Penguin Pilot — Acceptable Use Policy

The Network Software Limited trading as Penguin Pilot

Version 1.0 · Effective 01 October 2026

What this is

This policy sets out what you may and may not do with Penguin Pilot. It forms part of our Platform Terms of Service and applies to our customers, their users, and white label partners.

If you use Penguin Pilot through a white label partner, you don’t have an agreement with us — but these same standards reach you through your partner’s own acceptable use rules, which clause 7.2(d) of our White Label Partner Terms requires to be at least as strict as this policy. We enforce them through your partner under clause 3.3A of those terms.

The short version: use the platform for legitimate business, only hold data you’re entitled to hold, only message people who agreed to hear from you, check what the AI produces, and don’t try to get around the limits you’re paying for.

If you breach this policy we can remove content, disable features, suspend users, suspend your workspace, or terminate your subscription — immediately, if the breach is serious.

1. General conduct

You must not use the platform to:

• break any law, in New Zealand or in any country where you or the people you contact are located;

• infringe anyone’s intellectual property, privacy or other rights;

• defraud, deceive or mislead anyone;

• harass, threaten, defame, bully or discriminate against anyone;

• distribute malware, viruses or harmful code;

• publish content that is obscene, hateful, or that sexualises or endangers children;

• impersonate any person or organisation, or misrepresent your affiliation with one; or

• do anything that damages our reputation or the reputation of the platform.

2. Data you hold

The platform will hold a great deal of information about people who are not your customers — customers, prospects, leads, form respondents, event attendees, staff. This section matters more than any other. You must not:

• upload, import or store personal information you have no lawful basis or authority to hold;

• buy, scrape, harvest or otherwise acquire contact lists without a lawful basis, and you must never use address-harvesting software or a list you know was harvested;

• hold information about someone in breach of a request they’ve made to be removed;

• hold payroll, remuneration, financial account or identity information without the individual’s knowledge and an appropriate lawful purpose;

• upload voice recordings of someone without their documented consent (see section 4);

• use the platform to build a profile of someone for a purpose they’d find unreasonable or wouldn’t expect;

• put payment card numbers, card security codes, passwords, API keys or other access credentials anywhere in the platform — including notes, custom fields, file uploads and free text. The platform is not a card data environment and is not PCI DSS certified. Take card payments through the payment integrations, which keep card data with the payment provider;

• put government identity numbers or identity documents — passport, driver licence, IRD or other tax number — or health information into notes, custom fields, file uploads or other free-text fields. Where a module provides a field designed for that information, use that field and nothing else.

You must:

• have a privacy statement of your own, and give the people whose information you hold the notices the Privacy Act 2020 requires;

• comply with IPP 3A where you collect personal information about someone from a source other than that person — since 1 May 2026 you must take reasonable steps to make them aware that you hold it, why, who receives it, who you are and their access and correction rights;

• keep the information accurate and delete it when you no longer need it; and

• respond to access, correction and deletion requests from the people whose information you hold.

A note on higher-risk information. Penguin Pilot is general business software. If you choose to hold information that carries extra risk, that decision and the assessment behind it are yours. Clause 10.4 of the Platform Terms sets out the consents you need, and clause 18.2 sets out what we do and do not warrant about holding it here.

3. Messaging — email, SMS and campaigns

You must not:

• send unsolicited commercial email or SMS to anyone who hasn’t consented;

• send to a purchased, rented, scraped or harvested list;

• send to an address on a suppression list, or re-import a suppressed address, or move an address between audiences to get around suppression;

• remove, disable, alter or bypass the unsubscribe link or the platform’s suppression handling;

• use a misleading sender name, “from” address, reply-to address or subject line;

• fail to identify yourself accurately as the sender; or

• ignore an unsubscribe request, or act on it later than 5 working days.

You must:

• hold valid consent — express, inferred or deemed under the Unsolicited Electronic Messages Act 2007 — for every recipient, and be able to evidence it;

• include a free, functional unsubscribe that works for at least 30 days and can be used by the same method as the message;

• comply with the spam laws of the countries you send into, including Australia’s Spam Act 2003 and the US CAN-SPAM Act if you send there; and

• keep your bounce and complaint rates within reasonable industry norms.

Deliverability is shared. If your sending damages the reputation of the shared infrastructure, we may throttle, pause or terminate your sending immediately to protect other customers.

4. Voice cloning and synthetic media

You must not:

• create or use a cloned voice without the documented, informed consent of the person whose voice it is, for that specific use;

• clone the voice of a public figure, a deceased person, a child, or anyone who hasn’t consented;

• use a synthetic voice or synthetic media to make anyone believe a real person said or did something they didn’t;

• use a cloned voice in a way that could mislead a consumer about who they’re dealing with; or

• use synthetic media to impersonate, defraud, or harass.

You must keep evidence of consent and give it to us if we ask.

5. AI features

You must not use AI features to:

• generate unlawful, deceptive, harassing, discriminatory or infringing content;

• generate content that impersonates a real person or organisation;

• produce or present output as legal, financial, tax, valuation, employment or other professional advice;

• create logos, brands or designs that copy someone else’s trademark or copyrighted work;

• extract, reverse engineer, distil or replicate any underlying model, or use output to train a competing model; or

• deliberately probe for, or exploit, ways to make the AI produce prohibited content.

AI output can be inaccurate, incomplete or out of date. It’s your responsibility to review anything the AI produces before you rely on it, publish it or send it to anyone — and you’re responsible for what you do with it. Where your industry requires a qualified or licensed person to sign off on advice, estimates or other content, that obligation stays with you.

6. Public pages and shared links

You must not:

• publish content on a public page that you don’t have the right to publish;

• put confidential information into public file storage;

• share a tokenised link with someone who isn’t entitled to the content behind it;

• collect personal information through a form or booking page without an appropriate privacy notice; or

• use public pages to run a phishing, scam or deceptive collection exercise.

Remember: a tokenised link is not a password. Anyone with the link can open the page. Revoke links you no longer need.

7. Usage, limits and the API

You must not:

• share a seat between people, or rotate seats to avoid paying for them;

• run multiple workspaces to split usage that should sit in one;

• use the API, automations or any tool to avoid, distort or under-report metering;

• access modules or features you haven’t paid for;

• exceed published API rate limits, or engineer around them;

• scrape the platform, or use it to scrape a third-party website in breach of that site’s terms;

• use the platform in a way that materially degrades performance for other customers; or

• resell, sub-licence, rent or provide the platform to anyone else, except under our White Label Partner Terms.

8. Security

You must not:

• attempt to access another workspace, account or user’s data;

• probe, scan or test the security of the platform without our prior written consent — this includes penetration testing, vulnerability scanning and automated security tooling;

• attempt to defeat authentication, permissions, row-level security or tenant isolation;

• reverse engineer, decompile or disassemble the platform;

• introduce malware or any code intended to disrupt or damage; or

• use the platform to attack, overload or disrupt any other system.

If you find a security vulnerability, tell us at support@penguinpilot.ai. We’ll work with you in good faith and we won’t pursue anyone who reports responsibly, stops as soon as they’ve confirmed the issue, and doesn’t access, copy or disclose other people’s data. We don’t run a bug bounty and we don’t pay for reports.

9. Integrations and third parties

You must:

• hold your own accounts lawfully and have authority to connect them;

• comply with the terms of every third party you connect (for example Xero, Microsoft, Google, Meta and others); and

• comply with the advertising policies of any ad platform you publish through.

You must not connect an account belonging to someone else without their permission, or use an integration in a way the third party prohibits.

10. Industry-specific conduct

If you operate in a regulated industry — for example real estate, financial advice, insurance, legal services or healthcare — you must comply with the laws, licensing requirements and professional conduct rules that apply to you, including the rules about advertising and dealing with clients. Nothing the platform generates relieves you of those obligations.

If you use the training, accounting or payroll modules, you remain responsible for your obligations under employment, tax and financial reporting law.

11. How we enforce this

11.1 We investigate reports and signals of misuse. We may access content in your workspace where we reasonably need to in order to investigate.

11.2 Depending on what we find, we may: contact you; remove or disable content; disable a feature; throttle or pause sending; suspend a user; suspend your workspace; or terminate your subscription. Where the workspace belongs to a white label partner’s client, we act through the partner — we require them to suspend or terminate the client, and we may suspend the workspace ourselves where the matter is serious, unlawful or urgent.

11.3 We’ll normally tell you first and give you a reasonable chance to fix things. We’ll act immediately and without notice where the breach is serious or unlawful, where there’s a risk to us, the platform, another customer or a member of the public, or where a third party or a regulator requires it.

11.4 We may report unlawful activity to the police or a regulator, and we may preserve and disclose content where the law requires it.

11.5 We may charge our reasonable costs of investigating and dealing with a breach, itemised and notified before we invoice. Where the workspace belongs to a white label partner’s client, we charge the partner, who is responsible to us for its clients.

11.6 To report a breach of this policy, email support@penguinpilot.ai.

12. Changes

We may update this policy. We’ll publish the updated version and tell you by email or in the platform. Changes take effect when published, except where they materially increase your obligations, in which case clause 23 of the Platform Terms applies.

Questions: support@penguinpilot.ai.