KokuaOS — Acceptable Use Policy

The rules that govern acceptable use of the KokuaOS Platform, AI Services, and Communication Channels by everyone who uses them.

Capitalized terms have the meanings in the KokuaOS Definitions Schedule (kokuaos.com/legal/definitions).

1. Purpose and scope

This Acceptable Use Policy (this "AUP") states what is and is not permitted when using the Services. It exists to keep the Platform lawful, secure, and reliable for everyone, and to protect the KokuaOS Parties, Customers, partners, called and messaged parties, and the public.

This AUP applies to every person and entity that accesses or uses the Services, directly or indirectly, including Master Admin's direct Customers, every Service Provider and Reseller, and every downstream Customer of a Service Provider or Reseller, together with each of their Authorized Users and any end user who interacts with an AI Employee. Each Service Provider, Reseller, and Customer is responsible for the acts and omissions of its own Authorized Users, its downstream partners and Customers, and anyone using the Services through its account, as if they were its own. Passing the Services through a white-label brand does not reduce these obligations.

This AUP is a Policy incorporated by reference into the Agreement. It supplements, and does not limit, the Agreement, the Compliance & Shared Responsibility Policy (kokuaos.com/legal/shared-responsibility), the Responsible AI Policy (kokuaos.com/legal/responsible-ai), and applicable law. If the Agreement and this AUP conflict, the order of precedence in the Agreement controls. KokuaOS may update this AUP under the Policies-update terms in the Master Terms & Conditions; changes required by law or to address security or abuse are effective immediately.

2. General responsibility

You are responsible for all activity conducted through your account and for ensuring that your configurations, prompts, Knowledge Base content, workflows, campaigns, and AI Employees comply with this AUP and with all laws and third-party rights that apply to your use. You must obtain and maintain all consents, registrations, licenses, and disclosures that your use requires, and you must not use the Services in any way that would cause KokuaOS to violate, or lose the benefit of, any carrier, provider, app-store, or regulatory requirement.

3. Prohibited uses

You may not use, and may not permit or enable any other person to use, the Services to do or facilitate any of the following.

3.1 Unlawful, fraudulent, and harmful activity

• Violate any applicable law, regulation, sanctions or export-control requirement, or third-party right, or promote or facilitate any illegal activity.
• Engage in fraud, phishing, social engineering, pretexting, impersonation of any person or entity, misrepresentation of identity or affiliation, or identity theft.
• Harass, threaten, stalk, defame, abuse, or intimidate any person; exploit or endanger minors; or facilitate human trafficking, violence, or other harm.
• Distribute or generate content that is unlawful, or that sexually exploits or endangers minors.

3.2 Security and platform integrity

• Introduce or transmit malware, ransomware, or other malicious code; harvest or steal credentials; or attempt to gain unauthorized access to any system, account, network, or data.
• Interfere with or disrupt the Services or the servers or networks that provide them, including denial-of-service or distributed denial-of-service activity, or impose excessive automated load, traffic, or request volumes that degrade the Platform or others' use of it.
• Circumvent, disable, or attempt to defeat any authentication, rate limit, quota, usage-metering, security, or other technical safeguard of the Platform.
• Conduct penetration testing, vulnerability scanning, red-teaming, or other security testing of the Services without KokuaOS's prior written authorization; authorized testing is governed by the Vulnerability Disclosure Policy (kokuaos.com/legal/vulnerability-disclosure).

3.3 AI-specific misuse

• Submit prompts, inputs, or instructions designed to cause the AI Services to reveal system prompts, credentials, keys, other customers' data, or KokuaOS Confidential Information, or otherwise to bypass, manipulate, or defeat the Platform's safeguards, guardrails, or Compliance Shield configuration ("prompt injection").
• Use the Services to create deepfakes, synthetic media, or cloned or synthetic voices in a deceptive, non-consented, or unlawful manner, including impersonating a real individual without that individual's authorization or without disclosure required by law.
• Harvest, scrape, extract, or infer prompts, outputs, model behavior, workflows, architecture, or Documentation — including inferring or attempting to deduce the Platform's architecture, prompt templates, or workflows from its inputs, outputs, or behavior — to build or train a competing product or model, or to reverse engineer, decompile, disassemble, clone, or replicate the Platform or any part of it.
• Conduct, or publish or otherwise disclose to any third party, benchmarks, performance or load tests, or comparative or competitive evaluations of the Services or AI Output, without KokuaOS's prior written consent.
• Represent AI Output as human-generated where disclosure of AI interaction is required by law, or otherwise use the AI Services in violation of the Responsible AI Policy.

3.4 Communications, telephony, and messaging

• Send spam or unlawful bulk or automated communications across any Communication Channel.
• Place unlawful robocalls or automated calls or texts, or transmit falsified, spoofed, or misleading caller-identification or origination information.
• Violate the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, the Telemarketing Sales Rule, Do-Not-Call requirements, STIR/SHAKEN or caller-ID authentication rules, or any analogous federal, state, or foreign telemarketing, calling, texting, or anti-spam law, including consent, opt-out, identification, time-of-day, and calling-frequency requirements.
• Record, monitor, intercept, or surveil any call, message, or communication without all consents required by applicable law (including one-party or all-party consent and wiretap, eavesdropping, and privacy statutes), or use the Services for unlawful tracking or surveillance.

3.5 Intellectual property and privacy

• Infringe or misappropriate any patent, copyright, trademark, trade secret, publicity, or other intellectual-property or proprietary right.
• Violate any person's privacy rights, or collect, use, or disclose Personal Data without a lawful basis and required notices.
• Upload, submit, process, or store categories of sensitive or regulated data that KokuaOS has not approved for your use, as further described in Section 4.

3.6 Regulated and high-risk workflows

• Operate illegal healthcare, payment, financial, lending, insurance, or similar workflows, or any workflow that requires a license, registration, or authorization you do not hold.
• Use the Services to make autonomous legal, medical, financial, employment, eligibility, or public-safety decisions without the qualified human review required by the Agreement and the Responsible AI Policy.
• Use the Services in connection with emergency, life-safety, or critical-infrastructure functions except as expressly permitted in writing by KokuaOS (see Section 5).

4. Prohibited and restricted data

Unless KokuaOS has approved the specific use case, providers, and architecture in writing, you must not submit to or process through the Services, and must not place in prompts, Knowledge Base content, recordings, transcripts, logs, or other stores:

• Protected Health Information (PHI) or other data subject to HIPAA/HITECH, except where you have KokuaOS's written approval, an approved architecture and provider configuration, and a signed Business Associate Agreement (see the HIPAA / BAA Eligibility Notice, /legal/hipaa).
• Full cardholder data (such as a full primary account number with sensitive authentication data), except within an expressly approved payment workflow described in the Compliance & Shared Responsibility Policy.
• Other categories of special, sensitive, or regulated data (for example, government identifiers, biometric identifiers, precise geolocation, children's data, or criminal-history and CJIS-regulated data) where prohibited by the Agreement or where you have not implemented the controls the applicable law requires.

You are responsible for classifying your data and for keeping prohibited data out of the Services. Nothing in this Section grants any right to process data that applicable law otherwise restricts.

5. Emergency services

The Services are not a substitute for, and must not be represented as, traditional or emergency telephone service. Unless KokuaOS agrees otherwise in writing, you may not configure or use an AI Employee or Communication Channel to provide, route, or answer 911, E911, or other emergency-services calls, or to perform life-safety functions. You must clearly inform your Authorized Users and end users of these limitations and maintain an alternative means of contacting emergency services.

6. Enforcement

KokuaOS may, but is not obligated to, take any of the following actions to enforce this AUP, protect the Platform and others, or comply with law. KokuaOS will act proportionately and, where practicable and not legally or operationally constrained, will give notice; conduct that is unlawful or that poses a risk to security, safety, the Platform, or third parties may require immediate action without prior notice.

• Monitoring and investigation. KokuaOS may monitor use of the Services, and review configurations, traffic, and content, to the extent reasonably necessary to operate the Services, meter usage, maintain security, and investigate suspected violations, consistent with the Privacy Policy (kokuaos.com/legal/privacy) and applicable law. KokuaOS does not undertake to monitor all use and is not responsible for user content or conduct.
• Rate limiting and technical controls. KokuaOS may apply or adjust rate limits, quotas, filtering, or other technical controls.
• Suspension. KokuaOS may suspend the Services in whole or in part (including a specific AI Employee, Channel, campaign, or feature), narrowly and for the shortest time reasonably practicable, as further described in the Agreement. In addition to the grounds stated in the Agreement, grounds for suspension include prompt-injection or other attacks on the Platform, its safeguards, or other users; excessive or anomalous AI Consumption; and suspected credential compromise, account takeover, or other security risk. Suspension does not relieve any payment obligation.
• Content removal. KokuaOS may disable, quarantine, or remove offending configurations, prompts, Knowledge Base content, or other content, or require you to do so.
• Cooperation with law enforcement. KokuaOS may report activity to, and cooperate with, law enforcement, regulators, carriers, and other authorities, and may preserve and disclose information, where legally required or pursuant to valid legal process, consistent with the Privacy Policy.
• Termination. KokuaOS may terminate the Agreement, an Order Form, or access for material or repeated violations, as provided in the Agreement.
• Cost recovery and indemnity. You are responsible for, and will reimburse and indemnify the KokuaOS Parties for, fines, penalties, chargebacks, carrier or provider pass-through charges, remediation and investigation costs, and other losses, liabilities, and expenses (including reasonable attorneys' fees) arising out of your violation of this AUP, in accordance with, and subject to the procedures and limitations in, the Agreement.

A Commercial Parent is responsible for enforcing this AUP against its own downstream Resellers and Customers and for cooperating with KokuaOS's enforcement. KokuaOS's enforcement rights are in addition to all other rights and remedies available to the KokuaOS Parties at law, in equity, or under the Agreement, and a decision not to enforce any provision is not a waiver of the right to do so later.

7. Reporting violations

To report suspected abuse, security issues, or other violations of this AUP, contact KokuaOS at abuse@kokuaos.com (or the contact stated in the Trust Center, /trust). Please include enough detail to identify and investigate the issue. Suspected security vulnerabilities should be reported under the Vulnerability Disclosure Policy.

8. Relationship to the Agreement

This AUP is incorporated into and forms part of the Agreement, and its defined terms have the meanings given in the Definitions Schedule. Breach of this AUP is a breach of the Agreement. Nothing in this AUP limits the disclaimers, limitations of liability, or indemnities in the Agreement, which continue to apply and which protect the KokuaOS Parties as intended third-party beneficiaries.