AI Usage Policy

Effective Date: 8 August 2026

This AI Usage Policy supplements the EbaSaiyo Terms of Service. It describes the rules that apply when customers configure or use AI Employees, including semi-autonomous and autonomous communications.

1. Purpose

EbaSaiyo is designed to let businesses configure AI Employees that assist with operational communication and workflows. AI Employees can analyze incoming messages, generate content, apply rules, escalate work, and, where expressly enabled, send communications automatically.

AI systems are probabilistic. They can make mistakes. This policy is intended to establish clear expectations for human oversight, transparency, customer configuration, and prohibited uses.

2. AI Employee Autonomy

EbaSaiyo may provide the following autonomy concepts:

Manual

The AI Employee prepares a draft or recommendation. A human must approve the specific communication before sending.

Assist

The AI Employee helps prepare and organize work, while human approval remains required for outbound communications.

Semi-Autonomous

The Customer authorizes the AI Employee to execute defined actions automatically when configured rules, thresholds, and product safeguards are satisfied. Other cases may be escalated or held for approval.

Autonomous

The Customer authorizes the AI Employee to execute qualifying actions without case-by-case human approval, subject to Customer configuration and EbaSaiyo safeguards.

Manual should be the default when an AI Employee is first created unless the product clearly states otherwise.

3. Customer Responsibility for Autonomy

The Customer chooses the AI Employee's autonomy mode and is responsible for determining whether that level of autonomy is suitable for its business, industry, recipients, and legal obligations.

Before enabling autonomous sending, the Customer should:

• provide accurate instructions and policies;
• test the AI Employee with representative scenarios;
• review business rules and escalation conditions;
• select a confidence threshold appropriate to the risk;
• ensure recipient-facing AI disclosures are configured where required;
• verify that the Connected Account is appropriate for automated sending; and
• designate people responsible for monitoring exceptions and incidents.

EbaSaiyo may impose minimum safeguards that cannot be disabled.

4. Confidence Indicators

A confidence score or explanation is an operational signal, not a guarantee of correctness or a statistically calibrated probability unless EbaSaiyo explicitly states otherwise.

Customers must not interpret a high confidence score as proof that a response is legally correct, factually correct, or appropriate for a particular recipient.

EbaSaiyo may combine model output, deterministic rules, contextual checks, and safety conditions when determining whether an action should be automated.

5. Business Rules and Escalation

Customers should use available rules to require human review for higher-risk communications. Examples may include:

• refunds or compensation;
• cancellations;
• legal threats or legal claims;
• highly emotional or abusive interactions;
• VIP or strategically sensitive customers;
• requests involving sensitive personal information;
• uncertain product or policy questions;
• security incidents;
• complaints to regulators; and
• any category where an incorrect response could cause material harm.

Rules are safeguards, not guarantees. Customers should monitor whether their rules capture the scenarios intended.

6. Human Oversight

Customers must maintain meaningful human oversight appropriate to the risk of their use case.

Human users should be able to:

• review pending or escalated conversations;
• change an AI Employee's instructions;
• lower or disable autonomy;
• disconnect accounts;
• override an AI-generated draft; and
• investigate audit information where available.

Customers should not configure an AI Employee so that no qualified person can reasonably detect or stop harmful behavior.

7. AI Transparency

Where applicable law requires recipients to be informed that they are interacting with an AI system, the Customer must provide that disclosure.

For customers operating in the European Union, the EU Artificial Intelligence Act contains transparency obligations for certain AI systems that interact directly with natural persons. Customers must evaluate whether their implementation requires disclosure and ensure that legally required information is provided in a clear and timely manner.

Customers must not deliberately use EbaSaiyo to deceive a recipient into believing that an AI-generated or automatically sent message was personally authored by a specific real individual where that deception would be unlawful, fraudulent, or materially misleading.

8. Accuracy, Hallucinations, and Missing Context

AI Employees may:

• fabricate facts;
• misunderstand a message;
• miss relevant context;
• misread tone or intent;
• incorrectly apply a policy;
• fail to recognize a conflict between instructions;
• produce inconsistent responses; or
• act on malicious or misleading content in an inbound message.

Customers must design workflows with these risks in mind.

9. Prompt Injection and Untrusted Content

Inbound email and other third-party content must be treated as untrusted input. A sender may attempt to manipulate an AI Employee by including instructions directed at the AI system.

Customers must not assume that prompt-injection defenses eliminate all risk. EbaSaiyo may implement system-level safeguards, content separation, business rules, and testing, but customers should keep high-impact actions behind appropriate controls.

10. Prohibited High-Impact Uses

Unless EbaSaiyo expressly approves a specific product designed for such use and all applicable legal requirements are met, customers must not use AI Employees to make or execute final automated decisions that determine a person's eligibility for, or access to:

• employment or termination;
• housing;
• credit or lending;
• insurance;
• essential public services;
• healthcare treatment;
• education admissions;
• criminal justice outcomes; or
• other similarly high-impact rights or opportunities.

This restriction does not prohibit ordinary customer-service communications about these topics where the AI Employee does not make the underlying high-impact decision.

11. Regulated and Professional Advice

Customers must not present AI-generated content as legal, medical, tax, accounting, investment, or other regulated professional advice unless a qualified professional reviews and assumes responsibility where required by law.

12. Unlawful or Deceptive Communications

AI Employees must not be used to:

• conduct phishing or credential theft;
• impersonate a person or entity without authorization;
• make knowingly false claims;
• commit fraud;
• send illegal spam;
• conceal the commercial identity of the sender where disclosure is required;
• evade unsubscribe or opt-out obligations;
• harass, threaten, or intimidate recipients; or
• discriminate unlawfully against protected groups.

13. Sensitive and Confidential Information

Customers should minimize sensitive information included in prompts or knowledge sources to what is necessary for the intended feature.

Customers are responsible for determining whether they have authority to process special-category or otherwise sensitive personal data using the Service and whether additional contractual, regulatory, or technical safeguards are required.

14. Auditability

EbaSaiyo may record information about AI decisions, including the AI Employee involved, action selected, confidence information, rules triggered, human overrides, and whether a message was sent automatically or after approval.

Audit records support operational accountability but are not guaranteed to capture every external event, third-party provider action, or legal factor relevant to a dispute.

15. Customer Testing and Monitoring

Customers should test AI Employees before production use and periodically after material changes to:

• instructions;
• business rules;
• autonomy mode;
• connected accounts;
• AI models;
• supported languages; or
• underlying business policies.

Customers should promptly lower autonomy or disable an AI Employee if unexpected behavior is detected.

16. Incident Reporting

Customers should promptly notify contact@ebasaiyo.com or contact@ebasaiyo.com if they become aware of:

• unauthorized automated sending;
• unexpected access to a Connected Account;
• material prompt-injection success;
• cross-customer data exposure;
• a security vulnerability; or
• repeated harmful AI behavior that may affect other customers.

17. Enforcement

EbaSaiyo may restrict AI autonomy, disable a feature, suspend a Connected Account, or suspend access where reasonably necessary to prevent unlawful, abusive, unsafe, or materially harmful use.

18. Changes

AI technology and regulation evolve quickly. EbaSaiyo may update this policy to address new features, risks, laws, or safety practices. Material changes will be communicated as required by applicable law or contract.