Acceptable use policy

1. Who this applies to

It applies to your business and to everyone you give access to your Spendvora account, including staff, contractors and anyone using a shared login. You are responsible for what they do in your account.

2. What you must not upload or store

• Anything unlawful, or anything that infringes someone else's copyright, trade mark or other rights.
• Personal data you have no lawful basis to process, including documents belonging to another business that you were not given permission to hold.
• Special category data (health, biometrics, political or religious views and the like) or criminal offence data, unless it is genuinely necessary and you have your own lawful basis for it. Invoices rarely need any of it.
• Payment card numbers, passwords or other credentials typed into free-text fields.
• Malware, or files designed to exploit the service or the people who read them.

Remember that documents you upload for scanning are sent to a third-party AI provider for extraction. Do not upload anything you would not be comfortable having processed that way.

3. What you must not do to the service

• Try to reach another customer's tenant, records or files, or probe for a way to do so.
• Get around fair-use caps, scan limits or billing, for example by opening extra trial accounts, sharing one account across separate businesses, or scripting uploads to burn platform AI credit.
• Scan, load test, penetration test or attack the service without our written permission.
• Scrape the service, or resell, sublicense or white-label access to it.
• Reverse engineer, decompile or copy the software, or use it to build a competing product.
• Remove or obscure any notice of ownership, or misrepresent who provides the service.
• Send email through the service to people who have not agreed to hear from you. Supplier emails are for genuine purchase orders, not marketing.
• Deliberately overload the service, whether by volume of requests, file size or anything else that degrades it for other customers.

4. Accounts and access

Give each person their own login rather than sharing one. Use the role and visibility settings so people only see what they need. Remove access promptly when someone leaves, and tell us at procurement@brainwavedesigns.co.uk if you think an account has been compromised.

5. Fair use of AI features

AI scanning costs us real money per document, so the plans include a monthly scan allowance and a token cost cap. Use it for your own genuine business documents. Do not run bulk scans to test the model, process another business's paperwork as a service, or automate uploads to exhaust the allowance.

If you need more headroom, either move up a plan or add your own OpenAI API key in Settings, which takes your usage outside our platform cap.

6. Reporting a problem

If you find a security flaw, please tell us at procurement@brainwavedesigns.co.uk before telling anyone else, and give us a reasonable chance to fix it. We will not pursue anyone who reports a genuine issue in good faith and does not exploit it or access other customers' data.

7. What happens if this policy is breached

Depending on how serious it is, we may contact you to sort it out, throttle or switch off AI features, suspend individual users or the whole account, remove offending content, or close the account and end the agreement under section 13 of the terms of use. Where the law requires it, we will report the matter to the authorities.

We will normally warn you first and give you a chance to put things right. We will not wait where there is a live risk to the service, to other customers or to anyone's data.