Version 1.0 | Effective 21 September 2026
1. Scope and responsibility
These provisions supplement the Terms of Service and Acceptable Use Policy for AI features supplied by NAFCORP PTY LTD through PluginChatBot. They address AI-generated answers, knowledge retrieval, summarisation and supported synthetic speech. They apply only to features actually included in the customer's service, not every capability an upstream provider may offer.
PluginChatBot is intended to assist with business information, enquiries and support. It is not a human professional, emergency-response service or a guarantee of a correct result. The customer remains responsible for the lawful purpose and configuration of its bot, and NAFCORP remains responsible for its own service, representations and non-excludable obligations. An AI disclaimer does not excuse misleading conduct, inadequate security or a failure to meet applicable consumer guarantees.
2. Tell people when they are interacting with AI
The chatbot must identify itself as an AI or automated assistant in a clear, timely and accessible way. Its name, avatar, wording and voice must not falsely imply that a particular human is personally responding. Synthetic speech must be identified where needed to prevent deception, and must not impersonate a real person without appropriate authority.
The business operating the bot must be identifiable. Visitors should be able to find a relevant privacy notice and a practical contact or review route. A human-handoff option must accurately state its availability; an offline message or business contact may be appropriate when no person is available. Do not promise live assistance at all times unless it is actually staffed or otherwise supplied as promised.
3. Appropriate and restricted uses
Ordinary uses include explaining published business information, helping a visitor find a service or product, collecting a necessary enquiry and referring a matter to a person. A bot may provide general administrative information for a regulated business only within an assessed, approved scope; describing a clinic's opening hours is different from diagnosing a patient.
The standard service must not independently determine treatment, emergency action, legal entitlements, credit, insurance, recruitment, employment, housing, access to essential services or a comparably significant outcome. A high-impact or regulated use needs prior written approval, an assessment of the relevant laws and professional authority, defined human accountability, suitable evidence and controls, and a meaningful review route. The platform may decline a use that it cannot safely support.
Do not configure the service for prohibited harmful or exploitative content, adult sexual companionship, covert surveillance, manipulation of vulnerable people or uses prohibited by the Acceptable Use Policy. If children may access the service, assess the actual audience, likely content and applicable online-safety requirements. Requiring the paying account holder to be an adult does not answer that separate assessment.
4. Personal information, knowledge and model providers
Use the minimum personal information needed for a legitimate task. Do not place restricted sensitive records or secrets in prompts, knowledge files or tool outputs. Inform affected people of relevant collection and disclosure and obtain any necessary consent. Public availability of information does not automatically remove privacy obligations.
Uploaded documents and retrieved website content must be authorised, appropriately scoped and kept accurate. Retrieval from a knowledge base is not the same as training a general-purpose model. Customer content must not be used for an additional training purpose merely because it was uploaded to answer customer enquiries.
OpenAI API services are used for relevant features. Provider-standard no-training defaults do not mean zero retention, Australian-only processing or no human access under any circumstances. The Privacy Policy, DPA and approved provider register describe the applicable handling. The customer must not be shown a stronger assurance unless the exact account, endpoint and contractual settings support it.
5. Reliability, grounding and review
AI can produce inaccurate, outdated, incomplete, biased or fabricated information, even when it sounds confident or cites a source. A response may not be unique. A numerical confidence indicator must not be presented as verified factual reliability without evidence supporting that interpretation.
Customers should supply reliable knowledge, review material updates and test their bots before release. Prompts should confine answers to an appropriate business scope and instruct the assistant to acknowledge uncertainty and refer a visitor to a person when necessary. These prompt instructions are one layer of control, not a substitute for access controls, monitoring or evaluation.
Before relying on a response for an important decision, an authorised person should verify relevant facts and the source. Customers should provide a straightforward correction or complaint route. NAFCORP will assess reported platform faults and cooperate in correcting or restricting a materially unsafe response pattern within its control.
6. Tool use and actions outside the conversation
A model's text is not authority to access private records, change billing, accept a contract, send a message, disclose information or execute a transaction. Any enabled action must be checked by the application against the authenticated user's permissions, account and workspace, authorised scope and necessary confirmation.
Untrusted content in websites, files, messages and external responses may contain instructions intended to redirect the assistant. That content must not override the service's permissions or obtain another customer's records. Credentials must not be exposed to the model or browser merely to simplify an integration. External destinations and data sent to them must be appropriately restricted and validated.
Before an irreversible or material action, show the user the important details and require an appropriate confirmation unless a lawful, narrowly defined automation has been specifically authorised. An automated lead enquiry is not permission to enter a financial contract on the visitor's behalf.
7. Safety controls and incident handling
NAFCORP will maintain proportionate platform safeguards, including relevant access restrictions, abuse controls, service monitoring and a means to report a concern. A customer's configurable guardrail prompt is not represented as a complete content-moderation system. No claim is made that every harmful or incorrect output will be prevented.
Before enabling a material AI feature or a higher-risk use, the responsible team must assess reasonably foreseeable misuse, privacy and security impacts, applicable online-safety rules, and the suitability of the available safeguards. Findings should inform release conditions, customer guidance and any required restriction. A voluntary AI framework may assist this process but does not replace binding law.
Report a serious or harmful response, unexpected disclosure or unauthorised action to sales@pluginchatbot.com with the affected bot or website and approximate time. Avoid unnecessarily repeating sensitive content or sending illegal material. Where appropriate, stop the affected bot or integration while the issue is assessed. Do not rely on a chatbot for emergency assistance; use the relevant emergency service, including 000 in Australia for an emergency.
Reports will be considered by a person with appropriate responsibility. Proportionate steps may include correcting knowledge, changing a configuration, restricting a feature, investigating an incident or suspending an affected use under the Terms. Affected customers may ask for an explanation and human review, subject to lawful security and confidentiality limits.
8. Decisions significantly affecting people
A customer proposing to use personal information in a decision significantly affecting a person's rights or interests must first obtain a separate assessment and approval. That assessment must address the decision's purpose, authority, information quality, potential unfair discrimination, meaningful human oversight and an accessible challenge process.
Relevant statutory transparency obligations for automated decision-making must be assessed when they apply; operating an ordinary FAQ bot does not automatically establish that the particular legal threshold is met. Customers and NAFCORP must each make any required disclosures about their own use, rather than relying on a generic statement that the service uses AI.
9. Changes and continuing review
Material changes in model behaviour, enabled tools, provider handling or risk controls should be evaluated and reflected in accurate customer information. Where a provider or model change would materially reduce an agreed capability or safeguard, the applicable notice and remedy provisions of the Terms and DPA apply.
These provisions do not certify compliance with every industry or country's AI rules. Specialised or overseas deployments may require additional assessment and terms. Non-excludable rights and remedies remain available regardless of an AI limitation or usage restriction.