Acceptable Use Policy

• Violating applicable law, third-party rights (copyright, trademark, personality and data-protection rights), or sanctions and export-control rules.
• Content that sexually exploits children, glorifies violence, incites hatred or violence, supports terrorism, or harasses, threatens or discriminates against people.
• Fraud, phishing, impersonation, spam and unsolicited bulk messaging, fake-review manipulation, or disinformation campaigns designed to deceive the public.
• Building, distributing or operating malware or botnets, credential stuffing, scraping that circumvents technical protections, or attacks on third parties (DDoS, port scanning).
• Processing special-category personal data (Art. 9 GDPR) or minors' data without a legal basis and the contracts and notices data-protection law requires.

• Do not use model outputs to develop models that compete with AACFlow or the model provider where the provider's terms prohibit it.
• No fully automated decisions with legal or similarly significant effects on individuals (Art. 22 GDPR) without human review and a lawful basis.
• Practices prohibited by Art. 5 of the EU AI Act (Regulation (EU) 2024/1689) - such as social scoring or manipulative techniques - are not allowed.
• Label AI-generated content where the law or platform rules require it (e.g. chatbots and deepfakes, Art. 50 AI Act).
• The usage policies of the model providers you choose also apply (see Subprocessors).

• Do not bypass limits, quotas, billing or access controls, or share credentials across organizations.
• No load or penetration testing against the platform without our prior written consent. Please report vulnerabilities responsibly to security@aacflow.io (see the vulnerability disclosure section of the Privacy Policy).
• Do not use the platform to reach third parties' internal networks (SSRF) or to evade egress protections.
• No resale or white-label operation of the platform without written authorization.

Report illegal content or abuse to legal@aacflow.io. We review reports promptly, notify affected users where the law requires it (Arts. 16-17 DSA) and remove or restrict content where necessary.

Depending on severity - and without prior warning where there is imminent risk - we may remove content, throttle or block workflows and API access, suspend or terminate accounts, and notify authorities where we are obliged to. Rights that cannot lawfully be waived, including the right to be heard and to seek remedies, remain unaffected.