AI Policy

The Platform runs one AI agent. The six names you see in the dashboard — Seli, Helpi, Promo, Watso, Webi, and Mailo — are faces of the same engine, each configured for a channel or a job. The agent answers your store's customers: product questions from the synced catalog, order tracking, recommendations, coupons, refund and cancellation requests, and escalation to a human.

There is a seventh agent, Capi (the manager). Capi never talks to your customers; it talks only to you, inside the dashboard, reads your store's facts, and the only thing it can do is propose an action that a person on your team approves. It executes nothing on its own.

The agent uses language models from an external provider. The available options are Anthropic (the default, Claude models), OpenAI, and Google. You choose the provider at the organization level from the agent settings (/dashboard/ai-agent).

• Platform key: by default, requests go through our key and every reply is metered against the AI allowance of your plan.
• Your own key: you can store your own API key with us (encrypted with AES-256-GCM). The provider then bills you directly for usage, and those replies are not counted against your plan allowance.
• Failover chain: on the messaging channels (WhatsApp, Instagram, Messenger, X, email), if the primary provider is down we try the next provider you have configured. If all of them fail, the conversation is handed to a person on your team — it is never dropped silently.

The providers are located in the United States. Transfer details and safeguards are in the subprocessor list and the Data Processing Agreement.

We do not send your database to the provider. With each reply, the model receives only the minimum it needs:

• System instructions: your store rules and agent settings (tone, fallback language, the refund policies you wrote, and so on).
• The last 12 stored messages of the same conversation — not the full history.
• Minimal tool context: the products matching the question, capped at 200 characters of description each, knowledge-base answers capped at 500 characters, and the order status when the customer asks about it.

A reply is capped at 800 output tokens and at most 5 tool rounds. Never sent: payment data, credentials or encrypted tokens, or whole tables from the database.

With Anthropic we enable prompt caching: the stable part of the instructions (your store rules and agent settings) may be cached temporarily at the provider for up to 1 hour on WhatsApp or 5 minutes on the website widget, so we do not resend it with every reply and the cost stays lower. This cache is operational and short-lived, held by the provider itself and governed by its commercial terms.

• We use the providers' commercial APIs, whose terms state that inputs and outputs are not used to train their models.
• We do not train any model on your data or your customers' data — not now, and not later without your explicit written consent.
• No cross-tenant learning: one store's data never influences another store's agent. Everything the agent learns about your store (knowledge base, rules, evaluations) stays inside your account.

The agent cannot do anything outside a fixed list of tools, and all of them are scoped to your store — no tool can read or change another organization's data. The current tools:

• searchProducts, compareProducts, and suggestComplementaryProducts — search, compare, and recommend from your catalog.
• searchKnowledgeBase — answer from your knowledge base.
• trackOrder — order status.
• generateCoupon — create a coupon within the cap you set.
• requestRefund and requestOrderCancellation — refund and cancellation requests; they verify that the order really belongs to the requesting customer before doing anything.
• sendWhatsAppProductCard and expressCheckoutInterest — a product card on WhatsApp and recording purchase intent.
• resumeAbandonedCart — resume an abandoned cart for that customer only; it cannot reach another customer's cart.
• escalateFrustratedCustomer — hand the conversation to a human.

Several of these tools can be switched off or on individually from the agent settings (/dashboard/ai-agent).

You decide how much the agent acts on its own. Any tool that spends money, grants a discount, or changes an order passes through the following guardrail:

Hard caps override the level: you set the maximum automatic refund amount and the maximum discount percentage, and any action above them always goes to a person for approval, whatever the level. Approvals live on the Actions page (/dashboard/ai-agent/actions), and every approval is recorded in the audit log.

• Approval queue: risky actions wait for a person on your team to approve or reject them.
• Escalation tool: the agent hands the conversation to a human when it senses the customer is frustrated or the request is beyond it, and you can add your own escalation rules (keywords, topics, situations).
• A human keeps the thread: once a person on your team takes over a conversation, the agent never replies in it automatically again. Handing it back to the agent is a human decision.
• Customers can always ask for a human, and that request is honoured through the escalation tool and your rules.

The agent must not claim to be human when a customer explicitly asks whether they are talking to a bot. This is part of the Acceptable Use Policy and the Terms.

On the website widget you can set a notice visible to the visitor (such as "AI assistant"), and it is shown once you enable it. We also recommend that you mention your use of AI and name us as a processor in your own store's privacy notice.

No decision with a legal or similarly significant effect on a customer (such as refusing a refund or cancelling an order) is made without human involvement — that kind of action passes through the approvals or caps described above. This keeps us aligned with the Saudi Personal Data Protection Law (PDPL), the Turkish KVKK, and Article 22 of the EU GDPR. A customer can ask at any time for a person to review.

Text that reaches the model from external sources — product descriptions, knowledge-base answers, customer messages — is treated as data, not as commands: we strip known injection markers from it, fence it as untrusted content, and the system instructions explicitly tell the model to treat it as information only. Even so, there is no complete protection against this class of attack, which is why the sensitive tools are governed by the guardrails and approvals above.

Agent evaluation is an opt-in feature you enable per store. When it is on, we take frozen transcripts, replay them in an isolated sandbox that writes nothing to your store (no coupons, no refunds, no messages), and grade the result with deterministic checks and a model judge. Capi may propose at most one rule change per week, and it takes effect only when a person approves it. Evaluation spend is not counted against your plan allowance.

Weekly insights, mining unanswered questions for the knowledge base, and conversation quality scoring all read your store's data only. Intent classification uses keyword rules with no model, and Action Center proposals are limited to one per store per day; their numbers come from direct queries, and the model writes only the wording.

The agent generates responses probabilistically. Despite all the safeguards, it can get a fact wrong, misread a question, or respond unexpectedly. Any commercial commitment arising from its reply (a discount, a promised date, a refund) is your responsibility toward your customer, as set out in the Terms. That is why we recommend reviewing your knowledge base regularly and setting the caps and the autonomy level before running the agent on a live channel.

• Configure the autonomy level, the caps, and the enabled tools to suit your store, and monitor the approval queue.
• Keep an accurate, up-to-date knowledge base — the agent answers from what you feed it.
• Disclose your use of AI to your customers as your local law and the channel policies require (see Channel Policies).
• Handle your customers' requests about their data as the controller; we assist you under the Data Processing Agreement.
• Do not use the agent for purposes prohibited by the Acceptable Use Policy.

• Conversations the agent replies in follow the same conversation-retention setting you choose on the Data Rights page (/dashboard/settings/data-rights) — deletion after a number of days you set, or permanent retention. Details are in the Privacy Policy.
• Retention at the model provider is governed by its own commercial policy; we do not ask it to retain anything, and prompt caching never exceeds 1 hour.
• Approvals of agent actions are recorded in the audit log for 365 days.
• Your own API keys are encrypted, are never exported with your data, and are erased with account deletion. See the Security page.

If we change a default provider, add a tool that spends money or changes orders, or alter how human oversight works, we will notify you by email or by an in-dashboard notice 30 days before the change takes effect. Clarifying edits are published here with the date above updated.

For any question about how AI processes your data: privacy@capiagent.com. For usage and configuration questions: hello@capiagent.com or the contact page. The other legal documents are in the Legal Center.