ScamSafe is an AI-powered tool. This policy explains how we use artificial intelligence, what it can and cannot do, and how we govern its use in a way that is transparent, responsible, and compliant with EU law. We publish this policy because we believe you have the right to understand how automated decisions that affect you are made.

1. Purpose of This Policy

This AI Policy sets out how ScamSafe uses artificial intelligence, the principles that govern its use, and the commitments we make to users and institutional partners regarding transparency, accuracy, oversight, and compliance.

ScamSafe is, at its core, an AI-assisted tool. Artificial intelligence is not incidental to this service — it is the service. We therefore believe it is important to be more transparent about our AI use than most services would need to be, and to clearly explain both what the AI does well and where its limitations lie.

This policy should be read alongside our Privacy Policy and Terms of Service, both available at scamsafe.ie.

2. The AI System We Use

2.1 Model and Provider

ScamSafe uses the Claude large language model (LLM), developed by Anthropic, via Anthropic's API. Anthropic is an AI safety company founded in 2021 and headquartered in San Francisco, California.

We chose Claude for the following reasons:

• Strong performance on nuanced language understanding tasks, including identifying deceptive or manipulative text patterns;
• Anthropic's commitment to AI safety and responsible deployment, which aligns with ScamSafe's mission;
• Anthropic's API data policy: data submitted via the API is not used to train Anthropic's models, which is essential to our privacy-by-design approach;
• Consistent, structured output suitable for generating plain-English verdicts and explanations.

2.2 How the AI Is Used

When a user submits a message for analysis, that message is transmitted securely to Anthropic's API. The AI model analyses the message against a structured prompt developed and maintained by ScamSafe. The prompt instructs the model to:

• Identify linguistic, structural, and contextual characteristics commonly associated with scam messages;
• Assess the message against known Irish and international scam patterns, including impersonation of Irish institutions (Revenue, An Post, AIB, and others);
• Return a verdict in one of three categories: High Risk, Suspicious, or No Red Flags Detected;
• Provide a plain-English explanation of the reasoning behind the verdict;
• Suggest practical next steps appropriate to the verdict.

The AI does not have access to the internet, to databases of known scam messages, or to real-time threat intelligence feeds. Its analysis is based entirely on the patterns and knowledge embedded in its training data and the guidance provided in our prompt.

2.3 What the AI Does Not Do

• It does not access or analyse any links contained in a submitted message;
• It does not verify the identity of the sender of a message;
• It does not access any external systems, databases, or real-time fraud intelligence;
• It does not make a legally binding determination as to whether a message is a scam;
• It does not interact with users in a conversational way — it processes a single submission and returns a single verdict;
• It does not retain or learn from submitted messages.

3. Accuracy, Testing, and Known Limitations

3.1 Pre-Launch Testing

Before public launch, the ScamSafe AI prompt is validated against a test set of real Irish scam messages, including genuine scam messages, legitimate communications from Irish institutions, and edge cases. This testing covers the principal scam categories targeting Irish consumers, including Revenue / tax authority impersonation, bank impersonation, parcel and delivery scams, WhatsApp family emergency scams, investment and cryptocurrency fraud, prize and lottery scams, utility and energy supplier impersonation, rental and property scams (including Daft.ie listing fraud), online marketplace scams (Facebook Marketplace, DoneDeal, Vinted), romance scams, tech support scams, and fake job and money mule scams.

3.2 Known Limitations

No AI system is infallible. ScamSafe will make mistakes. Users should be aware of the following known limitations:

• False negatives: A scam message may not be flagged, particularly if it is sophisticated, highly personalised, or represents a novel scam pattern not well represented in the AI's training data.
• False positives: A legitimate message may be assessed as suspicious, particularly if it contains urgent language or unusual formatting.
• Irish-language content: The AI's performance on messages written in Irish (Gaeilge) may be lower than on English-language content.
• Highly contextual scams: Scams that rely on personal context known only to the recipient may be harder for the AI to identify from the message text alone.
• Evolving tactics: Scammers continuously adapt their methods. The AI's knowledge has a training cutoff date and may not reflect the very latest scam techniques.

3.3 Verdict Language and Framing

ScamSafe never uses language that states a message is definitively safe. Our verdict categories are deliberately framed as analysis, not conclusions:

• "High Risk" means the message displays multiple characteristics strongly associated with scams. It does not mean the message is confirmed as a scam.
• "Suspicious" means the message displays some characteristics that warrant caution. It does not mean the message is confirmed as a scam.
• "No Red Flags Detected" means the AI did not identify characteristics commonly associated with scams in this message. It does not mean the message is safe or legitimate.

Every verdict is accompanied by a plain-English explanation and a reminder that the result is guidance only and that human judgement must always be applied.

4. Human Oversight and Governance

4.1 Our Oversight Commitment

ScamSafe is committed to meaningful human oversight of its AI system. While individual verdicts are generated and displayed without human review, we maintain oversight at the system level through:

• Regular review and updating of the AI prompt, informed by user feedback, new scam patterns, and periodic re-testing;
• Monitoring of anonymised verdict data for anomalies;
• Review of user feedback to identify patterns of dissatisfaction that may indicate systematic errors;
• Priority treatment of any identified systematic failure in the AI's outputs.

4.2 No Fully Automated Consequential Decisions

ScamSafe does not make consequential decisions on your behalf. The service provides analysis; all decisions are made by the user. The AI verdict is one input into your decision-making, not a substitute for it. This design is intentional — AI tools used in consumer-facing safety contexts must preserve human agency and must never present themselves as infallible authorities.

4.3 Challenging a Verdict

If you believe a verdict produced by ScamSafe is incorrect, you can:

• Submit a correction or query via eoghan@scamsafe.ie, including the message content and the verdict received;
• Indicate via the on-page feedback mechanism that the verdict was not helpful.

We will acknowledge and respond to formal written queries within 10 business days.

5. Fairness, Bias, and Non-Discrimination

We are committed to ensuring that ScamSafe's AI operates fairly and does not systematically disadvantage any group of users. Our approach includes testing the AI against a broad and representative range of message types, monitoring for patterns that might suggest systematic bias, and maintaining verdict language that does not place blame on the recipient of a scam message — being targeted by a scam is not the fault of the person who received it.

6. Data, Privacy, and the AI System

Principle	Detail
Message content retention	Message content submitted for analysis is NOT retained by ScamSafe after analysis is complete. It is transmitted to Anthropic's API, processed, and discarded.
Anthropic data use	Anthropic does not use data submitted via its API to train its AI models. ScamSafe has confirmed and documented this as part of its data processor relationship with Anthropic.
What is stored	Only anonymised verdict data is stored: verdict category, scam type, date and time. No message content. No personal identifiers.
No profiling	ScamSafe does not build profiles of individual users. No data is linked across sessions. No tracking cookies are used.
Data transmission	All transmission between your browser and ScamSafe, and between ScamSafe and Anthropic's API, is encrypted via HTTPS/TLS.

7. EU AI Act Compliance

7.1 Classification

The EU AI Act (Regulation (EU) 2024/1689), which entered into force in August 2024, establishes a risk-based framework for AI systems deployed in the EU. ScamSafe's scam-checking tool is classified as a limited-risk AI system under the EU AI Act. It does not fall into the prohibited or high-risk categories because it does not make binding or consequential decisions, does not affect access to essential services, and is a consumer-facing safety tool designed to protect users from harm.

7.2 Transparency Obligations

As a limited-risk AI system that interacts with consumers, ScamSafe is subject to the EU AI Act's transparency obligations. We comply as follows:

• Disclosure: We clearly disclose that verdicts are generated by an AI system and are not reviewed by a human before being displayed to the user.
• Explanation: Every verdict is accompanied by a plain-English explanation of the AI's reasoning.
• Limitations: We clearly communicate the limitations of AI-generated verdicts, including the possibility of false positives and false negatives.
• Human oversight: We maintain human oversight at the system level and provide users with a mechanism to challenge or query verdicts.

7.3 Ongoing Compliance

The EU AI Act is being implemented on a phased basis through 2025 and 2026. ScamSafe is committed to monitoring regulatory developments and updating its practices as additional obligations come into effect.

8. Updates to This Policy and the AI System

We will update this AI Policy when we make material changes to the AI system we use, when we make significant changes to our AI prompt, when new EU AI Act obligations come into effect, or when we identify material changes to the accuracy or limitations of the AI system. When we make material changes, we will update the 'Last updated' date at the top of this page.

9. Contact and Feedback

Email: eoghan@scamsafe.ie
Website: scamsafe.ie

AI Policy queries: We aim to respond within 10 business days.