Acceptable Use Policy

This Acceptable Use Policy (the "AUP" or "Policy") is published by AI Empowerment Ltd, a company registered in England and Wales under company number 15515185, with its registered office at 124 City Road, London, EC1V 2NX, United Kingdom, trading as "Algominds" ("Algominds", "we", "us", or "our"). Our data protection registration with the Information Commissioner's Office (the "ICO") is ZC082052.

For questions about this Policy, or to report a breach, contact us at [email protected], or our privacy contact, Edward Albazii, at [email protected].

---

1. Scope and Incorporation into the Terms

1.1 What this Policy is

This AUP sets out the rules that govern how you may use the Algominds products and services (together, the "Services"). The Services include:

1.2 Incorporation and precedence

This AUP is incorporated into, and forms part of, the Algominds Terms of Service (the "Terms"). Capitalised terms that are not defined in this Policy have the meaning given to them in the Terms. Our processing of personal data is governed by the Algominds Privacy Policy and, where applicable, the DPA or the data-processing terms incorporated into your contract. If there is a conflict, the order of precedence is: (a) any signed order form or master services agreement; (b) the DPA (or incorporated data-processing terms), on matters of data protection; (c) the Terms; and (d) this AUP.

1.3 Who is bound

This Policy binds everyone who accesses or uses the Services, including:

• Signals account holders and the individual users they invite or authorise ("Users");
• Managed Services and Professional Services clients ("Clients"); and
• anyone acting on a User's or Client's behalf.

You are responsible for ensuring that everyone who uses the Services through your account, or on your instructions, complies with this Policy. In this Policy, "you" and "your" refer to Users and Clients together, unless the context requires otherwise.

1.4 Consequences of breach

A breach of this Policy is a breach of the Terms. Section 10 sets out how we enforce this Policy, which may include warnings, throttling, suspension, or termination, in addition to any other rights or remedies available to us at law or under the Terms.

---

2. General Acceptable-Use Principles

You agree that, when you use the Services, you will:

1. comply with all laws, regulations, and regulatory codes that apply to you and to your use of the Services, including data protection, privacy, marketing, and anti-spam laws;
2. use the Services only for legitimate B2B purposes and in accordance with the Terms, this Policy, the DPA (where applicable), and any documentation or guidance we provide;
3. be solely responsible for the content you create, upload, target, send, or transmit through the Services (your "Content"), including any data you upload and any messages you send;
4. ensure you have a valid lawful basis, and any consent required by local law, for the personal data you process and for the outreach you carry out through the Services;
5. respect the rights of third parties, including their privacy, intellectual property, and contractual and platform rights; and
6. not use the Services in any way that could damage, disable, overburden, or impair the Services, or interfere with any other party's use of the Services.

---

3. Prohibited Content and Conduct

You must not use the Services to do, or attempt to do, any of the following, and you must not permit or encourage anyone else to do so:

3.1 Illegal use

Use the Services for any unlawful purpose, or in furtherance of any illegal activity, including fraud, money laundering, the sale of illegal goods or services, or any activity that breaches sanctions or export-control laws.

3.2 Infringing intellectual property or privacy

Infringe, misappropriate, or violate any third party's intellectual property rights, privacy rights, publicity rights, confidentiality, or other legal rights; or upload, target, or send any Content that you do not have the right to use. To report infringement, see Section 10.6.

3.3 Harmful or malicious code

Upload, transmit, or distribute any virus, worm, trojan, ransomware, spyware, or other malicious code, or any material designed to interrupt, damage, destroy, or limit the functionality of any software, hardware, or telecommunications equipment.

3.4 Harassment, deception, or impersonation

Use the Services to harass, threaten, defame, abuse, or stalk any person; to send content that is obscene, hateful, or discriminatory; to deceive or mislead recipients; or to impersonate any person, company, or entity, or misrepresent your identity, affiliation, or authority (including falsely implying endorsement by, or affiliation with, Algominds).

3.5 Scraping and circumventing limits

Circumvent, disable, or otherwise interfere with any rate-limiting, sending-limit, or usage-limit feature of the Services or of any connected platform; or use any robot, scraper, or other automated means to access the Services other than through interfaces and methods we expressly authorise. Security-specific prohibitions (including probing, penetration testing, and credential sharing) are set out in Section 9.

3.6 Unauthorised access

Access, or attempt to access, any account, system, data, or network that you are not authorised to access; or use another person's credentials or allow another person to use yours.

3.7 Reselling the Services

Resell, sublicense, rent, lease, time-share, or otherwise make the Services available to any third party, or operate the Services as a service bureau (that is, running them on behalf of third parties for a fee), except where we have agreed this in writing (for example, under an approved white-label or agency arrangement). Where we approve such an arrangement, you must impose terms at least as protective as this Policy on each of your end users, you remain responsible for their compliance, and you remain liable to us for their breaches.

---

4. Outreach and Anti-Spam Rules

Outreach is central to the Services. You are the sender and, in data protection terms, the controller of the personal data in the outreach you carry out, as set out in Section 12. You are responsible for the legality of every message sent through your account or on your instructions.

4.1 Comply with marketing and anti-spam laws

You must comply with all laws that apply to your outreach, including, where relevant:

This list is illustrative, not exhaustive. You remain responsible for identifying and complying with every law applicable to your recipients. The GDPR legitimate-interests basis described in Section 5.1 does not satisfy consent-based regimes such as CASL or the national consent rules referred to in Section 4.5.

4.2 Accurate identification and headers

Every message you send must:

1. use accurate, non-deceptive header information and "from", "to", and routing data;
2. clearly and truthfully identify the actual sender, namely you (or, where you send on behalf of a Client, that Client) as the party whose product, service, or message is being promoted. Where Algominds acts only as your processor, the "from" line and sender identification must not present Algominds as the sender;
3. use subject lines that are not misleading; and
4. for commercial email, include a valid physical postal mailing address, as required by CAN-SPAM and good practice in other jurisdictions.

4.3 Opt-out and suppression

You must:

1. include a clear and working means to opt out, unsubscribe, or object in every marketing message, in the form required by applicable law;
2. honour every opt-out, unsubscribe, or objection within the time required by applicable law and, in any event, without undue delay. The minimum standards are: immediately for UK and EU/EEA recipients (PECR and GDPR); within 10 business days for US email (CAN-SPAM) and for Canada (CASL), with CAN-SPAM opt-out mechanisms kept working for at least 30 days after a message is sent;
3. maintain and apply suppression lists so that recipients who have opted out, objected, bounced, or otherwise asked not to be contacted are not contacted again. Suppression applies across channels (email, LinkedIn, and SMS) and across all campaigns in your account, so that a contact who opts out of one channel or campaign is not re-targeted through another; and
4. not require a login, account, fee, additional personal data (beyond confirming the address or identifier already contacted), or any step other than a reply or visiting a single page in order to opt out. For UK and EU email, a reply alone may not be a valid opt-out mechanism, so you must also provide an unsubscribe link or equivalent.

We operate suppression and do-not-contact controls as an enforcement layer across the Services and as an independent controller for that purpose (see Section 12). You must not disable, bypass, or override these controls.

4.4 No unlawful lists

You must not use purchased, rented, scraped, or harvested contact lists, or any data, without a valid lawful basis and the consent required by applicable law. You warrant that you have a lawful basis for every recipient you target and for every contact record you upload or use. This warranty survives termination.

4.5 Higher-risk and consent-based jurisdictions

Some jurisdictions impose stricter requirements on B2B cold outreach, including a requirement for prior consent.

• Germany. Germany (under the Act Against Unfair Competition, the "UWG", together with German data protection law) treats unsolicited B2B electronic marketing as high-risk. Algominds has received a German GDPR/UWG demand in connection with cold email. Accordingly, you must not carry out cold outreach to recipients in Germany without documented prior consent, and we may require evidence of that consent before permitting it.
• Other EU/EEA states. Certain other EU/EEA states (which may include, for example, Austria and Italy) also require consent for B2B electronic marketing. You must identify and comply with the national rules applicable to each recipient.
• Canada. Under CASL, commercial electronic messages to Canadian recipients require express or implied consent; legitimate interests is not a sufficient basis.

You must not target recipients in these higher-risk or consent-based jurisdictions without an appropriate lawful basis, including documented consent where local law requires it. We may restrict or suppress outreach to such jurisdictions, we make available our current restricted-jurisdiction controls so that this rule is determinable, and we may require evidence of your lawful basis before permitting outreach.

4.6 SMS-specific rules

Where you use, or instruct us to use, the cold SMS channel (offered through Twilio in the United States and Canada), you must:

1. obtain prior express written consent where required by the TCPA and applicable state law before sending marketing SMS to mobile numbers;
2. maintain valid sender registration, including 10DLC brand and campaign registration, and comply with CTIA messaging principles and carrier rules;
3. support STOP, UNSUBSCRIBE, and HELP keywords, honour opt-outs immediately, and observe applicable quiet hours and frequency limits; and
4. identify the sender in the message and not use deceptive or misleading content.

4.7 Volume, sender warranties, and indemnity

You warrant that your use of the Services for outreach is, and will remain, compliant with this Section 4, and you will indemnify us in accordance with the Terms for any claim arising from your non-compliant outreach. For the avoidance of doubt, and to the extent permitted by the Terms, "claim" includes regulatory investigations, penalties, and statutory damages (for example, TCPA per-message statutory damages, CASL administrative monetary penalties, FTC/CAN-SPAM enforcement, ICO/PECR action, and German UWG cease-and-desist and Abmahnung costs), as well as third-party claims.

---

5. Data and Discovery Rules

5.1 Lawful basis warranty

You warrant that, for all personal data you upload to, target through, enrich with, or otherwise process using the Services, you have:

1. a valid lawful basis under applicable data protection law (for B2B cold outreach this is typically legitimate interests under Article 6(1)(f) of the UK and EU GDPR, supported by a documented Legitimate Interests Assessment, an "LIA");
2. obtained any consent required by local law; and
3. provided any privacy notices and honoured any rights (including the right to object under Article 21) required of a controller.

5.2 Compliance with the DPA

Where we process personal data on your behalf (as your processor), you must comply with your obligations as controller under the DPA (or the data-processing terms incorporated into your contract) and applicable data protection law, including issuing lawful and documented instructions, and you must not instruct us to process data in a way that would breach applicable law.

5.3 Discovery, enrichment, and scraping

When you use, or instruct us to use, discovery and enrichment features, you must:

1. respect website terms, robots directives, and platform restrictions;
2. not collect, scrape, or harvest data beyond what is lawful and authorised;
3. not use the Services to build datasets in breach of any third party's terms or of applicable law; and
4. not use any data sourced through discovery or enrichment features (including data originating from Apollo, Exa, Bright Data, or Findymail) in breach of the originating source's terms, and not re-scrape LinkedIn or any other platform beyond what that platform and the relevant connector (such as Unipile or HeyReach) permit.

You, and not Algominds, bear the risk arising from any platform's terms (including LinkedIn's restrictions on automated tools) in connection with discovery, enrichment, and outreach. Some discovery and enrichment steps may involve us and you acting as joint controllers, and others involve our independent controller role; the allocation of responsibilities is set out in the Privacy Policy and the DPA.

5.4 Special category and prohibited data

You must not upload, target, or instruct us to process special category data (such as health, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation), data relating to children, or any data whose processing would be unlawful, except where expressly agreed in writing and supported by an appropriate lawful basis and condition.

---

6. Third-Party Platform Compliance

The Services connect to and rely on third-party platforms. You are responsible for complying with the terms of every platform you connect or use, including:

• LinkedIn (connected through Unipile, and used with HeyReach). LinkedIn's User Agreement prohibits unauthorised automated tools, and this is the single highest platform-ban risk for outreach;
• your email mailbox provider, any mailboxes provisioned through Zapmail, and email sending and infrastructure platforms (including Smartlead);
• mobile carriers, CTIA, and the 10DLC registration system, and Twilio, in connection with SMS (see Section 4.6);
• customer-connected CRM and calendar integrations that you connect (including Salesforce, HubSpot, Cal.com, and Calendly); and
• any other platform you connect through the Services (including via Unipile).

Payment processing is provided by Stripe, which we operate for billing; you do not connect Stripe yourself.

You acknowledge that:

1. these platforms set their own usage rules, sending limits, and automation restrictions, which may change at any time;
2. you are solely responsible for any suspension, restriction, ban, or other action taken against your account, mailbox, profile, or sender registration by a third-party platform or carrier as a result of your use; and
3. Algominds does not control, and is not responsible for, the acts, omissions, or availability of third-party platforms, and we make no warranty that automation of any platform is permitted by that platform's terms.

---

7. AI Use Restrictions

The Services use AI model providers (currently OpenAI and Anthropic, via their APIs) to generate signal intelligence, copy, and other outputs ("AI Output"). The following rules apply to your use of AI features and AI Output:

1. Lawful use only. You must not use AI Output for any unlawful, deceptive, defamatory, harassing, discriminatory, or infringing purpose.
2. No impersonation. You must not use AI Output to impersonate any person or entity, or to create content that falsely appears to originate from someone else.
3. Required disclosures. Where applicable law (for example, the EU AI Act transparency rules) requires disclosure that content is AI-generated or that an interaction is automated, you must make that disclosure.
4. Human review. AI Output may be inaccurate, incomplete, or unsuitable. You must review AI Output for accuracy, legality, and appropriateness before relying on it or sending it, and you remain solely responsible for any content you send.
5. Provider terms. Your use of AI features is also subject to the applicable AI provider's acceptable use rules. Inputs and outputs are processed via the providers' APIs and are not used to train their public or foundation models; providers may retain inputs for a limited period (around 30 days) for abuse monitoring. Further detail is set out in the Privacy Policy.

---

8. Volume, Deliverability, and Platform Integrity

To protect the Services, our sending infrastructure, third-party platforms, and other customers, you must:

1. respect all sending limits and ramp-up schedules that we or the relevant platform provide or apply;
2. not send at volumes, frequencies, or quality levels that risk harming sender reputation, domain or mailbox health, or deliverability for yourself, for Algominds, or for any other customer;
3. maintain good list hygiene, including prompt removal of bounces, complaints, and opt-outs;
4. not take any action that threatens, degrades, or could degrade the deliverability, reputation, or integrity of the Services or of any shared infrastructure; and
5. not engage in "snowshoeing", deceptive routing, or other techniques designed to evade spam filters or deliverability controls.

We may throttle, pause, or suspend sending where, acting reasonably, we consider it necessary to protect deliverability, platform integrity, or other customers.

---

9. Security and Integrity

You must not, and must not attempt to or permit others to:

1. probe, scan, or test the vulnerability of the Services or any related system or network, or conduct any penetration test, without our prior written consent;
2. breach, circumvent, or otherwise overcome any usage limit, rate limit, sending limit, authentication, or security measure of the Services;
3. share, sell, or transfer your account credentials or access, or allow any unauthorised person to use your account. OAuth tokens for connected mailboxes and LinkedIn accounts are encrypted at rest and must not be extracted, exported, or misused;
4. access the Services in order to build a competing product or service, or to copy any feature, function, or design of the Services; or
5. interfere with, disrupt, or impose an unreasonable load on the Services, our infrastructure providers (including Supabase, Vercel, and Cloudflare), or any connected platform.

Responsible disclosure and safe harbour. If you discover a security vulnerability, please report it responsibly to [email protected] and do not exploit it or disclose it publicly until we have had a reasonable opportunity to address it. Where you act in good faith, comply with these responsible-disclosure terms, and do not access, modify, or delete data beyond what is necessary to demonstrate the issue, we will treat your activity as authorised for the purposes of Section 9.1 and will not pursue action against you under this Policy or the Terms.

---

10. Enforcement

10.1 Monitoring

We may, but are not obliged to, monitor use of the Services, sending activity, deliverability metrics, and Content for compliance with this Policy, the Terms, and applicable law, and to detect and prevent abuse, fraud, and security incidents. We carry out monitoring for these purposes as an independent controller, as described in the Privacy Policy.

10.2 Action we may take

If we reasonably believe that you have breached, or are likely to breach, this Policy, or that action is necessary to protect the Services, our infrastructure, third-party platforms, other customers, or any person, we may take one or more of the following steps, with or without notice as the circumstances require and acting proportionately:

10.3 Urgent action

Where a breach poses an immediate risk to the Services, to deliverability, to a third-party platform, to other customers, or to any person, or where required by law, we may suspend or terminate access immediately and without prior notice.

10.4 Effect on suppression and data on termination

Suppression, do-not-contact, opt-out, and objection records are retained and continue to apply even after suspension or termination, and even after deletion of other data, because we maintain them as an independent controller for abuse prevention and to honour individuals' rights (see Section 12 and the Privacy Policy). Subject to that, on termination, Content and personal data other than suppression records are deleted or returned in accordance with the DPA and the retention periods set out in the Privacy Policy (for prospect data processed for a customer, typically deleted within 30 days of campaign completion).

10.5 Reporting abuse

To report suspected abuse, spam, a security issue, or any other breach of this Policy, contact us at:

• Abuse and general: [email protected]
• Privacy and data protection: Edward Albazii, [email protected]

Please include enough detail (such as the message, sender, domain, or account involved) for us to investigate.

10.6 Reporting infringement

If you believe Content on or sent through the Services infringes your intellectual property rights, notify us at [email protected] with: (a) identification of the work or right said to be infringed; (b) identification of the offending Content, with enough detail for us to locate it; (c) your contact details; and (d) a good-faith statement that the use is not authorised. We will review valid notices and may remove or disable the Content under Section 10.2.

10.7 Appeals

If you believe an enforcement action was taken in error, you may contest it by writing to [email protected]. We will review your request, and respond, within a reasonable period (we aim to respond within 10 business days), and may reinstate access where we conclude the action was unwarranted.

---

11. Liability and Indemnity

Your liability and ours in connection with this Policy are governed by the Terms and, on matters of data protection, by the DPA (or the data-processing terms incorporated into your contract). In summary, and subject to the full provisions of the Terms:

• for business customers, our aggregate liability is capped at the greater of (a) the fees you paid for the relevant Service in the 12 months before the claim, or (b) GBP 500;
• where an individual uses the Services as a consumer rather than for business purposes, that individual retains their statutory rights, which this Policy does not exclude or limit;
• data-protection liability between you and us is governed by the DPA or the data-processing terms incorporated into your contract; and
• you will indemnify us, as set out in the Terms, against claims arising from your breach of this Policy, including non-compliant outreach, unlawful data processing, and infringement of third-party or platform rights.

Disputes are resolved as set out in the Terms: business customers by arbitration before the London Court of International Arbitration (LCIA) seated in London; consumers through the courts.

---

12. Data Protection Roles (Summary)

This is a summary only. The Privacy Policy and the DPA govern in full.

In every case where we act as your processor, you are the controller and you warrant that you have a lawful basis for the processing. International transfers, sub-processors, retention periods, and security measures are described in the Privacy Policy and the DPA, including transfer mechanisms such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses with the UK Addendum, adequacy decisions, and the EU-US Data Privacy Framework where a vendor is certified.

---

13. Changes and Contact

13.1 Changes

We may update this Policy from time to time, for example to reflect changes in law, regulatory guidance, platform requirements, or our Services. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

13.2 Contact

AI Empowerment Ltd, trading as Algominds 124 City Road, London, EC1V 2NX, United Kingdom Company number: 15515185 (England and Wales) ICO registration: ZC082052

General and abuse reports: [email protected] Privacy contact: Edward Albazii, [email protected]

This Policy and any dispute or claim arising out of or in connection with it are governed by the laws of England and Wales, and are subject to the dispute-resolution provisions of the Terms.