Here's a policy that's short enough to fit on the back of a business card: we don't train on your data. Your decision_log is yours. Your brand-voice anchor is yours. None of it leaves your boundary, and none of it shapes a model another store will use. This post is the longer version of that card, and why we'd rather give up the upside than blur the line.
The tempting version we didn't build
It would be easy — and lucrative — to pool every tenant's data into one ever-improving global model. 'Stores like yours scaled this campaign' is a compelling pitch. It's also a quiet promise to leak the edge each operator worked to build. Your winner floor, your reply voice, your supplier mix: that's your business, not our training set.
- Per-tenant isolation: one store's data never enters another store's context or model.
- Customer data is processed to operate your service, never to improve a shared model.
- The brand-voice anchor lives inside your boundary; it's never a pretraining corpus.
- Sub-processors operate under DPAs with the same constraint flowed down.
The fastest way to make autonomy feel unsafe is to be vague about where the data goes. So we're not vague: it goes nowhere.
— Talia Reyes
What we use instead
Foundation models we don't train, plus your data as context at decision time, plus policies you control. The intelligence comes from grounding the model in your store's facts in the moment — not from having memorized them into weights forever. It's a harder engineering path and a cleaner trust story, and we'll take that trade every time.
If a vendor can't tell you plainly whether your data trains their model, assume it does. We'd rather you never have to assume.