mDOS Acceptable Use and AI Policy
This Policy replaces and expands section 14 (Acceptable Use) of Version 2.2 of our Terms of Service and is published at mdos.ai/acceptable-use.
1. About this Policy
1.1 This Acceptable Use and AI Policy (the Policy) sets out the rules for using mDOS (the Platform), provided by MDOS AI Ltd, a company registered in England and Wales with company number 17526969 and registered office at 3 Warren Close, Brighton, BN2 6DT, United Kingdom (MDOS, we, us). "mDOS" is a trade mark of MDOS AI Ltd.
1.2 This Policy forms part of the mDOS Terms of Service (the Terms). Words defined in the Terms have the same meaning here. If there is a conflict, the Terms prevail, except that the stricter rule applies to any matter of lawful marketing or data protection.
1.3 This Policy applies to every customer, Authorised User, Partner Agency, Certified Coach and reseller client using the Platform (you). Customers are responsible for making sure everyone using their Account follows it. Resellers must flow this Policy down to their clients.
1.4 This Policy is not legal advice. You are responsible for knowing and complying with the laws, codes and platform rules that apply to your business, sector and the countries where your recipients are. If you are unsure, get professional advice before you send or publish.
1.5 Report breaches of this Policy, or content you believe breaks it, to legal@mdos.ai. Report security issues to security@mdos.ai.
2. General rules
2.1 You must use the Platform lawfully, honestly and in a way that does not harm MDOS, other customers, recipients of your messages, your customers, or the public.
2.2 You must not use the Platform to break, or help anyone else break, any law or regulation, including laws on data protection, privacy, electronic marketing, consumer protection, advertising, intellectual property, equality, health and safety, financial services, licensing, sanctions and export controls.
2.3 You must comply with the terms and policies of any Third-Party Service you connect or use through the Platform, including Stripe, Google, Meta, LinkedIn, Twilio, Resend, Apollo and Shopify.
3. Prohibited content
3.1 You must not create, upload, store, publish, send or generate through the Platform any content that:
(a) is illegal, or promotes, facilitates or encourages illegal activity; (b) depicts, promotes or relates to the sexual abuse or exploitation of children in any way; (c) promotes terrorism or violent extremism, or incites violence; (d) is hateful, harassing, threatening, abusive or discriminatory on the basis of race, ethnicity, religion, disability, sex, sexual orientation, gender identity, age or any other protected characteristic; (e) is sexually explicit or pornographic; (f) is defamatory, or invades privacy, or discloses personal data without a lawful basis; (g) infringes any copyright, trade mark, database right, design right, image right or other intellectual property right, including using third-party logos, music, photographs or brand names without permission; (h) is false, misleading or deceptive, including misleading prices, hidden or "drip" fees, fake urgency or scarcity, false claims of awards or endorsements, or misleading environmental claims; (i) contains, links to or distributes malware, viruses, ransomware, spyware or phishing pages; (j) impersonates any person, business, brand or public body, or falsely implies an endorsement or affiliation; (k) is a fake review, a review written or commissioned to look independent when it is not, or a concealed incentivised review; (l) promotes or sells illegal drugs, controlled substances, weapons, counterfeit goods, or goods or services that require a licence you do not hold; (m) promotes unlicensed gambling, pyramid or multi-level marketing schemes, get-rich-quick schemes, or unregulated financial products; (n) promotes prescription-only medicines to the public, or makes unauthorised medical claims; (o) targets or is likely to appeal particularly to children in connection with alcohol, gambling, high fat, salt or sugar products, or other age-restricted goods or services; (p) is designed to exploit people's vulnerabilities due to age, disability, financial hardship or social or economic situation.
3.2 You must not use our payment, shop, voucher or membership features for any business type listed as restricted or prohibited by Stripe, or for any purpose Stripe would not permit.
4. Prohibited conduct
4.1 You must not:
(a) use the Platform to build, train or benchmark a competing product, or copy its features, user interface, AI Team configurations or prompts; (b) reverse engineer, decompile, disassemble or try to extract source code, model weights or system prompts, except where the law expressly allows it; (c) resell, sublicense, rent or share access to the Platform except as permitted under a Partner Agreement; (d) create multiple Accounts or Workspaces to get round Fees, Fair Use Allocations, suspensions or sending limits; (e) use automated tools, bots or scripts to access the Platform other than through features or APIs we provide, or exceed rate limits; (f) scrape or harvest data from websites, social networks or other services through the Platform in breach of their terms or the law; (g) generate artificial traffic, clicks, impressions, followers, reviews or engagement; (h) interfere with or disrupt the Platform, its infrastructure, or other customers' use of it; (i) use the Platform to stalk, monitor or track individuals; (j) use the Platform in a way that would make MDOS breach any law, or the terms of any of our suppliers.
5. Email, SMS and outreach rules
General principles
5.1 You are the sender. You choose who you contact and why, and you are responsible for the lawful basis for each message. MDOS provides the tools only.
5.2 Know which rules apply. The rules depend on where the recipient is and what kind of recipient they are, not only on where you are. At a minimum:
(a) UK: UK GDPR, the Data Protection Act 2018 and PECR, each as amended by the Data (Use and Access) Act 2025 to the extent in force; (b) EU: EU GDPR and national ePrivacy laws, which are often stricter for B2B email than the UK; (c) US: the CAN-SPAM Act for email, the Telephone Consumer Protection Act (TCPA) and state laws for SMS and calls, and state privacy laws; (d) Canada: Canada's Anti-Spam Legislation (CASL), which generally needs consent even for B2B email; (e) other countries' laws where you send to recipients there.
Marketing to individuals (consumers, sole traders and some partnerships)
5.3 Under PECR, you may only send marketing emails or SMS to individual subscribers (consumers, sole traders and, except in Scotland, partnerships) if:
(a) they have given you specific, informed, freely given consent to receive that marketing from you; or (b) the soft opt-in applies: you got their details in the course of a sale or negotiation for a sale of your goods or services, you are marketing your own similar goods or services, and you gave them a clear and simple chance to opt out when you collected their details and in every message.
5.4 Consent must be recorded. You must be able to show when, how and what each person consented to. Pre-ticked boxes, bundled consent and "consent" as a condition of a booking or Wi-Fi access are not valid.
5.5 If you use the WiFi portal, booking forms or lead magnets to collect marketing consent, you are the controller. You must show privacy information, offer a genuine choice, and honour each person's choice.
Marketing to businesses (corporate subscribers)
5.6 Under PECR, B2B email to corporate subscribers (limited companies, LLPs, Scottish partnerships and public bodies) does not need prior consent. However:
(a) where the email address identifies an individual (for example jane.smith@company.com), UK GDPR still applies. You need a lawful basis, usually legitimate interests, and must have assessed it; (b) you must identify yourself, give a valid address for opt-outs, and stop if the person objects; (c) the message must be relevant to the recipient's professional role; (d) EU, Canadian and other national laws may need consent even for B2B email.
Content and identification requirements for every marketing message
5.7 Every marketing email and SMS you send through the Platform must:
(a) clearly identify you as the sender, and not disguise or conceal your identity; (b) include a working, free and simple way to opt out (the Platform's unsubscribe link or STOP keyword), which must not be removed, hidden or bypassed; (c) have honest "From", "Reply-To" and routing information and subject lines that are not misleading; (d) for email to US recipients, identify the message as an advertisement where CAN-SPAM requires it and include a valid physical postal address; (e) comply with advertising codes, including the CAP Code.
5.8 Opt-outs. The Platform keeps a suppression list. You must not remove contacts from it, re-import suppressed contacts, or send to them from another tool using data exported from the Platform. Opt-outs must take effect promptly and in any event within the time required by law (for example 10 business days under CAN-SPAM).
Contact lists
5.9 You must not upload or send to purchased, scraped or harvested lists of contacts. If you rent a list or use a third-party list, you must first check that the consent or lawful basis covers marketing by you, by name, through the channel you will use, and keep evidence of those checks.
SMS and WhatsApp
5.10 For SMS and WhatsApp you must:
(a) have the consent or soft opt-in required for each recipient; (b) for US recipients, have prior express written consent where the TCPA requires it, respect state quiet hours and comply with carrier rules for A2P messaging; (c) send at reasonable times (we recommend between 8am and 8pm in the recipient's time zone) and not send excessive volumes; (d) comply with WhatsApp Business policies, including approved message templates; (e) include opt-out instructions.
SMS send costs are recharged at cost, as set out in the Terms.
Calls
5.11 The Platform's AI phone receptionist is for inbound calls. You must not use the Platform to make automated or AI-voiced outbound marketing calls, which under PECR require prior consent. You must not use it to make live marketing calls to numbers registered with the TPS or CTPS without consent.
Cold email and outreach limits
5.12 Cold outreach is limited to 40 outreach emails per campaign per day, across no more than 3 connected sending domains per Workspace, unless we agree a higher limit with you in writing. We may apply lower limits during domain warm-up.
5.13 You must:
(a) set up and keep SPF, DKIM and DMARC records for each sending domain; (b) use sending domains you own and control; (c) not rotate domains or mailboxes to evade limits, blocks or complaints; (d) comply with mailbox provider bulk sender requirements (such as Google's and Yahoo's), including one-click unsubscribe where required.
5.14 Deliverability thresholds. The Platform pauses sending automatically to protect your domains and ours: an outreach campaign, or every campaign sending from one mailbox, is paused when more than 2.5% of its emails over the last 7 days hard-bounce (once at least 40 have been sent), and an email campaign is paused when spam complaints reach 0.1%. In addition, we may pause sending from a domain or Workspace, without prior notice, if over any rolling 7-day period your:
(a) hard bounce rate exceeds 5%; or (b) spam complaint rate exceeds 0.1%.
We will tell you what happened and help you fix it before sending resumes.
LinkedIn outreach
5.15 LinkedIn outreach runs from your own LinkedIn account and under LinkedIn's User Agreement and Professional Community Policies. LinkedIn may restrict or ban accounts that use automation. You accept that risk. You must keep within the daily limits set in the Platform, which follow LinkedIn's own limits, send personalised and relevant messages, and stop contacting anyone who asks you to.
6. Visitor identification and prospecting rules
Company-level website visitor identification
6.1 The visitor identification feature uses IP intelligence to identify the organisation behind a website visit (for example, "a visitor from Acme Hotels Ltd"). It is designed to identify companies, not individuals. You must:
(a) use it only on websites you own or control; (b) not attempt to identify, or combine visitor identification data with other data to identify, individual visitors, unless you have a lawful basis and have told visitors clearly; (c) only run the tracking script after the visitor has given any consent required under PECR regulation 6 (the cookie and similar technologies rule) through a properly configured cookie consent tool. Analytics-style exemptions introduced by the Data (Use and Access) Act 2025, to the extent in force, do not in our view cover tracking for prospecting purposes; (d) describe visitor identification in your website privacy notice, including the provider types involved; (e) not use the feature to identify visits from residential connections or to profile consumers; (f) not use visitor identification data for decisions that significantly affect individuals.
B2B contact enrichment and prospecting
6.2 B2B contact enrichment (including through Apollo or similar providers) and prospecting features may only be used for business-to-business marketing to people in their professional capacity. You must:
(a) have carried out and recorded a legitimate interests assessment before using enriched contact data for marketing. "Direct marketing" may be a legitimate interest, but you must still balance it against the individual's rights; (b) provide privacy information to each person whose data you obtain from a source other than them (Article 14 UK GDPR), at the latest in your first communication with them and in any event within one month; (c) honour objections immediately and suppress the person permanently; (d) not enrich or prospect consumers, children, or personal (rather than work) contact details; (e) not use enrichment to obtain or infer special category data (such as health, religion, ethnicity, politics, sexual orientation or trade union membership) or criminal offence data; (f) keep enriched data only as long as needed. We recommend deleting prospect records that have not engaged with you within 12 months; (g) comply with the enrichment provider's terms, which may restrict use, storage and re-export.
6.3 B2B contact credits are subject to the Fair Use Allocations in the Terms. You must not export enriched data in bulk to build a separate database or sell it on.
6.4 We are not responsible for the accuracy of enriched data. You must keep records accurate and correct them when told they are wrong.
7. AI-specific rules
Human oversight
7.1 AI Output is a draft until a person approves it. By default, nothing the AI Team produces is published, sent or spent without approval. If you switch on Automatic Mode, you remain responsible for everything it publishes or sends.
7.2 Mandatory human review. You must make sure a suitably qualified person reviews and approves AI Output before it is published or sent, and you must not use Automatic Mode, where it contains or relates to:
(a) health, medical, dental, cosmetic or aesthetic claims, including claims about treatment outcomes, safety, pain or recovery. These must comply with the CAP Code (including the rules on medicines, medical devices, health-related products and beauty and cosmetic interventions) and any guidance from your regulator (for example the General Dental Council, General Medical Council, General Pharmaceutical Council or Nursing and Midwifery Council); (b) prescription-only medicines (for example botulinum toxin). These must not be advertised to the public; (c) nutrition, allergen or dietary claims, including "free-from" and allergen information for food and drink; (d) financial promotions, credit, investments or insurance, which may need approval by an FCA-authorised person; (e) alcohol, gambling or other age-restricted products, which must comply with the CAP Code and, for alcohol, should follow the Portman Group code; (f) environmental or sustainability claims, which must meet the CMA's Green Claims Code; (g) price comparisons, discounts, "from" prices and savings claims, which must be accurate and not misleading, including under the Digital Markets, Competition and Consumers Act 2024; (h) content aimed at or likely to appeal to children; (i) legal, employment or HR statements, and replies to complaints, negative reviews or regulatory matters; (j) comparative advertising that names competitors.
7.3 Review replies. You may use the AI Team to draft replies to genuine reviews. You must not use AI to write, generate or post reviews about your own or a competitor's business, or to suppress, filter or selectively solicit reviews in a misleading way.
Deepfakes, avatars and likeness
7.4 You must not use AI image generation or AI avatar video to:
(a) create deceptive deepfakes: realistic images, audio or video that falsely show a real person saying or doing something they did not, or that falsely depict real events; (b) depict any real person, including staff, customers or public figures, without that person's documented consent; (c) depict or imitate politicians, celebrities or public figures, or create content intended to influence elections or political opinion; (d) depict children; (e) create sexual, violent or degrading imagery of any person; (f) clone or imitate a real person's voice without their documented consent; (g) create fake testimonials, fake customers or fake staff presented as real.
7.5 Avatar and voice consent. Before creating an AI avatar or voice based on a real person (for example your owner, a manager or a team member), you must obtain that person's written consent that:
(a) is freely given (for staff, this means a genuine choice with no detriment for refusing); (b) explains how their likeness or voice will be used, where and for how long; (c) can be withdrawn, after which you must stop using new content and remove existing content within a reasonable time.
You must keep a copy of the consent and give it to us on request. Stock avatars may only be used within the licence terms we display, and not in a way that suggests the avatar is a real customer, patient or member of your staff.
7.6 Labelling AI content. You must not remove, alter or obscure any watermark, label, content credential or metadata that identifies content as AI-generated. Where AI-generated or AI-manipulated image, audio or video content resembles real people, places or events and could reasonably be taken as real, you must label it clearly as AI-generated when you publish it. You must also follow any AI labelling rules of the platform you publish on (for example Meta, TikTok, YouTube or Google Ads).
AI concierge, website chat and AI phone receptionist
7.7 Disclosure that it is AI. The AI concierge, website chat and AI phone receptionist tell people at the start of each interaction that they are talking to an AI system. You must:
(a) keep this disclosure switched on and not hide, contradict or weaken it; (b) not give the AI a human name, persona or voice that suggests it is a person, unless it is also clearly disclosed as AI; (c) answer truthfully if someone asks whether they are speaking to a person; (d) make it easy to reach a human, or to leave a message for one.
7.8 Call recording and transcription. If the AI phone receptionist records or transcribes calls, you must:
(a) tell callers at the start of the call that the call is being handled by AI and recorded or transcribed, and why; (b) have a lawful basis for the recording and transcription, and describe it in your privacy notice; (c) not use recordings or transcripts for marketing unless you have the consent required; (d) set and follow a retention period, deleting recordings and transcripts when no longer needed. We recommend no more than 90 days unless you need them longer for a specific purpose; (e) not process payment card details over AI-handled calls. Card payments must go through Stripe's secure flows.
7.9 Safe configuration. You must configure customer-facing AI with accurate, current information and clear limits. It must not:
(a) give medical, dental, legal or financial advice, or triage clinical symptoms; (b) collect health or other special category data. Limited health information (such as allergies, dietary needs, accessibility needs and answers to booking-related medical history forms) may only be collected through forms designed for that purpose, under your own condition under Article 9 UK GDPR; (c) make binding commitments (such as refunds, guarantees or prices) you have not authorised; (d) be used to collect personal data from children.
For dental, medical and other health clinics, the AI concierge and AI phone receptionist must direct anyone with a clinical question or emergency to a qualified professional or to NHS 111 or 999 as appropriate.
Prohibited and high-risk AI uses
7.10 You must not use the Platform's AI Features for any practice prohibited by Article 5 of the EU AI Act, or equivalent rules elsewhere, including:
(a) subliminal, manipulative or deceptive techniques that distort people's behaviour in a way that causes or is likely to cause significant harm; (b) exploiting vulnerabilities due to age, disability or social or economic situation; (c) social scoring; (d) inferring emotions of staff in the workplace, or of students; (e) biometric categorisation to infer sensitive characteristics; (f) facial recognition or building facial recognition databases.
7.11 You must not use the Platform's AI Features for high-risk uses, including:
(a) decisions about recruitment, promotion, termination, task allocation based on personal traits, or performance monitoring of staff (the rota and staff app must not be used to make such decisions automatically); (b) credit scoring or decisions about access to essential services; (c) any other use listed in Annex III of the EU AI Act; (d) any decision based solely on automated processing that has legal or similarly significant effects on an individual, unless you have put in place the safeguards required by Data Protection Laws.
Inputs and data
7.12 You must not put into AI Features:
(a) special category data, criminal offence data or clinical records. In particular, you must not use health information, or the fields that hold it (including allergies, dietary needs, accessibility needs and medical history form answers), in AI prompts, marketing or advertising. Clinical notes and records must not be stored in the Platform at all; (b) personal data you do not have a lawful basis to use for that purpose; (c) other people's confidential information or trade secrets without permission; (d) payment card data, passwords or secrets; (e) prompts designed to bypass the safety controls of the Platform or of our AI model providers ("jailbreaking") or to extract system prompts.
7.13 You must also comply with the acceptable use policies of our AI model providers, including the usage policies of Anthropic and Google and of any other AI provider listed on our Sub-processors Page, as they apply to content you generate.
8. Security rules
8.1 You must:
(a) keep login details confidential and not share accounts between people; (b) use multi-factor authentication, which is available to all users, for every user with owner, administrator or billing permissions. We strongly recommend it for everyone; (c) give each Authorised User only the role and permissions they need; (d) remove access promptly for people who leave, including seasonal staff and former Partner Agencies and Certified Coaches; (e) keep the devices used to access the Platform, including tills, card terminals and staff phones, secure and up to date; (f) keep API keys, webhook secrets and integration credentials secure and rotate them if they may have been exposed; (g) tell us at security@mdos.ai without undue delay, and in any event within 24 hours, if you suspect unauthorised access to your Account or any security incident involving the Platform.
8.2 You must not:
(a) try to access another customer's Workspace or data, or bypass row-level security, tenant isolation, role-based permissions or authentication; (b) probe, scan or test the vulnerability of the Platform, or carry out penetration testing or load testing, without our prior written consent; (c) upload or transmit malware or malicious code; (d) carry out denial-of-service attacks or deliberately overload the Platform; (e) intercept or monitor traffic that is not yours; (f) use the Platform to host phishing pages, credential-harvesting forms or fake payment pages; (g) store full payment card numbers, CVV codes or card PINs anywhere in the Platform. Card data must only be handled through Stripe.
8.3 Responsible disclosure. If you find a security vulnerability, report it to security@mdos.ai with enough detail for us to reproduce it. Do not access, change or delete data that is not yours, do not disclose the vulnerability publicly until we have had a reasonable time to fix it, and do not disrupt the Platform. We will not take legal action against people who report vulnerabilities in good faith under this clause.
9. Enforcement
9.1 Monitoring. We do not routinely review your content. We may, however, review content, sending metrics, usage and configuration where we reasonably need to in order to operate the Platform, enforce this Policy, respond to complaints, protect deliverability or comply with law, in line with the DPA.
9.2 Actions we may take. If we reasonably believe you have broken this Policy, we may do one or more of the following, acting proportionately to the seriousness of the breach:
(a) contact you and ask you to fix the problem; (b) remove or disable specific content, pages, ads, avatars or AI Output; (c) pause sending from a domain, campaign or Workspace; (d) switch off Automatic Mode, specific AI Features or integrations; (e) suspend your Workspace or Account under the Terms; (f) terminate your subscription for material breach under the Terms; (g) report the matter to the police, regulators (such as the ICO, ASA or CMA), Third-Party Service providers or other appropriate authorities, and cooperate with their investigations.
9.3 Notice. We will normally give notice and a chance to fix the problem before suspension. We may act without notice where there is a risk of serious harm, illegal content, a security threat, harm to deliverability for other customers, or where a Third-Party Service, regulator or law requires it. We will tell you what we did and why as soon as reasonably practicable.
9.4 Resellers, Partner Agencies and Certified Coaches. We may act directly against a reseller client Workspace, or a Partner Agency's or Certified Coach's access to a customer's Workspace, and will tell the reseller or customer.
9.5 Your responsibility. You remain liable for Fees during any suspension caused by your breach. You are responsible for, and indemnify us under the Terms against, claims, fines and losses caused by your breach of this Policy.
9.6 Appeals. If you think we have acted in error, email legal@mdos.ai within 14 days with an explanation. We will review the decision and reply within 10 Business Days.
9.7 No waiver. If we do not act on a breach, that does not mean we accept it or waive our right to act later.
10. Changes to this Policy
10.1 We may update this Policy to reflect changes in law, regulator guidance, Third-Party Service rules or the Platform. We will give at least 30 days' notice of material changes, except where a change is needed sooner to comply with law or to protect the Platform, recipients or the public.