A1. Illegal and harmful content
You must not use the Service to create, host, store, transmit or distribute content that:
1Is illegal under Applicable Law, or promotes or facilitates illegal activity.
2Sexually exploits or endangers children in any way. We report such content to the relevant authorities and terminate accounts without notice.
3Infringes or misappropriates any copyright, trade mark, patent, trade secret, privacy or publicity right.
4Is defamatory, harassing or threatening, or incites violence or hatred against any person or group based on protected characteristics.
5Promotes terrorism or violent extremism, or supports a designated terrorist organisation.
6Contains non-consensual intimate imagery, or publishes others' personal data without lawful basis.
7Is designed to deceive, including phishing pages, fake login or payment flows, look-alike sites imitating a real organisation, impersonation, fake invoices, receipts or records, and fabricated reviews or testimonials.
8Offers or facilitates illegal drugs, weapons, explosives, counterfeit goods, stolen data or other unlawful goods or services.
9Spreads malware or deliberately harmful misinformation about health, elections or emergencies.
A2. Prohibited and restricted businesses
You must not use the Service, and in particular payments under Schedule 1 S8, for: Ponzi, pyramid or "double your money" schemes; advance-fee fraud; unlicensed lending, deposit-taking, investment, insurance, foreign exchange or crypto exchange services; unlicensed gambling or betting; sale of personal data or credentials; and any business a Payment Partner prohibits. Regulated businesses (for example fintech, healthtech, betting, telecoms) may use the Service only if they hold every licence their activity requires, and must show it on request.
A3. Security abuse
You must not:
1Distribute, host or command malware, ransomware, spyware, botnets or other malicious code, or use Rimbra to host command-and-control servers, open proxies, open relays or anonymising services used to hide abuse.
2Gain or attempt to gain unauthorised access to any system, account or data, including other Workspaces or Rimbra's infrastructure. This includes any conduct prohibited by the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended.
3Probe, scan or test the vulnerability of the Service without our written authorisation. Good-faith researchers should follow our responsible disclosure policy at [rimbra.app/security]. We will not take legal action against research that follows it.
4Attempt to escape sandboxes or containers, or access other customers' workloads, networks or data.
5Bypass authentication, rate limits, spend limits, usage limits, billing or other controls.
6Launch or facilitate denial-of-service attacks, or scan third-party networks or systems you are not authorised to test.
7Intercept, monitor or redirect data not intended for you.
A4. Resource abuse
You must not:
1Mine cryptocurrency or run proof-of-work, password cracking or similar workloads, including on GPUs, unless expressly permitted in writing.
2Use the Service as general file storage, a file-sharing or piracy service, or a CDN for content unrelated to your products.
3Place a disproportionate load on shared infrastructure or interfere with other customers' use of the Service.
4Create multiple accounts or Workspaces to evade free-tier limits, spend limits, suspension or bans.
5Scrape or harvest data from the Service or other Users except through our published APIs and within their limits.
A5. Email, SMS, WhatsApp and push messaging
You must not:
1Send unsolicited bulk or marketing messages, or messages to purchased, rented or scraped lists.
2Send messages without a lawful basis and any consent required, or ignore opt-outs.
3Use misleading sender names, sender IDs, subject lines or headers, or send from domains you do not control.
4Send messages that breach Nigerian Communications Commission rules, Meta's WhatsApp policies, or the anti-spam laws of any recipient's country.
5Exceed the bounce and complaint thresholds in our documentation, or continue sending after we ask you to stop.
A6. AI Features and Agent Cloud
You must not use AI Features or agents to:
1Generate or act on content prohibited by this AUP or by our AI providers' usage policies.
2Attack, probe or overload third-party systems, solve or bypass CAPTCHAs or other anti-bot controls, or scrape sites in breach of their terms.
3Impersonate real people, create fake accounts, or post deceptive content at scale.
4Make purchases, payments or binding commitments without a human approval step configured by you, unless you have accepted that risk in writing.
5Extract system prompts, model weights or training data, or circumvent safety controls.
6Make fully automated decisions with legal or similarly significant effects on individuals without the human review required by the NDPA and other applicable law.
A7. Your End Users and Customer Applications
If you use the Service to build or operate products for others, you are responsible for how your End Users use those products. You must have terms and policies at least as protective as this AUP, act on abuse reports we forward within [48] hours (or [24] hours for phishing, malware or child safety), and give us a working abuse contact.
A8. Enforcement
1We may investigate suspected breaches, including by reviewing relevant Customer Content, Customer Applications and logs, and may cooperate with law enforcement, regulators, Payment Partners and affected parties as permitted or required by law.
2We respond in proportion to the harm: warning, removal of specific content, disabling a single Customer Application or domain, restricting a feature, pausing messaging or payments, suspending the Workspace, or terminating the account. We use the narrowest action that stops the harm, so a breach in one Customer Application does not normally take down your other applications.
3We may act without prior notice where content involves child safety, active phishing or malware, an ongoing attack, a court or regulator order, or risk to people or the Service. In other cases we will notify you and give you a reasonable time to fix the issue first.
4We will tell you what action we took and why, unless the law forbids it. You may appeal by emailing info@rimbra.com within [14] days, and a person not involved in the original decision will review it.
5Breach of this AUP is a material breach of the Terms. You are responsible for costs we reasonably incur to investigate and remedy it.
A9. Reporting abuse
Anyone can report abuse to info@rimbra.com with the URL, domain or Workspace involved, a description and any evidence. Report security vulnerabilities to security@rimbra.com and intellectual property infringement under clause 6.9 of the Terms. We acknowledge reports within [24] hours.
A10. Changes
We may update this AUP to address new risks, features or legal requirements. Material changes take effect 30 days after notice, except changes needed to address illegal activity or security risks, which take effect on publication.