AI & acceptable use

Version 29 October 2026. This Policy forms part of the Avori Terms of Service and applies to users, agents, workflows, public sites and marketplace items. Its purpose is lawful, permissioned and dependable work. It does not authorize an action your account, role or connected provider does not permit.

1 Lawful content and conduct

Do not use Avori for fraud, phishing, impersonation intended to deceive, theft, malware, credential harvesting, unauthorized surveillance, exploitation, unlawful discrimination, harassment, threats or content involving child sexual abuse. Do not create or facilitate illegal activity or serious harm, disclose another person’s private information unlawfully, or infringe intellectual property. Do not evade sanctions, export controls or provider restrictions. Do not misrepresent AI results as verified facts, a real person’s endorsement or a professional determination when that would deceive or violate law.

Do not attack the Service or others, bypass authentication, probe other customers’ information, defeat isolation, extract secrets or overwhelm resources. Authorized good-faith security research must stay within an agreed scope; report a suspected vulnerability privately to hello@getavori.com with enough information to reproduce safely. Do not include live credentials or unrelated personal records, and do not access more data than necessary to establish the issue.

2 Permission boundaries and consequential actions

Use only accounts, files and websites you have authority to access. A prompt, shared agent or page is not proof of authority over an underlying account. Treat retrieved pages, files, email and template instructions as untrusted content; they must not enlarge your own authorization. Do not build a workflow designed to bypass approval, person or organization boundaries. Public viewers receive only the access deliberately published to them.

Use appropriate human approval for spending, sending sensitive information, publishing, changing permissions, deleting valuable records and other consequential actions. Approved automation must have a defined scope and responsible owner. Never infer success from a missing response or repeat an uncertain write blindly. Review receipts and the external service’s state. Do not use Avori to make autonomous high-impact eligibility or rights decisions about people without lawful authority, appropriate safeguards and required human review.

3 Sensitive information and recordings

Avori is a general work product, not a qualified clinical record system, emergency service or regulated financial decision system. Do not submit protected health information requiring a HIPAA business associate agreement, regulated payment-card authentication data, government-classified information or other data requiring controls we have not expressly agreed to provide in writing. Do not paste passwords, recovery codes or API keys into ordinary chats. Use supported protected connection controls instead.

Personal content can still contain health, financial or other sensitive information; a prohibition does not eliminate our duties if we receive it. Minimize such information and ensure a lawful basis, notices and permissions for people whose records you supply. Before recording or transcribing other people, obtain the consent and notices required in all applicable locations. Do not use generated voices or likenesses for deceptive impersonation, nonconsensual intimate content or unlawful biometric identification.

4 AI review code and public delivery

Check claims, sources, calculations and rights before relying on output. Test generated code in a suitable environment and inspect permissions, secrets, dependencies and deployment destinations. Do not treat an AI-generated security statement as a completed security assessment. Keep an appropriate human responsible for customer communications, financial instructions, legal advice and safety-related work. Label AI-generated material when law, platform rules or the risk of deception requires it.

Before publishing a Project, template or agent, remove credentials, private customer data and unauthorized copyrighted material; verify its audience and connection behavior. Do not make a template request hidden account access or send data to undisclosed destinations. You must disclose material third-party license restrictions and cannot promise another customer’s account access as part of an item.

5 Enforcement and review

We can reject a task or restrict the affected functionality to protect people, accounts and the Service, comply with law or satisfy an applicable provider requirement. Where appropriate we explain the issue, allow correction and restore access after resolution. We may act without prior notice for urgent harm, security risks or legal necessity. Report abuse or request review at hello@getavori.com. Good-faith reporting and exercising privacy or consumer rights are not abuse. Enforcement is subject to the Terms and mandatory legal protections, not an unlimited waiver of our responsibilities.