Acceptable Use Policy

1. Who it applies to

It applies to every use of the Service: the website, the dashboard, the API, the gateway, and tafs. It covers you, the people you let into your account, and every agent that acts through it, whether you built the agent or it is a taf.

An agent's action is your action. A Card, a held call approved by one of your people, or a taf you started does not move the responsibility to us. If an agent does something this policy forbids, you have broken the policy.

2. What you may not do

You and your agents may not use the Service to:

• Break the law, or anyone's rights. Do anything unlawful where you, the people affected, or we operate, or help someone else do it. Infringe anyone's rights, including their intellectual property.
• Act without authority. Act on a system, account or tool you are not authorized to use, or connect a tool with a sign-in that is not yours to give.
• Commit fraud, or move money you have no right to move. Deceive anyone for gain, impersonate a person or business, or pay, refund, transfer or credit funds that you are not entitled to control.
• Break a tool's own terms. Use a third-party tool connected to KIFF in a way its provider's terms forbid, including going past its rate limits or reselling access you may not resell.
• Get around KIFF's decisions. Try to bypass, disable or trick a decision, a Card, a limit or a hold. This includes splitting one action into many to stay under a limit, making a call to a tool directly once KIFF has refused or held it, approving your own agent's held call through a second identity, or forging a receipt.
• Test security without permission. Scan, probe, load-test or attack the Service, another customer, or any system you do not own, unless the owner has agreed in writing. To test KIFF itself, write to security@kiff.dev first.
• Send spam or harass anyone. Send unsolicited bulk messages, or threaten, stalk, bully or abuse a person.
• Handle illegal content. Create, store or send content that is illegal, including child sexual abuse material.
• Spread malware. Create, store or send malware or exploit code.
• Take data that isn't yours. Scrape, mass-export or otherwise extract data beyond your own account, or try to work out another customer's data.
• Copy the Service. Reverse-engineer the hosted Service to build a competing product, or use the Service to develop products or services that compete with it. This does not apply to the open-source framework, which its MIT license governs.

3. What we may do

We do not watch what you send, but we act on what we find and on credible reports. If we believe the policy has been broken, we may, depending on how serious it is:

• refuse a call, a request or a connection;
• suspend an agent, a key, a person's access or the whole account, at once where the harm is serious or ongoing;
• end the account under §9 of the Terms.

We tell you what we did and why. Where we can, we give you a chance to fix the problem first. We don't give notice first when the use is illegal, or when people or money are at immediate risk. We may also report unlawful activity to the authorities.

4. Reporting abuse

If you think someone is using KIFF against this policy, tell us. Say what happened, when, and anything that helps us find it, such as a receipt or a call's reference.

• A security issue or an attack: security@kiff.dev.
• Any other abuse: hello@kiff.dev.

5. Changes

We may update this policy. We give notice of material changes the same way as for the Terms (§16).

Document version: v0.1.
Last updated: 23 October 2026.