is shown.
AI output may be incomplete or inaccurate. Please review it before acting. Decisions remain your responsibility. Paapi gives no warranty about AI output beyond your agreement.
TRANSPARENCY AND THE EU AI ACT
We are adding clear labels so AI output in the platform and alert emails is marked as AI-generated. The AI Assistant is an AI system, not a person.
Our AI features are not designed for any practice prohibited by Article 5 of the EU AI Act, or for any high-risk use in Annex III. Paapi’s role under the Act: deployer.
YOUR CHOICES AND INDIVIDUALS’ RIGHTS
Remove users from your account at any time.
Request deletion by writing to dpo@paapi.ai.
Ask us to switch generative AI features off for your account.
You are the controller of your data, so individuals should contact you to use their rights. We will help you in line with the DPA. For account data and security logs, Paapi is the controller: contact dpo@paapi.ai, or complain to the Information Commissioner’s Office (ICO).
STAFF USE OF AI
Our staff use only approved AI tools under business terms that prohibit training on Paapi or client data.
GOVERNANCE
Our approach is designed to align with ISO/IEC 42001 and the NIST AI Risk Management Framework. We are not certified under either. Our Data Protection Officer owns AI governance. New AI features get a privacy and risk review before release, and we review this policy at least once a year.
CHANGES AND CONTACT
We will give 30 days’ notice of material changes.
Paapi Limited, 2 Gabriel Drive, Camberley, Surrey, GU15 1DZ, United Kingdom. Data protection contact: dpo@paapi.ai
Start for free, today
Consumers, partners, employees and vendors expect convenient, fast agreement experiences.