Document 7: AI and Automated Processing Terms

Plain-language summary: How the AI features work and how donor information is protected when they run. The key points: the AI gives suggestions a person confirms; your donor records are stored, searched and queried in your region (Canada, for current customers); coaching, thank-you drafting and report descriptions run in Canada; Capture and Ask Relae may use a model that Amazon Web Services runs in the United States, and appeal planning may use Anthropic's service there, but only after names, emails, phone numbers and addresses that match your records are replaced, and an administrator can choose Canada-only processing instead; import planning and mapping hints also stay in Canada under that choice, and appeal planning does not run; otherwise import planning uses Anthropic's service in the United States, as do the separately enabled research features; other names can reach a model, so model requests stay Donor Data; and both providers' terms say they do not train models on your data.

1. What the AI does

The Platform includes AI-assisted features: donor-capture assistance, coaching suggestions, thank-you drafting (drafts only; a person sends them from the organization's own systems), the Ask Relae assistant, report descriptions, import planning, appeal planning, funder research, the opt-in donor-research feature, and opt-in voice-note transcription. AI outputs are suggestions only and may be inaccurate or incomplete. The Customer is responsible for reviewing outputs and applying human judgment.

2. Where the AI runs

For customers served from the Canadian Region, Donor Data is stored in Canada, and every search and database query on it runs in Canada. Coaching suggestions, thank-you drafting and report descriptions run in Canada, on Amazon Nova through AWS Bedrock in a Canadian region.

Capture and Ask Relae may send a request to Amazon Web Services that is processed in the United States. Only two kinds of content can be in such a request: figures and fields that Relae's engine assembled from the Customer's records, and text a person types or pastes into Capture or Ask Relae, including text copied from an email. Apart from import planning, Relae does not send imported files, uploaded documents, meeting transcripts, or notes and contact reports already stored in Relae outside Canada for AI processing. Relae keeps a request in Canada, on its Canadian model, when the typed or pasted text is longer than 2,000 characters, matches common Canadian or US address formats, contains a government or financial identifier, looks like a copied email thread, mentions health, bereavement, religion, sexuality or politics, contains a word that looks like a personal name and does not match a record, or contains part or a variant of a name on file. These checks are automatic and err toward keeping a request in Canada.

Appeal planning, when a person uses it on an appeal and only where the organization has not chosen Canada-only processing, sends a request to Anthropic's service in the United States. The request contains figures and fields Relae's engine assembled from the appeal and the Customer's records, in which each household appears as a Relae reference code with its giving and ask amounts and gift dates, never its name or contact details, and the text the person types. Relae applies the replacement described in clause 3 to that text and to the appeal's own labels. Relae does not send the request when the typed text is longer than 2,000 characters, or when the typed text or the appeal's own labels match common Canadian or US address formats or contain a government or financial identifier. Appeal planning has no Canadian model, so a request these checks stop is not processed. The other checks described above are not run for appeal planning, so a name that does not match a record, a sensitive subject or a copied email thread can reach Anthropic's service, and appeal planning requests remain Donor Data.

An organization administrator can choose Canada-only processing at any time in Settings > Data and privacy (/settings/data), or by writing to privacy@relae.ai. Relae records who made the choice and when, and applies it to every later request. With Canada-only processing, Capture, Ask Relae, import planning and mapping hints run only in Canada, on Amazon Nova through AWS Bedrock in a Canadian region, and appeal planning does not run. Until an administrator makes that choice, the organization uses the processing described in this clause.

The Named Exceptions send requests to Anthropic's service in the United States without the replacement described in clause 3. Import planning and mapping hints do so only where the organization has not chosen Canada-only processing. Import planning sends a profile of an imported file (the file name, sheet names, column headers and types, counts, and up to three sample values from each column that does not look identifying), any instruction the person importing types about the file, and, when it tries again, the checks its previous plan failed. A sample value can contain a name, for example in a fund or appeal column. Mapping hints send column headers, the current mapping and the person's instruction about that mapping. Funder research, available under a specific entitlement and off by default, sends the names of funding organizations and the organization's areas of interest. Donor research, which an organization turns on separately, sends the name and public context of the person being researched, as described in clause 6. No other AI processing leaves Canada for customers served from the Canadian Region.

Voice notes are off by default. An organization administrator can turn on voice notes in Settings > Data and privacy, and transcription runs only where Relae has configured and verified that workspace's regional route. For the Canadian Region, recordings and attached audio are sent to Amazon Transcribe in ca-central-1, with private input and output storage on Amazon S3 in the same region. Audio is sent as recorded, including any names or other personal information spoken; the text identifier replacement in clause 3 is not applied to audio. There is no United States fallback for transcription, including when Canada-only processing has not been chosen. The Customer is responsible for having the right to record and provide the audio, including any required participant consent. Transcription can be inaccurate. The person reviews it and chooses whether to add it to the note; transcription does not create donor activities or tasks on its own.

3. Identifier replacement before model calls

Before Capture, Ask Relae or appeal planning sends a request outside Canada, Relae replaces each name exactly as it is recorded in the organization's records, and each email address, phone number and postal address on file, with a placeholder, and replaces any other email address or phone number it finds. A name written differently from the records, such as a surname or first name on its own, or with a different accent or apostrophe, is not reliably replaced. The real values are put back only inside the Customer's Relae workspace in Canada.

For requests that stay in Canada, Relae also replaces identifiers it holds before content reaches the model, but what is replaced depends on the feature: coaching replaces the name, email address and phone number of the donor being coached; thank-you drafting replaces the donor's name; Ask Relae replaces the identifiers of the records it reads; and each replaces any other email address or phone number it finds. A postal address in the text that is not on file is not replaced.

The checks in clause 2 do not detect every personal name, in particular a name written in lower case or one that is also an ordinary word. Such a name can reach the model service, including in the United States. For that reason model requests remain Donor Data governed by the DPA, and Relae does not describe them as anonymized. In-product trust copy is kept consistent with this description.

4. Training and retention by the model services

Amazon Web Services states that content processed by Amazon Bedrock is not used to improve its base models and is not shared with model providers, and that AWS and third-party model providers do not use Bedrock inputs or outputs to train models. AWS also states that, depending on the model and on the data-retention setting of the AWS account in each Region, AWS may retain inputs and outputs for abuse detection, and that a retained request processed in another Region is stored in that Region. Relae will not send a request to Amazon Web Services for processing in the United States until the data-retention setting in each Region involved is one under which, as AWS states, no request or response data is written to durable storage by AWS.

Anthropic's commercial terms state that Anthropic may not train models on customer content. Anthropic states that it automatically deletes API inputs and outputs within 30 days of receipt or generation, except where it has agreed otherwise with the customer, where law requires, or where its systems flag a request as violating its usage policy, in which case it may keep the inputs and outputs for up to two years. Relae represents only what those service terms support.

Amazon Transcribe is a separate service from Bedrock. AWS states that Transcribe stores and uses voice inputs for service improvement by default and permits an AWS Organizations opt-out. Relae enables its Transcribe route only when it has verified the effective opt-out for the account processing the audio. After the transcript is saved in Relae, Relae attempts to delete the temporary audio, the provider's transcript file and transcription job. Cleanup can be delayed or fail; the private S3 objects also have an expiry rule set to seven days, and AWS lifecycle deletion may occur after the expiry time. This is not a promise of immediate deletion. The transcript saved in Relae remains private to its author until added to a note and subsequently shared or filed through the note's controls. It is then governed by the note's access and retention controls, rather than the temporary S3 expiry.

5. Human in the loop, and the two named exceptions

No decision that produces legal or similarly significant effects about a Donor is made solely by automated means. Two automated behaviours are named so nothing is hidden. First, the duplicate-record merge: off by default, per-organization, reversible, and limited to merging records of the same person. Second, per-donor AI access for Ask Relae: for a real customer organization the assistant works with aggregate figures only, until the organization explicitly opts in to letting it work with live individual donor records. Where Quebec Law 25 applies, a donor has the right, through the charity as Controller, to be informed of and to contest a decision based exclusively on automated processing; Relae will assist the Customer in responding to any such request.

6. The research features

Donor research is off until an organization turns it on, and its opt-in surface enumerates exactly what is sent (name, entity type, city, education, known employer, board, or company affiliations, and web-search queries) and what is never sent (giving history, amounts, ratings, prospect types, tags, notes). Funder research is available only under a specific entitlement, off by default, and sends organization names and topics only. Both use United States services. Enabling donor research is the organization's instruction as Controller, and the organization is responsible for having a lawful basis for researching its prospects.

7. Accuracy and no professional advice

AI outputs are not professional (tax, legal, or financial) advice. Ratings, estimates, and suggestions are aids, not guarantees, and must not be the sole basis for significant decisions about a Donor. AI outputs carry no warranty of accuracy or completeness, and the Customer's sole remedy for an AI output it is dissatisfied with is to discard the output and, where useful, regenerate it.

Last updated: 21 October 2026.