Acceptable Use Policy

Status. This Acceptable Use Policy forms part of the Agreement between ManyPI and the Customer ("you") under the Terms of Service. Terms defined in the Terms of Service have the same meaning in this policy.

Material breach. A breach of this policy is a material breach of the Agreement. Whether it entitles us to suspend the Service or to terminate the Agreement is determined by §12 of the Terms of Service. Your warranties and indemnities are governed by §6 of the Terms of Service (customer responsibilities, lawful basis and outreach) and §7 of the Terms of Service (web scraping, crawling and data extraction). This policy does not restate them.

Persons bound. This policy applies to all use of the Service under your account, including use:

1. (a)
   by you;
2. (b)
   by your Users; and
3. (c)
   by any person or system acting through the API, the MCP server or an integration using your credentials.

Purpose. This policy sets the minimum standard of lawful and responsible use of the Service. It protects the people you research and contact, the operators of the websites and systems the Service accesses, other Customers and the Service itself.

Relationship to the law. The obligations in this policy apply in addition to your obligations under applicable law. Compliance with this policy does not establish that a particular use is lawful.

Enquiries. If you are unsure whether an intended use is permitted, you may ask us at legal@manypi.com before you begin. Our answer is not legal advice and does not relieve you of your own assessment.

You are the sender. Outreach sent through the Service leaves your own mailbox, under your own domain and your own name. ManyPI does not relay it. Towards recipients, their mail providers and authorities, you are the sender. You are responsible for your domain reputation, your deliverability and the lawfulness of every message.

You are the controller. You decide which people to research, which contacts to import, what to send and why. For that processing you are the controller under the GDPR and ManyPI is your processor, and the Data Processing Agreement governs the processing. The only exception is the operational caches described in §13 of the Data Processing Agreement, for which ManyPI is an independent controller.

No implied lawfulness. The availability of a function, a default setting or the absence of a technical restriction does not establish a legal basis for any processing, does not replace any consent the law requires, and does not indicate that a particular use is lawful.

Legal basis and consent. You must not send a message through the Service to a recipient unless:

1. (a)
   you have a legal basis under data protection law for processing that recipient's personal data for the purpose of the message; and
2. (b)
   you meet every requirement for prior consent, and every other condition, that the law on electronic communications and unfair competition applicable to the message imposes.

Commercial email under German law. Under § 7(2) no. 2 UWG, advertising by electronic mail without the addressee's prior express consent is always an unacceptable nuisance and is unlawful. The requirement applies equally where the recipient is a business, and whether the address is a general business address or that of a named employee. Advertising includes a first message proposing a meeting, a call or a business relationship. Publishing an email address, for example on a company's website, is not consent to receive advertising. A legitimate-interest assessment under Article 6(1)(f) GDPR does not replace the consent that § 7 UWG requires. Under § 7(2) no. 3 UWG, advertising by message is also unlawful where the identity of the sender on whose behalf it is sent is disguised or concealed, or where there is no valid address to which the recipient can send a request to stop such messages.

Existing-customer exception. The only exception to the consent requirement in clause 3.2 is § 7(3) UWG. It applies only where all of the following conditions are met:

1. (a)
   you obtained the recipient's email address from the recipient in connection with the sale of goods or a service to that recipient;
2. (b)
   you use the address for direct marketing of your own similar goods or services;
3. (c)
   the recipient has not objected to that use; and
4. (d)
   the recipient was clearly and distinctly informed, when the address was collected, and is informed in every message, that they may object to that use at any time without incurring costs other than transmission costs at basic rates.

Other jurisdictions. Comparable consent requirements for commercial email, including email to business recipients, apply in Austria and in some other Member States, and the rules differ between jurisdictions. You must determine and comply with the law that applies to each message. You bear the legal consequences of non-compliance, which may include injunctions, claims for damages and, under data protection law, administrative fines.

Content of every message. You must ensure that every message you send through the Service:

1. (a)
   identifies you, or the person on whose behalf it is sent, as the sender, and does not disguise or conceal that identity;
2. (b)
   is sent from a domain and mailbox that you own or are authorised to use, under a truthful sender name, with a reply address that exists and is monitored;
3. (c)
   has a subject line that does not mislead about the content or the commercial nature of the message;
4. (d)
   is identifiable as a commercial communication where the applicable law requires it;
5. (e)
   contains a functioning means of objecting to further messages, such as an unsubscribe link, that the recipient can use without costs other than transmission costs at basic rates; and
6. (f)
   contains a postal address and any other information about the sender that the applicable law requires.

Opt-outs and objections. You must give effect to every unsubscribe, every objection to direct marketing under Article 21(2) GDPR, every spam complaint and every request to stop contact, whatever channel it reaches you through, without undue delay and permanently. After that, you must not contact that person again through the Service from any Workspace or account under your control unless the person has since given you fresh consent.

Records. You must keep records sufficient to demonstrate, for each recipient, the consent or other legal basis on which you rely, and produce them to us on request where we investigate a report under §10.

Prohibited practices. You must not:

1. (a)
   send to an address that you obtained from a purchased, rented, traded or scraped list, or that you constructed or guessed, without having established for that address that clause 3.1 is met;
2. (b)
   disable, remove, obscure or circumvent the means of objecting required by clause 3.5(e), or make its use conditional on anything other than the request itself;
3. (c)
   use false or misleading header information, forged routing information, or a sender identity that is not yours;
4. (d)
   send messages that are deceptive or defamatory, or that impersonate another person or organisation;
5. (e)
   use additional accounts, domains or mailboxes to evade a suppression list, a block, a spam filter or a suspension;
6. (f)
   manipulate deliverability or sender reputation through artificial engagement, the manipulation of seed lists or the rotation of domains to escape a poor reputation;
7. (g)
   send at a volume or rate above the sending limits that apply to your plan or mailbox; or
8. (h)
   circumvent, other than through the settings the Service provides, the sending limits, warm-up limits or bounce protections of the Service.

Obligations. When you collect data through the Service, you must:

1. (a)
   limit collection to what is necessary for a specified and lawful purpose;
2. (b)
   comply with the robots exclusion rules of each site you collect from and with any machine-readable reservation of rights under Article 4(3) of Directive (EU) 2019/790;
3. (c)
   provide each person whose personal data you collect with the information required by Article 14 GDPR, including the source of the data, within a reasonable period after obtaining it and at the latest within one month or, if you use the data to communicate with that person, at the latest at the time of the first communication;
4. (d)
   record the source of each record, so that you can answer requests under Articles 14(2)(f) and 15(1)(g) GDPR; and
5. (e)
   delete data once you no longer need it for the purpose for which you collected it.

Prohibitions. You must not use the Service to:

1. (a)
   collect from a source behind a login, a paywall, a CAPTCHA or any other access control that you are not authorised to pass;
2. (b)
   collect in breach of a website's terms of use, or from a site whose operator has prohibited that collection;
3. (c)
   bypass, disable or interfere with rate limits, bot detection or any other technical protective measure;
4. (d)
   collect at a volume or rate that impairs the performance or availability of a third-party website;
5. (e)
   deliberately collect special categories of personal data within the meaning of Article 9(1) GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, or data concerning a person's sex life or sexual orientation) or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR, unless we have agreed to it in advance in text form and appropriate additional safeguards are in place;
6. (f)
   collect personal data of children;
7. (g)
   collect data about individuals in their private, rather than their professional, capacity without a legal basis for that processing;
8. (h)
   build, sell or supply a general-purpose profile database, a people-search service or a data-broker service from data collected through the Service; or
9. (i)
   compile profiles or dossiers on individuals for the purpose of surveillance, harassment or discrimination.

Our controls. ManyPI respects robots exclusion files, maintains a block list of sources from which collection through the Service is not permitted, and reviews collection targets that its risk assessment flags. You must not circumvent or attempt to circumvent these controls, including by disguising a target, routing around the block list or splitting requests to evade rate limits.

Controls are not clearance. These controls reduce the risk of unlawful collection. They do not establish that a particular collection is lawful. Technical access to a site, including its absence from the block list, does not establish an entitlement to collect data from it. You are responsible for assessing that entitlement.

Relationship to the Terms of Service. §7 of the Terms of Service contains your warranties in respect of web scraping, crawling and data extraction, including database rights under Directive 96/9/EC, text-and-data-mining reservations under Directive (EU) 2019/790 and computer-misuse law, and the related indemnity. This section and §7 of the Terms of Service apply together.

Scope of access. When you connect a mailbox, you authorise ManyPI to send messages from it on your behalf and to synchronise correspondence from it into your Workspace, as described in §4 of the Privacy Policy. Synchronised correspondence is accessible to every User of your Workspace.

Obligations. You must:

1. (a)
   connect only a mailbox that you own or that its owner has expressly authorised you to connect;
2. (b)
   where the mailbox belongs to an organisation, be authorised by that organisation to give a third party access to its contents;
3. (c)
   inform the people in your organisation whose correspondence may be synchronised;
4. (d)
   decide whom to admit to your Workspace as a User in the knowledge that every User can access synchronised correspondence; and
5. (e)
   disconnect a mailbox without undue delay when you no longer need it or when your authority to use it ends.

Prohibitions. You must not:

1. (a)
   use mailbox access to read correspondence for a purpose unrelated to your use of the Service, for example to monitor an employee's private communications; or
2. (b)
   connect a mailbox that routinely receives special categories of personal data, legally privileged material, or confidential information of third parties that you are not entitled to place in a third-party system.

Open tracking. The Service can record whether a message you send has been opened. ManyPI records an open as a counter only and does not record the recipient's IP address or user agent for this purpose. Tracking can be switched off per campaign.

Obligations. You must:

1. (a)
   inform recipients of open tracking, and obtain their consent, where the applicable law requires it; and
2. (b)
   switch tracking off for any message for which you cannot meet clause 6.2(a).

Prohibitions. You must not:

1. (a)
   use tracking data to infer sensitive characteristics of a person, including any special category of personal data;
2. (b)
   use tracking data to harass a recipient, or to time contact in a way that a reasonable recipient would find intrusive; or
3. (c)
   state or imply to a recipient that a message is not tracked when it is.

Prohibitions. You must not:

1. (a)
   probe, scan or test the vulnerability of the Service or its infrastructure, except with our prior written permission or within clause 7.2;
2. (b)
   breach or attempt to breach any authentication or access control, or access data belonging to another Customer;
3. (c)
   interfere with the operation of the Service or with service to any user, host or network, including by a denial-of-service attack or by flooding;
4. (d)
   introduce malware, or use the Service to host, distribute or control malicious code;
5. (e)
   reverse engineer, decompile or disassemble the Service, except to the extent that mandatory law permits it, in particular §§ 69d and 69e UrhG;
6. (f)
   resell, sublicense or otherwise make the Service available to a third party, except as permitted by §4 of the Terms of Service;
7. (g)
   create accounts by automated means, or create or use additional accounts to evade plan limits, the limits of the Free Plan, trial restrictions or a suspension;
8. (h)
   misrepresent your identity or affiliation when registering or when communicating with us; or
9. (i)
   use the Service to develop or operate a product or service that competes with it.

Responsible disclosure. If you discover a security vulnerability, report it to security@manypi.com. We will not take legal action against, or treat as a breach of this policy, security research carried out in good faith by a person who:

1. (a)
   reports the vulnerability to us without undue delay and does not disclose it to anyone else before we have had a reasonable time to remediate it;
2. (b)
   does not access or retain data beyond what is necessary to demonstrate the vulnerability; and
3. (c)
   does not degrade the Service or impair its availability for others.

Obligations. You must:

1. (a)
   review Output before you act on it, and in particular before you send it, because Output is generated on a probabilistic basis and may be inaccurate, outdated or fabricated; and
2. (b)
   disclose to the people you communicate with that you use an automated system, where the law requires it.

Prohibitions. You must not use the Service or Output to:

1. (a)
   present Output as the verified statement of a person or organisation that has not reviewed and approved it;
2. (b)
   impersonate a real person or organisation;
3. (c)
   produce material that is defamatory or deceptive, or that is designed to manipulate a person into a decision against their interests;
4. (d)
   hold out Output to others as legal, tax, financial, medical or other professional advice; or
5. (e)
   make, or materially inform, decisions that produce legal effects concerning a person or similarly significantly affect them, including decisions on employment, credit, insurance, housing, education or access to essential services, and this includes the use of the scores and rankings the Service produces for such decisions.

Responsibility. You remain responsible for the accuracy and lawfulness of every message you send and of every use you make of Output, however it was generated. §8 of the Terms of Service governs Output in all other respects.

Prohibited uses. You must not use the Service in connection with:

1. (a)
   sexual content involving minors, or any content that sexualises a minor;
2. (b)
   the promotion or facilitation of terrorism, violent extremism, or violence against any person or group;
3. (c)
   harassment, stalking, doxxing, threats, or content intended to intimidate or silence a person;
4. (d)
   content that incites hatred of, or discrimination against, people on the basis of a protected characteristic;
5. (e)
   fraud, phishing, pretexting, advance-fee schemes, fake invoices, or any other attempt to obtain credentials, payment details or confidential information by deception;
6. (f)
   the sale or promotion of goods or services whose sale is unlawful in the recipient's jurisdiction, including controlled substances, weapons, counterfeit goods and stolen data;
7. (g)
   the provision or promotion of financial, medical, legal or other regulated services without a required licence or authorisation, or the solicitation of investments in breach of applicable financial markets law;
8. (h)
   the infringement of intellectual property rights or the misappropriation of trade secrets;
9. (i)
   political disinformation, coordinated inauthentic behaviour, or interference with an election or referendum; or
10. (j)
    any purpose prohibited by applicable export control or sanctions law, or activity on behalf of a person or entity subject to sanctions.

Reports to authorities. We report content that sexualises a minor to the competent law enforcement authorities, without notice to you.

Investigation. We investigate reports and indications of breaches of this policy. We do not routinely monitor the content of your outreach or your Customer Data, and this policy does not oblige us to do so.

Measures. Depending on the seriousness of the breach, we may take one or more of the following measures:

1. (a)
   a warning, with a deadline for remedy;
2. (b)
   throttling or suspension of a specific function, such as sending or data collection;
3. (c)
   suspension of your account;
4. (d)
   blocking access to specific content or data, or removing it where blocking is not sufficient to end the breach; or
5. (e)
   termination of the Agreement for good cause.

Procedure. Throttling or suspension of the Service or of any function, and termination, are subject to the conditions and procedure in §12 of the Terms of Service, which this policy does not extend. Before blocking or removing content or data under clause 10.2(d), we will contact you and give you a reasonable opportunity to explain or to remedy the breach, unless the breach is serious or continuing, or presents an immediate risk to third parties, to the Service or its infrastructure, or of legal liability for us.

Reasons. When we take a measure under clause 10.2, we will tell you which measure we have taken, the facts on which it is based, the provision of this policy or of the law concerned, and how you can ask for a review under clause 10.7, unless the law prohibits this.

Disclosure to authorities. We disclose information to a competent authority where we are legally obliged to do so, or where we reasonably believe that disclosure is necessary to avert a serious risk to the life, health or safety of a person.

Fees, Credits and indemnity. The consequences of a suspension or termination for fees, Credits and refunds follow from §9 of the Terms of Service (Credits), §11 of the Terms of Service (fees and refunds) and §12 of the Terms of Service (termination and suspension). Your indemnities under §6 of the Terms of Service and §7 of the Terms of Service are unaffected.

Review. If you believe that a measure was taken in error, write to abuse@manypi.com and give your reasons. We will review the measure and tell you the outcome. If the measure was not justified, we will lift it without undue delay. Your rights under §14 of the Terms of Service (defects) and §15 of the Terms of Service (liability) are unaffected.

Reporting abuse. Anyone may report misuse of the Service to abuse@manypi.com, with the message headers or other evidence. We review every report and act on those we substantiate.

Grounds. We may amend this policy with effect for the future where there is a valid reason, namely a change in the law or in case law, a decision of an authority, a change to the Service or the emergence of new forms of misuse, and provided the amendment is reasonable for you, taking our interests into account.

Notice. We will notify you of a proposed amendment in text form, to the email address of your account, at least thirty (30) days before it is to take effect. The notice will identify what has changed. We will also update the version and effective date shown at the top of this policy.

Right to object. You may object to the amendment in text form before it takes effect. If you object, the Agreement continues with this policy in its existing version; we may then terminate the Agreement with effect from the date on which the amendment would have taken effect, on the same terms as a termination following an objection under §17 of the Terms of Service. If you do not object before that date, the amendment takes effect. We will draw your attention to the right to object, the period for objecting and the consequence of not objecting in the notice itself.

Urgent amendments. Apart from the cases in clause 11.5, an amendment may take effect with a shorter period of notice, or immediately, only where this is necessary to address an urgent legal or security risk. We will state in the notice that the amendment is made on that ground and describe the risk. You may then terminate the Agreement in text form with immediate effect within thirty (30) days of receiving the notice. The consequences for fees and Credits follow from §9 of the Terms of Service and §11 of the Terms of Service.

Favourable amendments. Amendments that are exclusively favourable to you, and the correction of obvious errors, take effect on publication.