Legal

Acceptable Use Policy

Version 1.2. Effective October 16, 2026.

This policy sets the rules for how you may use the AI systems we build for you and our website. In short: use them lawfully and honestly. Do not use them to spam, deceive, defraud, harass or discriminate against people. Do not impersonate anyone or make deepfakes of real people without their consent. Do not scrape sites against their terms, spread malware or get around security controls. Follow the rules of your telecom, WhatsApp, platform and AI model providers. Do not process children’s data without a lawful basis. High-risk uses, such as medical diagnosis, credit, employment, law enforcement and critical infrastructure, need safeguards agreed with us in writing first. If you break these rules, we may investigate, suspend our work or end our agreement. To report abuse, email hello@upmarklabs.com.

1. Who we are

This website is operated by UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India (“we”, “us”, “our”). In this policy, “you” and “your” mean the business that places an order with us or uses our website.

2. About this policy

2.1 What this policy covers

This Acceptable Use Policy (“policy”) explains what you may not do with:

the products and other deliverables we build for you, including add-ons, bundles and work done under a Change Quote, maintenance or a monthly service; and
our website, including your account, the store, checkout and our request forms.

2.2 How this policy fits with our other documents

This policy forms part of our Terms of Use. A breach of this policy is a breach of the Terms of Use. If this policy and the Terms of Use conflict on a question of permitted use, this policy applies. Other documents that also apply:

our AI Usage Policy, which explains how AI outputs behave and where human review is needed;
our Privacy Policy, which explains how we handle personal data as a controller;
our Data Processing Addendum, which applies when we process personal data on your behalf;
our Security page, which describes how we access your systems; and
our Refund and Cancellation Policy, which sets out what we refund if an order ends early.

2.3 Who must follow this policy

You must follow this policy. You must also make sure that your Users follow it. You are responsible for what your Users do with a product or with access you give them, as if you had done it yourself. You are also responsible for how a product treats your End Users, because you decide how and where it is used.

2.4 Business customers only

We sell to businesses only. Our products and website are not for consumers. Our website is not directed at anyone under 18.

2.5 Which version applies

When you place an order, the version of this policy published at that time applies to that order. We store the accepted version on the order. Section 14 explains how we change this policy.

3. Definitions

In this policy, these words have the following meanings:

Term	Meaning
Product	A fixed-scope AI system bought from our store, including Core products, Industry Editions, Integration Editions, bundles and add-ons, and any system we build under a Custom AI quote.
Deliverables	Everything we create for you under an order, such as configurations, prompts, workflows, content and documentation.
Scope Card	The card on each product page that lists what is included, what you must provide and what is excluded. The Scope Card in force when you buy is the contract scope.
Website	Our website, including the store, checkout, your account area and our request forms.
User	Your staff, contractors and anyone else you allow to use, configure or manage a product, or to use your account on our website.
End User	Any person who interacts with a product or is affected by it, such as your customers, leads, patients, applicants or staff.
Third-Party Provider	A company whose service a product connects to or runs on, such as an AI model provider, a telecom or calling provider, WhatsApp, a CRM, a helpdesk, an online store platform or a hosting provider. You hold these accounts in your own name.
Personal Data	Any information about an identified or identifiable person.
Synthetic Media	Voice, image, video or text created or changed by AI so that it appears to come from, show or sound like a real person.
High-Risk Use	A use described in section 9.
Prohibited Use	Any use this policy does not allow.

4. General rules

You must not use a product, a deliverable or the website, or allow anyone else to use them, in a way that:

breaks any law or regulation that applies to you, to us, or to the people affected;
is deceptive or misleading, including false claims about products, prices, identity, affiliation or results;
is fraudulent, including phishing, scams, fake reviews, fake invoices, payment fraud or identity theft;
harasses, threatens, bullies, stalks or intimidates any person;
promotes violence, or incites hatred against any person or group;
discriminates unlawfully against any person on the basis of a characteristic protected by law, such as race, caste, religion, sex, gender identity, sexual orientation, disability, age or national origin;
creates, stores or shares content that sexually exploits or endangers children;
infringes anyone’s intellectual property, privacy or publicity rights, or breaches a duty of confidence; or
helps or encourages anyone else to do any of the above.

5. Messaging, calls and outreach

5.1 No spam

You must not use a product to send spam. Spam means unsolicited bulk or commercial messages sent to people who have not agreed to receive them, where the law or the channel’s rules require that agreement. This applies to email, SMS, WhatsApp, voice calls, social media messages and any other channel.

5.2 Consent and opt-out

When a product sends messages or makes calls, you must:

have any consent or other lawful basis the law and the channel require before contacting each person;
keep records of that consent or lawful basis;
honor opt-out, unsubscribe and do-not-call requests promptly, and keep any required suppression lists;
identify your business clearly in each message or call where the law or the channel requires it;
contact people only at times the law allows; and
follow all anti-spam, telemarketing, do-not-call and call-recording laws that apply where you and the people you contact are located.

5.3 Lists and contact data

You must not use a product with purchased, rented, harvested or scraped contact lists unless you have a lawful basis to contact every person on the list. You must not use a product to guess, generate or validate email addresses or phone numbers for unsolicited contact.

5.4 Misleading messages

You must not send messages with false or misleading sender details, subject lines, caller ID or headers. You must not hide or disguise the source of a message.

6. Impersonation and synthetic media

6.1 Impersonation

You must not use a product to impersonate any person, business, brand, government body or public official. You must not suggest a link with, or an endorsement by, any person or organization that has not agreed to it.

6.2 Deepfakes and voice cloning

You must not use a product to create or share Synthetic Media of a real person without that person’s clear, informed consent. This includes cloned voices, face swaps and fake images or videos. Where you do have consent, you must:

keep a record of it;
use the Synthetic Media only for the purpose the person agreed to; and
label it as AI-generated wherever the law or a Third-Party Provider requires it.

You must never use Synthetic Media to deceive, defraud, harass or embarrass anyone, to influence an election, or to create sexual content of a real person.

6.3 Being open about AI

You must tell End Users that they are dealing with an AI system wherever the law or a Third-Party Provider requires it. If an End User sincerely asks whether they are talking to a person or an AI system, the product must not claim to be human. You must not configure a product to hide or deny that it is an AI system in these cases.

7. Data, scraping and privacy

7.1 Scraping and automated collection

You must not use a product to scrape, crawl or collect data from any website, app or service in breach of its terms of use, its technical access controls or the law. This includes getting around rate limits, logins, paywalls or robots instructions that you are bound to respect.

7.2 Lawful handling of personal data

You decide what Personal Data a product handles and why. You must:

have a lawful basis for collecting and using all Personal Data that a product processes;
give End Users any notices that the law requires, including notice that an AI system is involved where needed;
process only the Personal Data you need for your purpose;
handle sensitive data, such as health, financial, biometric or government ID data, only where the law allows and with the extra protections it requires; and
respond to requests from End Users who exercise their data rights.

When we process Personal Data for you while building or supporting a product, we do so as your processor under our Data Processing Addendum. You must not instruct us to process Personal Data in a way that breaks the law.

7.3 Children’s data

You must not use a product to collect or process Personal Data of children without a lawful basis. Where the law requires consent from a parent or guardian, you must obtain and record verifiable consent before the product processes that data. You must not use a product to target children with marketing where the law does not allow it. Tell us in writing before the build if a product may handle children’s data.

7.4 Surveillance and profiling

You must not use a product to track, monitor or profile people secretly or unlawfully. This includes covert recording, unlawful location tracking and building profiles of people from data they did not agree to share for that purpose.

8. Security and system integrity

You must not use a product or the website to:

create, store or spread malware, including viruses, worms, ransomware, spyware or other harmful code;
gain unauthorized access to any account, system, network or data;
get around, disable or weaken any security, authentication, rate-limit or content-safety control, including controls set by Third-Party Providers and safety features in AI models;
probe, scan or test the security of any system you do not own or have written permission to test;
overload, flood or disrupt any system or network, including through denial-of-service attacks;
extract, copy or reverse engineer the prompts, models or settings of a Third-Party Provider where its terms forbid it; or
share access keys, logins or tokens with anyone who is not authorized to use them.

If you find a security weakness in our website or in work we delivered, report it to hello@upmarklabs.com. Do not exploit it, and do not access or change data that is not yours. Good-faith reports made this way do not breach this policy.

9. High-risk uses

9.1 What counts as a high-risk use

Our products are not designed for the uses in the table below. You must not use a product for them unless we have first agreed the safeguards with you in writing. A purchase through our store, or a Scope Card, is not that written agreement.

Area	Examples of high-risk use
Health and medical	Diagnosing a condition, recommending treatment or medication, triaging emergencies, or giving advice a person may rely on for their health.
Credit and finance	Deciding whether to give credit, loans or insurance, setting their terms, assessing creditworthiness, or giving personal investment advice.
Employment	Screening, ranking, hiring, promoting, disciplining or dismissing people, or monitoring staff performance.
Law enforcement and legal	Policing, criminal risk assessment, immigration or border decisions, identifying people for enforcement, or giving legal advice a person may rely on.
Critical infrastructure	Controlling or monitoring energy, water, transport, telecom networks, emergency services or other systems where failure could cause injury, death or major damage.
Other significant effects	Any other decision with legal or similarly significant effects on a person, such as access to housing, education, insurance or public benefits.

9.2 Safeguards

Where we agree in writing to support a High-Risk Use, the written agreement will set out the safeguards. Safeguards will usually include human review of each decision, testing for accuracy and bias, clear notice to the people affected, and a way for them to challenge a decision. You remain responsible for meeting all laws, licenses and professional rules that apply to your sector.

9.3 Human decisions

AI output is probabilistic and may be wrong. Even outside a High-Risk Use, a person in your business must review and make any decision that has legal, financial, medical, employment or similar significant effects on someone. A product must not make that decision alone. Our AI Usage Policy explains this in more detail.

10. Third-party provider policies

10.1 You must follow their rules

Products run in your own accounts with Third-Party Providers. You must follow the terms, usage policies and messaging rules of every Third-Party Provider a product uses. This includes:

the usage policies of the AI model providers you use;
WhatsApp’s business and commerce policies, including its rules on opt-in, message templates and the types of businesses allowed;
the rules of your telecom and calling providers, including caller ID, registration and consent requirements; and
the terms of any CRM, helpdesk, online store, social media or other platform a product connects to.

10.2 Their enforcement

A Third-Party Provider may limit, suspend or close your account if you break its rules. We do not control those decisions. We are not responsible for them, or for any fees or charges they cause. If a Third-Party Provider’s rules conflict with this policy, you must follow the stricter rule.

11. Using our website

When you use our website, you must not:

give false, incomplete or misleading information in your account, an order or a request form;
create an account or place an order for a business you are not authorized to act for;
share your account login with others or use another person’s account;
submit spam, bulk or automated entries through our request forms;
use bots, scrapers or other automated tools to access or copy the website, except standard search engine indexing;
interfere with the website’s operation, security or spam controls; or
upload or send anything that contains malware or that you do not have the right to share.

12. Your responsibilities

To meet this policy, you must:

tell us before the build if you plan to use a product for a purpose this policy restricts, so we can agree safeguards or decline;
review a product’s outputs and monitor how it behaves with End Users;
keep control of the accounts, admin access and API keys that a product uses, and revoke access you no longer need;
train your Users on this policy and on how to use the product safely;
act quickly to stop any Prohibited Use you become aware of; and
tell us at hello@upmarklabs.com if you learn that a product we built is being used in breach of this policy.

13. How we enforce this policy

13.1 Investigation

If we have reason to believe a product, a deliverable or the website is being used in breach of this policy, we may investigate. We may ask you for information and you must answer promptly and honestly. We may review the configuration we built and any records available to us through the access you have given us. We are not obliged to monitor how you use a product.

13.2 What we may do

Depending on how serious the breach is, we may take one or more of these steps:

Step	What it means
Warning	We tell you about the breach and ask you to fix it by a stated date.
Change request	We ask you to change, limit or switch off a feature, workflow or channel.
Refusal	We decline to build, change or support a feature that would break this policy.
Suspension	We pause work on your order, delivery, post-launch support or maintenance until the breach is fixed. We may also remove our team’s access to your systems.
Termination	We end the order, the maintenance or monthly service, or our agreement with you, as allowed under our Terms of Use.
Website action	We block form submissions, or restrict or close your account on our website.

13.3 Notice

Where it is practical and lawful, we will tell you before we act and give you a chance to fix the breach. We may act without notice if the use is unlawful, could harm people, could expose us to legal liability, or could put any system or data at risk.

13.4 Systems running in your accounts

Products run in your own accounts. Suspension or termination stops our work and removes our access. It does not by itself switch off a product in your accounts. You remain responsible for any use of the product after that point.

13.5 Reports to others

We may report a breach to a Third-Party Provider, to the people affected, or to law enforcement or a regulator where the law requires it or where we believe it is needed to protect people from harm. We may share information with them for that purpose, in line with our Privacy Policy.

13.6 Fees and refunds

Fees for work we have done remain payable after suspension or termination for a breach of this policy. Whether any refund is due is decided under our Refund and Cancellation Policy and our Terms of Use.

13.7 Your liability

You are responsible for claims, losses, fines and costs that arise from Prohibited Use by you, your Users, or a product as you configured and used it, to the extent set out in our Terms of Use.

14. Changes to this policy

We may update this policy, for example to reflect new laws or Third-Party Provider rules. We will publish the new version on this page with its effective date. A new version applies to orders placed after it is published. The version you accepted on an order stays with that order.

15.1 Reporting abuse

If you believe a product we built, or our website, is being misused, email hello@upmarklabs.com. Please include:

what happened and when;
where it happened, such as a phone number, WhatsApp number, email address or web page;
any evidence you have, such as screenshots, message headers or call records; and
how we can contact you, if you want a reply.

We review every report. We may not be able to tell you what action we took, to protect the privacy of others.

15.2 Other contacts

Topic	Contact
Abuse reports and questions about this policy	hello@upmarklabs.com
Security weaknesses	hello@upmarklabs.com
Personal data and privacy requests	hello@upmarklabs.com

You can also reach us through our Contact page. Our place of business is 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India.

Version history

Version	Date	Change
1.2	October 16, 2026	Clarified that the website is operated by UPMARK, a sole proprietorship of Amit Govil.
1.1	October 14, 2026	Updated wording for maintenance and monthly services.
1.0	October 13, 2026	First published version.