AI use policy

How we use AI

Last updated:

Got AI Policy tracks how Canadian municipalities govern AI. This page explains how we ourselves use AI to run the platform — so you can hold us to the same standard you apply to your own administration.

No-training guarantee

No content sent through any AI feature on Got AI Policy — your questions, your uploads, registry text, or model responses — is used to train public AI models. We enforce this in three layers:

  • Approved providers only (Lovable AI Gateway, OpenAI API, Gemini via Vertex), whose terms confirm no-training.
  • No-training and zero-retention headers sent on every request, and identifiers stripped from all prompts.
  • A single server-side wrapper (callModel) every AI call must go through — enforced by a CI test that fails the build if any code bypasses it.
  • Per-call metadata (purpose, model, latency — never the request body) is retained for 30 days then auto-purged. Full bodies are only stored when you explicitly click “Save”.

The exact rules our code enforces are published at docs/ai-data-handling.md. If the code and that document disagree, the code is wrong and we fix it.

Purpose & scope

This document covers the GotAIPolicy.ca platform's own use of AI: summaries, comparisons, search, and analysis of user-uploaded policies. For how municipal policies in the registry are found, classified, and verified, see the methodology.

Where we use AI in the product

  • Structured registry summaries (highlights, best practices, red flags, missing clauses).
  • Side-by-side comparisons across multiple municipalities.
  • Executive cohort briefs for Featured Cities.
  • “Ask the registry” — Q&A grounded in registry evidence.
  • “Review my policy” — structured analysis of a draft the user uploads or links.
  • Search ranking and autocomplete suggestions.

Models & providers

We combine three Google Gemini models, all accessed through a managed AI gateway:

  • google/gemini-2.5-flashdefault engine for municipal policy summaries, "Review my policy", "Ask the registry", and side-by-side comparisons.
  • google/gemini-2.5-proused for longer, more demanding cohort analyses (multi-city executive briefs).
  • google/gemini-3-flash-previewfaster next-generation model used for AI-assisted FAQ search and autocomplete.

We do not train any models ourselves. Providers and model versions can change as quality improves. Material changes are logged in the changelog.

Human oversight

  • Every registry row can carry a “human verified” flag when a reviewer has confirmed the cited evidence.
  • All AI-generated text is labelled as such and treated as a starting point — never a decision. See the correction process.
  • Founding Members have access to a priority verification queue and can request human review of specific entries.
  • Users can challenge any status; submissions are reviewed against official public sources before a status changes.

What the AI sees

  • Registry features: only public, cited sources (council minutes, official policy URLs, municipal websites).
  • “Review my policy”: the text you upload or link. That content stays confidential to your account and is not shared with other users.
  • “Ask the registry”: your question plus cached public summaries.

What we don't do with AI

  • We do not directly train public AI models on user uploads, private drafts, direct messages, or forum content.
  • We do not use AI to make automated decisions about people — no scoring of staff, residents, or vendors.
  • We do not recommend or rank AI vendors.
  • We do not fabricate quotes or sources: every citation links to a public, verifiable URL.
  • We do not use AI to take punitive moderation actions on the forum without human review.

Raw uploads, derived insights, and service improvement

There is an important difference between training an AI model on user content and using anonymized, aggregated insights to improve a service.

Got AI Policy may analyze uploaded policies to generate a private review for the user. We may also use anonymized and aggregated analytical insights from many reviews to improve benchmarking, recommendation logic, prompt quality, safety checks, and user experience.

We do not use raw uploaded policies, private drafts, direct messages, or forum content to directly train public AI models. Aggregated insights are reviewed at a systems level and are not intended to identify users or organizations, reproduce original documents, or expose confidential content.

Plain-language distinction:

  • Analytics: helps us understand what works and what needs improvement.
  • Retrieval/indexing: helps the system find relevant public registry evidence.
  • Model training: changes model behaviour based on training data. We do not directly train public AI models on user uploads or private content.

See the full Governance page →

Accuracy, limits & the verify-against-source rule

AI-generated summaries can be wrong, outdated, or miss context. Before relying on any output — especially for a governance, legal, privacy, or procurement decision — you must verify it against the linked source.

This is the same rule we apply to the “Review my policy” feature: AI helps structure the analysis; it does not replace legal, privacy, or risk review.

Bias & Canadian context

The models we use are trained largely on global English data. We add Canadian municipal context through carefully written prompts and curated examples, but bilingual parity, Indigenous governance contexts, and small-municipality realities can still be under-represented.

If you notice bias or a blind spot, tell us — that's how the platform improves.

Privacy & retention

Uploads and user-generated content are retained only as long as needed to deliver the service and are not shared with model providers for training. You can delete your account and all of your data at any time from Settings → Danger zone. See the privacy policy for the full picture.

Reporting an AI issue

If an AI output is inaccurate, biased, or harmful, email support@gotaipolicy.ca or use the “Report issue” button on the affected page. We commit to investigate and correct.

Alignment with existing frameworks

This policy is informed by: Canada's Treasury Board Directive on Automated Decision-Making, ISED's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, and the OECD AI Principles. We do not claim any certification; we reference these frameworks to signal the standard we hold ourselves to.

Changes to this policy

Material changes to this policy will be logged in the changelog and the "Last updated" date above will be revised.