Acceptable Use Policy

Summary

This summary is a plain-language guide to the main points of this document. It does not form part of the document’s binding terms and does not change their meaning. The numbered clauses govern.

This policy forms part of the Terms of Service. It applies to your organisation and to everyone your organisation lets use Lucrii.
Use Lucrii for lawful business purposes. Do not use it to store or send unlawful, harmful or infringing content.
Do not probe, scan or attack Lucrii, get around its limits or security, or share sign-in details. Good-faith security research under the Security and Incident Response page is permitted.
Your organisation is the sender of the emails, documents and public notes it sends through Lucrii. It must meet the Spam Act 2003 (Cth), have the consent the law requires, and identify itself accurately.
Do not try to manipulate Hermes, extract another organisation’s data, use Hermes’ outputs to build a competing AI model, or rely on Hermes alone for decisions that significantly affect people.
Connect to Lucrii by machine only through authorised clients, such as MCP clients connected by OAuth, and within the rate limits.
App developers must use only the data their app’s approved permissions allow, for the purpose the app describes.
Document Pages must never be used to deceive the people who receive them.
Report abuse to support@lucrii.io.
Lucrii responds in proportion to the breach. Except in urgent cases, Lucrii tells you first and gives you at least 7 days to fix the problem.

1.1 This Acceptable Use Policy (Policy) is issued by Lucrii Pty Ltd (ABN 46 694 710 211, ACN 694 710 211) (Lucrii, we or us). It forms part of, and is incorporated into, the Terms of Service (Terms). A breach of this Policy is a breach of the Terms.

1.2 This Policy applies to:

(a) the Customer;

(b) every User, including the Customer’s members and invitees and anyone using an MCP Client or App on its behalf; and

1.3 The Customer is responsible for its Users’ compliance with this Policy, and must take reasonable steps to make its Users aware of it.

1.4 The order of precedence in clause 2.3 of the Terms applies, so if this Policy is inconsistent with the Terms, the Terms prevail to the extent of the inconsistency. On matters concerning Hermes, this Policy is read together with the Hermes AI Terms.

1.5 This Policy is governed by the law of Victoria, Australia, as clause 22.5 of the Terms provides.

2. Definitions

2.1 This Policy adopts the definitions in clause 2.1 of the Terms, including App, Customer, Customer Data, Owner, Administrator, Service, Hermes, Hermes Content, Credits, Document Page, MCP Client, Outputs, Recipient, User and Sub-processor. Capitalised terms not defined below have the meaning given in the Terms. In this Policy:

(a) Customer Email means an email that Lucrii sends at the direction of a Customer or User to a person outside the Customer’s business, including a quote, invoice, sales order, purchase order or other document, a public note, and a link to a Document Page.

(b) Developer has the meaning given in clause 1.2(c).

3. Lawful use

3.1 The Customer and its Users may use the Service only for lawful business purposes and in accordance with the Terms, this Policy and all laws that apply to them, including laws on privacy, consumer protection, electronic messaging, intellectual property, discrimination, taxation and export control.

3.2 The Customer is responsible for having a lawful basis, and any notice or consent the law requires, for the personal information it puts into the Service, including personal information about its own customers, suppliers and staff.

4. Prohibited content

4.1 A User must not upload, store, create, display or send through the Service any content that:

(a) is unlawful, or promotes or facilitates unlawful activity;

(b) is or depicts child sexual abuse or exploitation material;

(d) harasses, bullies, stalks or intimidates any person, or vilifies or discriminates against a person on the basis of race, colour, national or ethnic origin, religion, sex, sexual orientation, gender identity, disability, age or another attribute protected by law;

(e) is defamatory, or discloses another person’s confidential information or personal information without a lawful basis;

(f) infringes any person’s copyright, trade mark, design, patent, trade secret or other intellectual property or moral rights;

(g) contains malware, viruses, ransomware or other code designed to damage, disrupt or gain unauthorised access to any system or data; or

(h) offers or promotes goods or services that the Customer is not licensed or permitted by law to supply.

5. Prohibited conduct

5.1 A User must not use the Service to:

(a) commit or facilitate fraud, money laundering, terrorism financing, sanctions evasion, theft or any other offence;

(b) impersonate any person, business or brand, or misrepresent the User’s identity, affiliation or authority;

(d) sell, resell, sublicense, lease or otherwise provide access to the Service to any third party, except to the Customer’s own Users as the Terms permit;

(e) create multiple Organisations or accounts to obtain more than one free trial, or to avoid plan limits, Credit allowances or spending limits; or

(f) use the Service as general file storage or for purposes unrelated to running the Customer’s business.

6. Security and integrity of the Service

6.1 A User must not:

(a) probe, scan or test the vulnerability of the Service or any system or network connected to it, except as permitted by clause 6.2;

(b) breach, disable or get around any authentication, access control, rate limit, plan limit, permission or other security or usage measure of the Service;

(d) share sign-in details, passwords, passkeys, backup codes, access tokens or API credentials with any other person, or let more than one person use a single User account;

(e) interfere with or disrupt the Service, including by denial-of-service attack, flooding, or sending requests in a volume or pattern that degrades the Service for other customers;

(f) reverse engineer, decompile or disassemble the Service, or attempt to derive its source code, except to the extent the law expressly permits despite this restriction; or

(g) copy, frame or mirror any part of the Service, other than the Customer’s own Customer Data.

6.2 Security research carried out in good faith, and in accordance with the vulnerability reporting terms on the Security and Incident Response page, is authorised and is not a breach of clause 6.1.

6.3 The Customer must notify Lucrii at support@lucrii.io without undue delay after becoming aware of any unauthorised access to its account or of any compromise of a User’s sign-in details.

7. Email and messages sent through Lucrii

7.1 The Customer is the sender of every Customer Email, and of every message it or its Users send to a Recipient through a Document Page. Lucrii transmits these messages on the Customer’s behalf.

7.2 The Customer must ensure that each Customer Email:

(a) complies with the Spam Act 2003 (Cth) and any other electronic messaging law that applies to it;

(b) where it is a commercial electronic message, is sent only with the Recipient’s express or inferred consent within the meaning of the Spam Act 2003 (Cth), and contains a functional unsubscribe facility that the Customer honours within 5 working days;

(c) clearly and accurately identifies the Customer as the business that authorised it, together with accurate contact details for the Customer; and

(d) is addressed to a person with whom the Customer has a genuine business relationship or dealing, such as a customer receiving a quote or invoice, a supplier receiving a purchase order, or a contact receiving a public note about their order.

7.3 The Customer must not use Customer Emails, public notes or Document Pages:

(a) to send bulk marketing, newsletters or unsolicited commercial messages;

(b) to send messages to purchased, rented or harvested address lists;

(d) to send content that clause 4 prohibits.

7.4 Each Plan includes a daily limit on Customer Emails, which is shown in the Service. The Customer must not attempt to get around that limit, including by spreading sending across Organisations.

7.5 Lucrii may suspend Customer Email sending for an Organisation under clause 15 if its messages generate complaints, bounces or blocklisting at a level that threatens the deliverability of email sent for other customers.

8. Document Pages

8.1 A Document Page presents the Customer’s own document to the Recipient. The Customer is responsible for the content of each document, for the terms on which it offers, accepts or confirms any transaction, and for its dealings with the Recipient.

8.2 The Customer must not use a Document Page to mislead or deceive a Recipient. In particular, the Customer must not:

(a) present a document that misstates the identity of the business issuing it, or that imitates another business’s documents or branding;

(b) present a quote, invoice or purchase order for goods or services the Customer does not intend to supply or acquire, or for an amount the Recipient does not owe;

(d) change a document after the Recipient has accepted or confirmed it in a way that misrepresents what the Recipient agreed to; or

(e) use a Document Page or its messaging to send content that clause 4 prohibits.

8.3 Lucrii keeps an evidence record of each acceptance, decline and confirmation made on a Document Page. A User must not tamper with, or attempt to falsify, an evidence record.

9. Hermes

9.1 A User must not:

(a) attempt to manipulate Hermes into acting outside the User’s instructions or permissions, including by prompt injection, jailbreaking, or placing hidden instructions in records, notes, attached files or emails intended to be read by Hermes on behalf of another User;

(b) attempt to use Hermes, an MCP Client or any other means to obtain the data, memories or Outputs of another Organisation or of a User whose data the User is not authorised to see;

(c) attempt to re-identify any Organisation or person from Hermes’ industry figures, or to infer another Organisation’s data from them;

(d) use Outputs, or the Service, to develop, train, fine-tune or evaluate an AI model or service that competes with Lucrii or Hermes;

(e) extract Hermes’ system instructions or attempt to copy Hermes’ design by systematic querying;

(f) use Hermes to generate content that clause 4 prohibits, or to carry out conduct that clause 5 prohibits; or

(g) represent Outputs as having been written or checked by a person when they have not, in circumstances where the law requires that disclosure or where it would mislead the recipient about something that matters to them.

9.2 The Customer must not use Hermes or Outputs, without meaningful review by a person who has the authority and competence to change the result, to make or substantially inform any decision that could reasonably be expected to significantly affect an individual’s rights or interests. Such decisions include decisions about employment, credit, insurance, housing, access to essential goods or services, and legal or medical matters.

9.3 Where the Customer uses Hermes in making decisions about individuals, the Customer is responsible for any disclosure, notice or consent the law requires, including under the Australian Privacy Principles and, where they apply, the EU General Data Protection Regulation and the UK GDPR.

9.4 Hermes can make mistakes. The Customer is responsible for reviewing Outputs before relying on them or sending them to anyone, as the Hermes AI Terms describe.

10. The MCP server and APIs

10.1 A User may access the Service by automated means only:

(a) through an MCP Client the User has connected to Lucrii’s MCP server through OAuth and approved;

(b) through Lucrii’s command line tool, an App, or another client that Lucrii provides or authorises for that purpose; and

10.2 A User must not:

(a) access the Service with bots, scrapers, crawlers or scripts other than through a client permitted by clause 10.1;

(b) exceed, or attempt to get around, the rate limits Lucrii applies to its MCP server, APIs and sign-in endpoints, including by rotating IP addresses, connections or accounts;

(c) share, publish or embed an access token or connection in a way that lets a person who is not a User reach the Customer’s account; or

(d) use the MCP server or APIs to copy the Service’s content or structure for a competing product.

10.3 Data that a User sends to an MCP Client leaves the Service and is handled under that client’s own terms. The Customer is responsible for its choice of MCP Clients and for the data its Users send to them.

10.4 Lucrii may slow or reject requests that exceed its rate limits without notice. Doing so is not enforcement action under clause 15.

11. Apps and the connector platform

11.1 A Customer that installs an App is responsible for reviewing the permissions the App requests, and for the data it allows the App to access. The App’s developer’s own terms and privacy policy apply to the App.

11.2 A Developer must:

(a) describe accurately, in the App’s listing, what the App does and what data it accesses, sends outside Lucrii or stores;

(b) request only the permissions the App needs for the purpose its listing describes, and use Customer Data only for that purpose and only on the instructions of the Customer that installed it;

(c) keep secret any credentials, signing keys and client secrets the platform issues to it, and not expose them to any person;

(d) comply with the laws that apply to the App, including privacy law in respect of any personal information it handles; and

(e) where the App handles personal information, make a privacy policy for the App available to Customers and refer to it in the App’s listing.

11.3 A Developer must not:

(a) build or publish an App that contains malware, conceals its behaviour, or does anything its listing does not disclose;

(b) use an App to access data of an Organisation that has not installed it, or data outside the permissions an Organisation approved;

(c) attempt to break out of the environment in which the platform runs Apps, or to access other Apps, other Organisations or Lucrii’s systems;

(d) sell Customer Data obtained through an App, or use it for advertising, profiling or training an AI model; or

(e) manipulate App Store ratings, reviews or listings.

11.4 Lucrii may suspend an App, remove it from the App Store, or disable its access to an Organisation under clause 15 if the App breaches this clause 11 or poses a risk to the Service or to Customer Data.

12. Fair use of plan limits

12.1 Each Plan includes limits, such as the number of Users, active documents, storage, Credits and Customer Emails, as shown on the Pricing Page and in the Service. A User must not attempt to get around these limits.

12.2 A Customer that uses the Service in a way that places a materially greater load on it than ordinary business use of its Plan will be contacted by Lucrii to agree a solution before Lucrii takes any action under clause 15, except in an urgent case under clause 15.3.

13. Reporting abuse

13.1 Anyone may report a suspected breach of this Policy, including abusive email, a deceptive Document Page or a harmful App, to support@lucrii.io.

13.2 A report should describe what happened, include any supporting material such as screenshots, links or email headers, and give the reporter’s contact details if they wish to hear back.

13.3 Lucrii will acknowledge each report that includes contact details and will assess it promptly. Lucrii may not be able to tell the reporter what action it took, because of its confidentiality and privacy obligations to its customers.

13.4 Security vulnerabilities should be reported as described on the Security and Incident Response page.

14. How Lucrii investigates

14.1 Lucrii does not review Customer Data to look for breaches of this Policy. Lucrii’s staff see Customer Data when they provide support, review session recordings and Hermes Content to measure and improve the Service as the Privacy Policy describes, or act under clause 14.2. Lucrii applies automated controls to the Service, including rate limits, plan limits, daily Customer Email limits, malware scanning that tags uploaded files, and checks for unusual sign-in activity.

14.2 Lucrii may review Customer Data, account activity and records of use to the extent reasonably necessary to:

(a) investigate a report made under clause 13 or a suspected breach of this Policy;

(b) protect the security and integrity of the Service, other customers or the public; or

14.3 Lucrii handles any personal information it reviews under clause 14.2 in accordance with its Privacy Policy and the Data Processing Addendum.

15. Enforcement

15.1 If Lucrii reasonably believes that a breach of this Policy has occurred, Lucrii may take one or more of the following steps, choosing the least restrictive step that is reasonably sufficient to address the breach:

(a) give the Customer or Developer a written warning;

(b) remove or disable access to the specific content or Document Page concerned;

(c) suspend a specific feature for the Organisation, such as Customer Email sending, Document Pages, Hermes, an MCP connection or an App;

(d) suspend the access of a specific User, MCP Client or App;

(e) suspend the Organisation’s access to the Service; or

(f) terminate the agreement with the Customer, or a Developer’s access to the app platform.

15.2 Lucrii suspends a Customer’s access under clauses 15.1(c) to 15.1(e) only where clause 7.5 of the Terms allows it, and terminates the agreement with a Customer under clause 15.1(f) only under clause 7.3 of the Terms. Except in a case under clause 15.3, before taking a step under clauses 15.1(b) to 15.1(f), Lucrii will:

(a) give the Customer or Developer written notice by email that describes the breach and the step Lucrii proposes to take; and

(b) give a reasonable period to remedy the breach, stated in the notice, of not less than 7 days where the breach is capable of remedy, or, before terminating the agreement with a Customer, the 30-day period in clause 7.3(a) of the Terms.

15.3 Lucrii may take a step under clauses 15.1(b) to 15.1(e) without prior notice, but only to the extent and for as long as reasonably necessary, where Lucrii reasonably believes that:

(a) the breach poses a risk to the security, integrity or availability of the Service or of other customers’ data;

(b) the breach involves content of a kind described in clause 4.1(b) or 4.1(c), fraud, or the deception of Recipients under clause 8.2;

(c) the breach is likely to cause serious harm to any person, or to expose Lucrii to material liability or regulatory action, if not addressed immediately; or

(d) the law, or a court, regulator or law enforcement agency, requires immediate action.

15.4 Where Lucrii acts under clause 15.3, it will notify the Customer or Developer as soon as practicable afterwards, with its reasons, unless the law prohibits it, and will lift the step once the risk has been addressed.

15.5 A suspension under this clause does not suspend Lucrii’s obligations to protect Customer Data, and on request Lucrii will give the Customer a reasonable opportunity to export its Customer Data, unless the law prohibits it. Fees, refunds and termination are governed by the Terms.

15.6 Lucrii may report conduct it reasonably believes to be unlawful to the relevant authorities, and may cooperate with them.

16. Review of decisions

16.1 A Customer or Developer that disagrees with a step Lucrii has taken under clause 15 may ask Lucrii to review it by emailing support@lucrii.io with its account email address, an explanation of why it believes the decision is wrong, and any supporting material.

16.2 Lucrii will review the decision, and tell the Customer or Developer the outcome in writing with its reasons. A request for review does not limit any other right the Customer or Developer has under the Terms or at law.

17. Changes to this Policy

17.1 Lucrii may change this Policy under clause 21 of the Terms, by giving at least 30 days’ notice by email to the Owners.

17.2 If a change is materially adverse to the Customer, an Owner may cancel the subscription or end the agreement before the change takes effect, as clause 21.3 of the Terms provides.

17.3 The date at the top of this Policy shows when it was last changed.

18. Contact

18.1 Questions about this Policy, and reports under clause 13, go to support@lucrii.io.

18.2 Lucrii Pty Ltd, ABN 46 694 710 211, ACN 694 710 211, PO Box 784, New Farm QLD 4005, Australia.