AI Use and Data Policy

What this policy covers

This policy covers two uses of AI at Arcesso LLC. The first is AI inside the products we build for clients, such as AI agents, chatbots, voice receptionists and document assistants. The second is AI tools our own engineers use while writing and reviewing code.

For both, the same principle applies: client data reaches an AI provider only when a project needs it, only under settings that exclude training, and only with the client's knowledge. The data flows for each project are written into its scope document, so you can see them before work starts.

Your signed contract and any data processing agreement take priority over this page if they set stricter rules. This policy describes our practices in plain English and is not legal advice. Our general Privacy Policy, for website visitors, is at /legal/privacy/.

Which model providers receive which data

Arcesso sends client data to a model provider only when that provider is configured for the project, and we list each one in the scope document. We use business and API products, not consumer chat apps, for client data.

No training on client data, and how long providers keep it

Arcesso never allows client data to be used to train a provider's models. We use API and business tiers whose terms exclude training on customer data by default, and we check that setting on every account we configure. Where a provider offers an opt-in to share data for training, we leave it off.

Each provider's terms set how long it keeps API inputs and outputs for abuse monitoring, which is usually a limited window. We record that window for each provider in the project's scope document. Where a provider offers zero data retention and the project qualifies, we request it.

Model API keys and billing sit in your own provider accounts where possible, so you control the settings directly and can see usage. Logs our systems keep, such as agent traces for debugging, stay in your cloud and follow the retention period agreed in scoping.

Masking personal data before model calls

Arcesso masks or removes personal data before it reaches a model, wherever the task can be done without it. A support agent that drafts replies does not need a customer's card number, and a document classifier rarely needs a full name.

• Names, emails, phone numbers, addresses and account numbers are replaced with placeholders before the model call, and restored after, where the workflow allows.
• Payment card data is never sent to a model. Card handling stays with a payment processor such as Stripe.
• Eval test sets use redacted or synthetic records, not raw customer data.
• Agents get only the tools and data access their task needs.
• Where a task truly needs personal data, such as booking an appointment, the scope document names the fields and the provider.

Human in the loop and evals on every agent

Every AI agent Arcesso ships has a human approval step for actions that carry real risk, and an eval that measures quality before launch. A person confirms anything that moves money, changes a customer record in a way that cannot be undone, sends a message on your behalf outside agreed templates, or touches a regulated decision.

The eval is a written set of test cases with a pass threshold agreed with you. It checks accuracy, refusals, made-up facts and data leaks, and it reruns whenever prompts, models or tools change. Results are a deliverable in each sprint and stay in your repository.

After launch, monitoring logs agent actions so your team can review what happened and why. If quality drops below the agreed threshold, the agent falls back to a person until it is fixed.

How Arcesso engineers use AI coding tools

Arcesso engineers use AI coding tools for drafts, tests and reviews. A named engineer owns every line that ships, you get the IP, and our rates do not change because of it.

In practice, AI coding assistants help with boilerplate, test cases, refactoring suggestions and documentation drafts. Every change still goes through a pull request that a human engineer reads, runs and approves. The engineer who approves a change is accountable for it, just as if they had typed every character.

Only AI coding tools with business terms that exclude training on our inputs are allowed on client code. Secrets, credentials and production customer data are never pasted into these tools. Code produced with AI help is assigned to you on the same terms as all other code we write.

Your choices: opting out and setting limits

Arcesso clients decide how AI is used on their project, and opting out does not change our rates. Tell us your preferences during scoping, or at any point during the build, and we will record them in the scope document.

• No AI coding tools on your codebase: our engineers work without them.
• Approved providers only: pick which of OpenAI, Anthropic and Google, if any, may receive your data.
• In-cloud only: use open-weight models hosted in your own cloud, so data does not leave it.
• Stricter retention: shorter log periods, or zero data retention where providers offer it.
• Extra human review: add approval steps beyond our defaults.

Questions, requests and changes to this policy

Questions about how Arcesso uses AI, or requests to change the settings on your project, can go to info@arcesso.ai with the subject "AI data", or to +1 (754) 423-0349. A senior engineer replies within one business day.

Clients can ask at any time for a list of the AI providers and subprocessors used on their project, the settings applied to each, and confirmation that data was deleted at the end of an engagement.

We review this policy when we add a provider, when a provider changes its data terms, and at least every six months. The effective date at the top of the page shows the latest version. If a change affects an active project, we will tell that client before it takes effect.