AI at ShortStack

In Short

ShortStack uses AI in two places: an assistant that answers questions in our support chat (from 30 November 2026), and assistants our own team uses to build software and produce content. There is no AI in the campaign builder or anywhere else in the ShortStack platform, and no AI system is connected to our database.

We do not use your data to train AI models, and we do not do so on an opt-out basis.

Where We Use AI

Customer support

From 30 November 2026, an AI assistant in our support chat answers questions about using ShortStack. Its knowledge comes from our published help documentation and nothing else — no customer data, no campaign data, and no internal material is in its knowledge base — and it has no access to your account. It processes the content of your support chat in order to answer you. Every reply identifies it as ShortStack’s AI assistant, and you can reach a person at any point; when the assistant can’t help, it passes the conversation to our team with what you’ve already told it.

In the ShortStack app you can turn the assistant off in ShortStack Account Settings, and your chats from the app then go straight to our team. On Enterprise accounts it is off unless you turn it on. The chat on our website always uses the assistant.

Software development and infrastructure

Our engineering team uses an AI coding assistant to write and review code and to configure infrastructure. Our engineering assistant works under a restricted cloud profile that is denied access to the storage holding campaign uploads, to the contents of application logs, and to stored secrets. Every action it takes is recorded in our cloud audit log.

Content and campaign production

Our team uses AI assistants when drafting marketing content and when building or customising campaigns. Where we work on your campaign, we use our internal campaign export, which carries the campaign’s structure, layout and styling — and does not carry entries, uploaded files, or integration credentials.

What AI Does Not Do

It is not given your entries or your entrants’ personal data

We do not send campaign entry data or the personal data of people who enter your campaigns to any AI system, and no AI system is connected to the ShortStack database. Where our engineers need database work, an assistant may help compose a query; an engineer reviews and runs it, and the results are not returned to the assistant.

The one way that data can reach an AI system is if you include it in a support chat. The support assistant then processes it in order to answer you, as described under The Providers Behind Our Support Assistant. Where you can, refer to an entry by its campaign link rather than an entrant’s name or email address.

It does not train on your data

Because we do not send your entries or your entrants’ personal data to any AI system, none of that data is used to train a model. Your support chats, including anything you include in them, are not used to train our support assistant’s model. The content our own team submits to these assistants — code, marketing copy, and campaign structure — is governed by our commercial agreements with their providers. We may use aggregated or de-identified data — information that does not identify anyone and cannot reasonably be used to identify anyone — and we neither attempt re-identification nor permit any third party to attempt it.

It does not make decisions about people

ShortStack does not use AI to determine eligibility, pricing, account enforcement, winner selection, or fraud outcomes. Where AI output informs a decision, a person makes the decision.

Bot Protection in Your Campaigns

Two anti-abuse services available in ShortStack use machine-learning risk scoring. We don’t classify them as AI features — they’re security controls, in the same family as spam filtering — but we’d rather describe them than have you find them.

Cloudflare Turnstile

Governs whether a visitor can reach your published campaign page. You choose whether to enable it.

Google reCAPTCHA

Off by default. If you enable it, using your own Google reCAPTCHA account, Google returns a risk score for each interaction and you set the threshold below which an interaction is rejected. It can be applied to form submissions, to Instant Win qualification, and to voting, each with its own threshold.

In both cases the scoring is performed by the third-party service, the threshold is yours, and ShortStack does not evaluate the individual. Because these are your campaigns and your entrants’ data, you are the controller: the decision to enable them and how strictly to apply them is yours, and so is any notice you give your entrants about it.

The Providers Behind Our Support Assistant

PostHog provides our support desk, where your conversations are kept with the rest of your support history. From 30 November 2026, Anthropic supplies the model behind our support assistant. Both are listed on our subprocessors page. Under our agreement with Anthropic, conversation content is not used to train its models, and Anthropic deletes it within 30 days, except where its automated safety systems flag a conversation for review under its usage policy, or where the law requires longer retention. Support history held by PostHog is kept for the periods in our Privacy Policy.

Our engineering and content assistants are not sub-processors of ShortStack, because they do not process personal data on your behalf. That remains so where one of them is supplied by the same provider as our support assistant: what decides it is the data a use receives, not who provides it. We review that position whenever our use changes.

If We Add AI Features to the Product

If we introduce an AI feature that processes data on your behalf, we will:

confirm a data processing agreement is in place with the provider and whether it engages sub-processors of its own;
add the provider to our subprocessors page and notify you before the change takes effect, with the objection process described in Section 5 of our Data Processing Addendum;
update our Privacy Policy before the feature launches rather than after; and
update this page.

Questions

For questions about our use of AI, or to request our security documentation under NDA, contact support@shortstack.com.