Acceptable Use Policy

Kaarvi Acceptable use policy ACCEPTABLE USE POLICY Effective Date: July 5, 2026 Version: 1.0 This Acceptable Use Policy (“AUP”) governs Customer’s access to and use of the platform, services, APIs, software, documentation, and related features provided by Kaarvi, Inc. (“Kaarvi”). This AUP forms part of, and is incorporated into, the applicable Terms of Service. Capitalized terms not defined in this AUP have the meanings given in the Terms of Service. This AUP governs permissible and prohibited use-level conduct in connection with the Services. The Terms of Service govern the commercial and contractual relationship between the parties, The Data Processing Addendum governs Kaarvi’s processing of Personal Data on Customer’s behalf. This AUP is intended to supplement, not duplicate, the obligations set forth in those documents. Where this AUP addresses a subject also addressed in the Terms of Service or Data Processing Addendum, it establishes additional use-level requirements and does not limit or modify the rights and obligations set forth therein. 1. PERMITTED USE. Customer may access and use the Services for lawful internal business purposes in accordance with the Terms of Service. Customer’s use of the Services is subject to the scope, limitations, and conditions set forth in the Terms of Service, the applicable Order Form, and this AUP. Nothing in this AUP expands or limits the rights granted to Customer under the Terms of Service. 2. PROHIBITED CONDUCT. Customer will not, and will not permit any Authorized User or third party acting on Customer’s behalf to, access or use the Services in any manner described in this Section 2. The use restrictions set forth in Section 2.5 of the Terms of Service apply in addition to this Section 2 and are not repeated here. 2.1 Unlawful use. Customer will not use the Services in any manner that: violates any Applicable Law, regulation, court order, or binding regulatory requirement; infringes, misappropriates, or otherwise violates the intellectual property, privacy, publicity, contractual, or other legally protected rights of any person or entity; involves the collection, processing, disclosure, or transfer of data without any notice, consent, authorization, or other legal basis required by Applicable Law; facilitates fraud, identity theft, stalking, harassment, or abuse; or makes or supports decisions that unlawfully discriminate against individuals on the basis of race, color, religion, sex, national origin, age, disability, genetic information, or other characteristic protected by Applicable Law. 2.2 Unauthorized access and data misuse. Customer will not use the Services to: access, query, transform, export, or otherwise interact with any database, system, file, storage location, API, or dataset unless Customer has the legal right and authority to do so; use the Services with stolen, unlawfully obtained, or improperly disclosed data, content, code, credentials, or other materials; or bypass or circumvent contractual, technical, organizational, or legal access restrictions applicable to any source system, dataset, or connected environment. 2.3 Platform and security abuse. Customer will not: introduce, upload, transmit, store, execute, or distribute any malware, ransomware, virus, worm, Trojan horse, spyware, destructive code, or other harmful component through or in connection with the Services, including through SQL execution, Python execution, pipeline, API, prompt, file upload, integration, or other feature; use the Services to transmit spam, unsolicited communications, fraudulent messages, phishing content, or other abusive communications; use the Services to conduct or facilitate denial-of-service attacks, credential-stuffing attacks, brute-force attacks, social engineering, or exploitation of vulnerabilities in any system or network; interfere with, disrupt, damage, disable, or impose an unreasonable or disproportionate load on the Services or any infrastructure used by Kaarvi or its providers; access or attempt to access another customer’s environment, data, metadata, Output, models, templates, or configurations; scrape, harvest, mirror, or systematically extract data or content from the Services except through functionality expressly made available for that purpose; or abuse natural-language querying, API, integration, automation, scheduling, execution, or export features in a manner that exceeds the scope authorized under the applicable Order Form, evades usage controls, or creates an operational or security risk to the Services. 2.4 AI and output misuse. Customer will not: use the Services or any Output as the sole or determinative basis for decisions that produce legal effects or comparably significant consequences for individuals, including in employment, housing, lending, insurance, education, healthcare, or public benefits, without implementing human review, oversight, and compliance controls appropriate to the applicable legal and regulatory requirements; represent AI-generated or automated Output as having been independently verified, audited, or certified when it has not undergone such review; use prompts, queries, workflows, or inputs designed to extract credentials, system instructions, or internal model configurations not intended for Customer access; use AI Features to generate content that violates Applicable Law, including malicious code or content intended to facilitate fraud, deception, or other unlawful conduct; submit to AI Features any content that Customer is not authorized to disclose to Kaarvi and, where applicable, to Kaarvi’s Subprocessors; use AI Features in a manner that is inconsistent with the Terms of Service or that is designed to circumvent safeguards, access controls, or usage limitations applicable to the Services; or generate profiles or assessments of individuals for purposes that violate Applicable Law or that Customer is not authorized to pursue. 2.5 Misrepresentation. Customer will not impersonate any person or entity, misrepresent an affiliation, identity, authorization, or source of data, or use false account information, deceptive billing information, or fraudulent credentials in connection with the Services. 2.6 Material Breach. A material violation of this Section 2 by Customer constitutes a material breach of the Terms of Service for purposes of the Terms of Service's termination provisions. For the avoidance of doubt, Kaarvi's right to suspend access under Section 12 of the Terms of Service may be exercised independently of, and prior to, any termination for material breach under Section 16.3, and the availability of a cure period under Section 16.3 does not limit Kaarvi's suspension rights under Section 12. 3. REGULATED AND HIGH-RISK DATA USE. This Section 3 allocates responsibility for regulated and high-risk data use between Customer and Kaarvi. It does not independently prohibit any category of data or use case; the applicable prohibitions and permissions are set forth in the Terms of Service, the applicable Order Form, the Data Processing Addendum, and any other applicable addendum. Customer may not use the Services with any data, or for any use case, that is prohibited by the Terms of Service. Where Customer uses the Services with data that is sensitive, regulated, or subject to heightened legal or contractual requirements, Customer is solely responsible for: determining whether such use is permitted under the Terms of Service and whether any additional terms, approvals, or restrictions apply; ensuring that all required agreements, addenda, consents, notices, authorizations, and regulatory measures are obtained and implemented; configuring and using the Services in a manner appropriate to the sensitivity and risk profile of the data and the intended use case; and ensuring that use of the Services does not cause Kaarvi to become subject to legal, regulatory, or contractual obligations that Kaarvi has not expressly agreed in writing to undertake.[a] 4. THIRD-PARTY SERVICES AND DATA SOURCES If Customer connects, enables, authorizes, or uses any third-party service, database, identity provider, API, cloud storage service, source system, application, or other integration with the Services, Customer is solely responsible for ensuring that Customer has all necessary rights, permissions, and approvals to do so, for complying with the terms and restrictions applicable to such third-party service. Customer may not use the Services to bypass, circumvent, or violate any contractual, technical, organizational, or legal restriction applicable to any third-party service, source system, API, dataset, or connected environment. Kaarvi does not independently verify that Customer has lawful rights to access, connect, query, import, export, or otherwise use any third-party service, data source, or dataset through the Services. Kaarvi is not responsible for Customer’s violation of any third-party terms, access conditions, or legal restrictions, or for any issues arising from third-party services or integrations not controlled by Kaarvi. 5. MONITORING AND ENFORCEMENT Kaarvi may monitor, review, and investigate use of the Services to the extent reasonably necessary. However, Kaarvi is not obligated to monitor all use of the Services 24 hours per day 7 days per week. Kaarvi may take action it reasonably determines is appropriate in response to suspected or actual violations of this AUP, including: removing, restricting, or disabling access to Customer Data, Output, content, integrations, workflows, or configurations; suspending, limiting, or restricting access to the Services or any portion thereof; requiring Customer to take corrective or remedial action; reporting conduct to law enforcement, regulators, or other appropriate authorities where required or permitted by Applicable Law; and terminating access to the Services in accordance with the Terms of Service. Kaarvi may take enforcement action in response to suspected or actual violations of this AUP in accordance with Section 12 of the Terms of Service. For the avoidance of doubt, the suspension and enforcement procedures set forth in Section 12 of the Terms of Service govern the manner and timing of any enforcement action under this AUP. Kaarvi’s failure to detect or enforce a violation does not constitute a waiver of its rights under this AUP or the Terms of Service, and does not limit Kaarvi’s ability to enforce this AUP or the Terms of Service at any time. Violations, security incidents, and related concerns may be reported to: security@kaarvi.ai (security incidents and vulnerabilities) or abuse@kaarvi.ai (acceptable-use violations and abuse). Kaarvi may request additional information as reasonably necessary to investigate and respond to any reported issue. 6. UPDATES. Kaarvi may update this AUP from time to time to reflect changes in the Services, Applicable Law, security practices, or business operations. If Kaarvi makes a material change that adversely affects Customer's rights or obligations, Kaarvi will provide Customer with not less than thirty (30) days' prior written notice. Changes required by Applicable Law or necessary to address security, fraud, or abuse may take effect immediately. Customer's continued access to or use of the Services after the effective date of any updated AUP constitutes Customer's acceptance of the updated AUP . If Customer reasonably objects to a material change that materially adversely affects Customer's rights during a then-current subscription term, Customer may provide written notice of non-renewal or, if the change materially reduces Customer's rights during a current term, terminate the affected Order Form upon written notice within thirty (30) days after receiving notice of the change, in which case Kaarvi will refund any prepaid fees covering the terminated portion. This remedy will not apply to changes required by Applicable Law or necessary to address security or fraud. [a]I'm not sure whether we should tighten it more now. Right now I assume that medical and children data may be processed. Financial and health is under question. I've added references to BPA but not sure if we need one.