Acceptable Use Policy

Use SIMCOAI only for lawful business purposes and only with data, numbers, accounts, integrations and sender identities you are authorised to use.

Do not use the platform to impersonate others, deceive customers, bypass another service terms, or evade provider or carrier rules.

API access is provided for legitimate integration with your own systems. Rate limits apply and are published in our documentation. Deliberately circumventing them, running unbounded retry loops, or generating request volume disproportionate to genuine business use is not permitted.

API keys must be kept server-side. Embedding a key in a browser, a mobile application bundle, or any other context a third party can read is a breach of this policy and puts your customers' data at risk. If a key is exposed, revoke it immediately from your dashboard.

You remain responsible for traffic generated by your own integrations, including any charges arising from it.

Do not use AI features for emergency response, final regulated decisions, medical diagnosis, legal/tax/financial advice, deceptive persuasion, discrimination or harmful automated decisions.

Do not prompt the system to reveal secrets, internal prompts, private customer data or security controls.

Do not spam, robocall unlawfully, spoof caller identity, ignore quiet hours, contact suppression lists, send marketing without consent, or overload Twilio/carrier resources.

Phone and messaging features may be blocked until number assignment, consent, registration, disclosure and recording checks are complete.

Do not collect card numbers, passwords, security codes, national identifiers, special category data, children data or confidential third-party data unless specifically reviewed and lawful.

Use structured questions and human handoff to minimise risk.

Do not probe, scan, scrape, brute force, abuse APIs, bypass rate limits, share API keys, use stolen credentials, or attempt to access another customer account.

Report suspected vulnerabilities responsibly to [email protected].

If you report a security vulnerability to us in good faith, take no more of another customer’s data than is needed to demonstrate the issue, do not disrupt the service for others, and give us a reasonable opportunity to investigate and fix it before disclosing it publicly, we will not treat that report as a breach of this policy or pursue action against you for making it. This safe harbour covers the act of reporting; it does not cover any other conduct that separately breaches this policy or the law.

Connect only systems your business owns or is authorised to administer. Use least-privilege access and remove integrations when staff or suppliers change.

Do not sync live customer data into test stores or expose integration tokens in client-side code.

Do not upload unlawful, infringing, hateful, exploitative, malicious, deceptive or unsafe content. Do not use SIMCOAI to facilitate fraud, harassment, malware, credential theft, or illegal goods/services.

Do not submit a review of SIMCOAI that is not your own genuine, first-hand experience. Do not submit multiple reviews for the same business to inflate a rating, submit a review on behalf of someone who did not write it, impersonate another customer, or use a review to advertise an unrelated product or service.

Do not include another person’s name, contact details or other personal data in a review, and do not describe an individual member of anyone’s staff in a way that identifies them.

Reviews are read by a person before publication. Anything breaching this section is declined, and repeated attempts are treated as abuse under section 09.

Proof upload links must only be sent to a person who is genuinely party to the refund, order, booking or escalation they relate to, and only to collect evidence you actually need to assess that request. Do not reuse, publish or bulk-distribute upload links, and do not use them as a general file-transfer, storage or backup service.

Do not use upload requests to solicit payment card numbers, passwords, one-time codes, full identity documents or special category data you have no lawful basis to process. Do not pressure a customer into providing evidence you are not entitled to require, and do not present a SIMCOAI barcode or document check to them as proof, certification or fraud detection — those checks are assistive only.

Uploaded material must be lawful. Malware, unlawful imagery, content that infringes someone else's rights, and deliberately falsified evidence are prohibited. We may scan for malicious files, apply file type, size, volume and retention limits, and remove or block content that breaches this policy or applicable law. Abuse of upload links may result in the link being revoked or the feature being suspended under the enforcement section below.

If you believe content reachable through SIMCOAI — a published review, a business profile, or material submitted through the platform by a customer or caller — infringes your rights or is otherwise unlawful, email [email protected] with: the material and where it appears, why it infringes your rights or breaks the law, your contact details, and a good-faith statement that the information you have given is accurate.

We review reports in good faith and may remove or restrict access to material while we investigate, without that being an admission that any particular report is correct. Where practical we will tell the account holder a report has been made and give them an opportunity to respond before acting, except where the nature of the material means acting first is the responsible course. This process is offered alongside, not instead of, any formal legal route such as a court order, and a knowingly false or bad-faith report may itself be treated as a breach of this policy under the enforcement section below.

A breach of this policy is a material breach of the Terms of Service. SIMCOAI may throttle, suspend, disable features, remove content, terminate accounts or notify providers and authorities where use creates legal, security, provider, customer or platform risk. Where the breach is remediable and the risk allows, we will give you notice and a reasonable opportunity to remedy before suspending or terminating.

Billing obligations may continue for charges already incurred before suspension or termination.

Where we believe this policy may have been breached, we will generally investigate and give you an opportunity to explain or correct the position before acting, except where immediate action is necessary to protect customers, callers, providers, networks, the platform or third parties from serious or ongoing harm. Suspension under this policy follows the process and any cure period in clause 20 of the Terms of Service where those apply; nothing in this policy shortens or removes that process.

Use the Service for legitimate business work with people who have a real relationship to the Customer or have chosen to contact it. A workflow should ask only for information needed to answer, route, book, investigate or complete that work. A technically available feature is not permission to collect every field, contact every number or automate every decision. The Customer must evaluate the effect on people, especially where the subject may be vulnerable or unable to use a digital channel.

We may ask for an explanation of a workflow if its volume, content or destination reasonably indicates abuse. We may limit the affected function while we investigate, using a narrower restriction where feasible. A Customer that learns of misuse by one of its users should stop that access promptly and tell us if our assistance is needed to contain it.

Do not present an AI assistant, agent or message as a particular human being if that would mislead a recipient. Do not impersonate another business, authority or individual, or hide the origin of a call or message in a way that breaks law or provider rules. A permitted business name, caller ID or sender label must be one the Customer may use. The Customer should check how that identity appears on the recipient’s device and correct a misleading configuration.

SIMCOAI may require proof of control of a number, domain, sender or integration before enabling it. We may reject an identity that conflicts with credible evidence of another party’s rights. A successful technical verification is not a legal opinion about trade marks, marketing consent or communications regulation; the Customer remains responsible for those issues.

Do not use scripts, repeated retries, parallel calls or integrations to overwhelm the Service or evade published rate or usage limits. A failed request should be checked before it is resubmitted if repeating it could create a booking, charge, message or refund. We may slow or reject traffic that threatens stability for other customers and may ask the Customer to change its schedule or integration design. We should explain a material limit and a practical path to restore normal access where safe.

A high-volume legitimate campaign still has to meet the applicable marketing, telecoms and data protection rules. Purchased lists, scraped addresses and indiscriminate calling are not made acceptable by spreading requests across accounts or numbers. The Customer should maintain suppression lists and a way to honour opt-outs.

Do not use the Service as the sole route for emergency requests, medical triage, legal advice, financial eligibility, employment decisions or other high-impact matters unless a separate written agreement and suitable controls specifically cover that use. Configure a handoff to a qualified person where the assistant may encounter an urgent or sensitive situation. An AI response should not be represented as a professional assessment merely because it is fluent or immediate.

The Customer should test the escalation path before relying on it and monitor failures. If an assistant lacks a required fact, it may refuse to guess, ask for clarification or send the issue to a person. That protective behaviour is not a Service defect merely because it leaves a task unfinished. The Customer should correct inaccurate knowledge rather than instruct the assistant to conceal uncertainty.

Good-faith reports of a suspected vulnerability are welcome through the published security or support contact. Do not access another customer’s information, persist in a system after discovering a flaw, alter records, run destructive tests or publish exploit details before we can investigate. We may give a written scope for an authorised test; testing outside that scope remains prohibited. A report should include enough detail to reproduce the issue without copying unnecessary personal data.

We will acknowledge and investigate a credible report and may ask the reporter to stop a particular action that risks others. This policy does not prevent lawful whistleblowing, regulator contact or exercise of a legal right. A reward, public credit or special access is not promised unless separately agreed.

When reasonably possible, we will tell the Customer what conduct appears to breach this policy and allow correction. We may act without advance notice where delay would expose people, data or infrastructure to material harm, or where law or a provider requires it. Measures may include limiting a feature, blocking a destination, suspending credentials, removing unlawful content or ending an account under the Terms. We will consider the seriousness, repetition, intent and effect of the conduct when choosing a measure.

The Customer may contact support to challenge an enforcement action and provide relevant evidence. We may preserve records needed to explain the decision, defend a claim or assist an investigation, subject to privacy law. Restoring access may require removing the cause, verifying authority or agreeing a safer configuration. We do not promise to restore a use that remains unlawful or unsafe.

A Customer challenging a restriction should give the account and affected function, explain the intended lawful use and provide relevant consent, sender or authority evidence where applicable. We should review the evidence and say whether the restriction can be narrowed or removed. A restriction may remain while a carrier, payment provider or authority independently blocks the traffic. We should not promise to override that external decision. Repeated violations after a clear warning may justify stronger measures; a first accidental error that is promptly corrected should be assessed on its actual risk. Records of enforcement should be limited to what is needed to explain the decision, prevent recurrence and meet legal duties.

If misuse of a Customer workflow affects another person, the Customer should stop the harmful activity, preserve relevant records and consider its notification and remedy duties. SIMCOAI will provide reasonable platform information and containment assistance within its control, subject to privacy and security limits. Neither party should tell an affected person that a report has been resolved when investigation is still open. A good-faith complaint or rights request must not itself be treated as abuse. We may restrict a dangerous configuration while the Customer investigates, and should restore lawful use once the reason for the restriction is removed. The Terms determine any payment or termination consequence.

A Customer must not create another account, rotate credentials, switch numbers or route traffic through a different integration to continue conduct we have specifically restricted for abuse, security or legal reasons. It may ask us to review the restriction and provide evidence that the issue is resolved. We should explain the affected function and a safe route to resume legitimate work where practical. A restriction on one abusive workflow should not automatically erase the Customer’s lawful records or unrelated data-rights route. Repeated attempts to evade a restriction may justify stronger action under the Terms, subject to proportionality and mandatory rights.