AI Use & Governance Policy

Grow Pro®, Grow_Pro_AI_Use_Policy_v1_1

1. Purpose and scope

What is in the Service today, so this policy is not read as a description of it. Grow Pro® does not currently use an outside AI provider for any customer-facing feature. Sage, the gardening assistant, answers from our own reference tables on our own systems, and nothing typed into it is sent to another company or leaves the UK. There is no plant identification feature. This policy is the standard any AI feature has to meet before it ships, not an account of what is running.

This policy sets out how Gro Pro Ltd designs, deploys and oversees AI, both in the product and in the business. It applies to all directors, employees, contractors and third-party processors who build or operate AI on our behalf.

2. Principles

Useful and safe by default. AI features must produce real value without exposing users to avoidable harm.

Honest about uncertainty. AI outputs are predictions and we say so. Confidence is shown; users are not misled into thinking outputs are guaranteed.

Human oversight. A human is accountable for every AI feature in production. We do not run fully autonomous decisions with legal or significant effect on users.

Privacy respecting. We process the minimum data needed. User data is not sent to third-party model providers in a way that could be re-used to train their models.

Fair. We test models for performance disparities, for example by region or plant family, and act on findings.

Accountable and auditable. Every model release is logged, including data, prompts, evaluation results and known limitations.

3. Permitted product uses

These are the uses allowed under this policy, not the features we have. See section 1.

Plant identification from user photos. Personalised care advice. Growth tracking, reminders and seasonal recommendations. Content moderation. Customer support assistance, with a clear path to a human.

4. Restricted and prohibited uses

Not permitted without explicit written approval from the Director(s) and a fresh DPIA:

• medical, veterinary or psychological advice
• definitive statements about the edibility or safety of foraged plants. The model must default to "not sure, consult a professional"
• facial recognition, emotion recognition or biometric identification
• use of children's data to train or fine-tune models
• real-time or covert surveillance of users
• fully automated decisions with legal or significant effect

5. Data handling

5.1 Training data. We do not use Grow Pro® customer data to train third-party foundation models. Where we fine-tune our own models we use only data we have a lawful basis to use, with personal identifiers stripped or hashed wherever feasible. Data subjects can object to the use of their data for model improvement.

5.2 Inference. No customer data is sent to an outside model today. Where a feature ever does so, it sends the minimum data required, for example a cropped plant image, without account identifiers, and logs are kept only as long as needed for safety, debugging and abuse prevention, then deleted.

5.3 Provider obligations. We use no AI provider today. Before we use one, they must, by contract: not use Grow Pro® data to train their models; meet our security baseline; accept a Data Processing Agreement; host data in the UK or EU by default, or under approved transfer safeguards.

6. Quality, evaluation and disclosure

Every customer-facing AI feature has documented evaluation criteria and a minimum acceptance threshold before release. Confidence is shown in plain language. A clear disclaimer tells users that AI outputs are predictions and not professional advice. We tell users when content is AI-generated.

7. Bias, safety and incident handling

We test models against representative user segments, plant families and regions, and act on disparities. We maintain a feedback channel for users to flag wrong, unsafe or offensive outputs; flagged items are triaged within 5 working days. Material incidents are logged in the Risk Register and treated under our Data Breach Response Plan where personal data is involved.

8. Internal use of AI tools by staff and contractors

Staff and contractors may use approved AI tools for productivity provided no confidential, customer or personal data is entered into a tool that does not meet our standards. Investor materials, financial models, legal documents and customer data must not be uploaded to public AI tools without director sign-off and a confirmed no-training contractual term. AI-generated code must be reviewed and tested before merging; AI-generated marketing copy must be fact-checked before publication.

9. Governance and review

The Founder & CEO is the AI accountable owner. The Director(s) review this policy annually, on any material change, and after any material incident. Significant changes trigger a refreshed DPIA.

Document control

Gro Pro Ltd | Grow Pro® UK Trade Mark No. UK00004034914