Acceptable Use Policy

Last Updated: May 12, 2026

This Acceptable Use Policy ("AUP") outlines the rules and guidelines for using {{COMPANY_NAME}}'s platform. Our goal is to ensure a safe, secure, and reliable environment for all our users.

1. INTRODUCTION AND SCOPE

*1.1. Purpose and Incorporation by Reference This Acceptable Use Policy ("AUP") defines the mandatory rules, restrictions, and prohibited conduct applicable to the use of the Provider’s e-commerce Platform, underlying Kubernetes infrastructure, and OVHcloud hosting environments. This AUP is expressly incorporated by reference into the master Terms of Service ("ToS") located at Terms of Service. Any severe violation of this AUP constitutes a material breach of the ToS and grants the Provider the right to execute the immediate suspension or termination protocols defined in Section 11.3(B) of the ToS.*

*1.2. Applicability, Responsibility, and Reasonable Security The restrictions and obligations set forth in this AUP apply universally to:*

  1. The Customer (the entity or merchant holding the SaaS subscription).
  2. All Authorized Users (employees, contractors, or third-party agencies granted access to the Customer's administrative dashboard).
  3. All End-Consumers interacting with, uploading files to, or purchasing goods from the Customer's public-facing digital storefront.

The Customer acts as the sole publisher and legal editor of their digital storefront. The Customer is legally and financially responsible for all actions taken by their internal personnel and Authorized Users.

*End-Consumer Liability & Negligence: The Customer is not automatically held strictly liable for the independent, malicious acts of third-party End-Consumers. However, the Customer assumes an affirmative obligation to implement commercially reasonable security hygiene (e.g., enforcing strong administrative passwords, utilizing CAPTCHAs on public forms, and restricting file upload types). The Customer shall be held liable for an End-Consumer's violation of this AUP only if such violation was facilitated by the Customer's proven negligence, failure to secure their credentials, or failure to act promptly once notified of an ongoing breach.*

*1.3. Affirmative Obligation to Report The Customer acknowledges that the Shared Infrastructure's health relies on mutual vigilance. If the Customer becomes aware of, or reasonably suspects, any violation of this AUP occurring within their Data Plane (e.g., an End-Consumer attempting to upload Malicious Code via a storefront contact form, or a compromised employee account posting prohibited goods), the Customer is legally obligated to immediately notify the Provider's security team at {{SECURITY_EMAIL}} and immediately quarantine the offending content or user.*

*1.4. Right to Modify and Evolve The landscape of e-commerce fraud, cyber threats, and regulatory compliance is continuously evolving. To adequately protect the Shared Infrastructure and comply with emerging laws, the Provider reserves the right to modify, expand, or update this AUP at any time.*

  • *Immediate Effect: Modifications necessitated by urgent security threats (e.g., zero-day vulnerabilities), new legal mandates from French/EU authorities, or updates to international prohibited goods lists shall take effect immediately upon publication.*
  • *Standard Notice: All other commercial modifications to this AUP will be communicated to the Customer with a minimum of fifteen (15) days' prior written notice via the Control Plane dashboard or email.*

The Customer's continued use of the Platform following the effective date of any modification constitutes unconditional acceptance of the revised Acceptable Use Policy.

2. PROHIBITED COMMERCE & CONTENT

2.1. General Prohibition on Illegal Activities

The Customer is strictly and unequivocally prohibited from utilizing the Platform, the Shared Infrastructure, or their specific Data Plane environment to host, sell, distribute, or promote any products, services, or digital content that violate the laws, statutes, ordinances, or regulations of the French Republic, the European Union, or the jurisdictions in which the Customer operates and targets End-Consumers.

2.2. Illegal, Dangerous, and Regulated Goods

To protect the integrity of the Platform and comply with international commerce restrictions, the Customer shall not use their digital storefront to sell, offer, or facilitate the exchange of the following strictly prohibited items:

  1. Weapons and Munitions: Firearms, firearm parts, ammunition, explosives, tactical weapons, and un-regulated blades.
  2. Drugs and Paraphernalia: Illegal narcotics, unapproved or unregulated psychoactive substances, prescription pharmaceuticals without proper medical licensing, and drug paraphernalia.
  3. Hazardous Materials: Toxic, flammable, radioactive, or bio-hazardous materials that violate transport or environmental regulations.
  4. Stolen or Smuggled Goods: Any items that have been illegally obtained, imported without proper customs declarations, or are subject to international embargoes or sanctions.

2.3. Commercial Fraud and Objective Fulfillment Failures

The Provider acts strictly as a technical host and does not editorially monitor the Customer’s chosen supply chain logistics. However, the Provider enforces a strict policy against active fraud and reserves the right to terminate the service due to objective financial inviability:

  1. Objective Financial Inviability (Chargebacks): The Customer's storefront generates a chargeback, payment dispute, or fraud rate that exceeds the maximum acceptable thresholds enforced by the Platform’s integrated payment processors (e.g., Stripe, Payplug). The Parties acknowledge that crossing this threshold—whether due to the Customer's failure to deliver goods, "friendly fraud," or the Customer being the victim of third-party "card testing" attacks—renders the continued processing of payments technically and financially impossible for the Provider.
  2. Active Commercial Fraud: The Customer actively operates deceptive financial schemes, including pyramid schemes, Ponzi schemes, multi-level marketing (MLM) programs, "get-rich-quick" schemes, or the unauthorized sale of equity or securities.
  3. Money Laundering: Structuring transactions, utilizing the storefront to process payments for off-platform services, or any activity designed to obscure the origin of illicit funds.
  4. Regulatory Action: The Provider receives formal injunctions or takedown notices from recognized consumer protection authorities (e.g., the French DGCCRF) regarding the Customer’s deceptive practices.

2.4. Hate Speech, Violence, and Harmful Content

In strict compliance with the French Law on Confidence in the Digital Economy (LCEN) and the EU Digital Services Act (DSA), the Provider strictly prohibits the hosting or dissemination of any content within the Data Plane that:

  1. Constitutes the apology of crimes against humanity, terrorism, or war crimes.
  2. Incites hatred, violence, or discrimination against individuals or groups based on race, religion, ethnic origin, gender, sexual orientation, or disability.
  3. Promotes self-harm, suicide, or eating disorders.
  4. Contains or promotes child sexual abuse material (CSAM) or the exploitation of minors. Note: In accordance with French law, the Provider reserves the right to immediately report any content falling under this section (2.4) directly to the relevant authorities, including the national PHAROS platform, without prior notice to the Customer.

2.5. High-Risk and Payment Processor Restricted Categories

Because the Provider's Control Plane integrates with third-party payment gateways (e.g., Payplug, Stripe) whose terms dictate platform-wide acceptable use, the Customer is strictly prohibited from utilizing the standard SaaS platform to sell the following high-risk categories, unless explicitly pre-approved in writing via a VIP Enterprise Agreement:

  1. Adult Content: Pornography, sexually explicit digital media, and adult-oriented escort services.
  2. Gambling and Betting: Unregulated online casinos, sports betting, lotteries, and games of chance requiring a financial buy-in.
  3. Cryptocurrency and Virtual Assets: Initial Coin Offerings (ICOs), cryptocurrency exchanges, non-fungible tokens (NFTs), or the direct sale of unregulated virtual currencies.
  4. High-Risk Services: Telemarketing services, debt collection, bail bonds, and highly regulated legal or medical consulting services without verifiable credentials.

3. INTELLECTUAL PROPERTY INFRINGEMENT

3.1. Prohibition on Counterfeits and Replicas

The sale of counterfeit goods represents a severe legal and financial risk to the Platform and its payment processing partners. The Customer is strictly prohibited from utilizing their Data Plane storefront to sell, offer, distribute, or promote counterfeit, "replica," "knock-off," or unauthorized derivative products. A product is deemed counterfeit if it illegally mimics the trademark, trade dress, or recognizable design of a genuine brand with the intent to deceive the End-Consumer, or if it is manufactured and sold without the explicit authorization of the intellectual property owner.

3.2. Copyright and Trademark Compliance

The Customer expressly warrants that they own or possess all necessary valid legal licenses, permissions, and rights to use all Customer Data displayed or processed within their Data Plane environment. This includes, but is not limited to:

  1. Product Imagery and Media: Photographs, videos, and promotional graphics.
  2. Text and Descriptions: Product descriptions, blog posts, and marketing copy.
  3. Branding: Trademarks, logos, service marks, and trade names.
  4. Design Assets: Custom digital themes, HTML/CSS code, and digital downloads. The Customer shall not upload or utilize any third-party intellectual property without the explicit, documented consent of the respective rights holder.

3.3. Status as a Hosting Provider (Passive Role)

The Parties acknowledge that the Provider supplies the technical infrastructure (the Shared Infrastructure) and acts strictly as an intermediary hosting service in accordance with Article 6-I-2 of the French LCEN and the EU Digital Services Act (DSA). The Provider is under no general legal obligation to actively monitor the Customer Data to proactively seek out facts indicating illegal activity. The "Good Samaritan" Protection: In accordance with Article 7 of the DSA, the Provider shall not be deemed to have lost its liability exemption as a passive host solely because it deploys automated security algorithms, Web Application Firewalls (WAF), or conducts voluntary, good-faith investigations aimed at detecting, identifying, and removing systemic threats (e.g., malware, DDoS patterns) to protect the Shared Infrastructure.

3.4. Notice and Takedown Procedure (LCEN / DMCA Compliance)

While the Provider does not actively monitor the Customer’s storefronts for IP violations, the Provider complies strictly with international notice-and-takedown frameworks, including the French LCEN and the principles of the US Digital Millennium Copyright Act (DMCA). If the Provider receives a legally compliant, formally drafted notice from an intellectual property owner (or their authorized legal representative) alleging that specific content within the Customer's Data Plane infringes upon their rights, the Provider reserves the absolute right to:

  1. Immediately hide, quarantine, or delete the allegedly infringing product listings or media files without prior notice to the Customer.
  2. Temporarily suspend the Customer's public-facing storefront if the infringement is deemed pervasive or systemic.
  3. Provide the Customer's identity and contact information directly to the complaining rights holder or regulatory authorities, as permitted or required by law.

3.5. Repeat Infringer Policy

The Provider maintains a strict "Repeat Infringer" policy to protect the Shared Infrastructure from continuous legal liability. If the Customer is the subject of multiple valid intellectual property infringement notices, or if the Provider reasonably determines that the Customer's primary business model relies on the recurrent sale of infringing or counterfeit goods, the Provider reserves the right to irrevocably terminate the Customer’s account and permanently delete their Data Plane environment for cause, without liability or refund, in accordance with Chapter 11 of the Terms of Service.

4. SYSTEM & NETWORK SECURITY

4.1. Prohibition of Malicious Code

The Customer is strictly prohibited from introducing, transmitting, hosting, or facilitating the upload of any Malicious Code into the Platform. This includes, without limitation, software viruses, Trojans, worms, ransomware, spyware, logic bombs, or any other destructive scripts designed to interrupt, destroy, or limit the functionality of the Provider’s servers, the underlying Kubernetes orchestrations, or the hardware provided by OVHcloud. The Customer must implement commercially reasonable measures (e.g., reCAPTCHA, input sanitization) on their public storefront to prevent End-Consumers from utilizing the Customer's Data Plane as a vector to upload Malicious Code to the Shared Infrastructure.

4.2. Unauthorized Penetration Testing and Scanning

While the Provider encourages robust security practices, the Shared Infrastructure is a multi-tenant environment where unregulated testing can trigger automated defense mechanisms and degrade performance for other users. Consequently, the Customer shall not execute, nor authorize any third party to execute, any of the following activities against their Data Plane, the Control Plane, or the overarching network:

  1. Penetration Testing: Ethical hacking or exploitation attempts designed to breach the logical isolation of the storefront.
  2. Vulnerability Scanning: The use of automated security scanners (e.g., Nessus, OpenVAS) to probe for open ports or software vulnerabilities.
  3. Load Testing and DDoS Simulation: Generating artificial traffic spikes or executing stress tests designed to measure the capacity or breaking point of the servers. Any such security assessments may only be conducted following the submission of a formal request and the receipt of explicit, prior written authorization from the Provider's security team, subject to strict scheduling and scoping parameters.

4.3. Resource Abuse and Limit Evasion

As established in the master Terms of Service, the Customer's Data Plane operates within strictly defined computational (CPU and RAM allocations) and network ingress/egress quotas to ensure the equitable distribution of resources across the Shared Infrastructure. The Customer agrees not to engage in any activity designed to bypass, exploit, or engineer workarounds to these automated resource limits. Attempting to force a "container breakout" (escaping the Kubernetes namespace assigned to the Customer) or intentionally executing inefficient, infinite-looping database queries designed to monopolize server memory shall be deemed a severe violation of this AUP.

4.4. Network Interference and Unauthorized Access

The Customer must respect the logical isolation boundaries established by the Provider. The Customer shall not engage in, or attempt to engage in, any form of network interference, including but not limited to:

  1. Spoofing: Forging TCP-IP packet headers, IP addresses, or email addresses to disguise the origin of any transmitted data.
  2. Packet Sniffing: Intercepting or monitoring network traffic that is not explicitly destined for the Customer's specific Data Plane.
  3. Lateral Movement: Attempting to access, probe, or interact with the databases ('tenant_db'), object storage, or administrative namespaces belonging to the Control Plane or to other tenants on the Platform.
  4. Reverse Engineering: Attempting to decompile, disassemble, or derive the source code of the underlying SaaS architecture.

4.5. Consequence of Security Violations (Proportionality Principle)

Violations of this Chapter 4 pose an immediate threat to the overarching Platform. However, to ensure proportionality and prevent unjustified commercial harm due to algorithmic false positives, enforcement is strictly tiered:

  1. Automated Precautionary Measures: If the Provider's automated monitoring systems detect an imminent threat (e.g., a massive traffic spike resembling a DDoS attack, or a known malware signature), the system is explicitly authorized to execute immediate, non-destructive interventions. This includes throttling network traffic, shadow-banning IPs, or temporarily isolating the specific container namespace.
  2. Human-Verified Escalation: The Provider's automated systems shall not autonomously execute the irrevocable deletion of a Customer's database (tenant_db) or the permanent termination of the account. Any total suspension of the storefront or permanent termination for a security violation under this AUP requires a prior investigation and verification by a human member of the Provider's technical team to confirm the malicious nature of the anomaly.

5. DATA PRIVACY & ANTI-SPAM

5.1. Protection of Shared IP Reputation

The Platform utilizes shared IP addresses and mail routing infrastructure to deliver transactional and marketing emails on behalf of all tenants. The Customer acknowledges that sending unsolicited or malicious emails negatively impacts the overarching "sender reputation" of the Provider’s infrastructure, which can cause legitimate communications from other tenants to be blocked by global Internet Service Providers (ISPs). The Customer is strictly prohibited from engaging in any activity that could cause the Provider’s IP addresses or domains to be penalized, blacklisted, or rate-limited.

5.2. Anti-Spam and Consent Requirements (GDPR & ePrivacy)

The Customer must adhere strictly to the EU ePrivacy Directive (Directive 2002/58/EC), the General Data Protection Regulation (GDPR), and all applicable national anti-spam legislation (e.g., CAN-SPAM, LCEN). The Customer shall not use the Platform to transmit unsolicited commercial email (UCE) or "spam." Specifically, the Customer agrees to the following mandatory conditions regarding End-Consumer communications:

  1. Explicit Opt-In: The Customer may only send marketing or promotional emails to End-Consumers who have provided explicit, freely given, informed, and unambiguous prior consent (opt-in) to receive such communications.
  2. Prohibited Lists: The Customer is strictly forbidden from importing, utilizing, or sending emails to purchased, rented, scraped, or publicly compiled mailing lists.
  3. Unsubscribe Mechanism: Every commercial email sent through the Platform must contain a clear, conspicuous, and fully functional "unsubscribe" or opt-out link. The Customer must honor all opt-out requests immediately.
  4. Accurate Headers: The Customer shall not use deceptive subject lines, forged routing information, or obscured "From" addresses.

5.3. Phishing and Deceptive Practices

The Customer is expressly prohibited from utilizing their Data Plane, storefront, or associated email services to engage in "phishing" or social engineering. This includes the creation of deceptive websites, forms, or emails designed to mimic legitimate brands, banks, or the Provider itself, with the intent of illicitly harvesting End-Consumer credentials, passwords, financial data, or Personally Identifiable Information (PII).

5.4. Data Harvesting and Automated Access (Anti-Scraping)

The Provider acknowledges that public-facing commercial data on a Customer's Data Plane belongs to that Customer. However, to protect the performance of the Shared Infrastructure, the Customer shall not actively deploy, nor explicitly authorize any third party to deploy, automated scripts, scrapers, web spiders, or bots in a manner that:

  1. Imposes Unreasonable Load: Generates an excessively high volume of outbound or authorized inbound automated requests that imposes a disproportionate load on the Provider's Kubernetes cluster.
  2. Harvests Personal Data: Extracts or indexes End-Consumer Data (PII) or Control Plane administrative data in violation of applicable data privacy laws.

Clarification on Third-Party Attacks: The Provider acknowledges that the Customer cannot control unauthorized, malicious third-party scraping attacks directed at their storefront. The mitigation of such unauthorized inbound attacks is the responsibility of the Provider's perimeter security (WAF), and being the victim of such an attack shall not constitute an AUP violation by the Customer.

5.5. Enforcement and Remediation Costs

If the Provider determines, through automated monitoring or third-party ISP complaints, that the Customer is generating spam, utilizing illicit mailing lists, or executing phishing campaigns, the Provider reserves the right to immediately suspend the Customer's emailing capabilities or entirely terminate the Customer's Data Plane without prior notice. In the event that the Customer's violation of this Chapter 5 results in the Provider's IP addresses or domains being placed on a recognized industry blocklist (e.g., Spamhaus, SURBL), the Customer shall be held financially liable for any direct costs incurred by the Provider to remediate the blocklist status, in addition to any applicable damages.

6. ENFORCEMENT, TAKEDOWN, AND REPORTING

6.1. Intermediary Status and the "Good Samaritan" Principle

In accordance with Article 6-I-2 of the French LCEN and the EU Digital Services Act (DSA), the Provider acts strictly as an intermediary hosting service (hébergeur).

  1. No General Monitoring: The Provider is under no general legal obligation to actively monitor, pre-screen, or police Customer Data to seek out illegal activity.
  2. Voluntary Investigations: In accordance with Article 7 of the DSA, the Provider’s status as a passive host is not jeopardized by the use of automated security algorithms or voluntary, good-faith investigations aimed at detecting systemic threats (e.g., malware, DDoS patterns). Such monitoring does not constitute "actual knowledge" of specific illegal content unrelated to infrastructure security.

6.2. Enforcement Actions and Proportionality

If the Provider determines a violation of this AUP, it shall take enforcement actions that are strictly proportionate to the nature, gravity, and duration of the violation.

  1. Targeted Precautionary Measures (Immediate): Upon receipt of a legally valid takedown notice (LCEN/DSA/DMCA) or automated detection of a specific security threat, the Provider shall prioritize targeted intervention. This involves disabling access to or quarantining the specific contested assets (e.g., a single product image or URL) rather than suspending the entire storefront, to prevent the weaponization of notices by competitors.
  2. Temporary Suspension: The Provider may temporarily restrict access to the Control Plane or the public-facing Data Plane only if the violation is systemic, threatens the Shared Infrastructure's stability, or if targeted measures are technically insufficient to contain the risk.
  3. Human-Verified Destructive Measures: The Provider’s systems are strictly prohibited from autonomously executing the "commercial death penalty." Any permanent, irrevocable termination of a Customer’s account or deletion of their tenant_db requires a formal investigation and verification by a human member of the Provider's team, ensuring a "human-in-the-loop" as suggested by the P2B Regulation and GDPR Article 22.

6.3. Cooperation with Law Enforcement and Reporting

The Provider will cooperate fully with recognized law enforcement agencies and judicial authorities:

  1. Mandatory Reporting: The Provider shall proactively report severe violations of law—specifically child sexual abuse material (CSAM) or terrorism—to national authorities (e.g., the French PHAROS platform) in compliance with the DSA.
  2. Legal Process Compliance: The Provider shall comply with valid subpoenas, court orders, or administrative requests for data.
  3. Gag Orders: If legally prohibited by a formal gag order, the Provider will disclose requested data to authorities without prior notice to the Customer.

6.4. Indemnification for AUP Violations

The Customer agrees to bear full financial and legal responsibility for any damages, regulatory fines (including those issued by the DGCCRF or CNIL), or third-party claims levied against the Provider resulting from the Customer’s (or their End-Consumers') violation of this AUP.

6.5. Good Faith Disclaimer

The Provider shall not be held liable for any loss of revenue, data, or commercial opportunity resulting from enforcement actions taken in good faith to protect the Platform’s integrity or to comply with its legal obligations as an intermediary service provider.