Legal

Acceptable Use Policy

PineWoodsAI LLC
Version: 1.0
Effective Date: March 28, 2025
Last Updated: September 15, 2026

1. Applicability and Defined Parties

1.1 Applicability

This Acceptable Use Policy ("AUP") applies only to Services provided under an agreement that expressly incorporates or references it (including our Terms of Service, AugSite Terms, an MSA, SOW, or order form that does so).

If this AUP conflicts with a signed order form, MSA, or product-specific terms applicable to the relevant Service, the signed or product-specific terms control. This AUP does not expand the scope of any Service or override PineWoodsAI's obligations under its Privacy Policy or an applicable data processing agreement.

By using the Services under such an agreement, the Customer agrees to this AUP and will cause its Authorized Users to comply with it.

1.2 Defined parties and terms

  • "PineWoodsAI," "we," "us," or "our" means PineWoodsAI LLC.
  • "Customer" means the person or organization that obtains the Services under an applicable agreement, including through an online checkout or order flow that incorporates the applicable terms.
  • "Authorized User" means an administrator, employee, contractor, or named Linear user (or similar seat) whom Customer permits to access or administer Customer's account or subscription.
  • "End User" means a member of the public who interacts with Customer's hosted site, Site Bot, lead form, or other customer-facing feature powered by the Services — not as an Authorized User of Customer's account.
  • "Services" means the PineWoodsAI offerings covered by the incorporating agreement, which may include pinewoodsai.com-related sites, Athena Prime, the Relational Intelligence Fabric ("RIF"), HealthSphere and related wellness offerings, AugSite (hosted websites, Site Bot, Augmented Experience Optimization ("AEO"), lead capture, integrations), AugSvcs, and other offerings that reference this AUP.
  • "Customer Content" means content, data, materials, prompts, files, code, images, text, leads, conversations, configurations, and other materials submitted, uploaded, published, hosted, or processed by or on behalf of Customer through the Services, including information submitted by End Users through Customer-facing features.
  • "Outputs" means information, text, recommendations, bot responses, insights, or other results generated by AI or automation features of the Services.
  • "Approved Wellness Data" means physiological, activity, sleep, nutrition, and wellness information that the relevant HealthSphere, Athena, or related product is specifically designed and documented to accept through its designated workflows. Approved Wellness Data does not include genetic test files, raw genomic data, or genetic reports, which require separate written approval under Section 5.4.
  • "Biometric Identification Data" means face geometry, voiceprints, fingerprints, iris or retina scans, and similar data used to identify or authenticate a particular person.
  • "Protected Health Information" or "PHI" has the meaning provided in 45 C.F.R. § 160.103, as amended. Health or wellness information is not necessarily PHI merely because it concerns an individual's health.
  • "Business Day" means Monday through Friday, excluding U.S. federal holidays.
  • "Personal Information" has the meaning stated in the applicable Privacy Policy or data processing agreement.

2. Customer and Authorized User Responsibilities

2.1 Age and eligibility (Customer and Authorized Users)

If Customer is an individual, Customer must be at least 18 years old. Each Authorized User must also be at least 18 years old, and Customer may not designate an Authorized User who is under 18.

End Users. The 18+ requirement in this Section does not automatically prohibit every visitor under 18 from interacting with a Customer's public AugSite website. Separate rules for minors and child-directed sites appear in Section 5.3.

2.2 Account security

Customer is responsible for:

  • safeguarding credentials, payment methods, Linear seats, admin access, and API keys;
  • ensuring Authorized Users know and follow this AUP;
  • all activity under Customer's accounts and hosted properties, except to the extent directly caused by PineWoodsAI's breach of its security obligations or a PineWoodsAI security failure;
  • not sharing credentials except through approved account functions;
  • using multifactor authentication where offered; and
  • promptly notifying PineWoodsAI at arch@pinewoodsai.com of suspected compromise.

PineWoodsAI may reset credentials or disable access when compromise is reasonably suspected.

2.3 Lawful use

Customer will use the Services only for lawful purposes and in accordance with this AUP, the applicable incorporating agreement, and applicable law (including privacy, consumer protection, intellectual property, computer-crime, export, and sanctions laws). Customer will not encourage, assist, or enable others to violate this AUP.

2.4 End User misuse

Customer will not knowingly permit or enable End Users to use Customer-facing features in violation of this AUP and will take reasonable corrective action after becoming aware of misuse. Customer is not strictly responsible for unauthorized End User conduct that Customer did not know about and could not reasonably prevent.

3. Illegal, Fraudulent, Harmful, and Exploitative Uses

Customer and Authorized Users may not use the Services to:

  • violate any applicable law or regulation, or encourage others to do so;
  • engage in fraud, identity theft, phishing, social engineering, advance-fee schemes, or other deceptive practices;
  • threaten, stalk, harass, abuse, defame, dox, or invade another's privacy or publicity rights;
  • engage in unlawful discrimination or hateful abuse based on protected characteristics;
  • exploit, groom, harm, or attempt to exploit or harm minors, or create or distribute child sexual abuse material ("CSAM");
  • engage in human trafficking or sexual exploitation;
  • create or distribute, or threaten to create or distribute, nonconsensual intimate imagery or nonconsensual synthetic sexual imagery;
  • encourage suicide, self-harm, eating disorders, or dangerous challenges;
  • make credible threats of violence or provide instructions to commit violent wrongdoing;
  • create deceptive deepfakes or impersonations intended to defraud;
  • traffic in illegal goods or services;
  • facilitate money laundering, sanctions evasion, terrorism financing, or proliferation-related activity; or
  • use the Services in or for the benefit of parties restricted under applicable U.S. export or sanctions rules, except as authorized by law.

4. Security Abuse and Unauthorized Access

Customer and Authorized Users may not:

  • probe, scan, or test vulnerability of any system or network, or otherwise conduct testing, scanning, exploitation, or access beyond ordinary use, except as expressly permitted by a published Vulnerability Disclosure Policy or prior written authorization from PineWoodsAI (see Section 11);
  • bypass, disable, defeat, or interfere with security, authentication, encryption, rate limits, or access controls;
  • access accounts, data, tenants, or systems without authorization;
  • upload, transmit, or distribute malware, viruses, ransomware, worms, Trojan horses, spyware, or other harmful code;
  • disrupt, degrade, overload, or interfere with the Services or others' use (including DDoS, traffic flooding, or abusive automation);
  • mine cryptocurrency or run similar high-intensity workloads on shared infrastructure unless we expressly agree in writing;
  • use Site Bot, lead capture, or other conversational features to collect passwords, one-time authentication codes, payment-card security codes, account-recovery secrets, or similar credentials; or
  • collect Social Security numbers, government identifiers, full payment-card numbers, or comparably sensitive data through the Services unless PineWoodsAI has expressly approved the use case in writing and configured an appropriate collection workflow.

5. Privacy, Sensitive-Data, and Health-Data Restrictions

5.1 Biometric Identification Data

Customer and Authorized Users may not use Biometric Identification Data through the Services to identify or authenticate a person, infer sensitive traits, categorize individuals, or conduct surveillance, except where a specific PineWoodsAI feature is expressly designed and separately approved for that purpose under a written enterprise agreement.

5.2 Approved Wellness Data (HealthSphere / Athena)

Nothing in this AUP prohibits Customer or Authorized Users from submitting Approved Wellness Data through designated HealthSphere, Athena, or related product workflows that are specifically designed to accept that data, subject to the applicable Terms, Privacy Policy, and product documentation.

Approved Wellness Data (for example, heart rate, HRV, sleep metrics, activity, nutrition, and similar non-genetic wellness signals accepted by the product) is not automatically PHI and is not automatically Biometric Identification Data. These concepts are distinct.

5.3 Minors and child-directed sites (AugSite and similar)

Customer may not operate a website or online service directed to children under 13, or knowingly collect Personal Information from children under 13 through Site Bot, lead capture, or similar features, without PineWoodsAI's prior written approval and any required configuration.

Absent such approval, Customer will not target the Services to children under 13 or knowingly collect Personal Information from them through the Services. Customer remains responsible for its own compliance with the Children's Online Privacy Protection Act and Rule ("COPPA") and similar obligations applicable to its sites and audiences. PineWoodsAI approval does not relieve Customer of those obligations.

5.4 Protected Health Information; genetic data

PineWoodsAI does not accept PHI through the Services unless PineWoodsAI has expressly approved the use case in a separate written enterprise agreement and has confirmed that the applicable Service has been configured for that use.

Genetic test files, raw genomic data, and genetic reports require separate written approval and configuration; they are not Approved Wellness Data.

Absence of a Health Insurance Portability and Accountability Act ("HIPAA") / business associate agreement ("BAA") relationship does not mean consumer health or wellness data is unregulated. Customer remains responsible for its own compliance with applicable federal and state consumer-health and similar obligations arising from data Customer collects, uses, or directs PineWoodsAI to process.

5.5 Professional advice and Outputs

Customer may not represent Outputs as diagnoses, prescriptions, clinical decisions, personalized legal advice, investment recommendations, or other personalized professional advice, or use Outputs as a substitute for the independent judgment of an appropriately licensed professional, unless the requirements of this Section are satisfied.

Generally informational content based on Customer-approved materials is permitted, provided it is not misleading and complies with applicable law and required disclosures. Administrative intake, appointment scheduling, contact collection, and routing do not by themselves constitute professional advice. Personalized professional conclusions via the Services are prohibited unless separately approved in writing.

Any exception under this Section requires a separate written agreement, use by appropriately licensed or otherwise authorized persons where required, compliance with applicable law, and implementation of safeguards agreed by PineWoodsAI. PineWoodsAI approval does not independently authorize conduct prohibited by law.

Do not use the Services for emergency medical or mental-health situations. In the United States, contact 911 or 988; elsewhere, contact the appropriate local emergency service.

6. AI and High-Impact-Use Restrictions

6.1 Validation and oversight

Outputs may be inaccurate, incomplete, biased, or unexpected. Customer must implement reasonable testing, review, monitoring, disclosure, escalation, and human-oversight measures appropriate to the use case before deploying or materially relying on Outputs. Customer is responsible for reviewing material Outputs used in business, health, legal, financial, or other consequential contexts.

6.2 Prohibited AI misuse

Customer and Authorized Users may not:

  • use AI features to generate content for purposes prohibited elsewhere in this AUP;
  • attempt to discover, extract, expose, or circumvent non-public system instructions, security controls, proprietary prompts, orchestration logic, model configurations, or data belonging to PineWoodsAI or another person;
  • knowingly submit others' confidential information to AI features without authority; or
  • represent Site Bot or another AI system as a human where that would be deceptive. Customer will retain any PineWoodsAI-provided AI disclosure on customer-facing bots.

6.3 High-impact / consequential decisions (default prohibition)

Customer may not use the Services or Outputs to make, recommend, materially influence, or serve as a substantial factor in decisions concerning employment, housing, credit, lending, insurance, education admissions, healthcare eligibility or treatment, legal services, immigration, criminal justice, law enforcement, public benefits, or access to essential goods or services, except under a separate written agreement expressly authorizing that use.

Any such exception requires a separate written agreement, use by appropriately licensed or otherwise authorized persons where required, compliance with applicable law, and implementation of safeguards agreed by PineWoodsAI. PineWoodsAI approval does not independently authorize conduct prohibited by law. Human review alone does not authorize such use under this AUP.

7. Spam, Scraping, Automation, and Competitive Misuse

Customer and Authorized Users may not:

  • send unlawful, deceptive, abusive, or otherwise noncompliant advertising, marketing, or promotional communications through the Services, including communications sent using unlawfully harvested lists or without consent where consent is required by applicable law (including via lead capture, email, or messaging features);
  • scrape, harvest, crawl, spider, or extract data from the Services except (a) as we expressly allow in writing, (b) via documented APIs for Customer Content Customer is entitled to access, or (c) as required by law;
  • reverse engineer, decompile, or disassemble the Services except to the limited extent such restriction is prohibited by law;
  • without authorization, systematically extract, scrape, or use non-public elements of the Services—including proprietary prompts, schemas, embeddings, model configurations, or orchestration logic—to build or materially improve a substantially similar competing platform;
  • frame, mirror, or manipulate display of the Services in a misleading way;
  • create a false identity to mislead others; or
  • circumvent technical or usage limits stated in the applicable agreement, order form, subscription tier, or product documentation.

Ordinary lawful business-to-business ("B2B") outreach that complies with applicable law is not automatically prohibited solely because it is unsolicited; unlawful or abusive spam is prohibited.

Commercial scope and licensing matters (including source-code handoff, customer-owned infrastructure, out-of-scope products, and resale or white-label rights) are governed by the applicable Terms, order form, IP or license provisions, or reseller agreement—not by this AUP. Unauthorized access, copying, or circumvention remains prohibited under Sections 4 and 7.

8. AugSite and Hosted-Property Restrictions

8.1 Hosting and Site Bot abuse

Customer and Authorized Users may not use AugSite to:

  • publish or facilitate phishing pages, malware distribution, scam funnels, counterfeit-goods storefronts, or credential harvesting;
  • operate open proxies, anonymizing exit nodes, or similar abuse on AugSite infrastructure;
  • use Site Bot or lead capture to collect personal data unlawfully, without required notices or consent, or for deceptive purposes;
  • configure Site Bot to present unlawful or infringing content, present information Customer knows is false as verified fact, or deploy material factual claims without reasonable testing and oversight appropriate to the use case; or
  • use custom integrations or APIs to exfiltrate data Customer is not entitled to, or to attack third-party systems.

8.2 High-risk regulated categories (prior written approval)

Without PineWoodsAI's prior written approval (and proof of required licenses where applicable), Customer may not use AugSite to offer, advertise, facilitate, sell, broker, distribute, or process transactions relating to:

  • firearms, ammunition, or regulated weapons;
  • cannabis or controlled substances;
  • gambling;
  • sexually explicit services or content;
  • consumer lending, securities, money transmission, virtual currency, debt relief, or other regulated financial services;
  • clinical healthcare delivery;
  • candidate, political committee, ballot-measure, or regulated political-fundraising activity; or
  • alcohol or tobacco sales.

A healthcare provider's ordinary marketing site is not automatically "clinical healthcare delivery." Diagnosis, treatment, clinical intake, patient portals, or processing clinical records are closer to the restricted category.

Customer-specific restrictions may appear in an order form. Generally applicable new high-risk categories will be added through Section 12.

8.3 Customer Content and End User responsibilities

As between the parties, Customer retains all rights it lawfully holds in Customer Content. Personal data of End Users is not simply "owned" property; End Users retain privacy and other rights under applicable law.

Customer is responsible for:

  • content Customer supplies and instructions Customer gives PineWoodsAI;
  • Customer's privacy notice and legal basis for End User data collection;
  • how Customer uses leads, transcripts, and Site Bot conversations;
  • obtaining necessary rights and consents; and
  • laws applicable to Customer's business and audience (including marketing rules where relevant).

Nothing in this AUP limits PineWoodsAI's obligations under applicable law, the Privacy Policy, an applicable data processing agreement, or the incorporating agreement. PineWoodsAI's handling of Personal Information, use of service providers, security responsibilities, and incident-response obligations are governed by those documents and applicable law.

We may remove, disable, or refuse to host Customer Content, or suspend hosting, under Section 10 when we reasonably believe it violates this AUP, the applicable incorporating agreement, applicable law, or third-party rights, or creates material security, reputational, or operational risk.

Customer should maintain its own copies of Customer Content. Where applicable law requires a data processing agreement or service-provider addendum, the parties must execute the applicable agreement before the relevant processing begins.

9. Shared-Resource Limits

Customer will comply with technical and usage limits stated in the applicable agreement, order form, subscription tier, or product documentation. PineWoodsAI may impose reasonable temporary limits when necessary to protect security, availability, shared infrastructure, or other customers.

Circumventing those limits, creating multiple accounts to evade caps, or imposing load that materially degrades service for others violates this AUP. We may throttle, queue, or suspend abusive workloads.

10. Monitoring, Investigation, and Enforcement

We may investigate suspected violations. We are not obligated to monitor all Customer Content, but we may act when we become aware of an issue.

10.1 Immediate protective action

We may immediately suspend access, disable content, or isolate systems when we reasonably believe conduct:

  • is illegal;
  • creates an imminent security or safety risk;
  • involves fraud, malware, phishing, credential theft, CSAM, sanctions evasion, or material privacy violations;
  • threatens other customers or infrastructure; or
  • could expose PineWoodsAI to significant legal liability.

10.2 Curable violations

For ordinary, non-urgent violations, PineWoodsAI will ordinarily provide notice and a reasonable opportunity to cure before suspension or termination, unless cure is impracticable or continued access creates material legal, security, safety, operational, or reputational risk.

10.3 Termination

PineWoodsAI may terminate Customer's access for a material or repeated violation of this AUP, failure to cure after notice where a cure opportunity applies, or an immediate-action violation under Section 10.1 that is serious enough to justify termination.

10.4 Notice and appeal

Where feasible and lawful, we will try to notify Customer's technical or billing contact before or promptly after material enforcement — except where notice would risk harm, compromise an investigation, or is legally restricted.

Customer may request reconsideration by emailing arch@pinewoodsai.com within ten (10) Business Days of notice of suspension or termination, with a brief explanation and cure plan. We are not required to restore access while a security or safety risk continues. PineWoodsAI's determination following reconsideration is final, except to the extent applicable law or the incorporating agreement provides otherwise.

10.5 Reporting to authorities and rights holders

We may report activity to law enforcement, regulators, or rights holders where legally permitted and reasonably necessary, and subject to the Privacy Policy and applicable law. A rights holder does not automatically receive Customer identity or account data merely by submitting a complaint.

PineWoodsAI will make reports to the National Center for Missing & Exploited Children ("NCMEC"), law enforcement, or other authorities and preserve relevant materials to the extent required by applicable law. Nothing in this AUP requires PineWoodsAI to monitor or affirmatively search all Customer Content.

11. Reporting Abuse; Copyright and DMCA

Abuse and AUP reports; security and vulnerability reports: arch@pinewoodsai.com

Please include URLs, account or site identifiers, date and time with timezone, a short description, and your contact information when possible.

Good-faith vulnerability reports are welcome at arch@pinewoodsai.com. Testing, scanning, exploitation, or access beyond ordinary use is not authorized unless expressly permitted by a published Vulnerability Disclosure Policy or prior written authorization from PineWoodsAI.

Copyright complaints, counter-notices, and repeat-infringer procedures are governed by our Copyright and Digital Millennium Copyright Act ("DMCA") Policy.

Other rights complaints (trademark, publicity, and similar) may be sent to arch@pinewoodsai.com.

We may review reports and take action in our discretion consistent with the applicable Terms and law. Submission of a report does not create a contractual duty to take a particular action or respond within a particular period.

12. Changes

Revisions to this AUP apply prospectively from the posted effective date. We will retain archived versions where practicable.

For material changes, we will provide notice as required by the applicable incorporating agreement, which may include email, Linear, an in-product notice, or another reasonably conspicuous method. We will obtain affirmative acceptance where required by applicable law or the incorporating agreement, or where PineWoodsAI determines that affirmative acceptance is appropriate.

Continued use after the effective date constitutes acceptance only to the extent permitted by the applicable agreement and law.

13. Dispute Resolution

Governing law, venue, arbitration, and other dispute-resolution requirements are governed by the applicable Terms or signed agreement that incorporates this AUP. This AUP does not itself create arbitration, forum, or class-waiver terms.

14. Contact

PineWoodsAI LLC
8 The Green #8292
Dover, DE 19901
Email: arch@pinewoodsai.com

For AugSite support tickets, use Customer's Linear team where one has been provisioned.

Appendix A — Quick Examples (Non-Exhaustive)

| Generally allowed (if otherwise lawful and within plan or approval) | Not allowed | |---|---| | Hosting a business marketing site on AugSite | Hosting phishing or malware landing pages | | Site Bot on Customer-approved informational content | Site Bot collecting passwords or card security codes | | Lead capture with clear notice and lawful basis | Harvested-list or deceptive spam via lead tools | | Approved Wellness Data in HealthSphere workflows | Using Biometric Identification Data for identification or surveillance | | Educational Athena or RIF exploration | Presenting Outputs as a medical diagnosis | | Lawful compliant B2B outreach | Unlawful or abusive spam | | Documented API access to Customer's entitled content | Unauthorized scraping to build a competing platform | | Approved child-directed site with required configuration and compliance | Child-directed Site Bot or leads without approval | | Approved regulated use with required licenses and compliance | High-risk regulated use without approval (see §8.2) |