AI & Data Handling Notice
How Bulk's AI features and customer-connected AI use information, route requests and interact with human oversight.
Effective
Scope
Bulk, operated by ManagementSupport LLC, uses AI in selected document extraction, assistant and workflow features. Customers may also connect their own AI tools through integrations or the platform’s API/MCP interfaces. These are different processing paths. The order, DPA and applicable provider arrangements determine what is authorised for a deployment.
What an AI request may contain
A request can include a prompt, an uploaded document or image, extracted text, conversation history, the selected task or record, and related context supplied by the feature. That may include personal, confidential or operational information. Outputs can be stored as conversation records, proposals, extracted fields or accepted operational records, and activity may be recorded in application logs or audit history.
Use the minimum information needed for the task. A claim about an external model provider’s retention does not describe the separate retention of prompts, outputs, attachments or audit records inside Bulk.
Providers and routing
The current application requires Google Vertex AI’s global endpoint for its configured Gemini models. The workspace’s primary hosting country therefore must not be read as a guarantee of same-country AI processing. Model availability, endpoints and contracted data handling must be assessed for the intended use.
Selected AI requests, including extraction and imported datasheet review, support an OpenRouter fallback if Vertex returns a rate-limit/resource-exhaustion error and OpenRouter is configured. That path can send the request content through OpenRouter to a downstream model provider. It does not simply retry within the same Vertex contractual boundary. The relevant recipient, downstream routing, retention and safeguards must be approved before that path is authorised for customer information.
The Subprocessor List identifies these provider categories and the details that must be confirmed for each deployment. Software support for a provider does not prove the provider is enabled in production.
Training and retention
Bulk will not use Customer Data to train a general-purpose model without a separate express agreement. Provider-side training, abuse monitoring, caching and retention depend on the actual service, configuration and contract. We do not make a blanket “zero retention” or “no provider training” promise without verifying the relevant arrangement, including any fallback path.
The deployment processing schedule must identify applicable provider controls and any exceptions. Customers should not infer those controls from a model name, an “enterprise” label or the location of their primary database. Stored Bulk records remain subject to their own retention and deletion rules under the DPA.
Permissions and human oversight
AI output may be wrong, incomplete, misleading or unsuitable. Customer remains responsible for reviewing it and validating its use in manufacturing, testing, safety, quality and employment processes. AI is not a certification authority or a substitute for qualified review.
Different features have different action boundaries. Some generate proposals for acceptance; configured tools and integrations can perform actions within their granted permissions. This notice does not promise that every AI write requires a separate human click or that every integration is read-only. Customers must review the feature’s permissions, approval rules and audit behavior before use and maintain required oversight.
Customer-connected AI and integrations
When Customer connects an external assistant, model, messaging tool or integration, information requested through that connection may be sent to the customer’s chosen service under its own contract. Customer must assess that recipient, the purposes and permissions it grants, and any international transfer. Disabling a Bulk-hosted AI feature does not necessarily disable every customer-created connection or automation.
Bulk’s service terms do not grant Customer ownership of a provider’s underlying model or guarantee that outputs are unique or free from third-party rights. Customer retains its rights in its own inputs and resulting Customer Data, subject to applicable law and the terms of the relevant service.
Deployment decisions and changes
Before using AI with restricted information, document the permitted features, data categories, providers and downstream recipients, processing locations, provider training/retention terms, transfer safeguards and approval requirements. If the required arrangement cannot be supported, the affected use must remain disabled or the data must not be submitted. Do not treat this notice as approval of a restricted use.
Provider changes affecting Customer Personal Data follow the DPA’s notice and objection process. Contact support@trybulk.app for the arrangement applicable to your deployment or to report an unexpected output or action. Avoid including unnecessary sensitive data in the initial report.