Acceptable Use Policy

Version: 2026-11-v1. Effective: November 16, 2026. This policy is part of the Workspace369 Terms of Service (version 2026-11-v2). Capitalized words have the meaning in the Terms.

This policy says what you can and cannot do with Workspace369. It applies to you, your workspace members, your guests, your automations, and any AI app or API key you connect. You are responsible for all of them.

1. The short version

Use Workspace369 to run a legitimate business. Only message people who agreed to hear from you. Stop when they say stop. Do not use it to deceive, harass, defraud or harm anyone, and do not use it for a business that our payment, phone, email or AI partners ban. If you break these rules we can pause features or close your account, and our partners can make us.

2. General rules

You must not use the Service to:

1. break any law or regulation, or help anyone else do so;
2. commit or facilitate fraud, deception, impersonation or identity theft, or make false or misleading claims about yourself, your business, prices, results or reviews;
3. harass, threaten, stalk, defame, or incite violence or hatred against people or groups;
4. upload, share or publish content that is illegal, infringes intellectual property or privacy rights, or sexually exploits or endangers children (we report this to authorities);
5. distribute malware, ransomware, or code meant to disrupt or gain unauthorized access;
6. circumvent plan limits, fees, usage caps, rate limits or security controls, or create accounts to evade a suspension or limit;
7. resell the Service or run it as a service bureau without our written permission;
8. scrape or bulk-collect data from the Service or other users, or use bots to access the Service except through supported APIs and connectors;
9. interfere with the Service or other customers' use of it.

3. Messaging: email, SMS/MMS and voice

These rules come from the law, from carriers, and from our providers' policies (see section 9). Breaking them is the most common reason accounts and phone numbers get shut down.

3.1 Consent

• Get consent before you message anyone. For texts and automated or prerecorded calls, marketing and promotional messages need prior express written consent. Other non-marketing texts need prior express consent. Marketing email needs the consent the law and the email provider rules require (opt-in in many countries).
• Consent must be specific to you and the kind of message. A person who gave their number for a quote has not agreed to promotional texts. Consent given to someone else, or "on behalf of partners", does not count.
• Keep proof: who, when, how, the exact consent wording shown, and the source. Keep it for as long as you message the person and for the period the law requires afterward. Show it to us within 5 business days when asked.
• If you import contacts, you confirm you have valid consent for the channel and purpose. We may require you to confirm this before you send a campaign.
• Texting someone who texted you first lets you answer that conversation. It does not give you permission to send ongoing marketing.

3.2 Not allowed

• Purchased, rented, shared, scraped or "co-registered" lists, and lists of people who did not opt in to you.
• Emailing addresses taken from the internet or social media, or generic role addresses (for example info@, sales@) without prior consent.
• Messages about the prohibited content categories in section 3.4.
• "Snowshoeing" (spreading similar messages over many numbers to dodge filters), misspelling words or changing keywords to evade filters, disguising or forging sender names, headers or routes, or using a number or domain you have not registered or do not control.
• Sending test or simulated phishing messages through the Service.
• Sending messages that look like they come from someone else, or that use deceptive subject lines.
• Mislabeling marketing messages as "transactional" or "service" messages to bypass opt-out or consent rules.

3.3 Opt-outs, labeling and timing

• Honor opt-outs by any reasonable means. STOP, UNSUBSCRIBE, CANCEL, END and QUIT are standard, but people may also write "please stop texting me", "remove me", "don't contact me" or anything similar, in any channel. Our tools try to catch these and may pause messaging to the number, and you must respect it. After an opt-out you may send at most one confirmation message and nothing more unless the person opts back in with new consent.
• Honor email unsubscribes within 10 business days or sooner if the law says so. Never hide or remove the unsubscribe link or require a login to opt out.
• Include required identification in every marketing message: who you are, opt-out instructions (for SMS "Reply STOP to opt out"), and for marketing email a working unsubscribe link and your valid postal address. Link to your privacy policy where required.
• Label promotional messages as promotional.
• Quiet hours: do not send promotional texts or place marketing calls outside 8 am to 8 pm in the recipient's local time. This is stricter than the federal 9 pm limit so that it also meets Florida and similar states; some states and countries are stricter still, and you must follow them.
• Respect do-not-call and do-not-text lists, and frequency limits.
• Stay within complaint and bounce limits. High complaint, bounce, opt-out or spam-trap rates can lead to throttling or suspension, and we may require you to fix your list before you send more.

3.4 Prohibited messaging content (SHAFT and more)

You may not send, or take payments or capture leads for, messages about:

• Sex and adult content or services, escort services, dating that is explicit;
• Hate speech, harassment or violence;
• Alcohol promotions without carrier-approved age gating (and where not permitted by the carrier program);
• Firearms, weapons, ammunition and explosives;
• Tobacco, vaping and related products;
• cannabis and CBD (even where legal locally), illegal drugs, controlled substances, and unapproved health or medical claims;
• gambling, sweepstakes and lotteries without required approval;
• high-risk financial offers: payday and short-term high-interest loans, debt collection abuse, debt relief and credit repair, get-rich-quick and income schemes, cryptocurrency investing and trading offers, multi-level marketing and pyramid schemes;
• phishing, fraud, impersonation, chain messages;
• anything else carriers or our providers treat as prohibited.

Carriers and providers can change these lists. When in doubt, ask us before you send.

3.5 Calls and recording

Do not place automated or prerecorded marketing calls without prior express written consent. Where you record or transcribe calls or voicemail with the Service, you must give the notice and obtain the consent required where you and the other party are located (including all-party-consent states and other countries), and choose the notice wording callers hear. Do not record where you cannot meet the law.

3.6 Registration accuracy

Your carrier and provider registrations (brand, campaign, use case, opt-in method, sample messages) must be accurate and match how you actually message. Tell us if your use changes. If you register a campaign as one thing and send something else, carriers may block everything and we may suspend your numbers.

3.7 Complaints and cooperation

If we, a carrier, provider, regulator or recipient questions your messages, you will answer quickly and give us the proof of consent and other information we ask for.

4. Prohibited businesses and partner policies

You may not use the Service for any business or activity that our payment, messaging, AI, platform or infrastructure partners prohibit or restrict, including those in:

• Stripe's Prohibited and Restricted Businesses list (reviewed 2026-10-15), which includes illegal products and services; adult content and services; debt relief; certain financial products and services; gambling; government services; identity-theft protection; illegal weapons and explosives; products that infringe intellectual property; certain legal services (for example bankruptcy attorneys and bail bonds); certain lending and credit services; marijuana; nutraceuticals and pseudo-pharmaceuticals; non-fiat currency (for example crypto mining, ICOs); certain travel services; and unfair, deceptive or abusive practices (for example pyramid and get-rich-quick schemes, telemarketing), plus restricted businesses requiring extra review (for example content-creation platforms, crowdfunding, dating, cyberlockers, regulated industries such as CBD, firearms, pharmaceuticals, medical devices and tobacco);
• Twilio's Acceptable Use Policy and Messaging Policy, and Twilio SendGrid's Email Policy;
• wireless carriers' rules, including the CTIA Messaging Principles and Best Practices;
• Google's policies, including the Google API Services User Data Policy and the Generative AI Prohibited Use Policy; Meta's and Microsoft's platform policies; and Apple's and Google Play's app rules.

Where those policies are stricter than this one, theirs control for the activity they cover. We may ask you about your business, and may refuse, limit or end service to categories we cannot support.

If you accept payments through Stripe Connect, you are also bound by Stripe's own terms and may be offboarded by Stripe independently of us.

5. AI features and connected AI apps

You must not use AI features, AutoPilot, Ask AI, the API or any connected AI app (MCP client) to:

1. create or spread deceptive content: fraud, scams, fake reviews or testimonials, impersonation of a real person to deceive, misleading claims of expertise (health, finance, law, government), or content presented as human-made when you are required to disclose it is AI-generated;
2. create phishing, spam or malicious software, or help attack any system;
3. create sexually explicit content, content that sexualizes minors, non-consensual intimate imagery, or content that incites violence, harasses or promotes hatred;
4. make automated decisions in high-risk areas (for example employment, housing, credit, insurance, health, legal rights) that materially harm people without meaningful human review;
5. process personal data or biometrics without the consents and notices the law requires, or track or monitor people without their consent;
6. bypass safety filters, jailbreak or manipulate a model into breaking its provider's rules, or probe or extract the model, prompts or system instructions;
7. build, train or improve a competing AI model or service from our output or Service;
8. send content in bulk to clients through unattended AI automations without the consent and review this policy requires for the channel.

Additional rules for connected AI apps and API keys:

• Grant only the permissions the app needs. Rotate or revoke keys and tokens when you stop using them.
• Do not give an AI app standing instructions that send messages, spend money, delete data or change records unless you accept responsibility for every result.
• Treat text in emails, web pages and documents your AI app reads as untrusted, because it can try to instruct the AI. Keep approval requirements for sends and deletes turned on.
• You may not run connected apps to flood the Service or evade usage limits.

Our AI providers' usage policies also apply, including Google's Generative AI Prohibited Use Policy. The exceptions that policy allows for educational, documentary, scientific or artistic purposes are decided by the provider, not by you.

6. Public pages, portals, funnels, forms and files

You must not publish or host through the Service:

• phishing or credential-harvesting pages, fake login pages, fake payment forms, or pages that imitate another company, brand, person, bank, government agency or service;
• pages designed to deceive visitors, scams, counterfeit goods, or fake giveaways;
• malware, drive-by downloads or content that tries to exploit visitors' devices;
• content that infringes copyright, trademark or other rights (see our DMCA Policy);
• adult content, content depicting child exploitation, or content that glorifies violence;
• forms that collect sensitive data (government ID numbers, payment card numbers outside Stripe fields, passwords, health information) without our written approval;
• redirects or cloaking meant to hide a page's true content from reviewers, security scanners or browsers;
• hosting for files that you do not have the right to share, or using the Service as a general file-hosting or content-delivery service.

We may review public content, using automated tools, and may disable pages, domains or links without notice when we suspect a violation or a provider or safe-browsing service flags them. Report abuse from a Workspace369-hosted page to support@workspace369.com with the subject "Abuse report".

7. Security and testing

• Do not probe, scan, penetration-test or try to breach the Service, our accounts with providers, or other customers, or exceed your authorization, without our prior written permission.
• Do not access or try to access data that is not yours, share credentials, or bypass authentication.
• Do not attempt denial-of-service attacks, load tests beyond published limits, or interfere with Service integrity.
• Good-faith vulnerability reports are welcome: see our Security page for how to report. Give us reasonable time to fix a problem before you make it public, and do not access or keep more data than needed to show the issue. Reports made this way in good faith will not lead us to take legal action. We do not run a paid bounty program.

8. Sensitive data

Do not put protected health information (PHI), payment card numbers outside Stripe's fields, government-classified information, or other specially regulated data in the Service unless we have agreed in writing. We do not offer HIPAA business associate agreements at this time.

9. Enforcement

9.1 What we may do. If we think you have broken this policy, or a partner tells us you have, we may do any of the following, at once and without notice where we think it is needed to prevent harm: warn you; ask for proof of consent or other information; remove or disable content, pages or links; hold or block messages, limit sending rates or volumes; require registration or attestation steps; suspend or release phone numbers; limit or suspend AI, API, payments or other features; suspend or terminate your account; and report to authorities, carriers, providers or affected parties. Where reasonably possible and legal we will tell you what the issue is and give you a chance to fix curable problems.

9.2 Partners can make us act. Providers and carriers may require us to suspend your messaging, payments or account immediately. We are not responsible for losses resulting from those actions.

9.3 Repeat violations. Repeat or serious violations may lead to permanent termination, with no refund of prepaid fees except as the Terms say.

9.4 Costs. You are responsible for fines, penalties, carrier fees, and reasonable costs we incur because of your violation, as allowed by the Terms (including the indemnity). Breach of this policy is a breach of the Terms.

9.5 Appeals. If you think we got it wrong, email support@workspace369.com with the facts, and a person will review it.

9.6 No duty to monitor. We do not promise to monitor use or content, and not acting on a violation is not permission.

10. Reporting

Report violations or abuse to support@workspace369.com with the subject "Abuse report". Report copyright infringement as described in our Copyright policy. Report security issues as described on our Security page.

11. Changes

We may update this policy. Material changes will follow the notice rules in the Terms.