AI and Data Use

Last updated: October 6, 2026

Current status: the public contact form routes a request for human follow-up and does not use AI. Stelo staff use AI-assisted extraction to read documents uploaded for a funding request and propose values for staff review, and AI transcription and summaries of recorded funding calls. AI sorting of email from the mailboxes of Titanova and Arcadia, the affiliated brokerages Stelo owns, and AI reading of the files attached to that email or linked from it in Google Drive run only while Stelo's read-only link to those mailboxes is switched on; while it is off, nothing from them is read. No AI system estimates, scores, approves, declines, or prices funding. Transaction classification, risk models, and offer optimization are under development and must not be represented as active until deployed and reviewed. Bank data from Stripe Financial Connections is not sent to AI providers and is never used to train models.

Document extraction

What is processed: documents Stelo staff upload to the private staff workspace for a funding request, such as applications, bank statements, identification, voided checks, submission emails, payoff letters, credit reports, tax returns, profit-and-loss statements, balance sheets, accounts-receivable records, and screenshots of DataMerch merchant-screening entries and court or lien search results. These can contain personal information, identification numbers, bank account details, and reported screening, judgment, or lien information about the business and its owners. Extracted screening and search entries are treated as reported information, not verified findings.
Who processes it: Cloudflare stores the encrypted original and prepares its pages, rendering PDFs in a private container without internet access. Page images or text, the document type, and the requested fields are sent through OpenRouter to the DeepSeek V4.1 Flash model hosted by DeepInfra. File names and internal record identifiers are not included. Requests are restricted to that one host, with fallbacks, model tools, and external OCR disabled.
Provider settings: each request asks for zero-data-retention routing and sets provider data collection to deny. These are request settings; each provider's own terms govern its handling. OpenRouter keeps request metadata, and Stelo has not selected a guaranteed processing region.
Banking logins: staff send a document to extraction only after confirming it contains no online-banking usernames, passwords, or security answers. Other documents are stored and previewed privately and are not sent to AI providers.
Staff review: each proposed value shows its source page. Staff accept, correct, or reject it; only staff-reviewed values become deal facts or are applied to a funding record. Model output is proposed data only; it cannot send messages or change records, and extracted values do not establish identity or funding.
No decisions or training: extraction does not approve, decline, score, or price funding. Stelo does not currently use uploaded documents or extraction results to train AI models.

Funding-call transcription and summaries

What is processed: recordings of funding calls that Stelo staff upload to the private staff workspace. Staff record a call only after telling the participants it is being recorded. A call can include names, contact details, business and financial information, amounts and payment terms discussed, and any identification or account numbers someone says out loud.
Transcription: Cloudflare stores the encrypted recording and sends its audio to Cloudflare Workers AI, where the Deepgram Nova-3 speech-to-text model hosted by Cloudflare writes it down with speaker turns and timestamps. Stelo's requests ask to opt out of Deepgram's model-improvement program. The transcript is stored encrypted next to the recording.
Summary: the transcript text, with Social Security, account, routing and similar numbers masked and speakers shown as generic labels, is sent through OpenRouter to the DeepSeek V4.1 Flash model hosted by DeepInfra, with the same provider settings as document extraction. It returns a short summary and the details discussed on the call, such as what the money is for, amounts and payment terms discussed, what the merchant said they would do, and things to double-check, each linked to the moment in the call.
Staff review: staff can play the call from any cited moment. Amounts and terms are shown as discussed, never as approved or funded values. What the money is for is only a suggestion; it is added to a deal only when staff tick it and confirm. Masked numbers are shown only when staff press Show, and each reveal is logged.
No decisions or training: transcripts and summaries do not approve, decline, score, or price funding, and Stelo does not use call recordings or transcripts to train AI models.

Email from Titanova's and Arcadia's mailboxes

What is processed: email in the work mailboxes of Titanova and Arcadia, the affiliated brokerages Stelo owns, whose reps send funding requests to Stelo and to funders, and the files attached to it, such as bank statements, applications, identification, voided checks, tax returns, and offers, contracts and declines from funders. While Stelo's read-only link to Drive files is switched on, Stelo also opens Google Drive, Docs, Sheets, Slides and Drawings files linked in that email, read-only and with the access of the person whose mailbox received it; it never browses or lists anyone's Drive and never opens linked folders, Google files are copied as PDFs, and a file it can't open is noted, not requested. Emails and attachments can include names, contact details, identification and bank account numbers, business and financial information, amounts requested or offered and payment terms. Each brokerage grants Stelo read-only access in its own Google Workspace and tells its reps in writing before Stelo's link to its mailboxes is switched on; Stelo reads them only while that link is switched on, and cannot send, change or delete any email.
Rules before any AI: fixed rules, not AI, first set aside newsletters and mailing lists, sign-in codes, calendar invitations, automatic replies, lawyers' email and internal chat with no deal in it. Any email whose text looks like it contains online-banking usernames or passwords is held back with its attachments: none of it is stored by Stelo or sent to an AI provider.
Who processes it: Cloudflare stores the remaining emails encrypted. The subject and text, with Social Security, account, routing and similar numbers masked, and the attachment names are sent through OpenRouter to one of two models hosted by DeepInfra, DeepSeek V4.1 Flash or GLM 5.3 Flash, with the same provider settings as document extraction; Stelo chooses which one reads this email and may let the other one try once when the first returns an unusable answer. To choose between them, Stelo may have the second model read the same stored sample of emails and attachments once more; its answers are stored encrypted, are seen only by Stelo administrators, and are used only to compare accuracy and cost. The model is told the email is data, never instructions; it has no tools and cannot reply or send anything. It returns a proposed label, such as a submission, an offer, a decline or a funded notice, and proposed details such as the business name, amounts, factor and term, with short quotes from the email.
Attachments and linked files: Cloudflare stores each attachment, and each file fetched from a Drive link, encrypted, once per file. Bank statements, applications, offers, contracts and declines from funders, and PDFs that can't be sorted by name are prepared like documents staff upload and their page images or text are sent, once per file, on the same route to the same model with the same provider settings, to read figures such as statement totals and balances, the terms of an offer or the reason for a decline. Before any file is sent, fixed rules check the text of every page for online-banking login details and hold the file back if they find any; applications that are only scanned images, and unsorted PDFs that are scans or whose text shows identification, check, tax-return or Social Security number details, are also kept but not sent. Files whose name or email marks them as identification, voided checks or tax returns are stored but never sent to an AI provider. Password-protected files are not opened.
Lead tracking and underwriting records: using the same keyed codes and the proposed details, Stelo groups these emails automatically into one record of each business's funding request across both brokerages and Stelo's website, from first email to funded, declined or closed, which staff can correct, and keeps an internal underwriting dataset of funders' offers and declines, statement figures and outcomes. Its export leaves out names, contact details, and tax ID and account numbers. These records are kept in Stelo's Cloudflare account for Stelo's own lead tracking and future underwriting; they are not sold or shared, they do not create or change a lead or deal, and they do not decide anything.
Staff review: nothing becomes a lead or is linked to a deal until Stelo staff confirm it. Matches to existing leads and deals use keyed codes of email addresses, phone numbers and tax ID numbers, never the numbers themselves, and are only suggestions. Staff see the email text only when they choose to view it, with restricted numbers masked, and each view is logged. Counts of confirmed submissions, offers, declines and funded deals per Titanova or Arcadia rep are internal reports only.
Spending limits: Stelo sets a daily limit and a monthly spending limit for this use, counting emails and attachments together; when either is reached, AI reading pauses until it resets.
No decisions or training: email and attachment reading does not approve, decline, score, or price funding, and Stelo does not use these emails, their attachments, files linked from them or the underwriting records built from them to train AI models; any future training requires separate approval.

Other permitted uses, not yet active

Classify revenue, transfers, financing proceeds, remittances, payroll, taxes, NSFs, and other transactions.
Detect duplicates, inconsistencies, stacking, fraud indicators, cash-flow trends, and missing data.
Generate reviewer summaries, reason codes, and quality-control flags.
Estimate performance, expected collections, capacity, or economics using validated structured models.

For any of these uses, bank data received through Stripe Financial Connections is not sent to an AI provider and is never used to train a model.

Prohibited uses

No online-banking usernames, passwords, or security answers may be entered into any AI tool.
No AI provider may receive applicant information unless it is listed in the Subprocessor Register.
No generative model may invent revenue, outcomes, documents, testimonials, or adverse-action reasons.
No final adverse decision may rely solely on an unvalidated generative-model output.
No historical repayment information may be used as a pre-funding feature, and no post-decision data may leak into training features.
No vendor may train its general model on applicant data unless a specific lawful basis, contract, notice, and approval exist.
No bank data received through Stripe Financial Connections, or anything built from it, such as bank summaries, monitoring figures, findings, and alerts, may be sent to an AI provider or used to train any model.

Training controls

Stelo does not currently train AI or statistical models on applicant data; future training requires separate approval. Bank data received through Stripe Financial Connections, and anything built from it, is never used for training. Raw files remain in restricted local or private object storage. Model-ready datasets use tokenized merchant and account identifiers, derived features, versioned labels, merchant-grouped time-based validation, and documented lineage. Selection bias is measured because repayment outcomes are generally known only for funded deals.

Human oversight and explanations

Reviewers must be able to inspect the source period, classifications, feature values, model and rule versions, reason codes, disclosure version, and decision timestamp. Applicants may ask questions or report inaccurate input data at privacy@updates.stelopartners.com.

AI chat and safety

Stelo does not currently operate a public AI chatbot. A chatbot may not launch without identity and scope disclosures, prompt-injection and data-loss controls, crisis/self-harm response handling where relevant, human escalation, retention rules, and vendor review.