Acceptable Use Policy

---

Effective Date: 2026-08-15

Last Updated: 2026-08-15

This Acceptable Use Policy (the “AUP”) governs access to and use of the Ebbets AI platform, applications, APIs, integrations, software, and related hosted services (collectively, the “Services”) provided by Ebbets AI LLC (“Ebbets AI,” “Provider,” “we,” “us,” or “our”).

This AUP applies to each customer that accesses or uses the Services (“Customer”) and to Customer's employees, contractors, administrators, agents, and other authorized users (“Authorized Users”).

This AUP forms part of the agreement governing Customer's use of the Services where that agreement incorporates or references this AUP. Capitalized terms not defined in this AUP have the meanings given in the applicable agreement between Ebbets AI and Customer (the “Agreement”).

If this AUP conflicts with an executed Agreement, the Agreement controls in accordance with its order-of-precedence provisions.

Customer and its Authorized Users may use the Services only:

• for Customer's legitimate internal business purposes;
• within the scope purchased under the applicable Order or Product Addendum;
• in compliance with the Agreement, Documentation, and Applicable Law; and
• in a manner that does not compromise the security, availability, integrity, performance, or lawful operation of the Services or any third-party system.

Customer is responsible for the conduct of its Authorized Users and for activity occurring through Customer-controlled accounts, credentials, integrations, and systems.

Customer and Authorized Users must not:

• access or attempt to access an account, tenant, system, environment, feature, data set, API, administrative function, or resource for which they are not authorized;
• share credentials with unauthorized persons;
• circumvent authentication, authorization, single sign-on, multifactor authentication, access-control, or other security mechanisms;
• obtain or attempt to obtain another customer's data or credentials;
• impersonate another person or entity or misrepresent authority to access data or systems;
• probe, scan, test, or attempt to identify vulnerabilities in the Services except pursuant to a security-testing program expressly authorized in writing by Ebbets AI; or
• interfere with Provider's logging, monitoring, metering, security, or abuse-prevention systems.

Customer must promptly revoke access for persons who are no longer Authorized Users and must notify Ebbets AI promptly after becoming aware of compromised credentials or unauthorized account activity.

Except to the extent a restriction is expressly prohibited by Applicable Law, Customer and Authorized Users must not:

• reverse engineer, decompile, disassemble, decode, translate, or otherwise attempt to derive the source code, underlying models, algorithms, architecture, prompts, methods, or nonpublic technical design of the Services;
• copy, modify, reproduce, create derivative works from, or commercially exploit Provider Materials except as expressly permitted by the Agreement;
• disable, bypass, defeat, interfere with, or circumvent technical restrictions, rate limits, usage controls, capacity controls, security controls, or access restrictions;
• use automated means to scrape, crawl, extract, copy, or harvest data or functionality from the Services except through APIs or functionality expressly authorized by Provider;
• conduct load testing, stress testing, penetration testing, benchmarking, or automated performance testing without Provider's prior written authorization;
• introduce malicious code, viruses, worms, ransomware, trojans, logic bombs, destructive code, or other harmful software;
• use the Services to distribute or facilitate malware, credential theft, phishing, denial-of-service attacks, botnets, or unauthorized system access;
• interfere with or materially disrupt the operation of the Services, Provider infrastructure, or another customer's use of the Services; or
• use the Services in a manner designed to impose an unreasonable or disproportionately large technical burden on Provider infrastructure.

Customer and Authorized Users must not use the Services:

• to develop, train, benchmark, validate, improve, or support a product or service that competes with Ebbets AI;
• for competitive analysis intended to replicate the functionality, architecture, workflows, user interface, models, or business logic of the Services;
• to provide the Services to third parties as a service bureau, application service provider, outsourcing service, managed service, hosted offering, or similar commercial service unless expressly permitted in an executed Order;
• to sublicense, resell, rent, lease, distribute, transfer, or commercially make the Services available to another person;
• to remove or obscure copyright notices, trademarks, proprietary notices, attribution, or other rights-management information; or
• to obtain Provider Confidential Information for the benefit of a competitor.

Nothing in this Section restricts Customer from evaluating whether the Services meet Customer's own business requirements.

An entitlement described as “unlimited users,” “enterprise access,” or similar terminology refers to the number of permitted Authorized Users and does notmean unlimited consumption of computing or infrastructure resources.

Use of the Services may be subject to reasonable technical and operational limits concerning:

• AI inference and model calls;
• API requests;
• document ingestion and processing;
• OCR and extraction;
• file and data storage;
• search indexing and vector processing;
• bandwidth;
• concurrent processing;
• data import or export;
• automated workflows;
• transaction volumes; and
• other compute-intensive or usage-based resources.

Ebbets AI may employ reasonable metering, queuing, throttling, rate limiting, or other technical controls to protect the security, stability, performance, and economic sustainability of the Services.

Customer must not deliberately structure, automate, distribute, or manipulate usage for the purpose of avoiding technical limits, usage measurement, additional-capacity charges, or other restrictions.

If Customer materially exceeds normal or documented capacity for the applicable service tier, Ebbets AI may require Customer to reduce usage or purchase additional capacity in accordance with the Agreement.

Customer may submit, connect, import, or otherwise make data available to the Services only if Customer has all rights, licenses, permissions, consents, and lawful authority necessary to do so.

Customer must not use the Services to:

• access data without authorization;
• obtain information through stolen, shared, improperly acquired, or unauthorized credentials;
• circumvent restrictions imposed by a data owner or third-party service;
• infringe or misappropriate intellectual-property, privacy, confidentiality, publicity, contractual, or other rights;
• unlawfully monitor, surveil, profile, or track another person;
• process data in violation of Applicable Law; or
• instruct Ebbets AI to engage in processing that Customer does not have the lawful authority to direct.

Customer is responsible for Customer-selected data sources, Customer-provided credentials, Customer-controlled integrations, processing instructions, and downstream uses of Customer Data and Output.

Unless Ebbets AI expressly agrees otherwise in a signed written amendment or applicable product agreement, Customer must not submit, transmit, store, or process through the Services:

• Protected Health Information regulated by HIPAA;
• payment-card data subject to PCI DSS;
• classified government information;
• ITAR-controlled defense articles, technical data, or other export-controlled defense information;
• passwords, authentication secrets, private encryption keys, or similar high-risk credentials except where specifically required by an authorized integration function;
• biometric identifiers or biometric templates;
• information revealing an individual's health condition, racial or ethnic origin, trade-union membership, or other special categories of sensitive Personal Data; or
• other information that the Agreement or Documentation expressly identifies as prohibited.

Customer is responsible for reviewing its data sources and configuring its systems to prevent prohibited information from being submitted to the Services.

Customer and Authorized Users must not use the Services to engage in, promote, facilitate, or materially assist:

• unlawful activity;
• fraud, deceptive practices, or intentional misrepresentation;
• identity theft or credential theft;
• infringement or misappropriation of third-party rights;
• threats, unlawful harassment, or unlawful discrimination;
• exploitation or abuse of children;
• trafficking or other criminal activity;
• distribution of malware or malicious code;
• unauthorized access to computers, networks, accounts, or data;
• unlawful surveillance;
• deliberate creation or dissemination of materially fraudulent business records;
• violation of sanctions, export-control laws, or other trade restrictions applicable to the Customer's use of the Services; or
• any activity for which use of the Services would itself violate Applicable Law.

Ebbets AI is not responsible for determining whether Customer's business activities, data, or use cases comply with laws applicable specifically to Customer.

Ebbets AI may provide AI-assisted extraction, classification, tagging, summaries, recommendations, search results, and other automated Output.

Customer and Authorized Users must not:

• represent AI-generated Output as having been independently verified when it has not;
• rely on Output as a substitute for required professional engineering, legal, financial, construction, safety, regulatory, or other professional judgment;
• use Output to take a material operational action where appropriate human review has not occurred;
• intentionally use the Services to create materially deceptive records or falsify project, safety, financial, compliance, or other business information;
• attempt to extract system prompts, confidential model instructions, security controls, or Provider Confidential Information through prompt injection or similar techniques; or
• intentionally submit instructions designed to cause the Services to bypass security, access-control, privacy, or usage restrictions.

AI Output may contain errors, omissions, or incomplete information. Customer is responsible for reviewing relevant source material, validating Output, and determining whether Output is appropriate for Customer's intended use.

Use of third-party services, APIs, cloud systems, model providers, or integrations remains subject to the applicable third party's terms and technical restrictions.

Customer must not use Ebbets AI to circumvent a third-party service's access controls, rate limits, license restrictions, or contractual requirements.

Customer is responsible for maintaining Customer-controlled third-party accounts, credentials, permissions, licenses, and authorizations.

Changes made by a third-party service—including API limitations, pricing changes, model changes, deprecations, outages, or altered access requirements—do not authorize Customer to bypass Provider's security or technical controls.

Customer must not conduct penetration testing, vulnerability scanning, automated security testing, or similar testing against the Services without Ebbets AI's prior written authorization.

A person who believes they have identified a potential security vulnerability should discontinue testing that could access, alter, destroy, download, or expose data and report the issue to:

security@ebbetsai.com

Ebbets AI may publish additional vulnerability-disclosure procedures from time to time.

Ebbets AI may investigate suspected violations of this AUP.

To the extent permitted under the Agreement, Ebbets AI may immediately restrict, throttle, disable, or suspend access to some or all of the Services without advance notice when Ebbets AI reasonably believes that:

• Customer or an Authorized User has materially violated this AUP;
• use of the Services creates a credible security threat;
• continued access may compromise system stability or the security of Provider, Customer, another customer, or a third party;
• malicious or prohibited activity is occurring;
• Customer is attempting to bypass usage or capacity controls;
• continued use may expose Ebbets AI or a third party to material legal or regulatory risk; or
• immediate action is reasonably necessary to protect the Services or affected data.

Where practicable and consistent with security and legal requirements, Ebbets AI may contact Customer regarding a suspected violation and provide an opportunity to correct the issue.

No cure period is required before an emergency-security, malicious-use, or other prohibited-use suspension where the Agreement permits immediate suspension.

Suspension does not excuse Customer from payment obligations under the Agreement.

Ebbets AI will restore access after the basis for suspension has been addressed to Ebbets AI's reasonable satisfaction, subject to any additional rights or remedies under the Agreement.

Suspected violations of this AUP may be reported to:

abuse@ebbetsai.com

Security vulnerabilities should be reported to:

security@ebbetsai.com

Legal notices must be provided in accordance with the notice provisions of the applicable Agreement and should not be sent solely to the abuse or security addresses above.

Ebbets AI may update this AUP periodically to address changes in the Services, technology, security threats, Applicable Law, third-party dependencies, or reasonable operational requirements.

A nonmaterial update becomes effective when the updated AUP is posted at https://ebbetsai.com/acceptable-use.

To the extent Customer's Agreement provides otherwise, an update that materially reduces Customer's contractual rights, materially increases Customer's contractual obligations, or changes ordered scope during an active Order term will not modify that Agreement without the amendment or change-order process required by the Agreement.

The “Last Updated” date above identifies the most recent revision.

This AUP supplements the Agreement and does not expand Ebbets AI's warranties, service levels, indemnification obligations, security commitments, or liability beyond those expressly stated in the Agreement.

Nothing in this AUP:

• creates an SLA or uptime commitment;
• guarantees that the Services will detect or prevent every prohibited use;
• requires Ebbets AI to monitor Customer Data or Customer activity;
• creates a duty to investigate or enforce against any particular conduct;
• creates rights in favor of a third party; or
• limits any additional suspension, termination, indemnification, or other remedy available to Ebbets AI under the Agreement.

Where the Agreement imposes a stricter requirement than this AUP, the Agreement controls.