CREATO AI Acceptable Use Policy

Document version: 2.0 — Date of preparation: September 30, 2026. This policy is an addendum to the SaaS Agreement.

1 Permitted use

The platform is designed to be used within the Customer's legitimate business operations and purchased subscription scope for customer support, permitted conversational marketing, e-commerce store analytics, and associated operational automations. Customer is responsible for supervising its authorized users. Relevant third-party carrier guidelines and messaging channel rules must be observed.

2 Prohibited activities

The following activities are strictly prohibited:

• Unsolicited commercial messaging or communications without required recipient consent; utilizing purchased, scraped, or unverified contact databases; sending communications in violation of recorded opt-out requests.
• Impersonation, falsified business identities, fraudulent schemes, phishing, deceptive advertising, or unlawful commercial enterprises.
• Publishing content that infringes personal data protection, privacy rights, trade secrets, or intellectual property of others; leaking or exposing third-party customer conversations across accounts.
• Harassment, threats, hate speech, incitement to violence, child sexual abuse material, human trafficking, or related harmful and exploitative content.
• Unauthorized access, token hijacking, compromising security boundaries, deploying malware, causing denial of service, or conducting uncoordinated penetration testing.
• Circumventing plan limits, user quotas, or channel restrictions via account duplication or automated scraping; unauthorized sublicensing, reselling, or white-label distribution.
• Marketing products, services, or regulated industries prohibited by messaging channels; non-compliance with age, jurisdictional, licensing, or sector-specific restrictions.
• Collecting unauthorized datasets for generalized AI model training; transferring Google user data for advertising targeting or training, developing, improving, or fine-tuning generalized AI/ML foundation models in violation of Google policies.

Statutory exceptions for scientific research, software interoperability, or mandatory legal disclosures are not negated by this policy. Formal security research requires prior written authorization with defined scopes.

3 Data and AI governance

Customer must not upload unnecessary special category personal data, full government identity documents, payment card security codes, plaintext passwords, or private encryption keys. Sensitive processing that has not been legally and technically agreed upon in advance is prohibited. AI outputs must not serve as the sole automated decision-maker for critical matters involving legal status, employment opportunities, creditworthiness, or health outcomes.

Customer must maintain updated knowledge base sources and define automation boundaries. CREATO AI enforces technical access limits and approval controls; customer errors do not eliminate Provider's statutory technical data security duties.

4 Reporting violations enforcement and appeals

Suspected violations or security incidents may be reported to hello@creato.digital. Upon identifying concrete risks or violations, CREATO AI may restrict offending content or campaigns, demand proof of recipient consent, and suspend affected features or accounts. Interventions remain strictly proportionate to risk urgency and scope.

Absent imminent security emergencies or legal mandates, Customer will receive notice of reasons and an opportunity to remedy curable breaches within timeframes established in the main agreement. Where emergency interventions occur, explanations are provided promptly as legally permissible. Customer may appeal enforcement actions; appeals are evaluated through audit logs and identity verification. Carrier-level restrictions remain under the independent authority of upstream network providers.

5 Liability and consumer protections

Customer is liable for its own culpable and unlawful platform misuse; Provider is liable for its own actions and contractual breaches. Enforcement discretion does not grant arbitrary termination rights or the right to retain unearned fees. Data handover rights, statutory consumer remedies, and non-waivable legal protections remain fully preserved under the main agreement.