Acceptable Use Policy

Purpose

This Acceptable Use Policy ("AUP") sets out the activities that are not permitted on the Chromoly platform. By using Chromoly, you agree to comply with this policy. Violations may result in suspension or termination of your account in accordance with our Terms of Service.

We keep this policy short and clear. If you're unsure whether a use case is allowed, contact us at david@artivex.io before proceeding.

Prohibited content and use cases

You may not use Chromoly to build, host, or process anything that:

Is illegal or facilitates illegal activity

• Violates any applicable law in Sweden, the EU, or the jurisdiction of your end users
• Infringes intellectual property, trademarks, or trade secrets
• Engages in fraud, money laundering, or sanctions evasion
• Distributes malware, ransomware, or other malicious code

Harms people

• Sexually exploits, endangers, or targets minors
• Promotes self-harm, suicide, or eating disorders
• Incites violence, terrorism, or hate against any group
• Harasses, bullies, doxxes, or threatens individuals
• Generates non-consensual intimate imagery or impersonates real people

Abuses AI capabilities

• Uses AI to deceive users about whether they are interacting with a human in contexts where transparency is required
• Generates disinformation, election manipulation content, or coordinated inauthentic behaviour
• Makes high-risk automated decisions about people (employment, credit, insurance, healthcare, housing, immigration, criminal justice) without meaningful human review
• Bypasses safety filters or content policies of underlying AI providers (Anthropic, OpenAI, Mistral, etc.)

Processes sensitive data without proper safeguards

• Stores or transmits special categories of personal data (health, biometric, genetic, racial, religious, political, sexual orientation) without explicit user consent and a signed DPA
• Sends unmasked personal data to external AI providers without the data subject's explicit consent
• Processes payment card data outside of compliant subprocessors (Stripe)
• Stores government-issued IDs, passwords, or authentication credentials in plain text

Disrupts the platform or other users

• Probes, scans, or tests the vulnerability of any system or network without explicit written authorisation
• Attempts to access data belonging to other Customers (cross-tenant access)
• Reverse engineers, decompiles, or attempts to extract our source code or internal AppSpec format beyond what is exposed via documented APIs
• Generates excessive load through high-frequency polling, retry storms, or unbounded loops designed to consume credits or compute
• Resells, sublicenses, or white-labels Chromoly without a written agreement

Industries we do not support without a written agreement

• Adult content, gambling, firearms, or controlled substances
• Cryptocurrency exchanges or token launchpads
• Mass-market surveillance, stalkerware, or covert tracking
• Political campaigning automation at scale

If your business operates in a regulated industry (healthcare, finance, legal, insurance), please contact us before signing up so we can assess fit and put the necessary contracts in place.

AI agent and MCP usage

Chromoly provides MCP endpoints that let third-party AI clients (Claude, ChatGPT, Cursor, etc.) operate on your data. When you grant AI access:

• You are responsible for the actions performed by AI clients you authorise, including any data created, modified, or deleted
• You must scope MCP tokens to the minimum permissions needed
• You must keep AI activity logs for at least 90 days for any production system processing personal data
• You must not use AI agents to bypass our rate limits, generate spam, or attempt to extract data belonging to other Customers

The kill switch is provided to revoke all AI access immediately if you suspect misuse.

Reporting and enforcement

To report a violation of this AUP - by your own account, another Customer, or a Customer-built application - contact david@artivex.io. We aim to acknowledge reports within 24 hours.

Where a violation is confirmed we may, depending on severity:

• Issue a written warning and request remediation
• Suspend specific automations, AI access, or features
• Suspend the entire account pending investigation
• Terminate the account permanently and report to relevant authorities where required by law

For severe or ongoing violations (CSAM, immediate threats to life, active malware distribution) we will act immediately and may not provide prior notice.

Changes

We may update this AUP from time to time as the platform evolves and as new categories of misuse emerge. Material changes will be communicated to active Customers by email at least 30 days in advance.