Penguin Pilot — Acceptable Use Policy

The Network Software Limited trading as Penguin Pilot

Version 1.0 · Effective 04 September 2026

What this is

This policy sets out what you may and may not do with Penguin Pilot. It forms part of our Platform Terms of Service and applies to our customers, their users, and white label partners.

If you use Penguin Pilot through a white label partner, you don’t have an agreement with us — but these same standards reach you through your partner’s own acceptable use rules, which clause 7.2(d) of our White Label Partner Terms requires to be at least as strict as this policy. We enforce them through your partner under clause 3.3A of those terms.

The short version: use the platform for legitimate business, only hold data you’re entitled to hold, only message people who agreed to hear from you, check what the AI produces, and don’t try to get around the limits you’re paying for.

If you breach this policy we can remove content, disable features, suspend users, suspend your workspace, or terminate your subscription — immediately, if the breach is serious.

1. General conduct

You must not use the platform to:

• break any law, in New Zealand or in any country where you or the people you contact are located;

• infringe anyone’s intellectual property, privacy or other rights;

• defraud, deceive or mislead anyone;

• harass, threaten, defame, bully or discriminate against anyone;

• distribute malware, viruses or harmful code;

• publish content that is obscene, hateful, or that sexualises or endangers children;

• impersonate any person or organisation, or misrepresent your affiliation with one; or

• do anything that damages our reputation or the reputation of the platform.

2. Data you hold

The platform will hold a great deal of information about people who are not your customers — vendors, buyers, leads, form respondents, open home attendees, staff. This section matters more than any other. You must not:

• upload, import or store personal information you have no lawful basis or authority to hold;

• buy, scrape, harvest or otherwise acquire contact lists without a lawful basis, and you must never use address-harvesting software or a list you know was harvested;

• hold information about someone in breach of a request they’ve made to be removed;

• hold payroll, remuneration, financial account or identity information without the individual’s knowledge and an appropriate lawful purpose;

• upload voice recordings of someone without their documented consent (see section 4); or

• use the platform to build a profile of someone for a purpose they’d find unreasonable or wouldn’t expect.

You must:

• have a privacy statement of your own, and give the people whose information you hold the notices the Privacy Act 2020 requires;

• comply with IPP 3A where you collect personal information about someone from a source other than that person — since 1 May 2026 you must take reasonable steps to make them aware that you hold it, why, who receives it, who you are and their access and correction rights;

• keep the information accurate and delete it when you no longer need it; and

• respond to access, correction and deletion requests from the people whose information you hold.

3. Messaging — email, SMS and campaigns

You must not:

• send unsolicited commercial email or SMS to anyone who hasn’t consented;

• send to a purchased, rented, scraped or harvested list;

• send to an address on a suppression list, or re-import a suppressed address, or move an address between audiences to get around suppression;

• remove, disable, alter or bypass the unsubscribe link or the platform’s suppression handling;

• use a misleading sender name, “from” address, reply-to address or subject line;

• fail to identify yourself accurately as the sender; or

• ignore an unsubscribe request, or act on it later than 5 working days.

You must:

• hold valid consent — express, inferred or deemed under the Unsolicited Electronic Messages Act 2007 — for every recipient, and be able to evidence it;

• include a free, functional unsubscribe that works for at least 30 days and can be used by the same method as the message;

• comply with the spam laws of the countries you send into, including Australia’s Spam Act 2003 and the US CAN-SPAM Act if you send there; and

• keep your bounce and complaint rates within reasonable industry norms.

Deliverability is shared. If your sending damages the reputation of the shared infrastructure, we may throttle, pause or terminate your sending immediately to protect other customers.

4. Voice cloning and synthetic media

You must not:

• create or use a cloned voice without the documented, informed consent of the person whose voice it is, for that specific use;

• clone the voice of a public figure, a deceased person, a child, or anyone who hasn’t consented;

• use a synthetic voice or synthetic media to make anyone believe a real person said or did something they didn’t;

• use a cloned voice in a way that could mislead a consumer about who they’re dealing with; or

• use synthetic media to impersonate, defraud, or harass.

You must keep evidence of consent and give it to us if we ask.

5. AI features

You must not use AI features to:

• generate unlawful, deceptive, harassing, discriminatory or infringing content;

• generate content that impersonates a real person or organisation;

• produce or present output as legal, financial, tax, valuation, employment or other professional advice;

• publish or send AI output to a client, vendor, buyer or learner without a human reviewing it first;

• generate market updates, appraisals, valuations or property estimates that are sent to a vendor without review by a licensed person;

• create logos, brands or designs that copy someone else’s trademark or copyrighted work;

• extract, reverse engineer, distil or replicate any underlying model, or use output to train a competing model; or

• deliberately probe for, or exploit, ways to make the AI produce prohibited content.

6. Public pages and shared links

You must not:

• publish content on a public page that you don’t have the right to publish;

• put confidential information into public file storage;

• share a tokenised link with someone who isn’t entitled to the content behind it;

• collect personal information through a form or booking page without an appropriate privacy notice; or

• use public pages to run a phishing, scam or deceptive collection exercise.

Remember: a tokenised link is not a password. Anyone with the link can open the page. Revoke links you no longer need.

7. Usage, limits and the API

You must not:

• share a seat between people, or rotate seats to avoid paying for them;

• run multiple workspaces to split usage that should sit in one;

• use the API, automations or any tool to avoid, distort or under-report metering;

• access modules or features you haven’t paid for;

• exceed published API rate limits, or engineer around them;

• scrape the platform, or use it to scrape a third-party website in breach of that site’s terms;

• use the platform in a way that materially degrades performance for other customers; or

• resell, sub-licence, rent or provide the platform to anyone else, except under our White Label Partner Terms.

8. Security

You must not:

• attempt to access another workspace, account or user’s data;

• probe, scan or test the security of the platform without our prior written consent — this includes penetration testing, vulnerability scanning and automated security tooling;

• attempt to defeat authentication, permissions, row-level security or tenant isolation;

• reverse engineer, decompile or disassemble the platform;

• introduce malware or any code intended to disrupt or damage; or

• use the platform to attack, overload or disrupt any other system.

If you find a security vulnerability, tell us at support@penguinpilot.ai. We’ll work with you in good faith and we won’t pursue anyone who reports responsibly, stops as soon as they’ve confirmed the issue, and doesn’t access, copy or disclose other people’s data. We don’t run a bug bounty and we don’t pay for reports.

9. Integrations and third parties

You must:

• hold your own accounts lawfully and have authority to connect them;

• comply with the terms of every third party you connect (Xero, Microsoft, Google, Meta, Trade Me, realestate.co.nz, OneRoof and others); and

• comply with the advertising policies of any ad platform you publish through.

You must not connect an account belonging to someone else without their permission, or use an integration in a way the third party prohibits.

10. Industry-specific conduct

If you use the real estate modules, you must comply with the Real Estate Agents Act 2008 and the associated professional conduct and client care rules — including the rules about advertising, appraisals, and dealing with vendors and buyers. Nothing the platform generates relieves you of those obligations.

If you use the training, accounting or payroll modules, you remain responsible for your obligations under employment, tax and financial reporting law.

11. How we enforce this

11.1 We investigate reports and signals of misuse. We may access content in your workspace where we reasonably need to in order to investigate.

11.2 Depending on what we find, we may: contact you; remove or disable content; disable a feature; throttle or pause sending; suspend a user; suspend your workspace; or terminate your subscription. Where the workspace belongs to a white label partner’s client, we act through the partner — we require them to suspend or terminate the client, and we may suspend the workspace ourselves where the matter is serious, unlawful or urgent.

11.3 We’ll normally tell you first and give you a reasonable chance to fix things. We’ll act immediately and without notice where the breach is serious or unlawful, where there’s a risk to us, the platform, another customer or a member of the public, or where a third party or a regulator requires it.

11.4 We may report unlawful activity to the police or a regulator, and we may preserve and disclose content where the law requires it.

11.5 We may charge our reasonable costs of investigating and dealing with a breach, itemised and notified before we invoice. Where the workspace belongs to a white label partner’s client, we charge the partner, who is responsible to us for its clients.

11.6 To report a breach of this policy, email support@penguinpilot.ai.

12. Changes

We may update this policy. We’ll publish the updated version and tell you by email or in the platform. Changes take effect when published, except where they materially increase your obligations, in which case clause 23 of the Platform Terms applies.

Questions: support@penguinpilot.ai.