Acceptable Use Policy

This Acceptable Use Policy ("AUP") applies to everyone who uses BrandedMark:

• our Customers;
• their Authorised Users;
• Trade Partner Users (dealers, distributors, installers and service agents a brand gives access) and Field Users;
• developers and AI agents using our API, CLI, SDKs or MCP server; and
• End Users who use a brand's portal.

It forms part of your agreement with us: for Customers, the Customer Agreement; for everyone else, the terms you accept when you use the Service. Capitalised terms not defined here have the meanings given in the Customer Agreement.

In short: use BrandedMark to tell the truth about real products, treat consumers fairly, and don't attack or abuse the platform. If you break these rules, we may remove content or suspend access, as your agreement with us allows.

#1. Product truthfulness and Digital Product Passports

BrandedMark exists to make product information trustworthy. You must not use the Service to:

1.1 Create, register or publish counterfeit, cloned or false product identities. This includes QR codes, serial numbers, GS1 identifiers or passports for products you do not make, import, distribute or have the right to represent.

1.2 Use GS1 identifiers (GTINs, GLNs, company prefixes) or GS1 Digital Link URIs that you are not licensed to use, or that belong to another company.

1.3 Publish Digital Product Passport data, certificates or declarations that you know, or ought reasonably to know, are false or misleading. This includes forged or expired conformity certificates, invented test results and inaccurate material or substance declarations.

1.4 Make misleading environmental or sustainability claims ("greenwashing"), for example:

• unsubstantiated "carbon neutral", "recyclable" or "eco" claims;
• durability or repairability scores you cannot evidence; or
• claims that break consumer-protection or green-claims rules where you sell.

1.5 Conceal or misrepresent a product recall, safety notice or known defect, or prevent consumers from receiving safety information you are required to give.

1.6 Offer, register or support illegal products or services. This includes products banned or restricted where they are sold, and products that require a licence you do not hold.

1.7 Misrepresent warranty or guarantee terms, or consumers' statutory rights. For example, you must not imply that registration is needed to keep statutory rights when it is not.

#2. Consumers, marketing and messaging

2.1 Consent and lawful basis. Only send marketing emails, SMS or messages to consumers where you have a lawful basis and any consent required by law (for example PECR in the UK, or national ePrivacy laws in the EU). You must honour opt-outs promptly. Do not remove or disable the unsubscribe mechanisms the Service provides.

2.2 No spam. Do not send:

• unsolicited bulk messages;
• messages to purchased, rented or scraped contact lists; or
• messages with false or misleading sender information or subject lines.

2.3 SMS and messaging rules. Follow the rules of the messaging providers and networks (for example Twilio's acceptable use policy and carrier rules), including sender registration, permitted hours and content restrictions. Do not use the Service's security-code messaging channel for anything other than sign-in codes.

2.4 Email sending domains. Only send from domains you control and have verified. Do not spoof another organisation's domain or brand.

2.5 Fair treatment. Do not use the Service to harass, threaten, discriminate against or deceive consumers. Do not use dark patterns to obtain consents, registrations or payments.

2.6 Personal data. Collect only the personal data you need. Give consumers a privacy notice. Respond to their rights requests using the tools provided. Do not upload data that your agreement with us prohibits.

#2A. Bulk and marketing messaging

This section applies when you send Campaigns through any marketing messaging features of the Service. It lists what is never acceptable. In this section, a "Campaign" is a marketing message sent to a group of people through the Service, a "Contact" is a person you message, and your "Suppression List" is the list of people who have opted out or must not be messaged.

2A.1 Permission you can prove. Do not send a Campaign to anyone unless you have the permission the law requires for that person and channel, and can show how and when you got it. Do not rely on the soft opt-in for people who did not buy from you directly.

2A.2 No acquired or harvested data. Do not import, sync or mail contact data that was bought, rented, borrowed, swapped, scraped, harvested, appended or enriched, gathered through co-registration, list brokers, lead-generation or "partner" lists, or taken from public sources. Do not run a list-broking, list-rental or lead-reselling business through the Service.

2A.3 No hiding or overriding opt-outs. Do not remove, hide or break the unsubscribe link, the one-click unsubscribe header, STOP handling or the required footer. Do not re-add or re-import anyone on your Suppression List, or send to them from another tenant or account.

2A.4 No disguised marketing. Do not send marketing as if it were a transactional, security, safety or recall message, or through support, case, job-link or Trade Partner features (see also 5A.4).

2A.5 No filter evasion. Do not:

• spread sending across domains, sender names, tenants or accounts to avoid limits, reputation or blocking ("snowshoeing");
• use look-alike domains, hidden text, image-only messages or other tricks to get past spam filters;
• use link shorteners or redirects that hide the destination, other than the Service's own;
• "clean" a list by sending to it through another provider first to strip out bounces, complaints or spam traps; or
• send from a domain you have not verified in the Service, or forge headers.

2A.6 Keep metrics healthy. Do not keep sending in a way that drives bounce, complaint, spam-trap or opt-out rates above the thresholds we set for the Service and tell you about. Repeatedly exceeding them is a material breach of this AUP.

2A.7 Channel rules. Follow the rules of the channel and your provider, including carrier registration, sender ID rules, quiet hours and the WhatsApp Business Messaging Policy. Do not send marketing by SMS or WhatsApp to a number without permission for that channel.

2A.8 Restricted Campaign content. Do not use Campaigns to promote:

• products or services that are illegal where the Contact is, or that need a licence you do not hold;
• prescription medicines, or food supplements and health products with unauthorised health claims;
• gambling, payday or high-cost credit, debt relief, credit repair, cryptocurrency or other speculative investments;
• multi-level marketing, pyramid or get-rich-quick schemes, or affiliate offers that are not your own products;
• adult or sexual content, weapons, tobacco or vaping products (subject to local law and channel rules); or
• the sale of followers, likes, reviews or contact data. We may add restrictions our email or messaging providers impose on us. A brand's own lawful products in a restricted category may be allowed on a channel only if we agree it in writing.

2A.9 No deceptive content. Do not send phishing, malware, fake invoices, false prize or urgency claims, misleading prices or discounts, fake reviews, or messages that imitate BrandedMark, an inbox provider, a bank, a delivery company or any other organisation.

2A.10 Children and sensitive data. Do not target children, or build Audiences from special category data, criminal-offence data or inferences about them.

#3. Content

You must not upload, publish or transmit content that:

3.1 is unlawful, defamatory, obscene, hateful, violent or threatening, or that promotes terrorism or violent extremism;

3.2 sexually exploits or endangers children, in any way;

3.3 infringes anyone's intellectual property, privacy or publicity rights;

3.4 contains malware, or code designed to harm, disrupt or gain unauthorised access to systems or data (including through widgets or custom code you add to experiences);

3.5 impersonates any person, brand or organisation, or misrepresents your affiliation with them;

3.6 discloses other people's personal or confidential information without the right to do so.

#4. AI Features

You must not use AI Features to:

4.1 generate or send content that breaches this AUP, including misleading product, safety or sustainability claims;

4.2 remove, hide or falsify AI disclosure labels, or present AI-generated content or chat as written by a human when the law or our labelling requires disclosure;

4.3 make fully automated decisions with legal or similarly significant effects on consumers (for example refusing a statutory warranty claim) without meaningful human review where the law requires it;

4.4 manipulate an AI Feature: try to bypass its instructions, guardrails or permissions, jailbreak it, extract its system prompts or hidden instructions or other customers' data, or carry out prompt-injection attacks against the Service or third parties. That includes instructions hidden in files, product documents, web pages, emails or webhook payloads you route into the Service;

4.5 give medical, legal, financial or safety-critical advice to consumers that has not been checked by a qualified human;

4.6 process special category data, or create profiles of consumers for purposes they would not reasonably expect;

4.7 breach the usage policies of our AI providers, which we make available on request;

4.8 use AI to replicate BrandedMark: use an AI model, agent or similar tool to analyse, reconstruct, clone or extract the Service's code, prompts, model behaviour, workflows, data structures, APIs or user interface. That includes feeding it screenshots, recordings, page source, network traffic, front-end bundles or API responses for that purpose; or

4.9 distil or train: use AI Output or API responses to train, fine-tune or distil a model that competes with the Service, or systematically capture our AI Features' behaviour, for example by generating synthetic training data.

#5. Platform security and integrity

You must not, and must not help anyone else to:

5.1 access accounts, tenants or data you are not authorised to access, or probe, scan or test for vulnerabilities in the Service, except as permitted by our Responsible Disclosure Policy;

5.2 scrape, crawl or harvest the Service, consumer portals, resolvers or passports by automated means, except:

• through our documented public API within its rate limits; or
• public passport and resolver access by search engines and regulators that follows our robots rules;

5.3 carry out load testing, stress testing or denial-of-service activity, or otherwise put an unreasonable load on the Service;

5.4 circumvent rate limits, usage limits, plan limits, authentication, tenant isolation or other controls;

5.5 interfere with other customers' use of the Service, or with any user, host or network;

5.6 reverse engineer, decompile or disassemble the Service, or copy, mirror or create derivative works of its interface or workflows, except as the law expressly allows;

5.7 use the Service to build a competing product, or to benchmark it for publication without our written consent;

5.8 share credentials, API keys or passkeys, or create accounts using false identities or automated means;

5.9 use widgets, webhooks or integrations to exfiltrate data from End Users without proper notice and lawful basis;

5.10 use browser automation, bots or agents that simulate a signed-in user to get around the Developer Tools, OAuth consent or rate limits. Use the API and MCP server, under the terms that apply to them, instead.

#5A. Trade Partners, Field Users and Signed Records

If a brand gives you access as a Trade Partner User or Field User, you must not:

5A.1 register a product, take a unit into trade-in, or start an ownership or warranty transfer for a consumer without their real, informed agreement, or misstate the delivery date, condition or ownership of a unit;

5A.2 forge a signature, sign for someone else, or alter a Signed Record after it is sealed, or capture a consumer's signature without showing them what they are signing;

5A.3 probe ownership or personal data: use owner-match, scan or search features to guess, enumerate or confirm who owns units, or to collect consumers' details you have no business need for;

5A.4 send bulk or unsolicited messages through fill-in links, job links, case emails or other sending features, or use them to email people with no connection to the job or case;

5A.5 use consumer data you see through partner access (names, contact details, case details, refund amounts, addresses on accepted orders) for your own marketing or any purpose other than the job the brand gave you, unless the brand's agreement with you allows it and the law permits it;

5A.6 sign or certify safety-critical work (for example gas, electrical or pressure-equipment commissioning or inspections) unless you are competent and, where the law requires, registered to do it; or

5A.7 share your sign-in, codes or passkeys with colleagues. Each person must use their own access so that records are attributable.

#6. Law, sanctions and export control

6.1 Comply with all laws that apply to your use of the Service, including consumer protection, product safety, product labelling, data protection, e-privacy, anti-bribery and tax laws.

6.2 Do not use the Service in breach of UK, EU, UN or US sanctions or export controls, including to provide it to sanctioned persons or territories, or to Russian entities where restricted by EU Regulation 833/2014.

#7. Enforcement

7.1 Investigation. We may investigate suspected breaches. That includes reviewing content or activity relevant to the suspected breach, but only to the extent needed and in line with our Data Processing Agreement with the Customer.

7.2 Action. We may:

• ask you to remove content or stop an activity;
• remove or disable content;
• restrict a feature; or
• suspend access.

We do this in line with your agreement with us, proportionately and with notice where practical. We may report illegal activity to the relevant authorities. Where we reasonably consider a breach serious or repeated, we may end your access or the agreement, as that agreement allows.

7.3 Reporting. To report misuse of BrandedMark, including counterfeit product identities, false passport data, spam or security issues, email [email protected], or [email protected] for vulnerabilities.

#8. Changes

We may update this AUP in line with your agreement with us. We will publish the change, with its effective date, and keep every previous version; ask [email protected] for a copy.

#Version history