Acceptable Use Policy.

1. Who this Policy applies to

This Policy applies to all use of the SweetNote platform and any service operated by The Sweet Note, Inc., a Delaware corporation (“SweetNote”), including:

• The marketing site at thesweetnote.com and any subdomain (the “Site”)
• The brand-facing dashboard and Insights portal at /clients/
• The recipient-facing reveal page at scan.html (whether reached via thesweetnote.com, a brand-customer subdomain at {brand}.thesweetnote.com, or a Customer-owned domain operated under the brand's own DNS), and the service that forwards a scan to a page the Customer hosts on a direct-delivery study
• The public and authenticated REST APIs, webhooks, and any other programmatic interface SweetNote publishes
• Email, transactional notifications, and any other communication channel SweetNote operates

The terms “you”, “your”, and the “User” throughout this Policy refer to any natural or legal person interacting with the platform in any of the above ways. Where a Customer has signed an MSA, the Customer is responsible for ensuring its own Operators, recipients, and authorized third parties comply with this Policy.

2. Relationship to the MSA, Terms of Service, and DPA

This Policy operates alongside three other documents and does not replace them:

• The Master Services Agreement §3.1 contains a content-specific AUP binding signed brand customers; the present Policy expands that with platform-wide conduct rules binding every User. To the extent there is any conflict between MSA §3.1 and this Policy with respect to a signed Customer's use of the platform, the MSA controls.
• The Terms of Service governs unauthenticated browsing of the marketing site by Visitors, including the public calculator and demo URLs; this Policy supplements those Terms with conduct rules.
• The Data Processing Agreement governs Personal Data processing between SweetNote (as processor) and a signed brand customer (as controller); this Policy does not modify the DPA but does describe conduct that, if engaged in, would also constitute a breach of the DPA.

3. Prohibited content

You may not upload, transmit, store, distribute, or otherwise route through the SweetNote platform any content that:

• Is unlawful under U.S. federal, state, or applicable foreign law, including content that on its face is illegal (child sexual abuse material, content directly incitative of imminent violence, content procuring or facilitating prohibited transactions in regulated goods or services)
• Infringes the copyright, trademark, trade secret, patent, publicity, privacy, or other intellectual-property or personality right of any third party
• Defames, harasses, threatens, or bullies any individual, including content that constitutes “revenge porn,” non-consensual intimate imagery, doxxing, or coordinated targeted harassment
• Targets a protected class for harm or unequal treatment in violation of federal civil-rights law or analogous state and foreign laws
• Is obscene or sexually explicit as those terms are understood under prevailing community standards, or that depicts minors in any sexual context
• Promotes self-harm or constitutes pro-eating-disorder, pro-suicide, or pro-self-injury content
• Promotes or facilitates the unlawful use of controlled substances, weapons, or violence
• Promotes terrorism or violent extremism, or constitutes glorification of organized violence against civilians
• Contains malware, viruses, ransomware, spyware, keyloggers, or other malicious code, or is designed to surveil, manipulate, or compromise the recipient's device
• Includes the likeness, voice, or recognizable personal information of any individual (a sender appearing in a video, an identified third party referenced in an inscription, or an identifiable bystander) for which you do not hold appropriate releases or consents
• Misrepresents the sender's identity, the brand's identity, the nature of the SweetNote moment, or any material fact about the engagement, including by spoofing another brand's identity or impersonating a person
• Constitutes regulated advertising (alcohol, tobacco, cannabis, firearms, gambling, regulated investment products, regulated financial services, regulated pharmaceutical products) without satisfying all applicable disclosure, age-gating, geographic-targeting, and jurisdictional-licensing requirements
• Phishes for credentials, payment information, or any other sensitive information from the recipient
• Carries unreviewed or inaccurate captions: the platform automatically generates a captions track for each video at upload. You are responsible for reviewing the generated transcript (or any replacement .vtt file you supply) before launch so the captions published with your reveal page are accurate and the page meets WCAG 2.1 SC 1.2.2 (Captions for Prerecorded Media)

4. Prohibited conduct

You may not engage in any of the following conduct with respect to the SweetNote platform:

4.1 Automation, scraping, and rate-evasion

• Scrape, harvest, crawl, or otherwise collect data from the Site, the dashboard, the reveal page, or any API endpoint using automated means (bots, spiders, scrapers, headless browsers, residential-proxy networks) beyond what a standard web browser does for an individual visitor loading a single page, except that compliant crawlers from major public search engines are permitted as long as they honor robots.txt and standard rate limits
• Bypass, attempt to bypass, or interfere with any rate limit, captcha, IP-block, geo-restriction, or other access-control mechanism SweetNote has put in place
• Use the platform to train an artificial-intelligence or machine-learning model on SweetNote content, including the methodology specifications, the calculator output, the published research, the dashboard surfaces, or any other content SweetNote authors; this is an express reservation of rights for purposes of any applicable text-and-data-mining exception under EU law and any analogous law

4.2 Security and integrity

• Probe, scan, or test the vulnerability of the platform without prior written authorization from SweetNote; coordinated, responsible-disclosure security research is welcomed under the procedure at /security and is not a violation of this Policy when conducted in accordance with that procedure
• Reverse-engineer, decompile, disassemble, or attempt to derive the source code, training data, model weights, or implementation details of any SweetNote service, except to the extent such activity is expressly permitted by applicable law that cannot be waived
• Use the platform in a manner that could damage, disable, overburden, or impair the platform or interfere with any other User's ability to use it (including denial-of-service attacks, amplification attacks, deliberate resource-exhaustion patterns)
• Use the platform to circumvent, disable, or interfere with security-related features of any SweetNote service (including features that limit usage, copy, or share)
• Introduce any virus, worm, trojan, ransomware, or other malicious code into the platform or use the platform as a vector to deliver malicious code to any third party
• Collect or attempt to collect any other User's credentials, session tokens, signed playback URLs, API keys, webhook secrets, or other authenticating material

4.3 Misuse of the engagement instrument

The integrity of the SweetNote measurement instrument depends on every reveal-page interaction representing a genuine human engagement with a brand moment. The following uses are prohibited:

• Generating, simulating, or scripting reveal-page interactions (scans, video views, reactions, CTA clicks) that do not represent a real human recipient interacting with a real brand moment
• Inducing recipients to scan, watch, react, or click through means inconsistent with the brand's published value proposition (paid micro-task workers, scan-farms, coerced engagement)
• Using a SweetNote campaign as a vehicle for engagement-fraud, traffic-laundering, or any other practice that pollutes a brand's own internal analytics or the SweetNote cross-tenant benchmark
• For Customers running a Gift A/B or Gift Lift methodology: failing to execute the campaign in a manner consistent with the Customer's randomization-honor attestation and the Customer's execution-identical attestation captured at scoping (these attestations are also binding contractual representations under MSA §8.4)
• Manipulating, deleting, or fabricating recipient list data, engagement events, or conversion events to alter the apparent outcome of a study

4.4 Misuse of credentials and access

• Share dashboard credentials, API keys, webhook signing secrets, or signed playback URLs with anyone outside Customer's Operators authorized under the MSA
• Sell, sublicense, or otherwise transfer access to a SweetNote account, the dashboard, or any artifact derived from the platform without prior written authorization from SweetNote
• Impersonate any other User, brand, or person in interactions with SweetNote
• Submit false, misleading, or fraudulent information through any SweetNote form, contract, attestation, or scoping interface

4.5 Recipient-list misuse

• For Customers running a study: upload to SweetNote a recipient list for which the Customer cannot represent and warrant the lawful basis under applicable privacy law, the absence of anyone under eighteen (18) years of age, or any higher age threshold applicable law sets, and the absence of recipients who have previously asked the Customer not to contact them
• Use the SweetNote platform to send a SweetNote moment to a recipient who has unsubscribed from the Customer's communications, opted out of marketing, or is otherwise on a documented suppression list maintained by the Customer
• Combine engagement data exported from SweetNote with third-party data to re-identify recipients in any way that the recipient did not consent to under the Customer's own privacy framework

4.6 Intellectual-property respect

• Use the “SweetNote”, “The Sweet Note”, “BBMR™”, or “Behavioral Brand Moment Research™” marks, the SweetNote logomark, or any methodology name (Snapshot, Cohort, A/B, Gift A/B, Gift Lift) in your own marketing, sales, product, or fundraising materials without prior written permission from SweetNote
• Frame, mirror, republish, or aggregate substantial portions of SweetNote-authored content (methodology specifications, dashboard surfaces, research outputs, calculator outputs, published findings) on a third-party site or in a third-party product without prior written permission
• Remove or obscure any copyright, trademark, patent, or attribution notice that SweetNote includes in any artifact it produces
• Take any action inconsistent with SweetNote's intellectual-property rights in the SweetNote platform and its measurement-instrument architecture, including any pending or future patent application directed to any part of it

4.7 Sub-license and assignment

• You may not assign your rights or obligations under this Policy without SweetNote's prior written consent. SweetNote may assign this Policy in connection with a merger, acquisition, sale of substantially all assets, or by operation of law.

4.8 Pages you host (direct delivery)

Where a Customer’s study forwards each scan to a web page the Customer hosts instead of a SweetNote reveal page (see DPA Section 4A), the Customer must:

• Identify itself on that page, and not present the page as SweetNote’s
• Give the notices and obtain the consents applicable law requires for anything that page collects, and honor recipients’ opt-out signals there
• Keep the page within the content and conduct rules of this Policy
• Keep the page, and the fallback page the study names, reachable through the study’s engagement window

5. Security research

SweetNote welcomes responsible security research and considers good-faith research conducted in compliance with the procedure at /security to be authorized access for purposes of the Computer Fraud and Abuse Act and analogous state laws. To qualify as authorized research, you must:

• Use only your own accounts or accounts you have explicit written authorization to test
• Avoid privacy violations, destruction of data, and interruption or degradation of service
• Not access, modify, or exfiltrate any data other than the minimum necessary to demonstrate the vulnerability
• Promptly report any finding to security@thesweetnote.com with sufficient detail for SweetNote to reproduce
• Allow SweetNote a reasonable period to investigate and remediate before any public disclosure (90 days is the SweetNote default)

SweetNote will not pursue legal action against researchers who comply with this Section. SweetNote does not currently operate a paid bug-bounty program but reserves the right to acknowledge contributors publicly with the researcher's permission.

6. Customer responsibility for downstream Users

Where the User accessing the platform is an Operator, third-party integrator, recipient, or other person acting on behalf of, with the authorization of, or in connection with a signed Customer, the Customer is responsible under the MSA for that User's compliance with this Policy. Customer's failure to control the conduct of its authorized Operators, contractors, and integrators is a breach of this Policy attributable to Customer.

Customer agrees to take reasonable measures (including its own internal acceptable-use policy, role-based access control, periodic credential review, and operator training where appropriate) to ensure that its authorized Users do not engage in conduct prohibited by this Policy.

7. Enforcement procedure

The enforcement framework for breaches of this Policy by signed Customers is set out in MSA §3.1 (notice, cure window, dispute, suspension carveouts). The summary below applies to all Users.

7.1 Standard procedure (notice and cure)

If SweetNote believes you have breached this Policy, SweetNote will notify you in writing (or, for unsigned Visitors, by the most effective channel reasonably available) identifying the specific conduct or content at issue and the provision SweetNote believes has been breached. You will have five (5) business days from the notice to cure the breach or to respond in writing disputing SweetNote's determination. Where you dispute the determination in good faith within the cure window, SweetNote will reconsider in good faith.

7.2 Immediate-suspension carveouts

SweetNote may suspend Services or access immediately and without prior notice in the following cases:

• Content that on its face is illegal under U.S. federal or state law (child sexual abuse material, content directly incitative of imminent violence, content procuring an active criminal transaction)
• Ongoing or imminent material harm to recipients, third parties, or SweetNote infrastructure
• A court or governmental order requiring suspension
• An active and credible threat to the integrity of the platform (active denial-of-service, active exploitation of a vulnerability, active credential-stuffing)
• A repeated, deliberate, or large-scale breach of Section 4 that cannot reasonably be addressed in the normal cure window

7.3 Customer dispute escalation

For signed Customers, disputes about an enforcement determination may be escalated through the notice procedure in MSA §13. Termination for an uncurable breach is governed by MSA §5.

7.4 Indemnification

Breach of this Policy that causes loss or harm to SweetNote, a third party, or another User triggers the indemnification obligations in MSA §10 for signed Customers, and the indemnification obligation in ToU §14 for unsigned Visitors. Specifically: you will defend, indemnify, and hold harmless SweetNote against any third-party claim arising from your breach of this Policy, your violation of applicable law in connection with use of the platform, or your infringement of any third party's intellectual-property or privacy right through your use of the platform.

8. Reporting abuse

To report content or conduct you believe violates this Policy:

• Abuse, harassment, illegal content, or trust-and-safety concerns: security@thesweetnote.com
• Security vulnerabilities: security@thesweetnote.com (also see the responsible-disclosure procedure at /security)
• Copyright infringement: follow the procedure in the DMCA Policy
• Trademark infringement or impersonation: legal@thesweetnote.com
• Recipient-side concern about a SweetNote moment you received: contact the brand that sent it (the brand identifies itself on the reveal page, or on its own page where the code takes you there directly), or contact SweetNote at privacy@thesweetnote.com and we will route the inquiry to the brand under the DPA

SweetNote will investigate reports in good faith. SweetNote may decline to take action on reports that are vexatious, automated, or that fail to identify content or conduct with sufficient specificity. SweetNote reserves the right to retain non-public records of reports and investigations consistent with the retention windows in the DPA.

9. Changes to this Policy

SweetNote may update this Policy from time to time. The current version is always posted at thesweetnote.com/legal/aup.html with an effective date at the top. Material changes affecting signed Customers will be communicated through the dashboard notification system and, where reasonably practical, by email to the Customer's billing contact. Continued use of the platform after a change becomes effective constitutes acceptance of the change. A signed Customer that does not accept a material change may terminate the MSA in accordance with MSA §5.

10. Contact

Questions about this Policy — and any notice to SweetNote under it — should be sent to legal@thesweetnote.com, SweetNote’s designated notice channel.