Acceptable Use Policy

1. Prohibited Content

You may not use the Services, or direct or allow an Agent, to create, store, publish, send, or link to content that:

• Is illegal or facilitates illegal activity in any jurisdiction where it is made available.
• Sexualizes or exploits minors, including child sexual abuse material (CSAM) in any form, real or generated. We report apparent CSAM to the National Center for Missing & Exploited Children (NCMEC) and cooperate with law enforcement.
• Depicts intimate imagery without consent, including non-consensual intimate images and sexualized deepfakes of real people.
• Is pornographic or sexually explicit.
• Depicts a real person saying or doing something they did not, in a way likely to mislead, or clones a person's voice or likeness without their consent.
• Promotes hatred or violence against people based on protected characteristics, incites or threatens violence, glorifies terrorism, or celebrates acts of extreme violence.
• Harasses, threatens, or stalks anyone, or publishes private identifying information about others without consent ("doxxing").
• Encourages or gives instructions for suicide or self-harm.
• Is malicious code: malware, spyware, ransomware, or any software designed to disrupt, damage, or gain unauthorized access to systems, devices, or data.
• Deceives or defrauds: phishing, credential harvesting, scams, deceptive impersonation of any person, brand, or service (including Emra), or content designed to trick people into disclosing sensitive information or sending money.
• Is deliberately false or misleading and meant to cause harm, including content meant to interfere with elections or other civic processes, and fake reviews or testimonials.
• Infringes or misappropriates anyone's intellectual-property, privacy, publicity, or other rights. Copyright complaints follow the process in Terms of Service Section 22.
• Sells or facilitates illegal goods or services, including illegal drugs and weapons, human trafficking, or gambling where it is unlawful.
• Helps anyone develop, acquire, or use chemical, biological, radiological, or nuclear weapons, or other weapons capable of mass casualties.

2. Agents and Automation

Agents can run code, browse the web, call APIs, send messages, and act in the accounts you connect. You may not direct or allow an Agent to:

• Access any system, account, or data it is not authorized to access, or test, scan, or attack any system you do not own or have written permission to test.
• Guess, stuff, or crack credentials, or use credentials that you are not authorized to use.
• Send spam or unsolicited bulk messages by email, Slack, or any other channel, send messages that violate anti-spam or telemarketing laws, or build or store harvested contact lists for that purpose.
• Scrape or crawl websites in violation of their terms or technical limits, evade their rate limits, bot detection, or access controls, or load them at a volume that burdens them.
• Pose as a human in a way that deceives the people it talks to, send messages as a specific person who has not authorized it, or fail to disclose that people are interacting with AI where the law requires that disclosure.
• Create fake accounts, fake engagement, or other inauthentic activity on any service, or run disinformation or influence campaigns.
• Attack, disrupt, or gain unauthorized control of critical infrastructure.
• Monitor, track, or profile individuals without a lawful basis, including covert surveillance of employees or members of the public, or identify people from biometric data such as face or voice where the law prohibits it.
• Infer people's emotions in a workplace or school, score people's trustworthiness, or predict criminal behavior, where the law prohibits it.
• Use Output as a consumer report, or as the sole basis for a decision about a person's credit, employment, insurance, or housing.
• Take actions with legal, financial, medical, employment, housing, or similarly significant effects on a person without meaningful human review before the action takes effect.

Give each Agent only the Connections and tools it needs, and review what Agents do. Admins can review Agent activity in the audit log.

3. Platform Integrity

In connection with the Services, you may not, directly or through an Agent:

• Bypass or attempt to bypass authentication, authorization, or other security controls, including the audit log, Agent permissions, and usage limits.
• Try to break out of a Workspace's isolation: reach another Workspace, the host machine, or Emra's infrastructure, or gain privileges beyond those the Services give an Agent.
• Probe, scan, or test the vulnerability of the Services except as permitted under Section 6 (Security Research).
• Interfere with or disrupt the Services, including denial-of-service attacks or deliberately exhausting shared resources.
• Use the Services for cryptocurrency mining, as an open proxy, VPN, or anonymizing relay, or as generic compute, storage, or bandwidth unrelated to the work of your Agents.
• Share sign-in credentials, create accounts by automated means, or create Agents, Workspaces, or accounts to multiply an Allowance or to evade limits, suspension, or termination.
• Circumvent your plan's Allowance, usage limits, or billing, or resell or white-label the Services without our written permission.
• Use the Services to build a competing product by copying Emra's software, interfaces, or prompts (Terms of Service Section 13).
• Circumvent the safety measures of the AI Tools, extract their model weights or system prompts, or use Output to train an AI model that competes with the provider of the AI Tool that produced it.
• Use the AI Tools in a way that violates the usage policy their provider publishes for the model your Agent runs on. Agents run on models from the providers listed on our Sub-processors page. Where a provider's policy is stricter than this AUP, the stricter rule applies.

4. Connected Accounts and Third-Party Services

When you connect an account, such as Google, GitHub, Slack, or Notion, Agents act in it as you. You must:

• Connect only your own accounts, or accounts you are authorized to connect, and follow the terms of each service and of any website or API your Agents use.
• Not ask an Agent to send email or messages from your accounts that you would not be allowed to send yourself, such as bulk unsolicited email or messages that break a workplace's rules.
• Where the Services offer a Connection for a service, use it instead of giving an Agent a password, key, or token for that service.

5. Sensitive Data and High-Risk Uses

Unless we have agreed otherwise in a signed written agreement, you may not put the following in a Workspace, send them to an Agent, or have an Agent collect them:

• Protected health information subject to HIPAA.
• Payment card data subject to PCI DSS. Card numbers belong with a payment processor.
• Government-classified information, export-controlled technical data (such as ITAR data), or criminal justice information.
• Personal data of children under 13.
• Data you are not lawfully permitted to collect, hold, or share with us.

Do not use the Services where a failure could lead to death, personal injury, or severe physical or environmental damage, such as medical treatment decisions, emergency services, or safety-critical control systems.

6. Security Research

We welcome good-faith security research into the Services under coordinated disclosure:

• Report suspected vulnerabilities to security@emra.ai and give us a reasonable opportunity to fix them before any public disclosure.
• Test only against a Workspace you hold. Do not access, change, or keep data that is not yours, do not degrade the Services, and do not test against other Customers' Workspaces. Social engineering, denial-of-service testing, and physical attacks are out of scope.
• We treat good-faith research that follows these rules as authorized. We will not treat it as a violation of this AUP or the Terms of Service, and we will not bring a legal claim against you for it.

7. Reporting Violations

Report abuse, illegal content, or AUP violations to support@emra.ai. Include the details we need to find and evaluate the problem. For copyright infringement, follow the process in Terms of Service Section 22. We review reports and act as described in Section 8, and where the law requires, we handle notices and communicate our decisions as it specifies.

8. Enforcement

We may investigate suspected violations and take any action we reasonably consider appropriate, including warning the Customer; removing or disabling content; pausing an Agent or a Connection; suspending Members or the Workspace; terminating accounts; and reporting to law enforcement. Where practicable and lawful, we will tell the Customer first and give it a chance to fix the problem. We may preserve and disclose information as described in the Privacy Policy. We do not pre-screen content, and enforcing in one case does not waive our right to enforce in another. Enforcement follows the Terms of Service, including Sections 6, 7, and 15.

9. Changes and Contact

We may update this AUP as the Services and abuse patterns change. We will notify you of material changes as described in Terms of Service Section 20.

Questions about this policy: support@emra.ai (Emra Tech, Inc.)