Acceptable Use Policy

This Acceptable Use Policy ("AUP") describes the rules that apply to any party ("Customer", "Client", "User") that uses any product or service ("Services") provided by Grovity Services LLC ("Grovity"), and to any user of any application or service made available by the Customer that interacts with the Services ("End User"). The examples in this AUP are illustrative, not exhaustive. The Customer is responsible for compliance with this AUP by its End Users and Authorized Users.

If the Customer or any End User violates this AUP, Grovity may suspend or terminate the use of the Services in accordance with the Terms and Conditions. Grovity may update this AUP with reasonable notice, through the Customer's account, by email, or by posting an updated version at https://www.grovity.ai.

The Customer's use of the Services and its End Users' interactions must comply with the policies of every third-party platform connected to the Services, including without limitation:

• The Meta Business Platform Terms, the WhatsApp Business Solution Terms, the WhatsApp Business Messaging Policy, and other policies issued by Meta Platforms, Inc.
• The operating rules of Visa, Mastercard, American Express, and any other card scheme, payment network, or financial institution integrated with the Services.
• The acceptable-use, anti-fraud, and consumer-protection policies of any bank, payment processor, or financial regulator applicable to the Customer.
• The terms of voice, SMS, and telecommunications providers and the rules of carriers in each jurisdiction where the Customer operates.
• The terms of CRMs, ERPs, and other enterprise applications integrated with the Services.

A violation of any of these third-party policies is a violation of this AUP.

The Customer must not use the Services to transmit, store, generate, or facilitate any content or communication that is illegal, harmful, fraudulent, unwanted, abusive, deceptive, defamatory, obscene, or otherwise inappropriate, including:

• Content that exploits, abuses, or endangers minors, including child sexual abuse material (CSAM).
• Hate speech, content that incites violence or discrimination, or material produced by or supporting hate groups.
• Threats, harassment, stalking, defamation, doxxing, or invasions of privacy.
• Sexually explicit content.
• Content that promotes self-harm, suicide, eating disorders, or other harmful behaviors.
• Glorification or facilitation of terrorism, violent extremism, or criminal organizations.
• Synthetic media, voice clones, or other AI-generated content used to deceive, defraud, impersonate real people without consent, or interfere with elections or democratic processes.
• Misinformation that poses a risk to public health, public safety, or the integrity of democratic processes.

The Customer must not use the Services to engage in, promote, or facilitate any activity that is illegal, misleading, harmful, infringes the rights of others, or is detrimental to Grovity's operations or reputation, including:

• Violating applicable laws, regulations, or industry guidance ("Applicable Laws"), including laws requiring consent before transmitting, recording, collecting, or monitoring data or communications, or requiring opt-out requests to be honored.
• Sending unsolicited commercial communications, bulk messaging without prior consent, or any communication that violates anti-spam or telemarketing laws (such as the CAN-SPAM Act, the TCPA, CASL, or equivalent rules, including Colombia's Law 2300 of 2023).
• Interfering with or negatively affecting the Services or any third-party network or platform connected to them.
• Creating a false identity or deceiving others about the identity of the sender or the origin of any communication, including impersonating Grovity, government authorities, financial institutions, health-care providers, or other organizations.
• Phishing, smishing, vishing, business email compromise, or any social engineering intended to obtain credentials, payment information, or other sensitive data.
• Money laundering, sanctions evasion, terrorist financing, fraud (including chargeback fraud or refund abuse), or any activity prohibited by financial-crime laws.
• Unauthorized collection, processing, or sale of personal data, including scraping or harvesting.
• Marketing or selling products or services prohibited by Applicable Laws or by the policies of integrated platforms (such as Meta's prohibited goods and services list).

The Customer must not:

• Bypass, circumvent, exploit, or deactivate any limitation or restriction of the Services.
• Probe, scan, or test the vulnerability of any Grovity system or network, except under a prior written security testing agreement with Grovity.
• Circumvent any security mechanism, access control, rate limit, or filter.
• Carry out denial-of-service attacks or any conduct that attempts to interrupt, disable, overload, or impair the Services.
• Transmit malicious code, including viruses, ransomware, spyware, or worms.
• Use automated means to access or use the Services beyond the limits of the Customer's plan or reasonable industry practice.
• Reverse engineer, decompile, or attempt to derive the source code, models, prompts, or proprietary architecture of the Services, except where legally permitted.
• Attempt to gain unauthorized access to the Services, to other users' accounts, or to any non-public area of Grovity's infrastructure, including through prompt injection or other manipulation of AI agents.

The Customer is responsible for the way the AI agents it creates or operates through the Services interact with End Users and the public. The Customer agrees:

• To configure its AI agents with clear guardrails so that they remain within the Customer's business scope and do not engage in deceptive, harmful, or illegal conduct.
• To clearly inform End Users that they are interacting with an automated AI system, and not with a human, wherever required by law (including the California Bot Disclosure Law and Article 50 of the EU AI Act, where applicable) and, in any case, in health, financial, and legal contexts.
• To provide End Users with a way to reach a human representative where required by law or appropriate to the use case.
• Not to use AI agents to provide regulated professional advice (such as legal, medical, psychological, or financial advice) without the participation of a duly qualified professional and appropriate disclaimers.
• Not to use AI agents to make decisions that produce legal or similarly significant effects on individuals (such as credit, employment, insurance, or access to health care) solely on the basis of automated processing, except as permitted by Applicable Laws and with the human review they require.
• Not to generate or distribute synthetic media that impersonates real individuals without their consent.
• To validate AI-generated outputs before relying on them for critical decisions, in accordance with the Terms and Conditions.

When the Services are used in connection with health, medical, wellness, pharmaceutical, or health-insurance activities, the Customer must comply with the Health Data Addendum and, in particular:

• Not use AI agents to diagnose, triage medical urgency, prescribe, recommend dosages, or make any other clinical decision without review by a qualified health professional.
• Configure AI agents to direct End Users who report a possible emergency or risk of self-harm to local emergency services and to qualified personnel.
• Not use the Services as the primary channel for medical emergencies, or as the official clinical record.
• Not transmit Protected Health Information under HIPAA without a Business Associate Agreement executed with Grovity.
• Obtain the consents and authorizations required to process health data before collecting it through the Services.
• Comply with health-advertising, telehealth, and professional-practice rules applicable to the Customer.

When the Services are used in connection with payments, banking integrations, or financial workflows, the Customer agrees:

• To comply with the rules of the relevant card schemes, payment processors, and banking partners.
• Not to transmit full card numbers (PAN), card verification codes, or other sensitive authentication data through conversations or agent prompts. Grovity does not store full payment card numbers; card data must be captured and tokenized by certified payment processors.
• To honor consumer-protection rules, including timely refunds, dispute responses, and clear disclosures.
• Not to use the Services for businesses prohibited by card schemes' high-risk merchant rules, unless expressly authorized by Grovity and the underlying providers.

The Customer is responsible for determining whether the Services offer adequate safeguards for its intended use before transmitting or processing any data through them, and for:

• Obtaining all consents and legal bases required to process personal data through the Services, in accordance with the GDPR, the CCPA/CPRA, Colombian Law 1581 of 2012, the Brazilian LGPD, and other Applicable Laws.
• Providing appropriate privacy notices to its End Users.
• Honoring opt-out, deletion, access, and other data subject requests.
• Not transmitting categories of data that it is not legally authorized to process or that exceed the scope of the contracted Services, including PHI without an executed BAA.

Violations of this AUP can be reported to legal@grovity.ai. Security vulnerabilities should be reported to security@grovity.ai. The Customer must promptly report to Grovity any violation of this AUP of which it becomes aware and cooperate, as reasonably requested, to investigate and remedy it.

Grovity may take any action it deems appropriate in response to a violation of this AUP, including: (i) issuing a warning; (ii) temporarily limiting or suspending the Services; (iii) terminating the Customer's account; (iv) removing or blocking specific content or messages; (v) cooperating with regulators, courts, or third-party platforms in any investigation; and (vi) pursuing legal remedies. These remedies are cumulative.