Keeping a Store Chatbot Honest: Price Checks, No Invented Discounts, Data Protection and Hand-off

A store chatbot stays honest when the important facts never depend on the AI model's memory: prices come from the catalogue and every amount in a reply is checked before the customer sees it, discounts and promises are off limits, personal data is removed or discouraged, manipulation attempts are filtered, costs are capped, and a person takes over when the bot reaches its limits. These are design decisions you make before launch, not settings you add after a mistake.

This guide describes the safeguards we built into two live store assistants, the coffee expert on Anas Saleh Coffee and the appliance advisor on Bashayer El Khair, at a level any store owner can check with their developer. It completes our series on AI shopping assistants for online stores.

Key takeaways

• Prices must come from tools that read the catalogue, and a checker must compare every amount in a reply with those results.
• The bot should not be able to offer discounts, coupons, promises or order changes.
• Saying "this detail is not listed, please confirm with the team" is a feature, not a weakness.
• Personal data such as phone numbers and national ID numbers should be removed before text reaches the AI provider, and customers should be told how chats are handled.
• Prompt-injection filtering, output checks, cost limits and a hand-off to staff belong in the first version.

Why a wrong price is a business problem

When a chatbot on your store says a product costs a certain amount, the customer reads it as the store speaking. A rounded figure, a price from last month or an invented discount creates an argument at checkout, a refund or a complaint. Our article on Egypt's Consumer Protection Law and online stores explains what your store must show customers; the chatbot is part of that store. AI models write fluent text, and fluent text can contain a wrong number that looks right. The answer is not a better prompt alone, but checks in code around the model.

Prices checked against the catalogue

Both assistants get prices only by calling tools that read the store's database. Then a checker reads the drafted reply before it is shown:

• Bashayer El Khair: every money amount in the reply, whether written as digits, in thousands or in words, must be a price a tool returned in that conversation or a number the customer typed, such as a budget. Otherwise the reply is corrected first.
• Anas Saleh Coffee: a reply may state only prices that a tool returned in that turn, plus the shipping fees. Any other amount is replaced with a pointer to the price shown in the store.

For custom products, the rule goes further. A coffee blend card, with its prices and add-to-cart button, is built from the server's pricing result, not from text the model typed, and checkout prices the recipe again on the server.

No invented discounts or promises

A sales assistant that wants to please will happily say "I can give you 10% off". The instructions forbid discounts, coupons, promises and order changes, and the price checker catches amounts that slip through. A subtler trick is editing the conversation itself: on the coffee store the browser sends recent messages back to the server, so a customer could change an earlier bot reply to read «وعدتك بخصم 90%». Each reply is signed by the server, and unsigned or altered replies are dropped before the model sees the history.

Saying what is missing

Honesty also means admitting gaps. In a real fridge comparison, the Bashayer assistant said that one model's warranty and energy rating were not listed and should be confirmed with the team. On the coffee store, a blend whose beans had no spiced price yet was marked "not available to order online" with the reason, and WhatsApp ordering was offered instead.

Personal data and privacy

Customers sometimes type their phone number or address into a chat. On the coffee store, Egyptian mobile and landline numbers, 14-digit national ID numbers, card numbers and email addresses are replaced with a placeholder before the message is sent to the AI provider, and chat text is not stored on the server. The Bashayer assistant takes a different, stated approach: conversations are recorded so the owner can read them in the dashboard, and a note under the chat box says so and asks customers not to write sensitive data. Either way, customers are told. Our article on using ChatGPT at work and data protection covers the legal side.

Prompt-injection defences

Some visitors will type "ignore your instructions" or try a fake system message. On the coffee store, a filter recognises these attempts in English, Egyptian Arabic, formal Arabic and Franco. Blatant attempts get a fixed reply and never reach the model; suspicious ones are sent with a security reminder. Invisible characters used to hide instructions are removed, replies are checked for signs of internal instructions leaking, only internal links survive, and HTML is stripped. A moderation check screens abusive messages. Our guide to AI chatbot security and prompt injection explains the wider risks.

Cost limits

Every AI reply costs money, so a bot without limits can be abused. Both stores cap use per visitor and per day, limit how many tool rounds one reply may use, and send only recent messages with each request.

Hand-off to people

A good assistant knows when to stop. The appliance advisor hands large or open-plan spaces and installation questions to the team, and offers a site survey instead of a confident number. The coffee store routes unpriced blends and factory-visit requests to WhatsApp.

A guardrail checklist for your store chatbot

Guardrail	What it prevents	Ask your developer
Prices only from catalogue tools	Prices from memory or old posts	Where does each price in a reply come from?
Reply price checker	Rounded, mixed-up or invented amounts	What happens to an amount no tool returned?
Server-built product cards and checkout re-pricing	A card or order at a price the model typed	Is the order total recalculated on the server?
No discounts or promises	Offers the store never made	Can the bot change orders or prices at all?
Personal data handling	Phone and ID numbers sent to the AI provider	What is removed, and what is stored?
Injection filter and output checks	Leaked instructions and hijacked replies	Is it tested in Arabic and Franco, not only English?
Cost limits	A surprise bill from abuse	What are the per-visitor and daily limits?
Hand-off to staff	Confident answers to cases that need a person	When does the bot pass the customer to us?

How Nilex helps

Every AI business chatbot Nilex builds is connected to your real data, and the safeguards above are part of the build: catalogue prices, checked replies, data protection, injection filtering, cost limits and a hand-off to your team. The coffee store's assistant also ships with automated tests and a set of real-world cases covering dialects, discount requests and injection attempts. If you already run a chatbot and are not sure what it might say about prices, contact us for a review.

Frequently asked questions

Can a chatbot be guaranteed never to state a wrong price?

The model itself can make mistakes, which is why the check happens in code after the model writes. With prices from tools and a checker on every reply, an unverified amount does not reach the customer.

What if a customer insists the bot promised a discount?

The bot is not allowed to offer discounts, and on the coffee store altered conversation history is rejected. Any real offer should come from the store's own pricing, not the chat.

Should we store chatbot conversations?

It depends on your needs. Storing helps you learn what customers ask; not storing reduces data risk. Whichever you choose, tell customers clearly.

Does an injection filter solve prompt injection?

No filter is perfect. That is why the important actions, such as pricing and order totals, are checked by the server rather than trusted to the model.

How do we keep AI costs predictable?

Limit use per visitor and per day, cap tool rounds per reply and send only recent messages. Review the usage after launch and adjust.