Acceptable Use Policy

Approval and access policies are not a transfer of responsibility. An action may be approved at the time, permitted by the workspace policy for selected apps, or initiated by a schedule you created. In each case, you remain responsible for the instruction, configuration, and resulting use of your account.

Instructing an agent to do something prohibited is the same as doing it yourself. “The AI did it” is not a defence, here or anywhere else.

You may not use Medlar to:

• send unsolicited bulk email, messages, or connection requests;
• contact people who have unsubscribed, asked you to stop, or never had a relationship with you;
• send messages that disguise who they are from, forge headers, or omit a way to opt out where the law requires one;
• scrape or buy contact lists and then message them, whatever the list was advertised as.

Automation makes volume cheap. It does not make it legal: CAN-SPAM, GDPR, PECR, KVKK and equivalent rules apply to a message an agent sent exactly as they do to one you typed.

Do not use Medlar to:

• impersonate a person or organisation, or create content designed to be mistaken for theirs;
• generate or distribute malware, phishing pages, fraudulent invoices, or anything intended to deceive someone into paying or disclosing credentials;
• harass, threaten, defame, or target an individual;
• produce content that sexualises minors, incites violence, or promotes terrorism — no exceptions, no context in which this is acceptable;
• make automated decisions about credit, employment, housing, insurance or immigration without meaningful human review;
• access accounts, systems or data you are not authorised to use, or attempt to bypass another service's rate limits, paywalls or terms;
• reverse-engineer Medlar, resell access, or use it to build a competing service by extracting our prompts, agent definitions or evaluation data;
• deliberately exhaust our capacity — running work with no purpose other than consuming model usage, compute, or a third party's API quota.

Only connect accounts you own or are authorised to operate. If you connect a shared or company account, you confirm you have permission to let Medlar act through it.

Every connected service has its own terms — Google, Slack, LinkedIn, HubSpot, Stripe and the rest. Those terms continue to apply to actions Medlar takes on your behalf, and some of them restrict automation more tightly than this policy does. Where they conflict, the stricter rule wins.

Medlar blocks some things in code. It refuses outright a write to an app you have locked to read-only, anything containing a term you have blocked, and a message to more recipients than that action allows. Deletions and anything that cannot be undone — a sent message, a published post — stop and ask, even on an automated run.

These are safety nets against mistakes. They are not a compliance programme, and passing them is not permission. An action this policy prohibits is still prohibited if no guardrail happened to catch it.

If you received something from a Medlar user that breaks this policy, tell us at hello@medlar.app with “Abuse report” in the subject, and include the message and its headers. We review reports and may request additional information needed to investigate.

Depending on severity we may warn you, disable a connected account, suspend scheduled runs, suspend the account, or terminate it. Where someone is being harmed — active phishing, impersonation, targeted harassment — we act first and explain afterwards.

We will tell you what happened and why, and give you a way to respond, unless we are legally prevented from doing so. Suspension for a violation does not entitle you to a refund of the current period; see the Refund Policy.

We may update this policy as the product changes. We will update the effective date and provide reasonable notice of material changes to registered users where required.

Questions about what is allowed: hello@medlar.app. Abuse reports go to the same address, with “Abuse report” in the subject.