AI Policy & Transparency Notice
AI-assisted security classification (risk score 0-100, category, confidence, explanation, evidence, recommended action; decision levels Allow/Monitor/Warn/Recommend Action/Critical Alert), AI phishing assessment (confidence, redirect-chain, verdict Safe/Suspicious/Dangerous), and any future generative/interactive AI. Website performs no AI processing today.
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Where AI is used and what it produces
Security classification: weighted risk scoring with severity ceilings, per-category breakdown, top risk drivers, severity counts and remediation prioritisation; AI adds category, confidence, plain-language explanation, evidence summary and recommended action. Phishing: multi-engine verdict (VirusTotal malicious count, Safe Browsing flags, AI assessment) + risk score 0-100 + threat category + engine/duration transparency + safety guidance. Autopilot reacts to security events (accessibility/cert/VPN/permission/install/network changes) with audit records (score, explanation, action, policy version, provenance). On-device deterministic fallback applies offline.
No AI feature makes solely automated decisions with legal/similarly significant effects (GDPR Art.22) today. High-impact ADM would require a decision registry + specific legal review before launch.
2. Data sent to AI providers (privacy-constrained payload)
Sent: risk features only (permission combinations, posture flags, hash/URL for reputation lookup, redirect-chain URLs you submit). Never sent: raw personal content, passwords, tokens, precise location, vault plaintext, biometric templates, clipboard contents, message bodies, photos. Full prompts are never logged unless needed and disclosed.
- Providers/models: [PLACEHOLDER — none integrated — list once integrated with version + endpoint region]
- Purposes: classification + phishing assessment only; no cross-purpose reuse without renewed notice.
- Retention at provider: [PLACEHOLDER — e.g. zero-retention / 30-day abuse-monitoring window — confirm contract]
- Training/evaluation: we do not use your data to train models unless the contract + renewed notice say so; evaluation uses de-identified aggregates only.
- Abuse monitoring: [PLACEHOLDER — window + process]
- Human review: [PLACEHOLDER — sampling + escalation]
- International transfers: per Privacy Policy Section 15 (adequacy/SCCs/certification/contract + assessment). China generative-AI/algorithm-filing, Korea AI Basic Act: LEGAL REVIEW REQUIRED before launch.
3. Transparency, disclosure and labelling (EU AI Act Art.50)
Art.50 applies from 2 Aug 2026 (grace to 2 Dec 2026 for Art.50(2) marking of pre-existing generative systems; Regulation 2026/1744 defers high-risk Annex III to 2 Dec 2027, Annex I to 2 Aug 2028 — transparency is not deferred). Providers must design interactive systems to disclose AI nature + responsible identity (Art.50(1)); mark synthetic audio/image/video/text machine-readably (Art.50(2)); deployers must disclose emotion/biometric categorisation (Art.50(3)) and label deepfakes + public-interest text without human review (Art.50(4)). Fines to €15M / 3% turnover. We implement: in-app 'AI-assisted' disclosure, explanation + confidence + evidence with every verdict, machine-readable marking for generative outputs, and deployer labels for deepfake/text notices. Commission Guidelines (20 Jul 2026) + Code of Practice (Jun 2026) followed.
4. Limits, accuracy and bias (no unsubstantiated claims)
AI output can be wrong, incomplete or biased. We claim no accuracy percentages, no 'unbiased', no '100% detection', no 'zero risk' unless evidenced in claims-registry.json with metric/sample/period/limitations. Output is decision support; you decide (guided remediation requires your confirmation for destructive actions). Do not use verdicts for employment, credit, housing, insurance, education or legal decisions without human review + legal basis.
5. Your controls, deletion and portability
AI processing where consent is the basis can be withdrawn (privacy-center → withdraw AI processing); where contract/legitimate-interest applies you may object. Prompts/outputs are exportable (JSON) and deletable per Privacy Policy Sections 17-18; provider deletion propagates via the deletion job (deletion_targets). Retention: [PLACEHOLDER — e.g. prompts 30 days, outputs per retention-matrix — confirm].
6. Acceptable use for AI features
Do not use AI to surveil non-consenting third parties, generate phishing, evade detection, or infer sensitive attributes about others. Abuse is logged (redacted) and may lead to suspension per the Acceptable Use Policy.
7. Version
Version 0.9.0-draft, last updated 2026-10-02, next review 2026-12-01, LEGAL REVIEW REQUIRED (high-risk classification + provider contracts + China/Korea AI duties). No AI provider is integrated today; this notice is forward-looking for the mobile product.
Sources
This document is derived from the following entries in our legal source registry: EU-AI-ACT, US-FTC-ACT, KR-PIPA, CN-PIPL, SG-PDPA. See for the full citations and the date each source was last verified.