Legal

AI Usage Policy

Version 1.2. Effective October 16, 2026.

The systems we build use AI models that run in your own accounts with your chosen AI provider. AI output can be wrong, out of date or biased, so a person in your business must review it, and a person must make any decision that has legal or similarly significant effects on someone. Where the law requires it, you must tell callers and chat users that they are dealing with AI, get consent before recording calls, and get consent before sending marketing calls or messages. We design each build with limited knowledge sources, a route to a human and logs kept in your systems. Some uses are not allowed at all. If you have a concern, email us.

1. Who we are

This website is operated by UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India (“we”, “us”, “our”). Our full business details are on the Company details page.

In this policy, “you” means the business that orders a product from us, and any person who uses the product for that business.

2. What this policy covers

We sell fixed-scope AI systems (“products”) to businesses. This policy explains:

how our products use AI models (section 4);
the limits of AI output (section 5);
the human oversight you must keep in place (sections 6 and 7);
your duties to tell people they are dealing with AI (section 8);
your duties when recording calls (section 9);
your duties when making marketing calls or sending marketing messages (section 10);
how we design the systems we build (section 11);
uses that are not allowed (section 12);
how to report a concern (section 13).

This policy forms part of our Terms of Use. It should be read with our Acceptable Use Policy, Privacy Policy and Data Processing Addendum. If this policy conflicts with the Terms of Use, the Terms of Use apply. If it conflicts with the Data Processing Addendum on the handling of personal data, the Data Processing Addendum applies.

3. Key terms

AI model means a machine learning model, such as a large language model or a speech model, that produces text, speech or other output from the input it receives.
AI provider means the company that offers the AI model, which you sign up with in your own account.
Product means the AI system we build and deliver to you under an order, as described on its Scope Card.
Scope Card means the description on each product page of what is included, what you must provide and what is excluded. The Scope Card in force when you placed your order is the contract scope.
Output means anything a product produces using an AI model, such as a reply, a summary, a classification, a draft, a score or a spoken response.
End user means a person who interacts with a product you run, such as a caller, a chat or WhatsApp user, a customer, a lead or a member of your staff.
Significant decision means a decision that has legal effects on a person or affects them in a similarly significant way. Examples include decisions about hiring, firing, pay, credit, lending, insurance, housing, education, healthcare, access to essential services, legal rights and eligibility for public benefits.
Handoff means passing a conversation or task from a product to a person in your business.
Marketing message means a call, text message, WhatsApp message, email or other message that promotes goods or services, including calls and messages that use an artificial or AI-generated voice.

4. How our products use AI

4.1 The AI runs in your accounts

Each product is built and runs in your own accounts. This includes your accounts with AI providers, telephony providers, WhatsApp, your CRM, your helpdesk, your store and your hosting. You choose and sign up with these providers. You accept their terms and policies, and they bill you directly for usage, including AI model usage during the build and testing.

We do not use our own AI provider accounts to process your data. How an AI provider stores, uses or retains the data sent to its models is governed by your contract with that provider and the settings in your account. You should review those terms and settings, including any options about using your data to train the provider’s models.

4.2 What the AI does

Depending on the product and its Scope Card, a product may use an AI model to:

answer questions from the knowledge sources listed on the Scope Card;
hold conversations by phone, chat, WhatsApp or email;
draft, summarize, classify or route messages, tickets, documents or records;
extract information and update your connected systems through the workflows on the Scope Card;
suggest next steps for a person in your business to review.

A product only does what its Scope Card describes. It does not have access to systems you have not connected, and it only takes actions in your systems that its workflows allow.

4.3 Our role and your role

You decide where, how and for whom each product is used once it is live. You are the operator of the product. Under the EU Artificial Intelligence Act (the “EU AI Act”) and similar laws, this usually makes you the “deployer” of the system. You are responsible for using the product lawfully in each place where you use it and for the end users you serve.

We build the product to the Scope Card and to your instructions. When we access personal data in your systems to deliver an order, we act as your processor under the Data Processing Addendum. We use your data only to deliver your order. We do not use it to train any AI model of our own.

5. Limits of AI output

AI models are probabilistic. They predict likely output from patterns. They do not know facts the way a person does. This means output can be:

wrong: an AI model can state false information with confidence, misread a question or take the wrong action;
out of date: an AI model may rely on old information, and your knowledge sources may change after the build;
incomplete: an answer may leave out facts that matter;
biased: output can reflect bias in the data the model was trained on or in the content it is given;
inconsistent: the same input can give different output at different times;
affected by changes outside our control: AI providers update, change or retire models, which can change how a product behaves.

We test each product against the Scope Card before delivery. Testing reduces errors but cannot remove them. We do not promise that output will be accurate, complete, current or free of bias. Our liability for output is limited as set out in the Terms of Use.

You are responsible for:

keeping the knowledge sources the product relies on accurate and current;
checking output before you rely on it, publish it or send it, in proportion to the risk;
telling us about defects during the acceptance window, and using post-launch support or maintenance for later issues.

6. Human oversight

Every product needs a person in your business who is responsible for it. That person should:

understand what the product does and does not do, using the training and documentation we provide under the Scope Card;
review a sample of conversations, actions and logs on a regular basis;
watch for errors, complaints, unusual behavior and signs of bias;
be able to pause the product or switch off a channel, workflow or integration quickly;
handle conversations that are handed off to a person;
keep access keys and permissions under review, and revoke them when no longer needed.

Some content should always be reviewed by a person before it is used. This includes output that gives legal, financial, medical, tax or safety information, output that makes commitments on your behalf such as prices, refunds or contract terms, and content you publish under your name.

7. Significant decisions need a human

Our products are not designed to make significant decisions on their own. A person in your business must make, or meaningfully review, any decision that has legal or similarly significant effects on a person. Meaningful review means the person:

has the authority and the competence to change the outcome;
looks at the relevant information, not only the AI output;
does not simply approve what the AI suggests as a matter of routine.

You may use a product to collect information, summarize it or suggest options for a person to consider. You must not let a product take the final decision in the areas listed in the definition of significant decision in section 3, unless safeguards for that use have been agreed with us in writing and the use is lawful where you operate.

Laws on automated decision-making may apply to you. Examples include Article 22 of the EU General Data Protection Regulation and the UK GDPR, and some US state laws on automated decisions and AI. These laws can require you to tell people that automated processing is used, to explain the logic involved, to let people ask for human review and to let them contest the outcome. You are responsible for meeting these duties.

Our products are not designed for uses classed as “high-risk” under the EU AI Act, such as uses in employment, credit scoring, education, essential services or law enforcement, without safeguards agreed with us in writing. If you plan such a use, tell us before you order so we can say whether the product is suitable.

8. Telling people they are dealing with AI

8.1 Your duty

Where the law requires it, you must tell end users that they are interacting with an AI system and not with a person. We recommend that you disclose this in every case, even where the law does not require it. Do not design or instruct a product to claim, or suggest, that it is a human.

8.2 Laws that may apply

Place	Rule	What it means in practice
European Union	EU AI Act transparency duties	People must be told they are interacting with an AI system, unless this is obvious from the context. AI-generated or manipulated images, audio or video that resemble real people, places or events (“deepfakes”) must be disclosed as such. AI-generated text published to inform the public on matters of public interest must be disclosed unless a person has reviewed it and takes editorial responsibility. Emotion recognition and biometric categorization systems need notice to the people exposed to them.
California, US	California bot disclosure law (Business and Professions Code sections 17940 to 17943)	A bot must not be used to communicate with a person in California online with the intent to mislead them about its artificial identity in order to encourage a sale or influence a vote, unless it clearly discloses that it is a bot.
Other US states	State AI and consumer protection laws	Some states require businesses to disclose the use of AI when asked, or before certain interactions, especially in regulated occupations. Unfair and deceptive practices laws can also apply if a person is misled.
Other countries	Local consumer protection, privacy and AI laws	Many countries treat misleading people about who they are dealing with as an unfair practice. Check the rules in each country where your end users are.

8.3 How to disclose

A disclosure should be clear, given at the start of the interaction, and in the language of the conversation. For example:

Voice calls: a spoken statement at the start of the call, such as “You are speaking with an AI assistant for [your business].”
Chat and WhatsApp: a first message or a visible label stating that the user is chatting with an AI assistant.
Email and drafted content: a statement where AI wrote and sent a message without human review, where the law requires it or where the reader would otherwise be misled.

The product should also answer truthfully if a person asks whether they are talking to a human, and should offer a route to a person where one is available.

We can configure the disclosure text you give us as part of the build, within the channels and languages on the Scope Card. You decide the wording and when it is needed. We do not decide which laws apply to you.

9. Call recording and transcription

9.1 Your duty

Voice products may record, transcribe or analyze calls in your telephony and AI provider accounts. Before you turn on recording or transcription, you must find out which consent and notice rules apply to each call and follow them. The rules depend on where each person on the call is located, not only where your business is.

9.2 How the rules differ

Type of rule	Where it applies (examples)	What you must do
One-party consent	US federal law and many US states	One party to the call may consent to the recording. Even so, you should tell callers about recording, and other laws, such as privacy laws, may still require notice.
All-party consent	Some US states, for example California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington	Every party to the call must consent. Give a clear notice at the start of the call and do not record a person who objects.
Data protection law	European Union, United Kingdom, India and many other countries	You need a lawful basis to record, must tell callers that the call is recorded and why, must keep recordings only as long as needed, and must respect people’s rights over their data.

This table gives examples only. Rules change and differ by place. Where a call crosses borders or you do not know where the caller is, follow the strictest rule that may apply.

9.3 Good practice

Play a recording notice at the start of every recorded call, before any recording is used for other purposes.
Give callers a way to refuse recording, or to reach a person without recording, where the law requires it.
Set retention periods for recordings and transcripts in your own accounts, and delete them when they are no longer needed.
Take extra care with calls that may include health, financial or other sensitive information.
Do not use recordings to create a copy of a person’s voice without their express consent.

We can configure a recording notice and recording settings you give us as part of the build, within the Scope Card.

10. Marketing calls and messages

10.1 Your duty

If you use a product to send marketing messages or make outbound calls, you are the sender. You are responsible for having the consent the law requires, keeping records of that consent, and honoring opt-outs. Do not use a product to contact people whose numbers or addresses you obtained without the consent the law requires.

10.2 United States

Telephone Consumer Protection Act (TCPA): the US Federal Communications Commission has confirmed that AI-generated voices count as “artificial” voices under the TCPA. Calls that use an artificial or prerecorded voice generally need the called person’s prior express consent. Marketing calls and texts of this kind generally need prior express written consent.
Do-not-call rules: you must check the National Do Not Call Registry where it applies, keep your own internal do-not-call list, and respect permitted calling hours in the called person’s time zone.
Identification and opt-out: artificial voice calls must identify your business at the start and give a way to opt out. Texts should include clear opt-out instructions, such as replying STOP.
State laws: several states have their own telemarketing and text messaging laws that add to the federal rules.

10.3 Other places

European Union and United Kingdom: electronic marketing rules, such as the ePrivacy rules in the EU and the Privacy and Electronic Communications Regulations in the UK, together with data protection law, generally require prior consent for marketing by automated calls, text and email, with limited exceptions.
Canada: Canada’s Anti-Spam Legislation requires consent, identification and an unsubscribe mechanism for commercial electronic messages.
India: commercial calls and messages must follow the Telecom Regulatory Authority of India’s rules on unsolicited commercial communications, including customer preference (do-not-disturb) registrations.
Elsewhere: check the rules in each country where the people you contact are located.

10.4 WhatsApp

If a product uses the WhatsApp Business Platform, you must follow WhatsApp’s and Meta’s business terms and policies, including the WhatsApp Business Messaging Policy and Commerce Policy. In particular:

get a person’s opt-in before you start a conversation with them on WhatsApp;
use approved message templates for messages you start outside the customer service window that WhatsApp allows;
honor every request to stop messaging, including requests made in the chat;
offer a way to reach a person where WhatsApp’s policies require it;
do not use WhatsApp for products or services its policies prohibit.

Meta’s policies also limit some uses of AI on the WhatsApp Business Platform. For example, they restrict general-purpose AI assistants that are not tied to your own business. These policies change. You must check the current version before you go live and while the product is in use. WhatsApp can restrict or close your account if you breach its policies, and conversation fees are billed by your provider to you.

10.5 Opt-outs

Every product that sends marketing messages should accept opt-out requests in the same channel, in plain words, and stop further marketing to that person. You must update your records and suppression lists, and honor opt-outs within any time limit the law sets. We can configure opt-out keywords and suppression steps you give us as part of the build, within the Scope Card.

11. How we design builds

We follow these practices when we build a product. The details for each product are on its Scope Card.

Practice	What we do
Scoped knowledge	The product answers from the knowledge sources listed on the Scope Card that you provide. We instruct it to stay within its purpose and to say when it does not know, rather than guess.
Limited actions	The product can only take the actions in the workflows on the Scope Card, in the systems you have connected.
Handoff to humans	Where the channel and the Scope Card allow it, we set up a route to pass a conversation to a person in your business, for example when the user asks for a person, when the product cannot answer, or when a topic needs human judgment.
AI disclosure and notices	We configure the AI disclosure, recording notice and opt-out handling you give us, in the channels and languages on the Scope Card.
Logging in your systems	Conversations, actions and errors are logged in your own systems and provider accounts, such as your CRM, helpdesk, telephony or AI provider account, where the Scope Card includes them. You control who can see the logs and how long they are kept.
Least privilege access	We work through accounts and API keys that you create, can limit to what the build needs, and can revoke at any time. We never ask for secrets by plain email.
Testing	We test the product against the Scope Card before delivery, including the handoff and notice steps that are in scope.
Training and documentation	We provide the training and documentation listed on the Scope Card so your team can oversee the product.

Changes beyond the Scope Card, such as extra channels, languages, safeguards or review steps, need a written Change Quote, as described in the Terms of Use. Our security practices are described on the Security page.

After launch, you run the product. Changes made by you or by your providers, such as new AI model versions, new knowledge content or changed settings, can change how it behaves. You should retest after such changes. Ongoing changes and monitoring are available through maintenance.

12. Uses that are not allowed

You must not use a product, or ask us to build one, for any use that breaks our Acceptable Use Policy. In addition, you must not use a product to:

pretend to be a human, or deny being an AI when a person asks;
impersonate a real person, business or public body, or clone a person’s voice or likeness without their express consent;
make significant decisions without human review, as described in section 7;
make calls or send messages without the consent the law requires, or to people who have opted out;
record calls without the consent or notice the law requires;
deceive, manipulate or pressure people, including by exploiting their age, disability or financial situation;
engage in any practice prohibited by the EU AI Act, such as social scoring or inferring emotions in the workplace or in education, where that law applies;
give individual legal, medical or financial advice to end users as if it came from a qualified professional;
process data you have no right to use, or break your AI provider’s or other providers’ usage policies.

If we believe a product is being used in breach of this policy, we may stop work on the order, decline further work, or suspend our services, as set out in the Terms of Use. We have no control over a product that runs in your accounts, and we do not monitor your live use of it.

13. Reporting concerns

Please tell us if you see a product we built giving harmful, misleading or biased output, or being used in a way that breaks this policy.

AI behavior or misuse: email hello@upmarklabs.com. Include the order number if you have one, what happened, when, and examples such as conversation logs or screenshots. Do not send passwords, keys or more personal data than needed.
Security issues: email hello@upmarklabs.com.
Privacy issues: email hello@upmarklabs.com. You can read more in our Privacy Policy.

If you are an end user of a product that a business runs, please contact that business first. It controls the product and your data. You can also contact us, and where appropriate we will pass your report to the business concerned.

We review every report. Where a report concerns a defect within the acceptance window or the post-launch support period, we fix it under the Terms of Use. In other cases we will tell you what we can do, which may include work under maintenance or a Change Quote.

14. Changes to this policy

Laws on AI, recording and marketing are changing. We may update this policy to reflect new laws, guidance or provider policies. A new version applies to orders placed after it is published. The version you accepted with an order stays with that order. Your own duties under the law apply as the law changes, whichever version of this policy applies to your order.

15. Contact

For questions about this policy, email hello@upmarklabs.com. Our business details are on the Company details page.

Version history

Version	Date	Change
1.2	October 16, 2026	Clarified that the website is operated by UPMARK, a sole proprietorship of Amit Govil.
1.1	October 14, 2026	Updated wording for maintenance and monthly services.
1.0	October 13, 2026	First published version.