Skip to main content
InstantCampaign’s AI features never receive the personal data of your contacts. Email addresses, names, phone numbers, postal addresses and custom-field values stay out of every prompt and every tool result an AI model reads. The one feature that works per contact, AI personalisation, sends coarse traits only (below). The public summary is at instantcampaign.ai/ai-privacy.

​
What the AI can see

A template preview that Spark or an MCP assistant reads is rendered for a stand-in contact called “Preview Contact”, never a real one, with any name or address in the sample data masked. A message-log row names the recipient’s domain and contact id; its subject is scrubbed of that recipient’s own stored values. Apart from AI personalisation’s trait profiles, this is fixed at aggregates only: there is no setting that widens it.

​
Sensitive fields

Mark a custom field sensitive on the Custom fields page. Its values already never reach a model; marking it also withholds its options and description from every tool output, and any segment rule or automation condition that uses it reads [sensitive] to a model. Emails, merge tags, segments and the API use it as normal.

​
See your workspace’s settings

Settings → Privacy → AI & data shows:
  • the contact context (aggregates only);
  • the fields marked sensitive;
  • which text and image models the platform uses and where they are hosted;
  • whether a residency mode (UK, EU, or UK + EU) is enforced.
The page is read-only apart from AI personalisation at send time, a switch (on by default) that can turn AI personalisation off for the whole workspace. Models and residency are chosen by InstantCampaign for the whole platform.

​
Where the models run

Two providers, picked per capability: Google’s Gemini API (global) and Amazon Bedrock (Claude and Nova in the UK/EU, Stability image models in the US). The pick is binding: a failed call returns an error instead of moving to the other provider, unless the platform has allowed fallback. Under an enforced residency mode, a model hosted outside the boundary is refused, and so is the fallback to Gemini.

​
Training and retention

  • Gemini API, paid services: Google states it does not use prompts or responses to improve its products and logs them for a limited time to detect policy violations (terms).
  • Amazon Bedrock: AWS states inputs and outputs are not used to train models and are not shared with model providers (FAQs); some models keep traffic up to 30 days inside AWS for abuse detection (abuse detection).
InstantCampaign keeps your AI generation history (prompt and result) for as long as the workspace exists. Spark conversations are not stored on our servers. MCP calls are kept for 90 days in the API request log, which only API-key managers can open.

​
Limits

  • Text you write (a brief, a template, your brand voice) is sent as written. A customer’s name typed into a brief reaches the model.
  • The REST API returns contact data to integrations you authorise with a key; it is for your systems, not for models.
  • A connected MCP assistant runs on its own provider’s model and terms.