app0 Acceptable Use Policy

1. Respect the law

You must not use the Services to do, or help anyone do, anything unlawful, fraudulent or harmful. You must not use the Services to:

• break any law that applies to you, including data protection, marketing, consumer protection, competition, export control and sanctions laws;
• infringe anyone’s intellectual property, privacy, publicity or other rights, or breach a contract or confidentiality obligation you are under;
• defraud, deceive or mislead anyone, including by fake reviews, fake testimonials or false claims;
• harass, threaten, defame or discriminate against anyone;
• create or distribute sexual content involving children, or intimate images of a real person without their consent; or
• plan, promote or assist violence, terrorism or other crime.

2. Outreach and email

The Services send email from your own mailbox and from assistant addresses, and Agents can draft messages. You are the sender and you carry the responsibility. You must:

• only email people where you have a lawful basis to do so, and comply with the UK GDPR, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), the ePrivacy rules of each country you send to, the CAN-SPAM Act for the United States, CASL for Canada, and every other marketing law that applies;
• remember that under PECR you need consent to send marketing email to individuals, including sole traders and some partnerships, unless the soft opt-in applies, and that you must still honour objections from people at companies;
• be honest about who you are: use your real name, company and reply address, never forge headers, spoof a sender or impersonate another person or organisation;
• include a clear way to unsubscribe in every marketing email and honour it promptly, and keep suppressed and unsubscribed people out of your sequences;
• not send unsolicited bulk email, and not send to bought, rented or scraped lists unless you have a lawful basis for every person on them;
• keep to the sending limits in the Services, including the daily limit per inbox and the warm-up period for new inboxes, and not try to get round them with extra mailboxes or accounts;
• not send content that is deceptive, misleading, defamatory, hateful or illegal, or that advertises illegal goods or services; and
• review every message, sequence step and Agent draft before it goes out.

We may pause sequences, inboxes, assistant addresses or Workspaces that attract spam complaints, high bounce rates, blocklisting or reports, or that appear to breach this section.

3. Personal data, scraping and research

The research agent, assistants and connected tools can look people and companies up and bring information into your Workspace. You must:

• only load, connect or research personal data where you have a lawful basis and have given any notice the law requires, and only as much as you need;
• not use the Services to crawl, scrape or collect data from websites or online services in breach of their terms or the law, or to get round technical barriers such as logins, rate limits and robots rules;
• not use the Services to build profiles of individuals beyond what is needed for your business relationship with them, or to track, locate or monitor people;
• not load special category data, criminal offence data, payment card numbers or children’s data unless you have a lawful basis and appropriate safeguards; and
• not load data you obtained unlawfully or in breach of confidence.

4. AI, Agents and assistants

AI Features can be wrong, and Agents act on your instructions. You must not:

• rely on Output without reviewing it, or present AI-generated research, facts or figures as verified when they are not;
• use Agents to send, publish or change things without the review the situation calls for, or turn off approval steps for actions you have not understood;
• use the Services to generate disinformation, deceptive content, content that pretends to be written by a specific real person, or chatbot interactions that hide that a person is dealing with AI where the law or honesty requires disclosure;
• use the Services to make decisions about individuals that have legal or similarly significant effects on them, such as decisions about employment, credit, insurance, housing or healthcare, based solely on automated processing;
• use the Services for any practice that is prohibited, or classified as high-risk, under the EU AI Act (Regulation (EU) 2024/1689), whether or not it applies to you, or in breach of any other law governing AI;
• try to jailbreak, prompt-inject or otherwise manipulate the Services or their models into ignoring their rules or safety controls, or instruct an Agent to do anything this Policy forbids; or
• instruct an Agent to reach the internet from its shell, to exfiltrate data or to attack other systems.

5. Meeting recording

The meeting notetaker joins calls as a visible participant and transcribes them. You must:

• only send it into calls you are entitled to record, and comply with the recording and wiretap laws of every place where a participant is, some of which require every participant’s consent;
• tell every participant before the call, or at the start, that app0 is transcribing it, and get any consent the law or the host requires;
• remove the notetaker if a participant objects or if the host asks you to;
• comply with the terms of Google Meet, Microsoft Teams and Zoom; and
• not use transcripts or notes for any purpose the participants would not reasonably expect, or share them in breach of confidence.

6. Outside Agents and the MCP server

When you connect an Outside Agent such as Claude, ChatGPT, Cursor or Claude Code, it acts as you. You must:

• only connect agents you trust, check the agent’s name and return address on the consent screen, and grant only the access it needs;
• not use an Outside Agent to do anything you could not do yourself, or to bypass approval steps, rate limits or permissions;
• not share, sell or expose your connection, and disconnect agents you no longer use; and
• accept that the agent’s provider receives what the agent reads from your Workspace, and that its terms apply.

7. Assistant email addresses

You must not use assistant email addresses to:

• sign up for other services, receive verification codes, or receive mail you have no right to receive;
• send bulk or marketing email, or to send anything without a person checking it;
• impersonate a person or organisation, or suggest the assistant is a human when asked; or
• register or verify a domain you do not own or control.

8. Apps, automations and webhooks

Apps you build run as you, and schedules, triggers and webhooks run unattended. You must:

• review what an app can do before you make it live, and keep its approvals appropriate to the data and services it reaches;
• not build apps that breach this Policy, that exfiltrate data, that mine cryptocurrency, that spam, or that run abusive loads against the Services or Connected Services;
• keep webhook addresses and keys secret and point only trusted systems at them; and
• not share an app that misleads other users of your Workspace about what it does.

9. Security and technical misuse

You must not:

• probe, scan or test the vulnerability of the Services or our providers without our written permission, except through a responsible disclosure you have agreed with us;
• access accounts, Workspaces or data you are not authorised to access, or try to break workspace isolation;
• interfere with the Services, other customers or our providers, including by denial of service, excessive automated requests, or abusing the MCP server, inbox API, webhooks or sandboxes;
• introduce malware, run malicious code in sandboxes, or use sandboxes to attack other systems or to mine cryptocurrency;
• share accounts, let someone outside your organisation use your Seat, or sell access to the Services;
• copy, frame, mirror or resell the Services, or build a competing product with them;
• reverse engineer the Services, their models, prompts or protections, except where the law allows and we cannot exclude it; or
• remove or alter any notice, footer, watermark or identifier that shows a message was sent by an assistant or that content was generated by AI.

10. Respect our providers

The Services use AI models from Third-Party AI Providers and connect to third-party applications and tools. You must comply with the acceptable use policies of those providers and applications, including the usage policies of OpenAI, Anthropic, Google, Microsoft, Composio, Treg and the other providers listed in the Data Processing Addendum. Where their rules are stricter than this Policy, their rules apply to the features they power.

11. Reporting and enforcement

If you see abuse of the Services, including unwanted email from an app0 user or assistant, please email legal@askyori.ai. We investigate reports and may ask you for information.

If you breach this Policy, we may pause sequences, inboxes, addresses, apps or Agents, remove content, restrict or suspend accounts or Workspaces, disconnect Outside Agents, or end the Agreement, as the Terms of Service allow. Where we reasonably can, we will tell you first and give you a chance to put things right. We may act without notice where needed to protect people, other customers, our providers or the law. We may also report unlawful activity to the authorities.

We may grant exceptions to this Policy in writing, for example for security research or academic work, at our discretion.

12. Changes to this Policy

We may update this Policy as our Services, the law or good practice change. Changes take effect as the Terms set out. By using the Services you agree to follow the version of this Policy in force at the time.