Responsible AI controls
The guardrails implemented in the product today. AI output can be wrong, so merchant oversight remains necessary; each control links to its setup guide where one exists.
Money actions are off by default
Cancelling, modifying, and refunding orders are separate per-store switches that start off. Shopify execution also needs platform permission, verified ownership and confirmation. WooCommerce and custom stores route these requests to a human ticket even when enabled. Shipping address changes move no money and start on, with supported Shopify and WooCommerce paths; merchants can switch them off.
How it works: Money actions are off by defaultVerified identity and confirm-first
Order and subscription actions only run for a shopper whose identity the store has verified, and only on that shopper's own order or subscription. The AI first describes the exact change and acts only after the shopper confirms it. Cancel and modify only work on orders that have not shipped.
How it works: Verified identity and confirm-firstSubscription changes are off by default
With ReCharge connected, signed-in shoppers can see their subscriptions. Skipping, rescheduling, pausing, resuming, or cancelling needs a separate merchant switch that starts off. Before cancelling, the AI offers a skip or pause once, and every applied change is recorded in the audit log.
How it works: Subscription changes are off by defaultMargin guard on discounts
Every discount the AI, a popup, or a proactive message offers is checked against product costs on the server before a shopper sees it. The guard is on by default with a 0% floor for known costs. When costs are missing, an offer cap cannot guarantee profitability; merchants can block those offers. Discounts always use real merchant-created codes through the store platform's own mechanism; checkout pricing is never modified directly.
How it works: Margin guard on discountsPer-store AI cost cap
Merchants can set a monthly cap on AI model spend for their store, with a near-cap warning. When spend reaches the cap, new AI provider calls stop for the rest of the month and shoppers get the store's configured unavailable or handoff behavior.
How it works: Per-store AI cost capGrounded answers and claim checks
The agent retrieves the store's catalog and knowledge records before answering. A guardrail checks shipping, returns, and order-tracking commitments: a reply that makes one without the matching store data behind it is replaced with a safe message that offers to confirm or connect a teammate. Missing or weak context can still produce an incomplete answer.
How it works: Grounded answers and claim checksHuman handoff
Shoppers can ask for a person at any time, and low-confidence conversations can escalate on their own. Handoffs open a support ticket in the merchant inbox, mirrored to Zendesk or Gorgias when the store has connected one. Store teams can review messages, feedback, knowledge gaps, and suggested content.
How it works: Human handoffProvider control
Platform operators configure primary and fallback model lanes. Conditional providers receive prompts only when selected by runtime routing.
Learning controls
Feedback and outcome signals are stored per store. Automated catalog rewrites remain drafts until merchant approval.
Current limits
AI output can be wrong. Zubby AI is not a substitute for legal, medical, financial, or product-safety judgment, and this page does not represent an external AI audit or certification.