Actions need confirmation
The model can offer a plan, top-up, reinstall or account action, but it cannot complete one by itself. A customer presses a confirmation card and the server checks identity, ownership, price and eligibility again.
Trust and guardrails
Useful by design. Limited on purpose.
AI Operator answers and proposes actions, while identity, money, ownership and policy stay under deterministic server controls. These are the boundaries the product enforces today.
Analytics do not copy transcripts
Product analytics keep token counts, latency, tool names, coarse topics, outcomes and fixed safety findings. They do not store the customer's prompt or the AI answer. A support conversation itself remains in the support ticket when a human handoff needs it.
A person is always available
Customers can ask for a person. Refund, dispute, repeated-failure and frustration signals offer handoff, and automatic support replies stop when a person takes or answers the conversation.
Tenant and secret boundaries
A partner shop sees only its own catalogue, rules and verified customers. Activation codes, QR codes, passwords, OTPs, card numbers, wallet secrets, wholesale cost and margin are not disclosed in chat.
Safety evidence
Every partner control center runs 28 fixed live probes across English, Spanish, Portuguese and French. They check brand isolation, purchase confirmation, knowledge lookup, payment grounding, secret refusal, safe troubleshooting, device evidence, order privacy and human handoff. A partner is not marked ready unless every current probe passes. Action-boundary and red-team contracts run in the release test gate.
AI subprocessors
- Anthropic processes assistant prompts and answers.
- OpenAI processes voice-receptionist audio and semantic-retrieval embeddings.
- Providers receive only the context needed for that request; partner and customer scopes are assembled before a model call.
This page describes product controls, not a replacement for the privacy policy or contractual data-processing terms.