Acceptable Use Policy

This Acceptable Use Policy (the Policy) governs use of Zammo’s Services. It is incorporated by reference into the Master Subscription Agreement and the Terms of Service. Capitalized terms not defined here have the meanings given in those documents.

Customer is responsible for compliance with this Policy by its Authorized Users, and for configuring and deploying its AI Agents so that End User interactions comply with it.

1. Prohibited Content

Customer will not create, upload, transmit, or use Customer Content, and will not configure an AI Agent to generate Output, that:

‍ ‍a. infringes or misappropriates a third party’s intellectual property, publicity, privacy, or contractual rights;

‍ ‍b. is unlawful, defamatory, obscene, pornographic, harassing, or fraudulent;

‍ ‍ c. promotes hatred, discrimination, or violence against any individual or group;

‍ ‍d. contains malicious code or is designed to interfere with any system; or

‍ ‍ e. would otherwise expose Zammo or a third party to liability or harm.

2. Prohibited Conduct

Customer will not, and will not permit any Authorized User or End User to:

‍ ‍‍ ‍a. impair the operation or integrity of the Services, or circumvent any security measure, rate limit, content filter, or guardrail;

‍ ‍‍ ‍b. share account credentials except with Authorized Users, or access the Services using another party’s credentials;

‍ ‍‍ ‍c. use data mining, scraping, robots, or similar extraction methods against the Services;

‍ ‍‍ ‍d. conduct penetration testing, adversarial testing, red teaming, or automated vulnerability scanning without Zammo’s prior written consent, which Zammo will not ‍ ‍‍ ‍‍ ‍ unreasonably withhold and will grant on reasonable terms where Customer is required to conduct such testing by law or policy;

‍ ‍‍ ‍e. reverse engineer, decompile, or disassemble the Software, or create derivative works of it; or

‍ ‍‍ ‍f. use the Services, any Input, or any Output to train, fine tune, or develop a machine learning model or service that competes with the Services.

Suspected vulnerabilities should be reported to security@zammo.ai rather than exploited or disclosed publicly.

3. Prohibited Uses of AI Agents

These restrictions reflect the nature of generative and agentic systems and apply in addition to Sections 1 and 2.

3.1 High-stakes and consequential decisions

Customer will not use an AI Agent as the sole basis for, and will not present Output as determinative of, any decision producing a legal or similarly significant effect on an individual, including eligibility for public benefits, housing, employment, credit, insurance, or education; permitting or licensing determinations; enforcement, investigative, or sanctions decisions; or medical, legal, financial, or safety decisions. Where an AI Agent supports such a process, Customer will provide meaningful human review before the decision takes effect and a route for the individual to contest it.

3.2 Transparency and impersonation

Customer will disclose to End Users that they are interacting with an automated system where disclosure is required by law or where a reasonable person would otherwise believe they were speaking with a human. Customer will not configure an AI Agent to claim to be a human when asked directly, to impersonate a specific individual, or to impersonate a government official, agency, or program other than Customer’s own.

3.3 Manipulation and misinformation

Customer will not use the Services to generate or distribute disinformation, to produce synthetic audio or text intended to deceive about its origin, to conduct political manipulation or targeted influence operations, or to exploit the vulnerabilities of a specific group in a way likely to cause harm.

3.4 Surveillance, profiling, and biometrics

Customer will not use the Services for covert surveillance of individuals, for social scoring, for emotion inference in employment, education, or law enforcement contexts, for predictive policing, or for biometric identification or categorization of individuals. Speech recognition used to transcribe an interaction for the purpose of responding to it is not biometric identification and is permitted.

3.5 Restricted data

Customer will not submit to the Services protected health information, criminal justice information, federal tax information, classified or controlled unclassified information, payment card data, or information about children subject to heightened protection, unless the parties have agreed in writing to the applicable safeguards in an Order. Customer will use available personal information filtering or obfuscation features where appropriate to its deployment.

4. Autonomous Actions

Where Customer configures an AI Agent to take Autonomous Actions, Customer is responsible for the scope of that authority. Customer will:

‍ ‍‍ ‍a. grant each AI Agent the narrowest access to connected systems that its purpose requires, and use dedicated service accounts rather than shared or administrative credentials;

‍ ‍‍ ‍b. test and validate AI Agent behavior in a sandbox before deploying it to End Users, and re-validate after a material configuration change or a change to the underlying model;

‍ ‍‍ ‍c. implement confirmation, approval, or monitoring controls in its AI Agent design or its own systems for any Autonomous Action that is financially material, irreversible, externally visible, or affects a legal right, since the Services do not include a built-in human review or approval feature;

‍ ‍‍ ‍d. implement its own volume, rate, or spending limits where appropriate, since Zammo does not impose them;

‍ ‍‍ ‍e. not configure an AI Agent to take an action in a system Customer is not authorized to access, or to act on behalf of a person or organization without that party’s authority; and

‍ ‍‍ ‍f. monitor the Autonomous Action record available through the Services and notify Zammo promptly of any Autonomous Action that appears to fall outside the configured scope.

5. Channel-Specific Requirements

5.1 Voice and IVR. Customer is responsible for obtaining any consent required to record, transcribe, or monitor a voice interaction, including in jurisdictions requiring the consent of all parties, and for providing any required recording notice at the start of a call.

5.2 SMS and messaging. Customer is responsible for compliance with applicable telemarketing and messaging law, including the Telephone Consumer Protection Act and carrier requirements, for obtaining and maintaining records of consent to receive messages, and for honoring opt-out requests.

5.3 Third-party Channels. Each Channel provider imposes its own terms, including WhatsApp and Meta business messaging policies. Customer is responsible for compliance with the terms of each Channel it enables. Channel providers process information exchanged through their platforms independently of Zammo.

5.4 Accessibility. Customer is responsible for the accessibility of its deployment as presented to End Users. Zammo will provide its accessibility conformance documentation on request.

6. Enforcement

6.1 Suspension. Zammo may suspend access to the Services, in whole or in part, if it believes in good faith that use violates this Policy and presents a risk to the Services, to Zammo, to End Users, or to a third party. Zammo will give notice before suspending where practicable, will limit the suspension to what is reasonably necessary, and will restore access promptly once the cause is resolved.

6.2 Termination. A material violation of this Policy that is not cured within the period stated in the applicable agreement is a material breach.

6.3 Reporting. Suspected violations may be reported to security@zammo.ai.

7. Changes to this Policy

Zammo may update this Policy from time to time by posting a revised version. Zammo will give Customer at least 30 days notice of a change that materially expands the restrictions applicable to a deployment Customer has already launched.

Questions about this Policy may be sent to legal@zammo.ai.