Acceptable Use Policy

1. Scope and responsibility

This Acceptable Use Policy ("AUP") forms part of the Hagency Terms of Service and applies to every account, Workspace, user, administrator, API client, bridge, bot, integration and item of Customer Data. You are responsible for ensuring that your users and anyone acting through your account complies with it. Examples are illustrative, not exhaustive. Conduct not specifically listed may still be prohibited when it is illegal, abusive, deceptive, unsafe or materially harmful to Hagency, its users, third parties or networks.

2. Illegal activity and harmful content

You may not use, attempt to use, or enable others to use the Services to create, upload, store, transmit, solicit, promote, coordinate or facilitate:

• activity or content that violates applicable law, regulation, court order, sanctions or export controls;
• child sexual abuse material, grooming or sexual exploitation of minors, or any content that sexualizes a minor;
• human trafficking, sexual exploitation, non-consensual intimate imagery or credible threats of violence;
• terrorism or violent-extremist activity, recruitment, operational support or content required by law to be removed;
• instructions or transactions whose primary purpose is to cause serious physical harm, manufacture prohibited weapons or facilitate violent crime;
• targeted harassment, stalking, doxxing, coercion or abuse that creates a credible risk of harm;
• content or conduct that unlawfully discriminates against, threatens or incites violence toward a person or protected group;
• fraud, scams, deceptive impersonation, forgery, money laundering, unlawful gambling or evasion of legal obligations; or
• promotion, sale or distribution of illegal goods, controlled substances, stolen property or unlawfully obtained data.

3. Cybersecurity and network abuse

• No malware, ransomware, spyware, credential stealers, botnets, command-and-control systems, cryptojacking, destructive code or unauthorized exploit delivery.
• No phishing, credential harvesting, domain spoofing, misleading authentication flows or impersonation intended to deceive.
• No unauthorized access, probing, scanning, interception, vulnerability exploitation or security testing of systems you do not own or lack permission to test.
• No denial-of-service activity, traffic amplification, reflection attacks, disruption, interference or material degradation of any service or network.
• No bypass of authentication, access controls, moderation, rate limits, quotas, suspensions or technical safeguards.
• No hosting or distribution of data obtained through a breach, unlawful surveillance, credential stuffing or other unauthorized means.

Good-faith security research must be limited to systems you own or are expressly authorized to test, minimize harm, avoid accessing others' data, and follow any published vulnerability-disclosure process.

4. Spam, automation and deceptive messaging

• No unsolicited bulk or repetitive messaging, spam, chain messages, artificial engagement or abusive invitations.
• No automated account creation, scraping, crawling or harvesting that disregards robots, rate limits, consent, privacy or applicable law.
• No collecting, buying, selling or using contact details, identifiers or credentials for unauthorized messaging or profiling.
• No falsifying sender identity, routing information, headers or affiliation, and no misleading claims that Hagency endorses a communication.

You must obtain all legally required consents, provide required identification and opt-out mechanisms, and promptly honor opt-outs. Transactional and community messaging must remain proportionate to recipients' reasonable expectations.

5. Privacy, intellectual property and personal rights

• Do not disclose, process or monitor another person's private or personal information without appropriate authority, notice and lawful basis.
• Do not infringe copyright, trademark, patent, trade-secret, publicity, confidentiality or other proprietary rights.
• Do not circumvent digital-rights controls, distribute unlawfully copied materials or knowingly link to content primarily intended to infringe.
• Do not impersonate another person or organization, misrepresent affiliation, or register deceptive Workspace labels or identifiers.

Hagency may remove or restrict content in response to a sufficiently detailed and apparently valid rights complaint and may provide relevant notices to the Customer. Repeated or egregious infringement may result in termination.

6. Platform, resource and account abuse

• Do not consume resources in a way that is abnormal, excessive or disproportionately burdens shared infrastructure or other users.
• Do not run cryptocurrency mining, public proxies, traffic relays, anonymization exits, file-sharing indexes, commercial bulk delivery or compute workloads unrelated to ordinary Matrix communications without written approval.
• Do not use the Services as a general-purpose backup, archive, content-delivery network or storage bucket.
• Do not resell, sublicense, rent or provide managed access to the Services unless an applicable plan or written agreement permits it.
• Do not create multiple accounts or Workspaces to evade quotas, payment, enforcement, free-plan restrictions or identity verification.
• Do not interfere with monitoring, logging, billing, abuse reporting or service attribution.

7. Federation, bridges, bots and integrations

You are responsible for all federation, bridges, bots, webhooks, appservices and integrations you enable, including their credentials, permissions, content, traffic and compliance with third-party rules. You must not use them to export or amplify prohibited activity, defeat moderation, secretly monitor users or cause Hagency addresses or infrastructure to be blocked. We may disable any integration or federation path that creates abuse, security, legal or reputation risk.

8. High-risk and regulated uses

Unless expressly agreed in writing, the Services may not be used to provide emergency communications, public-safety dispatch, critical infrastructure control, medical diagnosis, legally mandated recordkeeping or any system where interruption, delay or data loss could reasonably cause death, serious injury or material physical damage. You are solely responsible for determining and meeting industry-specific, employment, education, financial, health, telecommunications and data-localization requirements.

9. Enforcement and cooperation

Hagency may investigate suspected violations and may preserve evidence, limit traffic, remove or block content, disable a feature or bridge, quarantine a Workspace, suspend or terminate accounts, reclaim resources, or notify affected providers, rights holders or authorities. We select measures based on factors such as severity, recurrence, intent, harm, legal duties, technical feasibility and risk. We may act immediately and without notice when delay could increase harm or liability. A warning or opportunity to cure is discretionary, not guaranteed. Enforcement may cause service interruption or data loss, for which the Terms' disclaimers and liability limits apply.

You must reasonably cooperate with investigations, preserve relevant information, prevent recurrence and provide accurate contact and authorization information. You may not retaliate against a reporter or obstruct an investigation.

10. Reporting and appeals

Report suspected abuse through the authenticated support-ticket system or support@hagency.cloud. Include the Workspace hostname, Matrix room or user identifier, relevant timestamps, a precise description and supporting evidence. Do not send illegal content when a hash, link or description is sufficient. Emergencies should be reported to appropriate local emergency services first.

An account owner may appeal an enforcement decision within 30 days through the associated ticket, identifying the decision and providing new, specific information. We may decline repetitive, abusive, unauthorized or legally prohibited appeals. An appeal does not stay enforcement or guarantee restoration of access or data.

11. Changes

We may update this AUP as threats, law and the Services evolve. Changes take effect when posted or on the stated effective date. Material changes will be notified where required, but urgent safety or legal updates may apply immediately.