Acceptable Use Policy

The short version. Use Pazau to help your customers, lawfully and honestly. Don't use it to deceive people, spam them, break into systems, or harm anyone. Your AI agents must tell people they are talking to an AI where the law requires it, and whenever someone asks. Don't let an AI agent alone make decisions that have legal or similarly significant effects on people without the safeguards the law requires. If you're unsure whether a use case is allowed, ask us at legal@pazau.com before you launch.

Scope

This Acceptable Use Policy ("AUP") applies to everyone who uses the Pazau services, including Pazau Inbox, Pazau Agent, Pazau Voice, Pazau Insights, the Pazau APIs, and the Pazau messenger (the "Services"). It forms part of the Subscription Agreement or other agreement under which you use Pazau (your "Agreement"). "You" means the customer and every user, developer, and AI agent it configures. Capitalized terms not defined here have the meanings in your Agreement.

You are responsible for your users' compliance, for the Procedures and Actions you configure, and for the content your AI agents produce within the limits you set. The AI Addendum describes the shared responsibilities for AI features in more detail.

General prohibitions

You may not use the Services to:

1. Break the law. Violate any applicable law or regulation, including consumer protection, privacy, anti-spam, telemarketing, anti-discrimination, export control, and sanctions laws.
2. Infringe others' rights. Infringe intellectual property, privacy, or publicity rights, or send content you do not have the right to send.
3. Harm people. Harass, threaten, bully, stalk, or intimidate anyone; promote violence or self-harm; or distribute child sexual abuse material. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children and to law enforcement.
4. Commit fraud. Run phishing, scams, pyramid schemes, fake refunds, or any scheme to obtain money, credentials, or personal data under false pretenses.
5. Distribute malware or other harmful code, or use the Services to command and control compromised systems.
6. Support restricted parties. Provide the Services to, or for the benefit of, any person or country subject to US, EU, or UK sanctions.

Messaging and voice rules

Pazau connects to email, SMS, WhatsApp, social channels, and the phone network. These channels have their own rules, and you must follow them.

• Consent. Obtain and record all consent required before sending marketing messages or placing calls, including under the Telephone Consumer Protection Act, the FCC's rules on AI-generated voices in robocalls, CAN-SPAM, the ePrivacy Directive, PECR, and CASL. Honor opt-outs (for example, "STOP") immediately and across channels.
• Carrier and platform rules. Comply with the CTIA Messaging Principles, 10DLC and toll-free verification registration, and the WhatsApp Business Messaging Policy and Commerce Policy.
• Caller identity. Do not spoof caller ID or use numbers you are not authorized to use. Pazau Voice signs outbound calls with STIR/SHAKEN attestation.
• Call recording. Give the notice and obtain the consent required by the laws of every party's location, including all-party consent states such as California, Florida, Illinois, Pennsylvania, and Washington.
• Quiet hours. Respect time-of-day limits on outbound calls and messages.
• Emergency services. Pazau Voice is not a replacement for telephone service and cannot be used to call emergency services such as 911 or 112.

Pazau Agent is designed for customer support conversations that a person starts. Unsolicited outbound campaigns using AI-generated voice are prohibited unless your Agreement expressly permits them and you have prior express written consent from each recipient.

AI-specific requirements

These rules apply to Pazau Agent, Pazau Voice AI agents, AI features in Pazau Inbox and Insights, and any output generated by the Services.

Disclosure and impersonation

• Disclose that it's an AI. Where a law requires disclosure that a person is interacting with an AI system, you must make it. This includes Article 50 of the EU AI Act, the California Bot Disclosure Law (Bus. & Prof. Code § 17940 et seq.), the Utah Artificial Intelligence Policy Act, and similar laws. Pazau Agent discloses its AI status by default in its greeting. You may change the wording, but you may not remove the disclosure where it is required.
• Always answer honestly. Regardless of jurisdiction, you may not configure an AI agent to deny being an AI when someone sincerely asks, or to claim to be a specific human being.
• No impersonation of real people. You may not use the Services to impersonate a real person, including by cloning or imitating a person's voice, without that person's documented, informed consent and your Agreement's written approval for custom voices.
• Label synthetic media. Where required, mark AI-generated audio, images, or text as artificially generated. Pazau Voice embeds a disclosure in AI-generated call audio when the law requires it.

Consequential decisions and automated decision-making

You may not use the Services to make a decision based solely on automated processing that produces legal or similarly significant effects on a person unless you have:

• a lawful basis for it under Article 22 of the GDPR or UK GDPR, or the equivalent under other applicable law, such as the Colorado AI Act or state privacy law profiling rules;
• implemented the safeguards those laws require, including meaningful human review on request, the ability to contest the decision, and the required notices and risk assessments;
• configured a Pazau approval step, so a human reviews the decision before it takes effect.

Examples of consequential decisions include denying credit, an insurance claim, housing, employment, education, health care, or an essential government service. Pazau Agent may collect information for these processes, answer questions about them, and carry out a decision a human has made. It may not be the sole decision-maker.

Prohibited AI practices

You may not use the Services for:

• any practice prohibited by Article 5 of the EU AI Act, including manipulative or deceptive techniques that materially distort behavior and cause significant harm, exploitation of vulnerabilities due to age, disability, or social or economic situation, and social scoring;
• emotion recognition in workplace or educational settings, or biometric categorization to infer sensitive characteristics such as race, political opinions, religion, or sexual orientation;
• voiceprint or biometric identification of callers without the notice and consent required by laws such as the Illinois Biometric Information Privacy Act and Texas CUBI;
• dark patterns in retention flows: configuring an AI agent to obstruct cancellations, misrepresent terms, or refuse to process a cancellation that the law or your own terms require you to honor. Procedures for cancellation must offer the outcome the customer asks for;
• generating legal, medical, or financial advice presented as coming from a licensed professional, or giving regulated advice without the licenses and supervision the law requires;
• uses that are high-risk AI systems under Annex III of the EU AI Act, such as creditworthiness evaluation or life and health insurance pricing, unless your Agreement expressly covers the use and you meet the provider and deployer obligations that apply.

Guardrails and model integrity

You may not:

• attempt to bypass or disable Pazau Guard, PII redaction, safety filters, or approval steps, or instruct an agent to ignore them;
• use prompt injection, jailbreaks, or other techniques to extract system prompts, other customers' data, or model provider safeguards, except in authorized testing under our Vulnerability Disclosure Policy;
• use output from the Services to develop a competing foundation model, or systematically extract model outputs to train another model;
• misrepresent AI-generated output as human-written where that would mislead a person to their detriment.

Sensitive data

Send only the data your use case needs. Unless your Agreement expressly allows it and you have enabled the relevant controls:

• Protected health information may be processed only under a signed Business Associate Agreement and in a HIPAA-enabled workspace.
• Payment card data may be collected only through Pazau Voice secure payment capture (PCI DSS) or a tokenized integration, never in free-text messages or knowledge bases.
• Children's data: do not use the Services to knowingly collect personal information from children under 13 (or the applicable age of digital consent) without verifiable parental consent.
• Special category data under the GDPR must have a valid Article 9 condition and appropriate Pazau Guard redaction settings.

Security and platform integrity

You may not:

• access or attempt to access another customer's data, or any system or account without authorization;
• probe, scan, or test the vulnerability of the Services, except under our Vulnerability Disclosure Policy;
• exceed published API rate limits, or interfere with the Services' performance for other customers;
• share credentials, circumvent seat limits, or resell the Services without a written reseller agreement;
• reverse engineer the Services except as the law expressly allows despite this restriction.

Enforcement

We review suspected violations through automated signals, reports, and human investigation. Depending on severity, we may remove content, disable an AI agent, Procedure, Action, or channel, suspend a user, or suspend or terminate the Services under your Agreement. Except where there is an imminent risk of harm, a legal requirement, or a threat to the Services, we will notify you and give you a reasonable opportunity to fix the problem before suspending anything. We cooperate with law enforcement where required by law.

Reporting violations

To report abuse, including spam, phishing, or an AI agent behaving harmfully, email abuse@pazau.com with the phone number, message, or URL involved. Security vulnerabilities go to security@pazau.com. Copyright complaints follow our Copyright and DMCA Policy.

Changes

We may update this AUP to reflect new laws, channel rules, or risks. We give at least 30 days' notice of material changes by email or in the app, unless a change is required sooner by law or to prevent harm.