AI Disclosure & Use Policy

This policy explains how the Moche-AI guest concierge works, what it can and cannot do, and how it behaves when it is unsure. It is written for guests as well as hosts, consistent with EU AI Act Art. 50 transparency expectations.

1. You are talking to an AI

The concierge is an artificial-intelligence assistant, not a human. It answers questions about the property using information the host has provided. Its answers may be imperfect and are not professional medical, legal, financial, or safety advice.

In an emergency, contact local emergency services (911 in the US, 112 in the EU/UK) or the host directly — do not wait for the assistant.

2. Grounded answers

The concierge answers from the host’s Property Brain — their documents, FAQs, and recommendations. For high-stakes questions it favors host-provided, source-backed information and confidence thresholds rather than guessing.

3. Refusal & escalation

When the concierge lacks a confident, grounded answer, it declines to speculate and escalates to the host instead. Questions the system detects as an emergency trigger a prominent instruction to contact emergency services and the host. This mirrors the behavior implemented in our concierge engine.

4. Which models answer you

We do not train any model on your data. We use established third-party models through a model router (OpenRouter), which selects a model appropriate to the task and can switch to a backup model automatically if one is unavailable — so answers stay reliable:

• Guest answers — Google Gemini 2.5 Flash, with OpenAI GPT-4o-mini and Anthropic Claude Haiku 4.5 as automatic backups.
• Background processing (organizing a host’s uploaded documents, categorizing knowledge) — OpenAI GPT-4o-mini and Meta Llama 3.1.
• Search relevance (embeddings) and intent detection — OpenAI, called directly.

Model selection may change as better or more efficient models become available. The Subprocessors page is the authoritative, maintained list.

5. Data handling & safeguards

Before any request leaves our infrastructure for the model router, we apply the following controls:

• Redaction first. Personal data is programmatically stripped from the prompt — the model receives your question and relevant property information, not your identity or contact details.
• Fail-closed verification. After redaction we re-scan the payload. If personal data is still detected, the external request is refused outright and handled by our primary provider instead. We never send it anyway.
• Zero data retention. Every request instructs the router and the underlying model provider not to log or retain the prompt or the response.
• No training on your data. Any model provider that would collect or train on the content is refused; the request fails rather than falling through to a provider without that guarantee.

See the Privacy Policy, Security Overview, and Subprocessors for details.

6. Human oversight

Hosts review escalations and can correct or supplement the Property Brain. The AI does not take real-world actions (bookings, payments, dispatch) on a guest’s behalf.