When AI drafts a campaign or answers a message, it is touching a real person’s details. You should be able to find out exactly what it saw. This page says so, including the parts we have not finished.
What AI is given, and what it is not
Linxi AI has no access to the database. It cannot browse your contacts or query anything for itself. It only sees what Linxi puts in the request, and that is more than the message you are writing, so here it is in full:
- what you are writing, and the page or conversation you have open (for example the contact’s name and recent messages in that conversation)
- your account details and a summary of your Linxis, such as how many contacts and campaigns each has
- context about the Linxi you are working in: its name and phone number, contact counts, its ten most recent campaigns and their results, active keywords and their replies, message templates, its texting registration details, and the text of the ten most recent messages it received from any contact
- a short digest of your earlier AI conversations, only if you switch that on (it is off by default)
Each kind of Linxi data in that list (contacts, campaigns, messages, registration, analytics, keywords and templates) has its own switch in the AI data access settings, and switching one off keeps it out of the request. In some features, a data minimisation setting, on by default, also withholds the text of those recent messages.
It is never given your password, any carrier or API credential, or payment card details.
Some AI features can also run a read-only search of the public web to answer a question. The search itself cannot read or change anything in your Linxi.
What is taken out before the request leaves
Card numbers, social security numbers, passwords and credentials are stripped out of the text before it goes anywhere. There is no setting for this and there will not be: whether a customer’s card number reaches another company is not a preference the person whose card it is got to express.
Text that tries to give the AI new instructions — “ignore your instructions and…” — is removed and the attempt is recorded. Be clear about what that is worth: it is a tripwire, not a wall. A determined attempt can be phrased around a pattern list. What actually limits the damage is that AI here has no tools that change anything: the only tool any feature has is that read-only web search. It produces text, and every action that text could lead to is gated separately.
Auto-reply is off, and stays off until you turn it on
AI replies to the people who answer a campaign are the only AI feature here that sends words to your customer with nobody pressing Send. They are off for every account, they are never switched on by an upgrade or a default, and they need two separate switches on before they do anything: the permission to reply to texts in your account’s AI settings, and the automatic replies switch on that campaign. Once both are on, AI-written replies go out automatically, with nobody reading them first. There is no way yet to hold these replies for approval.
The log, so you do not have to take our word for it
Every AI request is recorded: which feature, when, on whose behalf, how large, whether anything sensitive was removed, and whether instruction-like text was found. A Linxi’s log is in Linxi Settings → Security → AI & Privacy.
That log does not yet show everything. Requests made from your own account rather than inside a Linxi (the assistant, the planner, and the automatic campaign replies above) are recorded without a Linxi attached, so they do not appear in that Linxi’s log today, and automatic campaign replies are not yet marked as sent with nobody looking.
The log does not record the contents of the request. That is deliberate. A transparency log that kept your prompts would be a second copy of your customers’ messages, sitting in a table read by anyone who administers the Linxi. It records the shape of what was sent, not the text.
Who processes it
Linxi uses Claude, made by Anthropic. Anthropic’s API terms state that data submitted through the API is not used to train their models — which is different from the consumer Claude app, where it may be. Anthropic is named as a service provider in our Privacy Policy.
We do not use your contacts to train any model, ours or anybody else’s, and we never will.
What you control
- which kinds of Linxi data AI is given, one switch per kind
- a master switch for all AI in a Linxi
- a switch per feature: drafting, summaries, lookups, support replies
- a daily request limit, which your plan sets and you can lower
- whether AI may reply to texts automatically, per account and per campaign
- the activity log, on every plan
The master switch, the feature switches and the daily limit apply to AI used inside a Linxi. AI used from your own account, outside a Linxi, is not governed by them yet.
What is not finished
- Holding AI replies for approval is not available: the setting exists, but nothing is held and nothing enters the review queue.
- Choosing which Claude model answers can be set, but is not applied yet.
- The separate switches for contact notes, contact tags and message history can be set, but are not applied yet. Use the data access switches above instead.
- AI used from your own account is not shown in a Linxi’s log, and is not governed by that Linxi’s switches and limit, as described above.
- Contact data is not encrypted field by field yet, for the reasons given on the security page.
We would rather list these than let you assume otherwise.
Telling us about a problem
If you find a way to make Linxi AI do something it should not, team@linxi.app. We will confirm receipt and tell you what we are doing about it.
Last updated 19 October 2026.