Acceptable Use Policy

1.1 This policy applies to the practice that holds the account, to each person the practice gives access to, to people who use a link the practice sends them, and to anything that uses the practice's API keys.

1.2 The practice is responsible for the use of the service under its account, including use by people it has invited and by programs that use its keys, as if the practice had done it itself.

2.1 You acknowledge that the assistant features use artificial intelligence. Their output can be wrong, incomplete, out of date, biased or not suited to the facts in front of you.

2.2 Output is not legal advice. We are not a law firm and do not practise law. A qualified person must review any output before it is relied on, sent to a client, filed or used to decide anything.

2.3 You must use your own professional judgement, check citations and quotations against the source, and not rely on output you have not verified.

2.4 You must not use output to make or support a decision that significantly affects a person without meaningful human review. This includes decisions about someone's rights, liberty, employment, credit, housing, immigration status or access to essential services.

2.5 You must not represent that output was prepared without the use of AI where the law, a court, a regulator or your client requires you to say so, and you must tell people when they are interacting with an AI feature if the law requires it.

2.6 You must not try to make the assistant do something it is designed not to do, such as act on a reserved matter, reveal another practice's information, or ignore the sources it was given.

2.7 You remain responsible for your obligations to your clients and to the body that regulates you, including competence, confidentiality, conflicts, supervision and the safeguarding of client money.

3.1 You must have the right to put Your Content into the service and to let us process it as the Terms of Service describe. This includes a lawful basis for any personal data in it, and the permission of your client where the matter requires it.

3.2 You must not put into the service content that infringes someone's intellectual property, privacy or other rights, that you have no right to share, or that is unlawful.

3.3 You should put in only the personal data that you need, and you should take particular care with special categories of personal data and information about criminal matters.

3.4 You must not upload payment card numbers, passwords or other credentials, or other data that the service is not designed to hold and that would put people at risk if it were exposed.

3.5 You must not use the service to store or share material that is abusive, defamatory, harassing or discriminatory, that exploits or endangers a child, or that incites violence or hatred.

You must not use the service:

• to break any law or regulation that applies to you, to us or to the people concerned, including those on money laundering, sanctions, export controls, bribery and data protection;
• to commit or help with fraud, to launder money, to conceal assets from lawful claims or to evade tax;
• to practise law, or to give the appearance of doing so, where you are not authorised to;
• to forge, falsify or backdate a document, a signature, an identity check or an entry in the audit trail, or to present a draft as an executed document;
• to impersonate a person or organisation, or to misrepresent who you are or who a message is from;
• to monitor, profile or track a person unlawfully, or to carry out identity screening of a person without a lawful basis for doing so;
• to send unsolicited, deceptive or bulk messages through the email, signing, invoicing or portal features;
• to interfere with a court process, to intimidate a witness or to destroy evidence.

You must not, and must not allow anyone else to:

• attempt to access another practice's data, or to get around the separation between practices, a role or an approval step;
• probe, scan or test the security of the service or its network, or search for vulnerabilities, other than as our vulnerability disclosure terms allow;
• introduce a virus, malware or other harmful code, or interfere with or overload the service;
• reverse engineer, decompile or try to obtain the source code of the service, except as the law allows despite this restriction;
• modify, adapt, translate or create derivative works of the service, or remove any notice of ownership or confidentiality;
• share an account or a password, sell or sub-license access, or let someone use credentials that belong to another person;
• use the service to build a competing product or to benchmark it for publication without our written permission;
• bypass a limit on usage, a plan restriction or a rate limit.

6.1 Programs may use the service only through the API and the keys we provide. You must not use scraping, crawling or other automated extraction to read the service's pages.

6.2 You must keep API keys secret, give each key only the permissions it needs, use sandbox keys for development and testing, and revoke a key you think has been exposed.

6.3 You must stay within the rate limit of each key. The default limit is 60 requests a minute and the most that can be set is 6,000. Requests above the limit are refused, and repeated attempts to get around it may lead to the key being suspended.

6.4 Webhook endpoints must be addresses you control and must verify the signature on every delivery. You must not point a webhook at an address you do not control or at an internal network.

6.5 You must not use the API to copy the service's data into another service in a way that exposes confidential information, or to supply the data to a person who is not entitled to it.

7.1 Invite only people you are entitled to share with. A client portal, guest link, signing request or shared document gives the recipient access to what the link reaches, and you are responsible for deciding who receives it.

7.2 You must not share a personal link in a way that lets people other than the intended recipient use it, and you must withdraw access when it is no longer needed.

7.3 You must not use a signing request to mislead a person about what they are signing, to pressure them, or to collect a signature that they have not freely given.

7.4 Where you ask us to verify a person's identity, you must tell them, you must have a lawful reason, and you must use the result only for that purpose.

You must use the service in a way that is reasonable for the plan you are on and that does not degrade the service for others. We may limit or slow use that places a disproportionate load on the service, for example very large or repeated uploads, bulk exports on a loop or unusually heavy use of the assistant features, and we will tell you when we do.

A practice administrator must:

• give each person the least access they need, and review who has access from time to time;
• remove a person's access on the day they leave, and revoke any keys and links they held;
• keep the practice's verified domains and approval settings accurate;
• make sure the people who use the service know and follow this policy;
• tell us promptly of any suspected misuse or compromise.

10.1 You must keep your credentials secure and confidential. If you suspect that your account, a key or a link has been accessed or used without permission, you must tell us at once at security@olympuspay.co, and change your password or revoke the key.

10.2 If you become aware of a breach of this policy by anyone, you should tell us at legal@olympuspay.co. We treat reports in confidence and we do not take action against a person for a report made in good faith.

11.1 We may investigate a suspected breach. We look first at account activity, such as logs of sign-ins, requests and sharing. We do not read the content of a practice's matters unless it is necessary to deal with a serious breach or a legal duty, and then only the part that is necessary.

11.2 Depending on the seriousness of the breach, how often it has happened and whether it was intended, we may: ask you to stop and put it right; remove content or a link; limit a feature or a key; suspend a user, a key or the account; or end the agreement under the Terms of Service.

11.3 Where there is a serious or continuing risk to the service, to other practices or to a person, we may suspend access at once and tell you as soon as we reasonably can. Otherwise we will give you notice and a reasonable chance to respond before we act.

11.4 If we suspend or end access, the practice can still export Your Content for the period the Terms of Service provide, unless the law prevents us from allowing it.

11.5 We may disclose information to a court, regulator or law enforcement body where the law requires, and we will tell the practice unless the law prevents us.

11.6 These steps are in addition to any other right we have. Fees already paid are not refunded where an account is suspended or ended for a breach of this policy.

11.7 If you think we have acted wrongly under this policy, write to legal@olympuspay.co and we will review the decision.

We may update this policy to reflect changes in the service, the law or how the service is misused. We will show the date at the top and give notice of a material change. Continuing to use the service after a change takes effect means you accept it.

13.1 This policy is governed by the laws of the Republic of Botswana, as the Terms of Service provide. If a provision is unenforceable, the rest continues. Our not enforcing a provision at one time does not waive it.

13.2 You can reach us at privacy@olympuspay.co for data protection matters, legal@olympuspay.co for legal notices, and support@olympuspay.co for help. Our address for notices is 1111B S Governors Ave, STE 25834, Dover, DE 19904, USA. A written notice sent to that address, or an email to legal@olympuspay.co, is treated as delivered when received.