AI and Automated Analysis Policy

The short version

Most of what SailCoach does is arithmetic, not artificial intelligence. GPS tracks, race results and training records are turned into charts and sentences by code that always produces the same answer from the same input.

A small number of features do send text to an AI model. There is exactly one provider — Anthropic — and five places where we use it. They are listed in full below, with what gets sent and who sees the result.

Two parts of the app used to be labelled "AI" when they were not. That framing has been removed, and the rule from here is simple: anything we call AI will be AI, and anything a model wrote will say so.

The part of SailCoach that makes the most consequential judgements about a young sailor — the Helm Grade and the "ready for bigger fleets" verdict — uses no model from any provider. It is statistics. Whether statistics of that kind count as an "AI system" under the EU AI Act is a real question and section 7 answers it honestly rather than conveniently. Either way it is not harmless, so section 5 sets out binding limits on what it may be used for.

This policy is published by Innovology Ltd, trading as SailCoach. Read it alongside the Privacy Policy, the Subprocessors list and Your Data Rights.

1. Our principles

These are commitments, not ambitions. Each one is testable, and we expect to be held to it.

1. We label honestly in both directions. If we say a feature uses AI, it uses AI. If a model generated the words you are reading in the app, the app will tell you. The first half is true today. The second half is not true everywhere yet, and section 3 says exactly where it falls short.
2. No model is trained on your data. Not by us, and not by our provider under the commercial terms we use. We do not sell, license or contribute your data to anyone's training set.
3. A number never decides something about a child on its own. Every rating, band and verdict in SailCoach is advisory. A human decides.
4. We do not tell a struggling child they are struggling. Where a sailor's results are below the middle of their fleet, the platform produces no evaluative headline at all.
5. We do not dress a percentile up as a rank it has not earned. No grade band gets a name like "national" or "international" until we can show the rating actually predicts results.
6. We send the least we need to. No sailor is named to our AI provider on any path, and no coach is named either. None of these tasks needs a name, so none of them gets one.
7. You can always ask why, and ask a person. Any analysis we show about you can be explained, challenged and reviewed by a human being.
8. Turning it off is one setting. Every AI feature fails soft. With the model key removed, SailCoach still works, entirely deterministically.

2. Where we genuinely use AI

We use one provider: Anthropic, and one model family: Claude Haiku, called over Anthropic's commercial API from our own servers. There is no other model provider in the product — no OpenAI, no Google model, no self-hosted model, no model we have trained ourselves.

There are five uses.

What we are honest about here

Features 1 and 2 used to send the sailor's name, and feature 2 used to send coaches' names. They no longer do. In the same release as this document, the code that looked the name up and put it in the request was removed, and no name is now built into any prompt on any path. One loose end, because we would rather name it than let you find it: the two functions still accept a sailor-name argument, marked in the source as deliberately ignored and never interpolated. No part of the product passes one, and a test deliberately passes a name and fails if it reaches the prompt — but "accepted and ignored" is a weaker guarantee than "gone", so removing the argument outright is on our remediation register. The table above is the description as the software runs today.

The text itself still identifies a child, and we do not pretend otherwise. Removing the name does not make a coach's paragraph about one young sailor anonymous. It is still personal data about that sailor, it is still going to the United States, and it is still covered by the transfer section of the Privacy Policy. What the change buys is that nobody at the other end is handed the name alongside it.

On feature 4, "names stripped out" is pseudonymisation, not anonymisation. The stripping replaces the names of the sailors in that session, and then catches capitalised words in the possessive form — "Sam's" becomes "[SAILOR]'s". A name used in any other position is not caught: "Sam was late" goes through untouched. It is a crude heuristic, and a nickname, a sail number or a distinctive detail can still identify someone to a reader who knows the group. We describe it as a risk-reducing step, not as anonymisation, and we treat the data as personal data throughout.

Access to feature 1 used to be too broad. The endpoint that analyses a stored piece of feedback now applies the same rules as reading that feedback: the coach who wrote it, a system administrator, an administrator of the sailor's own club, or the sailor themselves — and a sailor cannot use it to read coach-only feedback about themselves. Features 2 and 3 require that you are the sailor, an administrator, or connected to them, and neither folds another coach's private notes into what it sends. The one endpoint that checks only that you are signed in is the one that analyses text you typed into the request yourself; there is no stored record there to authorise.

Features 1, 2 and 3 have no screen in the app at all. They exist as API endpoints. When they get a screen it will carry a machine-generated label from the start, under principle 1. Features 4 and 5 are the two you can actually reach today.

The provider relationship

• Anthropic processes this data in the United States. International transfers are covered in the Privacy Policy and the vendor is listed in Subprocessors.
• Under Anthropic's commercial API terms, inputs and outputs are not used to train their models. We rely on that contractual position rather than on a technical guarantee we have configured ourselves.
• We have not configured a zero-data-retention option on our account, so provider-side retention is whatever Anthropic's commercial terms specify for API traffic.
• We have not yet completed a data processing agreement with Anthropic. We are saying that plainly rather than implying one exists. Putting it in place is an open action on our remediation register, and we will update this policy — and the Subprocessors list — when it is signed.

Switching it off

All five features depend on a single API credential. If that credential is not configured, every one of them either disappears or falls back to plain deterministic text handling, and the rest of the platform is unaffected. There is no AI dependency anywhere in the core of the product.

3. Where we do not use AI, despite appearances

This section exists because misdescribing ordinary software as AI is its own kind of dishonesty — it misleads you about what the product is, and it makes the rest of this policy untrustworthy.

The coach reflection on race data is not AI

The written reflection you get after a tracked race — the paragraphs about your start, your first beat, your mark roundings — reads like something a machine wrote. It is not. The numbers come from geometry over your GPS track, and the sentences come from fixed templates filled in with those numbers. No model is involved, nothing is invented, and the same race will always produce the same words. The output carries a machine-readable marker recording that it was templated, and if that ever changes to a model-generated version, the label in the app will change with it.

Two features carried AI framing with no AI behind it

• The "AI Insights" card on the training progress page was threshold logic. Three sessions a week gets one message, one and a half gets another, fewer gets a third. There is no model.
• The session summary is built by joining sentences together, and the interface showed an animated sequence — "reading feedback", "identifying patterns", "writing insights" — on a fixed timer while it did so. That animation was theatre. Worse, coaches are encouraged to share that summary with parents and clubs, so the misdescription travelled.

Both were corrected in this release. The card is now called "Training Patterns" and says it is counted from the sessions you logged in the last 60 days. The session summary gets an ordinary loading spinner. The animated sequence survives in one place only: over the group-session insights in section 2, feature 4, which is a real call to a real model.

The rule going forward

Anything labelled AI will be AI. Anything generated by a model will be labelled. The way we intend to keep that promise is a provenance marker on every generated output, with the interface taking the label from the marker rather than from a designer's choice — so a future decision to swap templated prose for a model becomes a visible change, not a silent one.

Be clear about how far that has got. One output carries a marker today: the race reflection, which records that it was templated. The tidied voice note, the feedback analyses, the group insights and the session summary do not carry one, so their labels are still set by hand, and a label set by hand can drift. Extending the marker to all of them is work we have started and not finished.

4. Speech recognition when you dictate

When you dictate a note, the transcription is done by your browser's built-in speech recognition, not by us.

That matters, because in Chrome and other Chromium-based browsers, the browser streams your audio to Google's servers to turn it into text. That happens between your device and Google. It does not pass through our servers, we have no contract with Google covering it, and we cannot see or control what Google does with it. Our own source code used to describe this feature as involving no upload. That was wrong, and we have corrected it.

If you then use the tidy-up feature on the resulting transcript, the text is sent to Anthropic as described in section 2 — feature 5. Your audio never is.

How to avoid it entirely: type instead of dictating. Every place in SailCoach that offers dictation also accepts typing, and browsers without speech recognition simply show a text box. Nothing is lost except convenience.

If the person dictating is a child, we would ask parents and coaches to make that choice deliberately. The Privacy for Young Sailors note explains the same point in plainer words.

5. Ratings and verdicts about people

This is the part of the platform that makes evaluative judgements about young sailors. No model from any provider is involved. All of it is statistics, of a published kind, and section 7 deals with whether the EU AI Act would nonetheless call it an AI system. The regulatory label matters less than what it does, so we set out what it does, fully.

The Helm Grade

The Helm Grade is a rating, calculated with a published statistical method (an OpenSkill / Weng-Lin Plackett-Luce model — closely related to the ratings used for chess and for online game matchmaking).

In plain terms, it keeps two numbers for each sailor in each family of boat:

• a best estimate of how you are racing, and
• how sure it is of that estimate.

Every race result nudges both. Beating people the model rated above you moves your estimate up; beating people it already expected you to beat moves it very little. The more races there are, the more confident the model gets — and if you stop racing, it becomes deliberately less confident again, because a rating from two years ago should not be treated as current.

What it is computed from:

How it is shown: as your position along a ladder of five unnamed segments, with a visible halo showing the uncertainty. The halo is not decoration. A wide halo means "we do not really know yet", and the interface is built so that you cannot read the number without also seeing how sure it is. Early ratings are marked as still settling.

Who can see it: you; a system administrator; an administrator of your club; your parent or guardian if you are a minor linked to them; and a connected coach only if you have shared your events data with them. It is not public, and it is not on any leaderboard.

The headroom verdict

Alongside the grade, the platform may show one short verdict — things like "Ready for bigger fleets", "You've cleaned out this fleet", or "Plenty to win here".

"Ready" only appears when four separate tests all pass:

1. Dominance — even the cautious end of your rating puts you in roughly the front tenth of the sailors you race against.
2. Evidence — the rating has settled and there are at least five official results behind it.
3. Saturation — your recent races have stopped teaching the rating anything new.
4. A real fleet — at least one recent event with fifteen or more boats. A six-boat event called a championship is a club race whatever the entry form said.

Where the verdict is "ready", the platform lists the actual events the conclusion rests on — name, finishing place, fleet size and month — so a coach or parent can look at the evidence rather than the label.

What it does not yet do is show you the four tests. The platform works out which of them passed and sends that with the verdict, but no screen displays it. The thresholds are published above and you can check them against your own results; ask us at [email protected] and we will tell you which test failed. Putting the four tests on the card is work we owe you, and it is why the sentence below says "we publish" rather than "we display".

It is advisory. It suggests that trying a bigger event might be worthwhile. It does not enter you for anything, select you for anything, or tell anyone to.

Binding limits

These six limits are how we keep a statistical system about children from becoming something it should not be. They are commitments, not internal conventions, and changing any of them requires a published update to this policy.

• Grade bands stay unnamed until calibration is published. We will not call a band "national" or "international" until we can publish evidence that the rating genuinely predicts results at that level. A percentile is a position, not a title.
• No evaluative verdict is shown to a sailor below the threshold. Below roughly the middle of the fleet, the platform produces no normative headline at all. A child is never told by a machine that they are behind.
• A step up is protected. Once "ready" has fired and a sailor races a genuinely bigger fleet, their first events at that level are held in a neutral "learning this level" state for up to two events or ninety days — so a mid-fleet result at a much harder regatta can never be displayed as going backwards.
• Self-reported results can never arm a promotion signal. They inform the rating at reduced weight; they cannot, on their own, produce a "ready" verdict. That commitment stands, and we are keeping it — but we have to tell you that the code does not yet honour all of it. The evidence test requires at least five results that came from a published result sheet or a tracked fleet, and a self-report is never one of those, so no amount of self-reporting gets you past it; a self-report is also blocked from narrowing the uncertainty by more than a token amount. The saturation test is the problem. It asks whether your recent results have stopped moving the rating, and it is currently computed over every result, self-reported ones included. Because a self-report moves the rating by only about a quarter of what a real race does, logging them makes that one test slightly easier to pass rather than harder. It is a real gap between this page and the software, we found it by auditing this page against the code, and we are fixing the calculation rather than editing the promise.
• Ratings and verdicts must not be used as the sole basis for squad selection, team picks or event entry. This applies to us and to any club using the platform. We publish the underlying tests and their thresholds here, and the platform shows the exact supporting events, precisely so a human can interrogate the conclusion rather than defer to it.
• Squad grading levels are awarded by a human coach. Every level in a squad programme records who set it and whether a human has confirmed it. No algorithm awards, infers or removes a grading level, and the grouping tools only sort on what a human has already decided.

Other scores in the platform

A few smaller deterministic measures exist: a connection health score that measures how active a coaching relationship is, comparisons of places gained upwind versus downwind, head-to-head counts against regular rivals, and start-quality classifications from GPS geometry. These grade an activity or a relationship rather than a person's worth, they are visible only to the sailor and people they have shared with, and rivalry framing is hidden entirely for sailors under 13. The connection health score currently uses the phrase "at-risk" for an inactive coaching relationship; that wording is wrong for a platform used by children and we are changing it.

6. Automated decision-making and your rights

Under UK and EU data protection law (Article 22), you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

SailCoach makes no such decision. We looked for them specifically. Nothing in the platform automatically selects a squad, picks a team, enters an event, awards or removes a grading level, or grants or withdraws anything of consequence. Access to data is decided by who you are and what you have chosen to share, never by a score.

Two things do happen automatically, and we would rather name them than claim there are none. A connection invitation is accepted when you open a valid link you are already holding. And a message containing abusive language is flagged so that a club administrator reads it. Neither produces a legal or similarly significant effect: the second is the trigger for a human review, not a decision.

The honest caveat. The headroom verdict is advisory inside the platform, but if a club adopted "the platform says ready, so they go up" as an automatic rule, the decision would become automated in practice even though our code never made it. That is exactly why the fifth limit in section 5 exists, and why we publish the tests and the supporting events rather than just the headline. If you are a club using SailCoach, that limit is a term of your use of it — see the Terms.

Your rights in this area. You can:

• ask for an explanation of any rating, band or verdict we show about you, including which inputs produced it;
• challenge an analysis you believe is wrong, including AI-generated summaries of feedback about you;
• ask for a human review of anything the platform has concluded;
• ask us to correct or delete the underlying data, which changes the output.

Write to [email protected]. The full set of rights and how to use them is in Your Data Rights.

7. Our position under the EU AI Act

Some of our users are in the EU, so the EU AI Act applies to us. This is our assessment, in plain terms.

First, which hat we are wearing. For the five features in section 2 we are a deployer of somebody else's model — Anthropic is the provider. For the Helm Grade and the headroom verdict, which we built, we would be the provider if they are AI systems at all. The obligations differ, so the distinction matters.

We do not operate a high-risk AI system under Annex III. The reasoning rests on two grounds, one of which is genuinely arguable and one of which we think is solid.

1. Whether the rating is an "AI system" at all is arguable, and we are not claiming it is settled. The Helm Grade is a published Bayesian rating method: it fits a skill estimate from observed results and predicts from it. The fact that it is deterministic and that anyone can reproduce it from the observation log does not help us, because neither is a criterion in Article 3(1) — adaptiveness is expressly optional there, and what the definition turns on is whether the system infers how to generate outputs such as predictions. The Commission's February 2025 guidance on the definition places Bayesian and statistical-learning approaches inside it. Our view is that a fixed, published estimator applied without adaptation sits at the edge of the definition rather than comfortably outside it. Nobody should read this section as us saying the question is closed. The headroom verdict is a different matter: it is four hard thresholds written by people, applied to the rating's output.
2. The activity is recreational sport, not education or vocational training. The Annex III education category is aimed at schools, colleges and vocational institutions where outcomes gate qualifications, admissions or jobs. A junior sailing squad grade confers no qualification, no academic credit and no employment consequence. The honest complication is RYA certification, and we would rather name it than leave it for someone else to find. Clubs using SailCoach are often RYA recognised training centres; two of the grading schemes we ship are the RYA National Sailing Scheme and RYA Youth Racing; and the platform records coaches' RYA qualifications. We think a squad grade is still not an "appropriate level of education" in the Annex III sense, but we are not going to pretend that a sport with a national certification ladder is plainly outside the education category.

Human oversight, which is a mitigation and not a classification argument. The one thing in the platform that genuinely determines which group or level a sailor is in — the squad capability record — is set and confirmed by a coach, and the record stores who set it and whether a human confirmed it. That does not by itself take a system out of Annex III: human oversight is what Article 14 requires of a high-risk system, not an exemption from being one. We list it because it materially reduces the risk, not because it settles the tier.

The weakest point, stated rather than hidden. A regulator could reasonably characterise keeping a per-sailor rating as profiling — evaluating personal aspects to analyse performance — and under the AI Act that characterisation matters more than it looks. Article 6(3) normally lets an Annex III system out of the high-risk tier where it performs only a narrow procedural or preparatory task, but its final paragraph shuts that door where the system performs profiling. So the usual escape route is not available to us. If we are wrong that the Helm Grade is outside the definition of an AI system, and wrong that a sailing squad is outside the education category, the conclusion flips straight to high-risk with no derogation to fall back on. We think we are right on both. We also think you are entitled to know how narrow the ledge is, which is why the DPIA treats these systems as high-scrutiny regardless of their AI Act tier.

Transparency. Article 50 is narrower than it is often quoted as being. The machine-readable marking duty for synthetic content falls on the provider of the generative model, which is Anthropic. The text-disclosure duty on a deployer is confined to text published to inform the public on matters of public interest, which coach feedback is not. So Article 50 does not, strictly, require us to label the outputs in section 2. We are going to label them anyway, because principle 1 says we will and because a coach reading a machine's summary of a child's feedback should know a machine wrote it. Today the dictated-note feature says so on the screen you press the button on. Features 1, 2 and 3 have no screen yet. Group insights shows a model-is-working animation while it runs, but the text it produces carries no label once it is sitting in the debrief. That last one is the gap.

We will re-run this assessment if any of the limits in section 5 change — in particular if named grade bands ship, or if any deployment wires a verdict to an automatic selection decision. Either of those would make the "appropriate level of education a person can access" limb of Annex III a live question, and we would rather reach that conclusion ourselves than have it reached for us.

8. Human oversight, accuracy, and how to challenge something

A coach's judgement beats the platform's number, always. A rating is a summary of results in the fleets you happened to race in. It knows nothing about the day you sailed brilliantly in a boat that was falling apart, or the season you spent fixing a technique flaw at the cost of results. Anyone using SailCoach to make a decision about a young sailor should treat its output as one input to a conversation, not as the conclusion.

Known limits of the analysis:

• AI summaries of coach feedback can misread tone, miss context and occasionally state something the feedback did not say. Treat them as a first draft, not a record. The original feedback is always kept and is always the authoritative version.
• Ratings from few races are genuinely uncertain, which is why the uncertainty is drawn on the chart.
• Results we ingest from published race results can contain errors, mis-spelled names, or two sailors sharing a sail number. Those errors flow into the rating.

To challenge an analysis, a rating or a verdict:

1. Email [email protected] (or [email protected] if you prefer), saying what you are challenging and why you think it is wrong. A parent or guardian can do this on behalf of a young sailor.
2. We reply within five working days to confirm we have it and tell you who is looking at it.
3. A person — not an automated process — reviews it, checks the underlying data, and responds with a decision within 30 days.
4. If data is wrong, we correct it and recompute. If an AI-generated summary is misleading, we delete it. If the disagreement is about method rather than data, we will explain the method and say plainly whether we are changing it.

If you are not satisfied with how we handle it, you can complain to us through the Complaints procedure, and to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

9. AI in building SailCoach

We use AI coding assistants to help write and review the software. That is disclosed here because it should be, not because it affects your data.

• Those tools work on source code, documentation and GitHub activity. They do not process customer records.
• Our automated tests and build pipelines never touch production data; every test run creates its own empty throwaway database, and a build-time check fails the build if a developer's machine is pointed at the live system.
• No customer data is used to train any model, ours or anyone else's — by us, by our AI provider, or by our development tooling.

We hold ourselves to the same rule internally that we publish externally: a human is accountable for every change that ships, regardless of what helped write it.

Questions, and how this policy changes

If something here is unclear, or you think something in the product does not match what this document says, tell us — [email protected] for data questions, [email protected] for anything else. If it is a safeguarding concern about a young sailor, [email protected].

We will publish an updated version of this policy when any of the following happen: we add or remove an AI feature; we change model provider; we complete the data processing agreement with Anthropic; or we change any of the binding limits in section 5. Older versions stay available so you can see what changed and when.