Acceptable Use Policy

1. Prohibited content

You may not use Ordalis to upload, store, or process content that:

• Violates any applicable law, regulation, or third-party right (including intellectual property, privacy, publicity, or contract rights).
• Contains child sexual abuse material (CSAM) or exploits minors in any form. Violations are reported to NCMEC and law enforcement.
• Constitutes or promotes terrorism, incitement to violence, or organized criminal activity.
• Contains non-consensual intimate imagery or is used to harass, stalk, dox, or threaten an identifiable person.
• Is obtained through unlawful means, including data exfiltrated from a system you are not authorized to access.
• Contains malware, ransomware, exploit code, or credentials intended for unauthorized system access (other than isolated samples for bona fide security research).

2. Regulated data — know your tier

Certain data types are only permitted on certain plans:

• Protected Health Information (PHI) — only permitted with an executed Business Associate Agreement on the Business plan or above.
• Cardholder data (primary account numbers) — not permitted. Redact before upload. Ordalis is not a PCI-DSS processor.
• Government-classified information — not permitted.
• Export-controlled data (ITAR/EAR Category 600-series) — not permitted without prior written approval.
• EU/UK personal data — permitted under the DPA; you are responsible for your lawful basis and cross-border transfer obligations.

3. Platform abuse

You may not, and may not permit any user of your account to:

• Probe, scan, or test the vulnerability of the Service, except under our published responsible disclosure program.
• Circumvent rate limits, quotas, authentication, billing, or any technical controls (including by rotating accounts, keys, or IPs).
• Resell, sublicense, or white-label the Service to third parties without a written reseller agreement.
• Use the Service to build a product that competes directly with Ordalis, or to train machine-learning models that replicate Ordalis extraction capabilities.
• Interfere with other customers' use of the Service, including by generating loads intended to degrade performance.
• Submit content you know or reasonably should know will cause unreasonable abuse volumes against third-party inference providers used in our pipeline.

4. API and automation

Programmatic use is encouraged within published limits. You must:

• Use a unique API key per environment (dev, staging, production) and rotate keys if compromised.
• Respect rate limits and back off on 429 responses rather than retrying in a tight loop.
• Identify your application with a descriptive User-Agent header where possible.
• Not distribute your API key publicly, in client-side code, or commit it to version control.

5. Content accuracy and downstream use

Ordalis uses AI to extract structured data. Output is probabilistic and may contain errors. You are responsible for reviewing extracted data before relying on it for financial reporting, legal filings, medical decisions, or any other consequential purpose. See Section 6 of the Terms of Service.

6. Fair use — unlimited plans

Plans marketed as "unlimited" are subject to fair use. Sustained use that (a) exceeds 5× the mean usage of customers on the same plan over a rolling 30-day window, (b) appears to be automated resale of extraction capacity, or (c) is clearly inconsistent with the intended use of the plan, may be rate-limited or moved to a metered billing arrangement after 14 days' notice.

7. Reporting and enforcement

To report suspected abuse of the Ordalis platform, email [email protected]. For security vulnerabilities, use [email protected].

Ordalis may investigate suspected violations and, at its discretion, suspend or terminate accounts, preserve evidence, cooperate with law enforcement, and refuse to issue refunds for terminated accounts. We will make reasonable efforts to notify you of enforcement actions unless notice would harm an investigation or a third party.

8. Changes

We may update this AUP from time to time. Material changes will be announced at least 15 days before they take effect, except where the change addresses an imminent legal or security risk.