Acceptable use policy

1. Purpose

Cluebase sits inside your application and speaks directly to the people who use it. That position carries obligations on both sides: we commit to handling those conversations lawfully, and you commit to deploying the service in ways that respect your end users and the service itself.

This policy draws that line. It is not exhaustive; an absence from the list below is not permission. We may act on any use we judge to be harmful to end users, other customers, or the service, under section 8.

2. Who this applies to

This policy binds you, the customer, for everything done under your account, including by your team members and anyone using your API keys or incident tokens. You are also responsible for the way you configure the service toward your end users: the widget is yours to deploy, and what it says to them under your configuration is on you.

An end user who abuses the widget conversation is primarily your concern under your own terms of service, though we may throttle or block traffic that attacks the service itself under section 5.

3. Where the widget may run

3.1 Your own properties

The widget is licensed for deployment in applications and sites you own or control, or where you have the rights to embed third- party software. That includes your production app, your staging environments, and your documentation site.

3.2 Not anywhere else

• You may not deploy the widget on someone else’s site or application without their permission, or in a way that presents the service as part of a product you do not operate.
• You may not offer the widget to third parties as a standalone feature of your own product, white-label it, or resell access, except under a separate written agreement with us.
• You may not use the widget to collect information under false pretences, such as presenting an automated recovery agent as a human support representative.

4. Data you must not send

The service is built for error context and support conversations. The privacy policy describes what we collect and how it is protected, including automatic redaction of obvious secrets before anything is stored. Redaction reduces the cost of an accident; it is not a licence to route sensitive data through the service on purpose.

You must not knowingly send, cause to be sent, or solicit through the widget:

• Special categories of personal data (health, biometric, racial or ethnic origin, religious belief, sexual orientation, union membership, criminal records) except where you have a lawful basis, have completed any required transfer assessment, and have told us in writing first.
• Payment card data intended to be captured through the widget. Card numbers that appear incidentally in error output are masked by redaction; building flows that ask end users for card details is prohibited outright.
• Credentials and authentication material. Do not design error payloads that include passwords, API keys, session tokens or private keys, and do not instruct end users to type secrets into the conversation.
• Children’s data from services directed at children under 13, or whatever age requires parental consent in your jurisdiction, unless you have obtained valid consent and any additional verifications that law requires.
• Content that is illegal in the jurisdictions you or your end users operate in, or that you have no right to transmit.

5. Prohibited conduct

5.1 Against the service

You may not:

• probe, scan or test the ingest or conversation endpoints for vulnerabilities outside a disclosure made to us first (good-faith security research is welcome, see our security page for how to reach us);
• load-test, flood or otherwise degrade the service, or circumvent its rate limits and plan quotas, whether manually or with automation;
• scrape the service, bulk-extract conversation transcripts, or build a dataset from another customer’s use of it;
• interfere with another customer’s incidents, conversations, or notifications, or attempt to gain access to their workspace.

5.2 Against people

The service may not be used to:

• harass, threaten, defame or stalk anyone;
• send spam or unsolicited marketing through conversations;
• distribute malware, phishing links or fraud schemes, including luring end users into the widget to phish them;
• violate export controls, sanctions, or applicable economic restrictions, or use the service from a territory you are prohibited from using it in.

6. The agent

The recovery agent is an AI model operating within fixed constraints, described in the privacy policy. Two rules follow from what it is:

• Do not attack it.Attempts to manipulate the agent into breaking its instructions, extracting its system prompt, producing harmful content, or acting on another customer’s data are prohibited and will end the conversation involved.
• Do not over-trust it. Its output can be wrong. Under our terms, you are responsible for reviewing agent guidance before your team acts on it, and we are not liable for decisions made solely on its output.

7. Your end users

The widget converses with people who trusted your application, and you owe them a working disclosure chain: they should be able to find out what the widget is, why the conversation is happening, and who to reach besides it. Specifically, you will:

• identify yourself as the operator of the widget; it must be clear to end users that messages come from your product;
• disclose that the responder is automated where the law or fair practice requires it;
• link your own privacy notice wherever the widget is embedded, since you are the controller of your end users’ conversation data, as described in our privacy policy;
• keep a channel open for end users to reach a human when the agent cannot resolve their issue.

8. Enforcement

We investigate suspected violations. Depending on what we find, we may, in increasing order of severity:

• warn you and require the violation to be corrected by a date;
• suspend the offending project, integration or feature while it continues, giving you notice where practicable and immediately where the violation exposes end users or the service to ongoing harm;
• restrict or terminate your account under section 12 of the terms, with the refund and data-export treatment described there;
• report unlawful activity to law enforcement or a supervisory authority, where the law requires or permits it.

If we suspend or terminate for a violation of this policy, we will tell you what provision was violated and, where we can without compromising an investigation, what evidence led to the decision. You may appeal in writing to the address below.

9. Reporting violations

If you see Cluebase being used against this policy, or receive content through a Cluebase widget that should not exist anywhere, write to hello@cluebase.dev with what you saw and where. Reports made in good faith are acted on regardless of source, including from end users.

10. Changes and contact

This policy may change as the service does. Material changes are announced in advance under section 14 of the terms, and the effective date above moves with the current version. Questions go to hello@cluebase.dev.