Acceptable Use Policy

1. Use the service for authorised, lawful work

Use only accounts, organisations, records and integrations you are authorised to access. Do not impersonate a person, falsify authority, evade account restrictions, misuse another business's data or use TradePilot for illegal, fraudulent, threatening, exploitative or discriminatory conduct.

Do not upload material you lack the right to use, including confidential client plans or third-party copyright material. Do not fabricate licences, signatures, timesheets, invoices, safety inspections, compliance records or approvals. Correct mistakes through legitimate workflows rather than concealing material changes.

2. Malware, unsafe files and prohibited technical activity

Do not knowingly upload, link, send, host or execute malware, ransomware, credential-stealing material, malicious macros, exploit payloads, destructive scripts or files designed to bypass validation. Take reasonable care with files received from others, including images, PDFs, office documents and archives.

Do not attempt unauthorised access, password attacks, token theft, injection, data extraction across company boundaries, denial-of-service attacks or interference with logs, monitoring or backups. Do not evade rate limits or exploit a flaw to inspect another person's information.

Do not perform penetration tests, mass scanning or load testing against production services without our prior written authorisation. This does not restrict lawful reporting of an issue discovered in good faith. Follow the reporting approach below.

3. Email, SMS, spam and fraudulent messages

Do not send phishing messages, malicious links or attachments, deceptive invoices, false bank-detail changes, harassment or unsolicited commercial messages contrary to law. Do not use harvested address lists or a purchased list without a valid basis for each recipient.

Where consent is required, obtain and keep evidence of it. Identify the real business authorising the message and give accurate contact details. Commercial messages must provide a clear working unsubscribe method that remains functional for at least 30 days; action opt-outs within five working days or the shorter applicable legal period. Do not require account creation, login, unnecessary personal details or payment to unsubscribe.

Use only sender IDs you are authorised to use and satisfy applicable registration requirements. A branded sender ID or delivered message is not a guarantee of authenticity or receipt. Do not add promotional content to a transactional message to avoid marketing rules.

4. Respect personal and confidential information

Only collect, view, upload, export or share information needed for an authorised purpose. Obtain required notices, permissions and consents. Restrict licence, identity, payroll, health and emergency-contact records to the people who legitimately need them.

Do not publish another person's private information to embarrass, threaten or harm them, and do not use TradePilot for covert unlawful surveillance. Device access or an administrator role does not remove privacy, workplace or confidentiality obligations.

Do not place passwords, recovery codes, private cryptographic keys, full card details or unrelated specially regulated information in ordinary notes, Help Centre content or shared files.

5. Protect availability and use integrations responsibly

Keep automated requests, uploads and bulk messaging within documented or agreed limits. Do not intentionally overload infrastructure, create excessive duplicate records or use a workaround to avoid a disclosed usage limit. We will explain a material fair-use concern and seek a reasonable adjustment before restriction where the risk allows.

Only connect authorised external systems, review their access and remove connections that are no longer needed. Do not use an integration to access another tenant or bypass permissions that apply in either service.

6. How we respond to a concern

We may reasonably investigate relevant logs, content or metadata; reject, quarantine or remove harmful material; restrict affected messages or integrations; reset access; or suspend the affected account where necessary. We balance the seriousness, evidence, urgency and impact and use a less disruptive practicable response when it adequately addresses the risk.

We provide reasons, an opportunity to respond and reasonable remediation time where safe and lawful. Serious risks or legal requirements may require immediate action. Evidence may be preserved or lawfully disclosed. Unlawful or dangerous material may not be returned as a normal downloadable attachment.

A restriction does not automatically forfeit all prepaid fees or make a user liable for every resulting cost. Suspension, termination, refunds and liability are governed by the Terms of Service and applicable law. Contact us to request review of an enforcement decision.

7. Report misuse or a vulnerability

Contact sales@tradepilot.com.au with the subject Security incident or Abuse report. Give a description, affected page or record identifier, time and safe steps to reproduce where relevant. Do not include live credentials, unnecessary personal records or an executable malware sample. Ask for a secure transfer method if detailed evidence is required.

If you discover a vulnerability, stop once you have enough information to explain it, avoid accessing or retaining other people's data and do not exploit it, disrupt users or demand payment. Reporting does not itself authorise further testing. This policy does not restrict protected disclosures or reports to authorities.

8. Related terms and updates

This policy forms part of the accepted Terms of Service. Material changes follow the notice and change process in those Terms. See the Privacy Policy for information handling and Security & Data for practical incident and continuity information.