Acceptable Use Policy

1. Scope

This policy applies to everyone who uses a software product of Talivio Technology OÜ (registry code 16991406, Estonia) — for example Mailio, Replio, Hostio, Growio, CanopyProof, PrivaScan or A11yProof — including the members of your team and anyone you let use your account. You are responsible for their use.

It is part of the terms you accept for each product. Where we process personal data on your behalf, the Data Processing Agreement also applies. A product may add stricter rules of its own; it never relaxes these.

2. Never allowed, in any product

• Content or activity that is illegal in the European Union, in Estonia or in the country where you or the recipients are — including child sexual abuse material, terrorist content, illegal hate speech, and the sale of illegal goods or services.
• Fraud, phishing, impersonation of another person or organisation, and deceptive pages or messages that collect passwords, payment details or identity documents.
• Malware, ransomware, spyware, botnet command servers, or links that deliver them.
• Infringing someone else's copyright, trademark or other rights, or publishing someone's personal data without a lawful basis.
• Harassment, threats, or content that incites violence against people.
• Getting around a product's limits, rate limits, plan quotas, team isolation or security controls, or trying to reach another customer's data.
• Reselling or sublicensing access to a product without a written agreement with us.

3. E-mail and messaging (Mailio, Replio and other sending features)

• No spam. Send bulk or marketing messages only to people who agreed to receive them, as the e-mail and e-privacy law of the recipient's country requires. Bought, rented, scraped or harvested address lists are not allowed.
• Every marketing message identifies you as the sender and includes a working way to unsubscribe; honour unsubscribe and "stop" requests promptly.
• Do not forge headers or sender addresses, hide the origin of a message, or send from a domain you are not authorised to use.
• Do not use a mailbox or number to relay mail or messages for third parties, or to run an open relay.
• Bounce and complaint rates that put a shared sending reputation at risk (for example listings on public blocklists) are treated as abuse even when the list was opt-in; we may pause sending while the cause is fixed.
• WhatsApp (Replio): you must also follow Meta's WhatsApp Business policies, including the rules on opt-in, message templates and the 24-hour customer service window. If Meta restricts or bans your number, that decision is Meta's and we cannot reverse it.

4. Servers, scanning and security (Hostio, CanopyProof, PrivaScan, A11yProof)

• Connect to Hostio only servers that you own or are authorised to manage. Hostio receives root or sudo access to those servers; you decide which servers to connect and which changes to apply.
• Do not use a connected server or a Talivio product to scan, probe, attack or test systems you are not authorised to test — including load or denial-of-service tests against third parties, brute-force attempts and vulnerability exploitation.
• No cryptocurrency mining, open proxies, spam infrastructure, phishing pages or malware hosting on servers managed through Hostio.
• Scan only websites you own or have permission to scan. Scanning a third-party site for a sales prospect is allowed only within the limits of the product (public pages, normal crawling rate) and never to collect personal data from it.
• If you find a security vulnerability in a Talivio product, report it to us and give us reasonable time to fix it before disclosing it. Do not access data that is not yours to show the problem.

5. AI features and AI output

Several products use AI models (through Talivio's AI gateway) to draft replies, summaries, reports or suggestions. AI output can be wrong, incomplete or out of date.

• Review AI output before you rely on it or send it to others. You are responsible for what you publish or send, including AI-drafted text.
• Do not use AI output as the only basis for a decision that has legal or similarly significant effects on a person — for example about a child's education or health, someone's employment, credit or access to a service. A qualified person decides.
• Where a product answers people on your behalf automatically, make sure they are told they are dealing with an automated system where the law requires it (for example Article 50 of the EU AI Act).
• Do not use AI features to generate content that this policy prohibits, to produce deceptive content presented as human-made where disclosure is required, or to try to extract the underlying models, prompts or other customers' data.
• Do not put special categories of personal data (health, religion, ethnic origin and the like) into free-text AI features unless the product is designed for it and you have a lawful basis.

6. Reporting abuse or illegal content

Anyone can report abuse, spam or illegal content involving a Talivio product by e-mail to [email protected] with the subject "Abuse". Tell us where the content or activity is (address, message headers, IP address or account), why you believe it is illegal or abusive, and how we can reach you. We confirm receipt, act on the report without undue delay and tell you what we decided.

7. What we do when this policy is broken

We act in proportion to the harm. Usually the steps are:

1. Notice. We e-mail the account owner what we found, which rule it breaks and what needs to change, with a reasonable time to fix it.
2. Restriction. If the problem continues, we limit the affected feature only — for example pause outgoing mail or messages, stop a scan, or disconnect one server — while the rest of the account keeps working.
3. Suspension. For serious or repeated breaches we suspend the account or team. Your data is kept during suspension and you can still ask for an export.
4. Termination. For very serious or repeated breaches we may end the agreement under the product's terms.

We may restrict or suspend immediately, before any notice, when abuse is ongoing and harms others (for example a spam run, an attack or malware), when there is a security risk to our systems or other customers, or when the law or an authority requires it. We then tell you as soon as we can.

Each decision comes with a statement of the reasons: what we restricted, the facts, the rule and how to contest it. To contest a decision, reply to that e-mail; a person who was not involved in the original decision reviews it and we lift the restriction as soon as the cause is resolved. You keep any right to go to court or to an out-of-court dispute body. Where we must, we report illegal content to the competent authorities.

8. Changes

We may update this policy; the version and date at the top show the current text. We tell account owners about material changes by e-mail at least 30 days before they apply, unless a change is needed sooner because of the law or a security risk.