AI at ShortStack

In Short

ShortStack uses AI in two places: an assistant that answers customer support questions, and assistants our own team uses to build software and produce content. There is no AI in the campaign builder or anywhere else in the ShortStack platform, and no AI system is connected to our database.

We do not use your data to train AI models, and we do not do so on an opt-out basis.

Where We Use AI

Customer support

An AI assistant in our support system answers questions about using ShortStack. Its knowledge comes from our published help documentation and nothing else — no customer data, no campaign data, and no internal material is in its knowledge base. It processes the content of your support conversation in order to answer you, and you can reach a person at any point.

Software development and infrastructure

Our engineering team uses an AI coding assistant to write and review code and to configure infrastructure. Our engineering assistant works under a restricted cloud profile that is denied access to the storage holding campaign uploads, to the contents of application logs, and to stored secrets. Every action it takes is recorded in our cloud audit log.

Content and campaign production

Our team uses AI assistants when drafting marketing content and when building or customising campaigns. Where we work on your campaign, we use our internal campaign export, which carries the campaign’s structure, layout and styling — and does not carry entries, uploaded files, or integration credentials.

What AI Does Not Do

It does not process your entries or your entrants’ personal data

No AI system we use receives campaign entry data or the personal data of people who enter your campaigns. No AI system is connected to the ShortStack database. Where our engineers need database work, an assistant may help compose a query; an engineer reviews and runs it, and the results are not returned to the assistant.

It does not train on your data

Because no AI system we use receives your entries or your entrants’ personal data, none of that data can be used to train a model. The content our own team submits to these assistants — code, marketing copy, and campaign structure — is governed by our commercial agreements with their providers. We may use aggregated or de-identified data — information that does not identify anyone and cannot reasonably be used to identify anyone — and we neither attempt re-identification nor permit any third party to attempt it.

It does not make decisions about people

ShortStack does not use AI to determine eligibility, pricing, account enforcement, winner selection, or fraud outcomes. Where AI output informs a decision, a person makes the decision.

Bot Protection in Your Campaigns

Two anti-abuse services available in ShortStack use machine-learning risk scoring. We don’t classify them as AI features — they’re security controls, in the same family as spam filtering — but we’d rather describe them than have you find them.

Cloudflare Turnstile

Governs whether a visitor can reach your published campaign page. You choose whether to enable it.

Google reCAPTCHA

Off by default. If you enable it, using your own Google reCAPTCHA account, Google returns a risk score for each interaction and you set the threshold below which an interaction is rejected. It can be applied to form submissions, to Instant Win qualification, and to voting, each with its own threshold.

In both cases the scoring is performed by the third-party service, the threshold is yours, and ShortStack does not evaluate the individual. Because these are your campaigns and your entrants’ data, you are the controller: the decision to enable them and how strictly to apply them is yours, and so is any notice you give your entrants about it.

The Providers Behind Our Support Assistant

Zendesk provides our support system and is listed on our subprocessors page. The large language models behind its AI features are supplied by third parties and are not trained on customer data. Where a model is hosted directly by its provider, Zendesk uses zero-data-retention endpoints, meaning request and response content is held in memory only to serve the request and is not stored afterwards. Zendesk publishes the providers involved in its own sub-processor policy.

Our engineering and content assistants are not sub-processors of ShortStack, because they do not process personal data on your behalf. We review that position whenever our use changes.

If We Add AI Features to the Product

If we introduce an AI feature that processes data on your behalf, we will:

confirm a data processing agreement is in place with the provider and whether it engages sub-processors of its own;
add the provider to our subprocessors page and notify you before the change takes effect, with the objection process described in Section 5 of our Data Processing Addendum;
update our Privacy Policy before the feature launches rather than after; and
update this page.

Questions

For questions about our use of AI, or to request our security documentation under NDA, contact support@shortstack.com.