Acceptable Use Policy

1. What This Policy Covers

This Acceptable Use Policy governs your use of the ESR platform and everything the Service does at your direction (the "Service"). It forms part of the ESR Terms of Service and is incorporated into them by reference. Capitalised terms not defined here have the meaning given in the Terms.

ESR is different from most software in one way that matters here. ESR does not only produce work for you to use. Under permissions you grant, ESR acts on your behalf: it sends email, posts to accounts you connect, builds and publishes sites and software, schedules and books, and writes to systems you connect. When an ESR agent takes an action, it does so as you.

That is why this policy exists and why it is more specific than most. What follows applies to your use of the Service, to anything you submit to it, to anything it produces for you, and to any action it takes at your direction.

Nothing leaves your account without your approval. You review before anything acts. That control is the foundation of this policy, and the rules below assume it.

2. General Prohibitions

You may not use the Service, or direct an agent, to:

• Violate any law or regulation, or the rights of any third party
• Generate, submit, transmit, publish, or store content that is unlawful, defamatory, harassing, or that invades a person's privacy or publicity rights
• Create deceptive or misleading content, including synthetic audio, video, or imagery of a real person, or content that misrepresents who it comes from
• Impersonate any person or organisation, or misrepresent your relationship with one
• Incite, organise, promote, or facilitate violence or criminal activity
• Infringe or misappropriate anyone's intellectual property

3. High-Risk Decisions About People

The Service can produce research, summaries, screening notes, and analysis about people. You may use that output as input to your own decision. You may not treat it as the decision.

You must review the output yourself, and satisfy yourself that it is accurate and lawful to rely on, before you act on it, where the decision materially affects a person's:

• Employment, including hiring, promotion, discipline, or termination
• Credit, lending, or financial terms
• Housing or tenancy
• Healthcare or medical treatment
• Insurance eligibility or pricing
• Legal rights or legal status
• Education or admission

ESR produces work product. You make decisions. ESR is not a consumer reporting agency, does not provide consumer reports, and its output is not a background check, a credit report, a tenant screening report, or any equivalent. You may not use it as one, or supply it to a third party as one.

Where the law imposes specific obligations on decisions of this kind, including notice, disclosure, adverse action, bias auditing, or record-keeping requirements, meeting them is your responsibility. Using the Service does not transfer any of those obligations to ESR.

4. Email and Messaging

The Service sends email as you, from addresses you connect, under permissions you grant. That means your sending reputation and ours are the same reputation.

You may not:

• Send unsolicited bulk email, or email any recipient who has not consented to hear from you
• Use purchased, scraped, rented, or otherwise acquired contact lists
• Send in violation of CAN-SPAM, CASL, GDPR, or any other applicable law governing electronic communications
• Conceal or falsify the sender, the reply-to address, or the origin of a message
• Fail to honour an unsubscribe or opt-out request, or make one difficult to act on
• Use the Service to relay messages on behalf of a third party whose consent you do not hold

You are responsible for having a lawful basis to contact every recipient, and for keeping evidence of it.

5. Connected Accounts and Publishing

Where you connect an account so that ESR can post, publish, schedule, advertise, or write to it, that platform's own rules apply to everything ESR does there.

You may not:

• Post, publish, or advertise in violation of the terms of the platform you have connected
• Use advertising features to promote anything the relevant advertising platform prohibits
• Operate accounts you are not authorised to operate, or connect credentials that are not your own
• Publish content that misrepresents its source, its author, or whether it was produced with AI, where disclosure is required
• Use the Service to manipulate engagement, reviews, ratings, or rankings on any platform

You are responsible for whether an action ESR takes on a connected account complies with that platform's rules. Approving an action is how you take responsibility for it.

6. What You Build

The Service builds and publishes websites, storefronts, applications, payment flows, and login systems. What gets built is yours, and so is responsibility for what it does.

You may not use the Service to build, host, or operate anything that:

• Is unlawful, or that carries out a regulated activity you are not licensed to carry out
• Collects credentials, payment details, or personal information deceptively, including any phishing page or lookalike site
• Distributes malware, ransomware, spyware, or any other malicious code
• Impersonates another business, brand, product, or person
• Facilitates fraud, deceptive commerce, or an illegal marketplace
• Infringes a third party's intellectual property
• Collects personal data without a lawful basis and a privacy notice that reflects what you actually do with it

If what you build handles other people's money or data, meeting the legal requirements that apply to it is your responsibility.

7. Research and Access to Other Systems

The Service reads publicly available pages to do research on your behalf, and cites what it read. That is a normal part of how it works.

What is not permitted is access you are not entitled to. You may not use the Service to:

• Bypass a paywall, a login wall, or any other access control
• Use credentials that are not your own, or that you are not authorised to use
• Defeat or attempt to defeat a CAPTCHA, bot detection, or any other measure a site uses to control automated access
• Evade rate limits, IP blocks, or usage quotas imposed by any third party
• Access, copy, or extract data you are not authorised to access
• Collect personal data from any source in violation of applicable privacy law

Publicly readable pages, fetched at a reasonable rate and cited to their source, remain permitted. Systems you are not authorised to enter do not become permitted because an agent is doing the entering.

8. The Service Itself

You may not:

• Reverse engineer, decompile, disassemble, or attempt to derive the source code or underlying methods of the Service
• Copy, modify, distribute, sell, or create derivative works from the Service, except as the Terms expressly permit
• Circumvent or attempt to circumvent security measures, approval gates, spend controls, rate limits, or usage quotas
• Share account access with anyone not authorised to use your account
• Resell, sublicense, or repackage the Service as a competing AI agent service
• Introduce any virus, worm, or other harmful code into the Service
• Interfere with, disrupt, overburden, or attempt to gain unauthorised access to the Service, to another user's account, or to any system connected to it
• Use any automated means to extract data from the Service other than the export tools ESR provides

9. What You Submit

Your agents work from what you tell them. What you tell them goes to ESR's subprocessors for processing, as described in the Privacy Policy.

You may not submit to the Service:

• Data you do not have the right to disclose to a third-party processor, including anything covered by a confidentiality obligation that forbids subprocessing
• Payment card data, other than through ESR's payment processor in the ordinary course
• Protected health information, or any other category of data subject to specific regulatory handling requirements, unless ESR has agreed in writing to receive it
• Personal data about anyone else without a lawful basis for providing it

If you are not sure whether you may share something with a processor, do not put it in.

10. Enforcement

ESR may investigate suspected violations of this policy and may suspend or terminate access, remove content, or disable a connection or grant, as described in Section 16 of the Terms.

Where a violation is serious, including anything unlawful, anything that puts other people at risk, or anything that threatens the integrity of the Service or ESR's sending reputation, ESR may act immediately and without notice. Otherwise ESR will ordinarily contact you first and give you an opportunity to fix it.

Some of these rules are enforced by the Service itself rather than only stated here. Approval gating, spend limits, and refusal to defeat bot detection are built in and are not settings you can turn off.

This policy changes as the Service changes. We will notify you of material changes by email or by displaying a notice in the Service, as described in Section 18 of the Terms.

Questions about this policy, or reports of misuse: legal@esr.co