Acceptable Use Policy

Scope and responsibility

This policy of ERP•AI US Inc., 2 Embarcadero Center, San Francisco, CA 94111, USA (“ERP•AI”, “we”, “us”), covers all Services and all Customer Content. It is part of the Terms of Service, the Proto Terms and the build.host Terms, and a material violation is a material breach of them. Capitalized terms have the meanings given in the Terms of Service.

You are responsible for your Authorized Users, your Agents, anyone using your account or API keys until you revoke them or tell us they are compromised, and misuse of your Published Apps or Hosted Content that you know about. The usage policies of the Model Providers we route your requests to (linked from our Subprocessors page) and the terms of Third-Party Services you connect also apply. The examples below are not exhaustive, and helping others break this policy is a violation. Nothing in this policy limits your right to post honest reviews or other lawful statements about ERP•AI.

Agents and automated actions

Agent Actions taken under your account count as your actions under this policy, whether you approved them, scheduled them or allowed them through your settings, including Proto’s default mode. This does not apply to the extent an Agent Action resulted from a defect in the Services, a block, limit or approval setting not working as described, a setting ERP•AI changed without your agreement, or ERP•AI’s breach of the Terms or its security obligations.

Proto’s default Uninterrupted mode runs shell commands, file changes, ERP•AI record updates, form submissions, payments and messages without asking you first. Turning it off in Settings > Permissions makes Proto ask before most, but not all, consequential actions, as the Proto Terms explain.

Content an Agent reads can try to hijack it (prompt injection), so supervise Agents, limit their access and keep approvals on for high-stakes tasks. When we respond to a violation, we consider whether an Agent was misled and how it was configured. Instructing an Agent to break this policy is a violation even if the Agent fails.

What you must not do

Illegal content and activity

Do not use the Services for anything illegal where you, your Authorized Users or the people affected are, such as fraud, money laundering, or selling illegal drugs, weapons or counterfeit goods, or to plan violence or develop biological, chemical, nuclear or radiological weapons.

Child sexual abuse material

Do not upload, generate, store, link to, request or share any sexualized depiction of a minor, including drawn, fictional or AI-generated images, or use the Services to groom, entice, sexually extort or traffic children. We have zero tolerance, as “Child safety and law enforcement” describes.

Phishing, impersonation and malware

Do not build, host or send phishing or fake login or payment pages, wallet drainers, or forms that collect passwords, one-time codes, recovery phrases, keys or card details under false pretenses (a login form for your own service is fine); impersonate any company, brand, government body or person, including ERP•AI, or use lookalike names, logos or domains to mislead; or create, host or distribute malware, ransomware, spyware, stalkerware, keyloggers, exploit kits or botnets.

Spam and unsolicited messages

Do not use the Services, including Agents and workflow emails, to send bulk unsolicited messages, message purchased, rented or scraped lists, or send anything that breaks the anti-spam, telemarketing or e-privacy law where the recipient is. Get the consent the law requires, identify the sender and honor opt-outs promptly.

Security testing and resource abuse

Do not probe, scan, penetration test, load test or attack any system, including other customers’ apps and our infrastructure, without its owner’s written permission. You may test the security of your own Published Apps and Hosted Content at normal traffic levels, but load testing them needs our written permission. Do not mine cryptocurrency on our infrastructure or in visitors’ browsers, run open proxies, open mail relays or anonymization exit nodes, take part in denial-of-service attacks, botnets or traffic fraud, or overload shared infrastructure.

Report vulnerabilities in the Services to legal@erp.ai and give us at least 90 days to fix them before disclosing them, unless we agree otherwise. Good-faith research that avoids other people’s data, does not degrade the Services or touch other customers’ apps, stops once the issue is shown and is promptly reported does not violate this policy.

Scraping other services

Do not use the Services, including Agents, to access, scrape or automate a third-party site or API in breach of its terms or the law, by defeating its access controls (such as logins, paywalls, rate limits, CAPTCHAs or IP blocks), by crawling at scale against its robots.txt rules, or to create accounts or buy tickets or other limited goods in bulk.

Limits, credits and payments

Do not:

• get more Promotional Credits or free allowances than one person or organization may have, through multiple accounts, false or disposable emails or automated sign-ups, or sell or transfer Promotional Credits or accounts;
• evade metering, rate, plan or spend limits, build.host’s review of server-side apps or other usage controls, including by splitting work across accounts;
• use stolen payment methods, or charge back an authorized payment for Services you received without first contacting care@erp.ai (this does not limit any dispute right the law gives you);
• reverse engineer the Services, except as the law allows, or bypass safety filters; or
• access or automate the Services except through our documented APIs, exports, features and tools (Agents, including Proto, working in your own account this way are allowed).

We may revoke Promotional Credits obtained or used in breach of this policy. Usage they paid for is then owed, and we tell you the amount before we collect it.

Intellectual property

Do not publish, generate or distribute anything that infringes copyright, trademark, patent, trade secret or publicity rights or breaks open-source or other licenses, strip copyright notices, or offer pirated software or cracked keys. The Copyright Policy covers copyright and trademark notices and repeat infringers.

Privacy and surveillance

Do not process personal data without the lawful basis, notices and consents the law requires; track or record people without required notice or consent; build dossiers from scraped data, dox anyone or sell personal data you have no right to sell; or collect data from children under 13 without complying with COPPA. Submit full card numbers or security codes only through a payment provider’s checkout, and protected health information covered by HIPAA only under a business associate agreement signed with us. If your Published App or Hosted Content collects personal data, give people a privacy notice; our DPA covers our processing of it.

Harassment, hate and intimate images

Do not threaten, harass, stalk or intimidate anyone, promote violence or violent extremism, or attack people for race, ethnicity, national origin, caste, religion, disability, sex, gender identity, sexual orientation, age or another protected trait. Do not create or share intimate images of a real person without consent, including AI-generated sexual deepfakes.

Deceptive AI content

Do not use Outputs or Agents to deceive people, including by:

• publishing a deep fake (AI-generated or manipulated image, audio or video that resembles real people, objects, places or events and would falsely appear authentic) without clearly disclosing that it is artificial (for evidently artistic, satirical or fictional works, in a way that does not spoil the work);
• publishing AI-generated text on matters of public interest without the disclosure the law requires, unless a person reviewed it and takes editorial responsibility for it;
• letting an Agent or chatbot claim to be human, or hide that it is automated where the law requires disclosure; or
• creating fake reviews, testimonials, news, receipts, IDs or election information.

Prohibited AI practices

Wherever you are, do not use the Services for practices prohibited by Article 5 of the EU AI Act, such as harmful manipulative or deceptive techniques or exploitation of people’s vulnerabilities, social scoring, predicting crime based solely on profiling, untargeted scraping of facial images for facial recognition databases, inferring emotions at work or school (except for medical or safety reasons), biometric categorization to infer sensitive traits such as race, political opinions or sexual orientation, and real-time remote biometric identification in public spaces for law enforcement.

Decisions about people

Do not use Output, Agents or other AI features as the only basis for, or otherwise to replace or substantially replace human decision-making in, a decision with legal or similarly significant effects on a person, such as hiring, firing, pay, credit, insurance, housing, education, healthcare, immigration or access to essential services. A qualified person must meaningfully review each such decision and be able to change it, and you must meet the notice, assessment, opt-out, appeal and audit duties the law sets. Rules and calculations you set yourself, such as payroll or credit limits, are not restricted.

As between you and ERP•AI, the duties of a deployer and, where your use makes you one, of a provider under the EU AI Act and similar laws are yours. Do not give personal legal, medical, tax or financial advice based on Output without professional review.

Sanctions and export controls

You may not use the Services if you are, or act for, a person on a US, EU, UK or UN sanctions or restricted-party list; an entity owned 50 percent or more, directly or indirectly, alone or together, by such persons, or otherwise controlled by them; or a person located, organized or ordinarily resident in Cuba, Iran, North Korea, Russia, Belarus, Crimea, the so-called Donetsk or Luhansk People’s Republics, or the Russian-occupied parts of the Kherson and Zaporizhzhia regions of Ukraine. Do not use the Services to breach export controls, support weapons of mass destruction, or evade sanctions, including by hiding your location or giving such a person access.

Credentials and connected accounts

Do not access accounts, systems or data without authorization, including with someone else’s or leaked, phished or bought credentials, cookies, keys or tokens, or share or publish ERP•AI, Proto or build.host API keys. Use connected Third-Party Services, such as model provider keys or browser sign-ins imported into Proto, only as you are authorized to.

Codex mode connects Proto to OpenAI as OpenAI’s Codex CLI. Each time Proto starts, in any connection mode, Proto copies the Codex CLI’s sign-in tokens from your device if it has no ChatGPT sign-in of its own. The Proto Terms explain this and the risk that OpenAI limits your account. Using Codex mode as Proto provides it is not by itself a breach of this policy.

Enforcement

What we may do

If we reasonably believe content or activity breaks this policy or the law, we may, in proportion to the issue, block deploys, remove or unpublish content, stop workloads, pause Agents or features, revoke keys or Promotional Credits, or suspend or close accounts, under the notice, cure, refund and export rules of the Terms of Service. If it breaks neither but creates a serious security risk, or an authority’s order requires action, we restrict it only as long as needed, and if we then close your account without cause, we refund your unused Purchased Credits.

We aim to use the least severe measure that works, but may act immediately against child sexual abuse material, phishing, malware, attacks, threats to safety, sanctions breaches and legal orders. The Terms of Service govern our liability for these actions and what happens to your Credits and Customer Content, except that we do not return content we removed as illegal or as malicious code unless we confirm we misidentified it.

Child safety and law enforcement

When we become aware of apparent child sexual abuse material or other apparent child sexual exploitation, including enticement or trafficking, we disable access to it, report it to the National Center for Missing & Exploited Children (NCMEC) as US law requires and, where appropriate, to law enforcement, preserve the material and related account data as the law requires, and may close the accounts responsible without notice.

If we believe in good faith that a crime threatens someone’s life or safety, we inform the competent law enforcement authorities, including as Article 18 of the EU Digital Services Act requires where it applies. Authorities can reach us at legal@erp.ai. As the law and our DPA allow, we may share the minimum information needed to stop ongoing abuse, such as a URL, with an impersonated company or with a domain, hosting or network provider.

Monitoring and automated tools

We do not review all Customer Content and have no duty to, but we may, as the Privacy Policy describes. Proto sends some content to our servers, including model requests routed through us (which we record), web searches and automatic error reports that contain the full session transcript, as the Proto Terms describe; we may review it to secure the Services and investigate abuse.

build.host blocks direct uploads that strongly match phishing or wallet-drainer patterns before they go live. It may also check live sites and apps and automatically stop those that strongly match phishing, credential-theft or in-browser mining patterns, or that run known mining software or use very high CPU for a sustained period. These automatic actions happen before any human review and can be wrong. Reports and weaker matches are recorded for authorized staff to review, and a person reviews every appeal.

Telling you why

We do not yet send restriction notices automatically, except that a blocked build.host upload shows its reason on screen. If your site, app, content or account is restricted and you do not know why, email care@erp.ai with its address or your account email. We will tell you what we did, where and for how long; the facts and the rule or law we relied on, including any report; whether automated tools were involved; and how to appeal and seek other redress. We may hold back details where the law or an authority’s order forbids sharing them or, as far as the law allows, where sharing them would endanger someone or hinder a criminal investigation. Where risk allows, we let you fix the problem first.

Reporting a violation

How to report

Report build.host sites at build.host/report-abuse, and everything else, including Published Apps and messages sent by Agents, to legal@erp.ai.

Give the exact URL, what is wrong and why, your name and email, and a statement that you believe in good faith that the report is accurate and complete. On the form, put anything without its own field in the details box (up to 2,000 characters). If you give an email address, we may contact you about your report, and you can ask legal@erp.ai what we decided. The form records your IP address and any email you give, as the Privacy Policy explains.

Child sexual abuse material. Never send the material or screenshots. Send only the URL, through the form (choose “Child sexual abuse material”) or to legal@erp.ai; your name and email are optional. You can also report to NCMEC’s CyberTipline at report.cybertip.org or to a hotline in your country.

Intimate images shared without consent

If an intimate image of you, or of someone you are authorized to act for, real or AI-generated, was published through the Services without consent, email legal@erp.ai with the subject “Removal request: intimate image”, including:

• your physical or electronic signature;
• the URL or other information we need to find the content (you do not need to send the image);
• a brief statement of your good-faith belief that it was published without consent; and
• your contact details.

We remove or disable access to it as soon as possible, and no later than 48 hours after we receive a valid request, and make reasonable efforts to find and remove known identical copies on the Services. If it shows someone under 18, also follow the child sexual abuse material instructions in “How to report”.

Appeals

You may ask us, free of charge, to review a decision on your content, account or report within 6 months after we tell you about it (or, if we did not, after you learn of it). Reply to our message or email legal@erp.ai with “Appeal” in the subject, explaining what was affected and why we were wrong or what you fixed. A person reviews every appeal. We decide without undue delay, explain our decision and promptly reverse restrictions we got wrong. Your other legal rights, including going to court, are not affected.

Changes to this policy

Changes to this policy follow the change rules in the Terms of Service: at least 30 days’ notice by email or in the product before a material adverse change, unless the law or security requires a faster one; no effect on disputes that arose, or that either of us knew about, before the change; and your right to close your account with a refund of unused Purchased Credits if you do not agree.