Version 1.0 | Effective 21 September 2026
1. Purpose and scope
This policy applies to PluginChatBot accounts, embedded widgets, knowledge sources, generated outputs, messaging channels, integrations and related services provided by NAFCORP PTY LTD. It forms part of the PluginChatBot Terms of Service. It applies to customers and their authorised users. A customer must take reasonable steps to ensure that its configuration and use of the service comply with this policy; it is not automatically responsible for every unsolicited action of an unrelated visitor.
Ordinary permitted uses include business FAQs, product information, customer support, lawful lead enquiries and human handoff. Permission to use a feature is not permission to collect unnecessary personal information, send unlawful marketing or provide regulated advice without the required authority. Statutory rights and our responsibilities under applicable law are not excluded by this policy.
2. Lawful content and conduct
You must not use the service to commit or facilitate an offence, fraud, identity theft, unlawful discrimination, harassment, threats, stalking, exploitation or an unlawful invasion of privacy. You must not create or distribute child sexual abuse material, non-consensual intimate content, terrorist material or other material whose creation, possession or distribution is unlawful. You must not use the service to facilitate violence, self-harm, sexual exploitation or other serious physical harm.
You must not knowingly publish defamatory statements, impersonate a person or business without authority, manufacture deceptive endorsements or reviews, or misrepresent an AI-generated response as a statement personally made or approved by an identified person. AI-generated content must not be used to make misleading claims about prices, availability, qualifications, safety, legal rights or product capabilities.
Do not upload, retrieve, reproduce or distribute content in breach of copyright, confidentiality, trade mark rights or a lawful access restriction. Only connect websites, customer records, accounts and messaging channels you are authorised to use. The ability to access material on the internet does not, by itself, establish permission for every intended use.
3. Personal information and restricted data
Collect only information reasonably necessary for the stated purpose. Provide an appropriate collection notice and obtain any consent or other authority required for collection, use, disclosure and marketing. An enquiry, chatbot message or acceptance of service terms is not automatic permission to add a person to a promotional mailing list.
Do not ask visitors to enter passwords, authentication codes, private keys, full payment-card details, tax file numbers, government identity documents or similarly high-risk secrets into an ordinary chatbot conversation. Use an appropriately secured, purpose-specific channel instead. Do not publish customer conversations, contact details or private knowledge documents to unrelated users.
The standard service is not approved for collecting sensitive health, biometric, genetic, criminal-record or similarly sensitive information, for handling My Health Record data, or for storing regulated clinical records. A specialised use requires our prior written approval and a separately documented assessment of legal obligations, security, access, retention and appropriate notices. Our approval cannot supply a consent, professional qualification or legal authority that you must obtain yourself.
If sensitive information is unexpectedly submitted, restrict access, avoid repeating it unnecessarily, and contact us where assistance is needed to assess and remove or otherwise lawfully handle it. Do not use unexpected disclosure as permission to profile, market to, or train models on that person.
4. AI use and decisions affecting people
Do not configure a chatbot to conceal that it is automated or to impersonate a human professional. Identify AI involvement clearly and provide an appropriate way to reach the business or a human where a response needs review. Synthetic speech must not deceptively imitate a real person.
The standard service must not be the sole or unreviewed decision-maker for medical treatment, emergency response, legal rights, credit, insurance, employment, housing, essential services or another decision with a significant effect on a person's rights or interests. Do not offer regulated professional services through the platform without the necessary authorisation and a separately approved workflow with meaningful human oversight.
Do not configure adult sexual companionship, sexual exploitation, encouragement of self-harm, or other prohibited harmful-content services. Do not design a chatbot to exploit a child's vulnerability, pressure a child to disclose information, or evade applicable age-assurance and online-safety duties. A business-account age requirement is not a substitute for assessing risks to children who may encounter a public widget.
Our AI Usage and Safety Provisions give further requirements for grounding, human oversight and incident reporting. Neither a prompt nor a disclaimer makes an otherwise unlawful activity lawful.
5. Messaging, marketing and integrations
You must have an appropriate basis to send a commercial email, SMS or other regulated electronic message, identify the sender accurately and honour applicable unsubscribe requirements. Do not use harvested address lists or a connected channel to bypass a person's opt-out. Observe applicable messaging-platform permissions and channel rules as well as the law.
Connect only the records and permissions needed for the intended task. Do not use an integration to disclose a conversation to an unrelated workspace, customer, advertising audience or external recipient. Additional uses of connected information require their own lawful basis. A feature described as lead capture does not include a licence to resell personal information.
Do not enable undisclosed recording or surveillance. A future voice or call-recording integration requires assessment of the applicable state, territory and federal rules before use; this policy does not authorise secret recording.
6. Security and resource use
Do not deliberately bypass authentication, access another tenant's records, extract secrets, interfere with availability, deploy malware, perform destructive testing without permission, or use the service for unauthorised scanning or exploitation. Do not manipulate prompts, uploaded documents or tool responses to obtain unauthorised actions or data. Legitimate security reporting and testing authorised in writing are not prohibited by this paragraph.
Do not evade message, website, storage or resource limits by fraudulent accounts, automated account creation or other circumvention. Do not resell credentials or share an administrative account where separate user access is required. Reasonable security testing, accessibility use and ordinary business automation must not be misclassified as abuse merely because requests are automated.
Keep credentials secure, use appropriate user permissions and promptly tell us about suspected compromise. Do not place secrets in public source code, knowledge files, browser-visible configuration or support screenshots.
7. Reporting, investigation and response
Report suspected misuse, harmful AI responses, security concerns or privacy incidents to sales@pluginchatbot.com. Include the affected website or account, approximate time and a description sufficient to investigate. Do not attach illegal material, passwords or an unnecessary copy of sensitive records. Ask for a secure transfer method where evidence is needed.
We may investigate a credible report, restrict a particular function, remove unlawful content, preserve evidence where justified, or suspend the affected account under the Terms. Action will be proportionate to the apparent risk and limited to what is reasonably necessary where practicable. We will normally explain the reason and a way to remedy the issue, unless doing so would be unlawful or materially compromise safety or an investigation.
An urgent, serious risk may require immediate action. Otherwise, we will provide a reasonable opportunity to address a remediable breach. You may request human review of an enforcement decision by replying to the notice or using the contact above. We will correct an erroneous restriction and restore access where appropriate. This process does not prevent a complaint to a regulator or the exercise of statutory rights.
8. Changes
Material changes to this policy follow the notice and fairness provisions in the Terms of Service. We do not use a policy change to retrospectively impose a charge, remove accrued consumer rights or obtain consent to a new processing purpose.