# Acceptable Use Policy: [Product name]

> Format for a customer-facing acceptable use policy (AUP) for a SaaS
> product, hosting service, API or online platform: what users and
> their end users may not do with the service, usage limits, rules for
> AI features, how to report abuse, how the provider enforces the
> policy and how users can appeal. Based on common online-service
> practice, with the EU Digital Services Act duties on terms and
> conditions and content moderation (Regulation (EU) 2022/2065, Art. 14
> and related articles, applying since 17 February 2024). Replace every
> `[bracketed]` value and every row marked *Example*.
> **This is a documentation format, not legal advice.** It makes no claim that the policy
> is enforceable or meets every legal duty that applies to your service.
> Have a qualified lawyer review it before you publish it.
> For an internal staff policy on using company IT, use the
> compliance/acceptable-use-policy template instead.

<!--
Guidance: How to use this template
- This policy sits under your terms of service
  (legal-lite/terms-of-service), which should say that breaking the AUP
  is a breach of the terms. Keep enforcement wording consistent between
  the two.
- Describe only rules you will actually enforce, and enforce them the
  same way for everyone. Under the DSA, restrictions must be applied
  diligently, objectively and proportionately, with due regard to users'
  fundamental rights.
- Write each rule as an observable behaviour. "Do not be offensive" is
  hard to enforce; "do not post content that threatens violence against
  a person" is not.
- Delete sections that do not fit your product (for example section 5
  if you have no AI features).
-->

## Document control

<!-- Guidance: Internal record. Publish the policy with its "Last updated" date. The DSA requires you to inform users of significant changes to your terms. -->

| Field | Value |
|---|---|
| Document ID | [LEGAL-AUP-001] |
| Service | [Product name and URL] |
| Provider | [Legal entity] |
| Version | [0.1] |
| Status | [Draft / Legal review / Approved / Published] |
| Owner | [@owner, Trust and Safety or Legal] |
| Approvers / reviewers | [Legal counsel], [Security lead], [Product owner] |
| DSA role | [Hosting service / Online platform / Not a hosting service] |
| Last updated | YYYY-MM-DD |
| Classification | Public once published |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Legal counsel | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Trust and safety lead | [@name] | [Approved enforcement process] | YYYY-MM-DD |
| Security lead | [@name] | [Approved security rules] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary | Users notified |
|---|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft | n/a |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* First published version | n/a |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Added rules for AI form assistant (section 5) | Email and in-app notice, 30 days ahead |

## 1. Scope

<!-- Guidance: Say who must follow the policy (customers, their users, API clients) and that customers are responsible for their own end users. Link the terms that make the AUP binding. -->

This policy applies to everyone who uses [Product name], including
customers, the people they invite, and anyone who submits content
through a customer's [forms, pages or apps] (together, **users**). It
forms part of our [Terms of Service](link). Customers are responsible
for making sure their own users follow it.

*Example:* Tarnwick Forms (fictional) is a hosted form builder.
Customers build forms; their respondents submit answers. The policy
covers both groups, and customers must not build forms that collect
content banned in section 2.

## 2. Prohibited content

<!-- Guidance: List categories of content that may not be hosted, shared or collected through the service. Separate illegal content (which you must act on when notified) from content you choose to restrict. The DSA requires terms to say what restrictions you impose. -->

You must not use the service to create, upload, store, share or
collect content that:

| ID | Category | Examples |
|---|---|---|
| AUP-C-001 | Is illegal where it is published or received | [Content that infringes intellectual property, illegal hate speech, terrorist content] |
| AUP-C-002 | Sexually exploits or endangers children | Any such content, which we report to the authorities |
| AUP-C-003 | Threatens or incites violence against people | [Threats, glorification of attacks on identifiable people] |
| AUP-C-004 | Harasses or bullies a person | [Targeted abuse, sharing private information to cause harm] |
| AUP-C-005 | Deceives people to obtain data or money | [Phishing pages, fake log-in forms, impersonating another organisation] |
| AUP-C-006 | Contains malware or links to it | [Viruses, ransomware, drive-by downloads] |
| AUP-C-007 | Collects special categories of personal data without a lawful basis | [Health or biometric data collected without the protections the law requires] |
| AUP-C-008 | [Other category your service restricts] | [Examples] |

## 3. Prohibited conduct

<!-- Guidance: Cover misuse of the service itself: security, abuse of resources, spam and evasion. These rules protect other customers and your infrastructure. -->

You must not:

| ID | Rule |
|---|---|
| AUP-B-001 | Access or try to access accounts, systems or data you are not authorised to access, or probe, scan or test the service's vulnerabilities, except under our [security disclosure policy](link) |
| AUP-B-002 | Interfere with or overload the service, for example by denial-of-service attacks or by bypassing rate limits |
| AUP-B-003 | Send unsolicited bulk messages (spam) through the service, or use it to collect email addresses for spam |
| AUP-B-004 | Reverse engineer, scrape or copy the service except where the law allows it or we permit it in writing |
| AUP-B-005 | Resell or sublicense the service unless your plan allows it |
| AUP-B-006 | Create accounts by automated means, or to evade a suspension |
| AUP-B-007 | Use the service to break sanctions or export control laws |
| AUP-B-008 | Help or encourage anyone else to do any of the above |

## 4. Usage limits

<!-- Guidance: State fair-use limits that apply to every plan, or point to the plan page. Say what happens when a limit is exceeded: throttling, a warning, an upgrade offer. Do not hide hard limits only in technical documentation. -->

| ID | Resource | Limit | When exceeded |
|---|---|---|---|
| AUP-L-001 | [API requests] | [(N) per minute per key] | [Requests are rejected with an error until the next minute] |
| AUP-L-002 | [Storage] | [(N) GB per workspace, see plan] | [We notify you and ask you to delete or upgrade] |
| AUP-L-003 | [Outbound email] | [(N) per day] | [Sending pauses until the next day] |
| AUP-L-004 *(Example)* | Form submissions | 10,000 per month on the Starter plan | Form stays open; extra submissions are kept and we offer an upgrade |

## 5. AI features

<!-- Guidance: If the product offers generative AI or automated decisions, set rules for their use and say what the provider does with prompts and outputs. Check transparency duties under Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744, Art. 50 (applying from 2 August 2026), for systems that interact with people or generate synthetic content; see ai-data templates for the full assessment. -->

When you use [AI feature name], you must not:

- use it to produce content banned in section 2;
- try to bypass its safety measures (for example with prompts designed
  to make it ignore its instructions);
- present its output as human-written where the law requires
  disclosure, or use it to impersonate a real person;
- use its output as the only basis for decisions with legal or
  similarly significant effects on people, unless your own processes
  include human review.

[Say whether prompts and outputs are used to train models, and how to
opt out. Link to the privacy policy.]

## 6. Reporting a violation

<!-- Guidance: Hosting services under the DSA must have an easy electronic mechanism for anyone to notify illegal content (Art. 16), and must confirm receipt and tell the notifier the decision. Say what a notice should contain. Give a separate route for urgent threats to life or safety. -->

Anyone can report content or behaviour that breaks this policy, or
content they believe is illegal, at [report link] or [abuse email].

A notice is easiest to act on when it includes:

- why you think the content is illegal or breaks this policy;
- the exact location, such as the URL;
- your name and email address (not required for reports of child
  sexual abuse material);
- a statement that you believe in good faith that the notice is
  accurate and complete.

We confirm receipt [electronically, without undue delay] and tell you
what we decided. If you believe someone's life or safety is at risk,
contact the local emergency services first.

## 7. Enforcement

<!-- Guidance: Describe the range of measures and how you choose between them. Under the DSA, a hosting service must give the affected user a statement of reasons for restrictions (Art. 17), and terms must describe content moderation policies, including any algorithmic decision-making and human review (Art. 14). Online platforms must also offer an internal complaint system (Art. 20), give information on out-of-court dispute settlement (Art. 21) and apply the misuse measures in Art. 23 (section 7.4); micro and small enterprises are exempt from most online platform duties (Art. 19), so check which apply to you. -->

7.1 **How we review.** We review reports [using a combination of
automated tools and trained staff]. [Describe which decisions are
automated and when a person reviews them.]

7.2 **Measures.** Depending on how serious the violation is, whether
it is repeated and its effect on others, we may:

| Level | Measure | Typical trigger |
|---|---|---|
| 1 | Warning and request to fix | First minor violation |
| 2 | Remove or disable the specific content | Content that breaks section 2 |
| 3 | Restrict features (for example sending or publishing) | Repeated violations, spam |
| 4 | Suspend the account for a set period | Serious or repeated violations after warning |
| 5 | Terminate the account | Severe violations, or repeated serious violations |

We may act immediately, without a prior warning, where needed to
protect people or the service, or where the law requires it.

7.3 **Statement of reasons.** When we restrict your content or account,
we tell you what we did, the facts and the rule or law it was based
on, whether automated means were used, and how you can challenge the
decision.

7.4 **Repeated misuse.** We may suspend, for a reasonable period and
after a prior warning, accounts that frequently provide manifestly
illegal content, and stop processing notices from people who
frequently submit manifestly unfounded ones.

```mermaid
flowchart TD
  R["Report received or issue detected"] --> A["Acknowledge receipt to notifier"]
  A --> V{"Violation confirmed?"}
  V -- "No" --> N["Close and inform notifier"]
  V -- "Yes" --> M["Choose proportionate measure, levels 1 to 5"]
  M --> S["Statement of reasons to the user"]
  S --> C{"User appeals?"}
  C -- "No" --> E["Close case"]
  C -- "Yes" --> H["Internal complaint reviewed by a person"]
  H --> D["Decision upheld or reversed, user informed"]
```

## 8. Appeals

<!-- Guidance: Tell users how to challenge a decision, how long they have and who reviews it. Online platforms in the EU must let users complain free of charge for at least six months after the decision, have complaints handled under the supervision of qualified staff and not solely by automated means, and inform users of out-of-court dispute settlement bodies. -->

If you disagree with a decision, you can appeal at [appeal link]
within [six months] of being told of it. Appeals are free. A member of
our team who was not involved in the original decision reviews it and
tells you the outcome [within (N) days]. If we were wrong, we reverse
the measure without undue delay.

[EU users of an online platform: you may also refer the dispute to a
certified out-of-court dispute settlement body, and you can go to
court at any time.]

## 9. Changes and contact

<!-- Guidance: Say how you give notice of significant changes and when they take effect. Give one contact for questions about the policy. -->

We will tell you about significant changes to this policy [by email and
in the product at least (30) days before they take effect], unless a
change is needed sooner for legal or safety reasons.

Questions: [trust@example.com]. Security vulnerabilities: see our
[security policy](link) (dev/security-policy).

## References

<!-- Guidance: Sources checked on the date shown. Keep this list internal. -->

| Source | Status / date checked | Used for |
|---|---|---|
| Regulation (EU) 2022/2065 (Digital Services Act), Arts. 14, 16, 17, 20, 21, 23, eur-lex.europa.eu/eli/reg/2022/2065/oj | Applies since 2024-02-17 (European Commission, DSA questions and answers, read 2026-10-30) | Terms content, notice and action, statement of reasons, complaints, misuse |
| Regulation (EU) 2024/1689 (AI Act) as amended by Regulation (EU) 2026/1744, Art. 50 | Applies from 2026-08-02, as used across this collection's ai-data templates; check the current text and guidance | Section 5 |
| Terms of Service (legal-lite/terms-of-service) | This collection | Binding effect, termination |
| Internal staff policy (compliance/acceptable-use-policy) | This collection | Not the same document: internal use of company IT |

## Standard and licence note

Based on common online-service practice for acceptable use policies,
with EU clauses based on Regulation (EU) 2022/2065 (Digital Services
Act), paraphrased in original words. Check the current consolidated
text and any national rules before use. This is a documentation
format, not legal advice: it does not create a lawyer-client
relationship and makes no claim that the policy is enforceable.
Original text written for this collection; examples are fictional.
Template licence: MIT.