AI data, privacy, and the model

What CLVR sends to the AI model and what it never sends, the Claude model behind every feature, how decisions stay auditable and GDPR-compliant, and where to read the full policy.

Every time you open AI Settings in CLVR, the first thing you see is a purple Data and privacy notice that sits above all the AI toggles. It applies to every AI feature, not just one, and sums up in one paragraph what CLVR sends to the AI model and what is never sent. Its What we send button opens the full lists in the side panel on the right, together with the model, retention, and links to the full policy; close it with the cross in its corner. This article walks through what that panel says, names the model behind each feature, and explains how decisions stay auditable and GDPR-compliant, so you can answer the questions your team will ask before turning anything on.

What data is sent

CLVR sends only the minimum each feature needs to do its job. The side panel lists this under Sent, depending on what you turn on, and what actually goes depends on which toggles you have enabled:

• Receipt images or PDFs, for the report being scanned or evaluated.
• Benefit category names, so the model can suggest the best match.
• Company policy documents, but only when Company file context is on.
• The questions employees type to the CLVR Assistant, together with those documents, but only when the assistant is on.
• The asking employee's own figures (their allowance, their expenses, the benefits they can see, their total compensation, their elections), but only when you also switch on Let the assistant read each employee's own benefit data.
• A receipt an employee attaches to a question, with the same switch. It is read to price it and never stored.
• A text snapshot of a page an employee chooses to share, but only when you also switch on Let the assistant look at a page an employee shares, and only after that employee presses Allow. It is text, not a screenshot, it is sent once, and it is not stored.

If you only have receipt scanning on, no policy documents are involved. The files you upload under Company Files are read by the AI only after you turn on the Company file context card, which sits on its own between receipt scanning and auto-approval. The CLVR Assistant cannot be turned on without it, and the two switches under the assistant card are off until you turn them on as well. Files in the Shared with CLVR folder are read only if you also switch on Let AI read Shared with CLVR on that card. Then the CLVR Assistant answers from them too, and auto-approval judges receipts against the PDFs in it. That means your employees can ask the Assistant about what is in those files, even though they cannot open them, so leave the switch off if the folder holds payroll exports, contracts or anything else employees should not read.

What is never sent

The panel is just as explicit about what stays inside CLVR. Under Never sent, it lists:

• One employee's data to another employee's assistant. An HR user's own assistant also answers about your company, from the same records the Employees, Expenses and Reporting pages already show them; an employee who is not HR cannot ask about a colleague, however the question is phrased.
• Another company's data, in any feature.
• Personnummer, and anything typed into a password field on a page an employee shares.

So a receipt is evaluated on its own, with the relevant category names, and nothing about the person who submitted it or any of their other claims travels to the model. With the two switches under the assistant card off, the assistant reads the documents under Company Files and nothing else: no balances, receipts, salaries or employee data. Turn them on and it also reads the asking employee's own figures, a receipt they attach, and a page they choose to share, all listed above.

Who can see a conversation

• The employee reads their own chats and can delete any of them. They are deleted automatically 90 days after the last message.
• You do not. What you see is the questions the assistant could not answer, grouped by wording and without names, on the CLVR Assistant card, so you can see which policies are missing or unclear. Conversations are also left out of the data export a company receives at the end of its contract, because they were never yours to read.
• CLVR staff can, for one purpose: to check the answers and improve the assistant. Every time a CLVR account opens a conversation, that is recorded in our own audit log, with who opened it and whose it was. A chat the employee deletes is gone for us too.

The AI model behind each feature

Every AI feature in CLVR is powered by Claude from Anthropic. The last part of the panel, Model and retention, names the model and the handling rules in one place:

• AI features are powered by Claude (Anthropic).
• Only the minimum data needed for each feature is sent.
• Your data is not used to train models.
• CLVR retains only what is necessary for the features to work and for audit compliance.

All four features use the Claude Haiku model from Anthropic. There is no separate provider or model to choose, and nothing for your HR team to configure beyond turning each feature on. The cards sit in two groups on the page:

• Under Expenses: Receipt scanning reads an uploaded receipt and pre-fills the expense form, and Auto-approve expense reports evaluates wellness (friskvård) reports and approves, declines, or defers them. Auto-approval needs receipt scanning to be on.
• Under Documents and the assistant: Company file context reads the text of the files you upload under Company Files (PDF, Word, Excel, CSV), once when you switch it on and again for every new upload. Only the text is stored. Auto-approval uses it to judge receipts against your policies, and the assistant answers from it. CLVR Assistant gives employees an Assistant tab in their account panel where they can ask about your company's policies. It needs Company file context to be on, and the card is only shown to companies where CLVR has made the assistant available. Two further switches sit under that card, each off until you turn it on: Let the assistant read each employee's own benefit data and Let the assistant look at a page an employee shares.

A person stays in the loop

When AI auto-approval is on, CLVR can approve or decline wellness reports in seconds, but it never takes a person out of the loop. Your HR team has full access to every expense report and can review, revert, or override any AI decision at any time.

• Decisions where AI confidence is below 85% are automatically deferred to manual review, so a borderline call always lands with a person.
• Approved and declined reports both show an AI decision card in the HR expenses view, with the confidence score and the reasons behind the call.
• Any decision can be undone with Revert AI Decision, which sets the expense back to Pending for manual review.

This is the human-in-the-loop principle that GDPR Article 22 asks for: a customer is never left subject to a purely automated decision with no way for a person to step in.

Every decision is logged

Each time AI evaluates a report, CLVR stores a full record of the call:

• The decision (approved, declined, or deferred).
• The confidence score, from 0 to 100.
• The reasons, up to three short bullet points.
• The decline reason, when a report is declined.
• The exact AI model version used for the evaluation.

When your HR team reverts a decision, that is recorded too, including who reverted it, when, and the reason they typed in the Why are you reverting this decision? box. Nothing is overwritten, so the trail of what AI decided and what a person changed stays intact. Receipt scans are also recorded against the employee and report, so there is a history of what the AI suggested.

Employees can push back

A declined report is never a dead end. The employee who submitted it can:

• Open the report, read the decline reason, fix the issue, and use Edit & Resubmit to send it for review again. Resubmitting puts it back through the normal approval flow.
• Contact your HR team directly, who can revert the AI decision and review it by hand.

Transparency you can point to

AI use is disclosed in three places, so nothing is hidden:

• The AI Settings page itself, under How auto-approval works and Data and privacy.
• Your CLVR privacy policy, for how CLVR handles personal and company data.
• The CLVR Trust Center, for security and compliance information.

Both documents open in a new tab from the AI model and processing text. Changes to the AI toggles are also recorded as settings changes for your company, so there is a record of when a feature was turned on or off, and by whom.

Good to know

• The notice and the side panel do not change based on your toggles: they always describe the full set of what may be sent. So the lines about company policy documents apply only once Company file context is on, the line about employees' questions only once the CLVR Assistant is on, the lines about an employee's own figures and an attached receipt only once you allow employee data, and the line about a shared page only once you allow that.
• Turning Company file context off also turns the assistant off, and turning receipt scanning off also turns auto-approval off. Turning auto-approval off leaves Company file context as it is.
• Reading the notice or the side panel changes nothing. They are informational, and turning a feature on or off is a separate, deliberate action that you confirm with Save changes.
• AI is an optional capability tied to your environment. If it has not been set up, receipt scanning returns a short "not configured" message instead of scanning (the employee fills in the form by hand), and auto-approval is skipped silently (the report follows the normal review route to your approvers). Nothing breaks: expenses are still uploaded, reviewed, and reimbursed, just without the AI assist.

Troubleshooting

• Which model is running? Claude Haiku from Anthropic, for all four features. There is no model picker.
• I need to undo an AI approval or decline. Open the report in the HR expenses view and select Revert AI Decision. A reason is required, and the expense returns to Pending for manual review.
• An employee disagrees with a decline. They can correct the report and use Edit & Resubmit, or you can revert the decision and review it by hand.
• I want to show our DPO what AI receives. Open AI Settings, select What we send in the Data and privacy notice, then link them to the privacy policy and Trust Center for the full detail.