Acceptable Use Policy

This Acceptable Use Policy ("Policy") governs your use of the Service as defined in the PMCollab Terms of Service: the web, mobile, and desktop applications, the Microsoft Teams and Microsoft 365 Copilot apps, the VS Code extension, the Claude Code plugins, the PMCollab MCP server, our APIs, and every agent, integration, sandbox, or export that the Service runs on your behalf.

This Policy is part of, and incorporated by reference into, the PMCollab Terms of Service. Capitalized terms not defined here have the meaning given in the Terms. If this Policy and the Terms conflict, the Terms control.

You are responsible for everything that happens under your account, including activity by the people you invite, the participants you admit to a workspace, the credentials and integrations you connect, and the autonomous agents you enable.

You may not upload, generate, store, publish, or transmit through the Service any content that:

• Is unlawful, or that you do not have the right to use, including content that infringes or misappropriates the intellectual property, trade secrets, privacy, or publicity rights of others.

• Is defamatory, harassing, threatening, hateful, or that incites or glorifies violence against any person or group.

• Sexually exploits or endangers minors, in any form.

• Contains malware, or is designed to compromise, damage, or gain unauthorized access to any system, device, network, or data.

• Is deceptive, including impersonating a person or organization, misrepresenting the source of content, or presenting AI-generated material as the verified words of a real person without their consent.

• Is synthetic media created to deceive, including fabricated audio, video, or images of a real person that are presented as genuine, non-consensual intimate imagery of any person, or content produced for a disinformation or coordinated inauthentic campaign.

• You are contractually or legally prohibited from disclosing, including another party's confidential information you have no right to share.

You may not, and may not permit or enable anyone else to:

• Probe, scan, or test the vulnerability of the Service, or breach or circumvent any security, authentication, access-code, rate-limiting, or usage-metering measure, except as permitted in Section 10.

• Access the Service by any automated means other than our documented APIs, MCP server, plugins, and exports, or scrape, crawl, or bulk-extract data from the Service. This does not prohibit authorized operations through our APIs, MCP server, plugins, or exports within their documented permissions and limits.

• Interfere with the integrity or performance of the Service, including by sending excessive requests, deliberately exhausting shared resources, or disrupting another customer's use.

• Share human accounts or personal access tokens with other people, use credentials without authorization, or misrepresent your identity or authority. Customer Agents (as defined in the Terms of Service) and integrations must use credentials issued or authorized for their access and operate within their granted permissions. Supported, authorized delegated access is permitted.

• Create multiple accounts or organizations, or move work between them, to evade plan limits, seat counts, usage-credit allowances, or trial restrictions. Maintaining multiple accounts or organizations for legitimate purposes is permitted.

• Copy, modify, reverse engineer, or create derivative works of the Service or any licensed component it ships with, or resell, sublicense, or offer the Service to third parties as a service bureau, except through a partnership agreement with us.

• Remove, obscure, or alter any proprietary notice, or use our name or marks without written permission.

• Use the Service in violation of any applicable law, including export control, sanctions, anti-spam, privacy, employment, and consumer-protection laws.

The Service generates content and takes actions using AI models, including specifications, code, documents, images, speech, research, reviews, and recommendations. Some features run autonomously and continuously in the background once you enable them. These rules apply to all of them:

• You remain responsible for AI output. AI output can be wrong, incomplete, biased, or out of date. You must review it before relying on it, acting on it, publishing it, shipping it, or presenting it to others as fact. Do not use the Service as the sole basis for a decision that produces legal effects on, or similarly significantly affects, a person (including employment, credit, housing, insurance, healthcare, or access to essential services) without meaningful human review.

• You are responsible for autonomous activity. When you enable an agent, a scheduled sweep, a webhook, or an integration that acts on your behalf, you are responsible for what it does as if you had done it yourself, within the controls the Service gives you. Configure those controls (including source-control write permissions, telemetry content levels, and model panels) appropriately for your organization before enabling the agent.

• Protect and revoke credentials. Keep the accounts, personal access tokens, and other credentials used by you, your Users, and your Customer Agents secure, and revoke them when they are no longer needed or may be compromised. Responsibility for Customer Agents is set out in the Customer Agents provisions of the Terms of Service.

• You may not use AI features to create or distribute malware or exploits; to plan or facilitate violence, weapons capable of mass harm, or other serious harm; to harass, intimidate, or deceive people; to generate spam or coordinated inauthentic activity; or to produce sexual content involving minors.

• Research, browsing, and crawling agents act in your name. Some features browse websites, run web and social searches, crawl sites you point them at, and collect public reviews and competitor signals. Direct them only at sources you are permitted to access, respect those sites' terms and robots directives, do not use them to log into or act on a third-party site without that site's and the account holder's authorization, and do not use them to collect personal information about individuals for surveillance, profiling, or any purpose the source would not permit.

• You may not attempt to manipulate, jailbreak, or prompt-inject our agents, or feed them content designed to make them exceed their authorization, exfiltrate data, or act against another customer, person, or system. Content you connect to the Service (repositories, tickets, messages, documents, meeting transcripts) is read by our agents; you may not seed that content with instructions intended to hijack an agent.

• You may not use the Service, its prompts, or its output to train, fine-tune, distill, or otherwise improve a model or a competing product management or agent platform, or to systematically extract our prompts, agent designs, or evaluation data.

• Prohibited AI practices. You may not use the Service for any practice prohibited by applicable AI law, including Article 5 of the EU Artificial Intelligence Act. In particular, you may not use it to: deploy manipulative or deceptive techniques that materially distort a person's behavior in a way that causes or is likely to cause harm; exploit the vulnerabilities of a person due to age, disability, or social or economic situation; evaluate or classify people based on their social behavior or personal characteristics in a way that leads to detrimental or disproportionate treatment (social scoring); predict the likelihood that a person will commit a criminal offense based solely on profiling or personality traits; build or expand facial-recognition databases through untargeted scraping of images; infer the emotions of a person in a workplace or educational institution; or categorize people by biometric data to infer race, political opinions, religious beliefs, sexual orientation, or trade-union membership.

• High-risk uses. The Service is a product management platform, and its AI features are not designed, tested, or approved for high-risk use. Do not use them as a component of a system that makes or materially informs decisions about a person's access to employment, education, credit, insurance, housing, healthcare, public benefits, or essential services; that operates critical infrastructure, medical devices, vehicles, or weapons; that is used by law enforcement, border control, or the administration of justice or democratic processes; or that would be classified as high-risk under the EU Artificial Intelligence Act or similar law. If you intend to use AI output in such a system, you are solely responsible for the conformity assessment, risk management, human oversight, transparency, and record-keeping that law requires of the provider or deployer of that system.

• Disclosure. Where you use the Service to generate content, interact with people, or make decisions that affect them (including your own customers, participants, and employees), you are responsible for telling those people that AI is involved where applicable law or the reasonable expectations of the person require it, and for labeling synthetic audio, video, and images as artificially generated where law requires it.

• Model providers' terms apply. Our AI features are provided through third-party model providers, and your use of those features must also comply with the applicable provider's usage policies. Where you bring your own provider credentials (Section 6), you are directly bound by that provider's terms.

The Service can connect to systems you control, including source-control hosts (such as GitHub, GitLab, and Azure DevOps), work-tracking and support tools, messaging platforms, meeting and transcript providers, knowledge bases, calendars, CRM and feedback tools, and low-code platforms, to read from them and, where you allow it, to write to them.

• You must have authority to connect a system. Connect only accounts, repositories, channels, tenants, and data sources that you own or are authorized by their owner to connect, and only to the extent your organization's policies and the third party's terms permit.

• Writes are your instruction. When the Service commits code, opens branches or pull requests, posts comments or reviews, merges, dispatches workflows, creates repositories, books meetings, sends messages, or otherwise writes to a connected system, it does so under your authorization and on your behalf. You are responsible for reviewing those changes and for the consequences of merging, publishing, or acting on them. Use the write controls the Service provides to restrict what agents may do in each connected system.

• You are responsible for the data a connection brings in. Content imported from a connected system (including customer conversations, support tickets, source code, and documents) may contain personal information or confidential information. You are responsible for having a lawful basis to process it, for honoring any obligations you owe its subjects, and for not connecting sources you are prohibited from exporting.

• Deployments are yours. When the Service builds and deploys an application into an environment you connect (such as a low-code platform environment, an app-builder project, or a cloud sandbox), you are the owner and operator of what is deployed and are responsible for its security, its licensing, and its compliance with that environment's terms.

• Do not connect a third-party service in a way that violates its terms, exceeds its rate limits, or uses credentials belonging to someone else.

Organizations may configure the Service to run AI features on their own model-provider credentials ("BYOK").

• You may only use credentials you are entitled to use, and you are solely responsible for the spend, quotas, rate limits, data-handling terms, and usage policies of the provider that issued them.

• Calls made on your credentials are not metered against our usage-credit allowances and are not subject to our platform spend controls; monitor them with your provider and with the usage reporting the Service offers.

• Do not configure a model panel so that a person who is not a member of your organization can spend your credentials without your knowledge; use the collaborator and seat controls the Service provides.

• No AI proxying or resale. Whether on our credentials or your own, you may not use the Service as a proxy, gateway, or wrapper to provide model access or AI features to third parties as a service, resell or meter our AI features to others, or use the Service to route traffic that does not originate from your own use of PMCollab.

The Service lets you invite participants (including people without a PMCollab account) into brainstorming sessions, interviews, Q&A sessions, document reviews, and voting; capture live meetings; and import recordings and transcripts from meeting providers.

• Obtain consent where it is required. You are responsible for complying with all laws governing the recording, transcription, and analysis of conversations in every jurisdiction where a participant is located, including obtaining any consent or giving any notice those laws require before you capture or import a meeting.

• Tell participants what is being collected and how it will be used, and do not use participant responses for purposes they would not reasonably expect.

• Do not invite anyone under the age of 18 as a participant, do not collect information from minors through the Service, and do not direct the Service to children.

• Do not use interviews, surveys, or participant sessions to harass, discriminate against, or deceive participants, or to collect categories of data you are not permitted to collect.

The Service is a product management platform. It is not designed to be a system of record for regulated data. Unless we have agreed otherwise in writing, do not submit to or connect with the Service:

• Protected health information subject to HIPAA or equivalent laws.

• Full payment card numbers, bank account credentials, or other financial account data subject to PCI DSS.

• Government-issued identification numbers, biometric identifiers, or precise geolocation of individuals.

• Data subject to export control, ITAR, or classified-information restrictions.

• Secrets and credentials (API keys, passwords, private keys, and tokens), other than those entered into the designated integration and model-connection settings, which the Service stores separately from workspace content. Do not paste secrets into chat, specs, notes, or repository content the Service scans.

If you need to process such data, contact us before doing so.

• Email and messaging. Send invitations, participant links, interview requests, and other messages through the Service only to people with whom you or your organization have an existing relationship or who have agreed to hear from you. Do not use the Service to send unsolicited bulk email, and comply with CAN-SPAM, CASL, GDPR, and similar laws for every message you originate.

• Public sites, live results, and embeds. The Service can publish documentation, specs, and session results to public URLs and to pages you embed in your own product. You are the publisher of that content: you are responsible for its accuracy, for having the rights to publish it, for removing it when you are no longer entitled to publish it, and for not publishing personal information of participants or customers without a lawful basis.

• Capability links. Some links (such as live-results and participant links) grant access to anyone who holds them. Share them only with intended recipients and revoke them when a session ends.

• Test instances. The Service can launch a generated application into a temporary, publicly reachable preview environment. Preview environments are for evaluating your own work; they are not production hosting. Do not use them to serve content that violates this Policy, to run proxies, miners, scanners, or other workloads unrelated to the application under test, or to collect data from the public. Preview environments are short-lived and may be stopped or deleted without notice.

We welcome good-faith security research. If you discover a vulnerability in the Service, report it to us at the address in Section 13 before disclosing it publicly, give us a reasonable time to remediate, and do not access, modify, or exfiltrate data that is not yours, degrade the Service, or test against other customers' data. Testing that follows these rules will not be treated as a violation of this Policy.

Any other penetration testing, load testing, or vulnerability scanning of the Service requires our prior written authorization.

AI features consume usage credits and provider capacity, scans consume compute, and sandboxes and background agents consume shared infrastructure. Plan limits, usage-credit allowances, concurrency caps, and rate limits exist to keep the Service available to every customer. You may not circumvent them, and we may throttle, pause, or decline work that exceeds them or that we reasonably believe is abusive, even if it is otherwise permitted by this Policy.

Promotional, trial, and usage credits are for the account and organization they were issued to. You may not sell, transfer, or trade credits, access codes, or promotional codes; redeem a code you were not offered or that was obtained through unauthorized disclosure; create accounts, organizations, or referrals to collect allowances or promotions more than once; or use an automated process to consume an allowance for the purpose of exhausting it. Credits obtained in violation of this section may be revoked without compensation.

We may investigate any suspected violation of this Policy. Depending on the severity, we may warn you, remove or disable content, suspend an agent, integration, or token, suspend or restrict an account or organization, or terminate the account under the Terms. Where we reasonably believe a violation involves a threat to people, to other customers, or to the Service, we may act without prior notice.

We may also report illegal activity to, and cooperate with, law enforcement and the affected third parties.

If you believe we have taken enforcement action in error, contact us using the information in Section 13.

To report a violation of this Policy, abusive or harmful content, a security vulnerability, or content you believe infringes your rights, contact us at:

Email: support@updates.pmcollab.ai

Mailing Address: 2301 E Pikes Peak Ave Ste 317, Colorado Springs, CO 80909 (El Paso County, Colorado)

We may update this Policy from time to time by posting the revised version on this page and updating the "Last Modified" date. Material changes will be announced in the same way as changes to the Terms.