The Rules.

Specific on purpose. You should be able to tell, before you sell us a project, whether we can take it — and to know exactly what happens, and what we have on record, if something goes wrong.

1The one rule

Do not use anything we build, host or run to hurt people, break the law, or push the risk of your business onto us. Everything below is that sentence, spelled out so nobody has to guess where the line is.

These Rules apply to your site, your content, your visitors' data, the requests you send our agents, and anything you do through our API or MCP endpoint. They form part of the Terms of Service.

2Never, on any plan

We will not build it, host it, or keep it online:

• Anything illegal where you operate or where we operate — including content that sexualises minors, incites violence or terrorism, or facilitates human trafficking. This is reported, not just removed.
• Malware, phishing, or deception infrastructure — fake login pages, brand impersonation, cloned storefronts, "verification" pages that harvest wallets, seed phrases, card numbers or passwords.
• Fraud — fake shops, fake reviews, fake charities, unauthorised use of someone else's identity or company details, money laundering.
• Financial and investment schemes — token sales, "guaranteed returns", HYIP, signal-selling with performance claims, unlicensed money transmission or exchange, any regulated financial service you are not licensed to provide.
• Counterfeits and pirated goods, or content that infringes someone's copyright, trademark or patent.
• Stalkerware and surveillance — anything designed to track, record or profile a person without their knowledge; scraped personal data offered for sale.
• Weapons, explosives, illegal drugs and controlled substances, and instructions for making them.
• Sexual content involving real people without their documented consent, and any adult content presented as, or reachable by, minors.
• Hate and harassment — content attacking people for who they are, doxxing, or campaigns aimed at an individual.
• Spam infrastructure — bulk unsolicited email or messaging, SEO doorway networks, link farms, deceptive redirect chains.

3Allowed, with care

These are fine, but tell us before we build them, because they change what we have to set up (age gates, disclaimers, data handling, hosting region):

• Regulated professions — clinics, legal practices, financial advice — where you hold the licence and can show it.
• Health, supplements and cosmetics claims: they need to be truthful and, where the law demands it, sourced.
• Alcohol, tobacco, vaping, gambling, adult-oriented but legal content: only with the right licences and age verification, and never where prohibited.
• Anything collecting sensitive personal data — health, biometrics, precise location, children's data. We will design for it properly rather than pretend it is ordinary form data.
• Crypto businesses that are not investment schemes — a wallet, a tool, an exchange with a licence.

4Using our AI agents

• Do not ask the agent to produce anything in §2. Attempts are logged.
• Do not try to extract our system prompts, other customers' data, credentials or infrastructure details, or to jailbreak the agent into acting outside your own site.
• Do not feed it data you have no right to share — someone else's customer database, leaked material, or confidential documents that are not yours.
• Automated hammering of the agent or the API is capacity abuse; use the documented rate limits.
• The agent produces drafts. You are responsible for checking claims, prices and legal text before they go live on your site.

5Fair use of capacity

Your plan buys a stated number of change requests, running a stated number at a time. That is a real budget of people and machine time, so:

• One account runs one business's sites. Running an agency's whole client base through a single subscription is not fair use — that is what the partner programme is for.
• Do not split one large project into dozens of "small" requests to dodge the counting in the request table.
• Do not resell, sublicense or white-label our capacity, agents or API to third parties without an approved partner agreement.
• Hosting is for your site, not for file storage, media distribution, mining, proxying, tunnelling, or running someone else's workload.

6Security

• No probing, scanning, load-testing or exploiting our systems without written permission. Found something? Write to [email protected] — we answer researchers and we do not shoot the messenger.
• No accessing accounts, data or admin areas that are not yours, and no sharing your credentials or API keys.
• No circumventing quotas, rate limits, billing or access controls.
• Keep your own domain and email security in order — most incidents start there.

7Extra rules for partners

• Record real numbers: the price agreed, the prepayment actually received, the real stage. The workspace is our shared source of truth, and inventing entries in it is a termination-level breach.
• Capacity granted for one client's project is for that project.
• Do not present yourself as our employee, do not promise on our behalf, and do not quote timelines or features we have not agreed.
• Your clients get these same Rules. If you knowingly bring a project from §2, you lose the account and any unpaid share.

8What we log

Enforcement without evidence is just mood, so we keep records — and we tell you which, rather than leaving it to your imagination:

Reviews are done by a person. Automated checks flag things; they never close an account on their own. What we do with personal data, and your rights over it, is in the Privacy Policy.

9How we enforce

Normally in three steps, and we tell you the reason at each one:

1. Warning — written, with what is wrong and what fixes it. Usually a few days to put it right. Service continues.
2. Suspension — sign-in blocked, active sessions ended immediately, site may go offline. Nothing is deleted. Used when a warning is ignored, a breach repeats, or a payment is disputed.
3. Closure — the account ends. You have 90 days to export your data and your code, then it is deleted.

We skip straight to suspension or closure for anything in §2 that is illegal or puts other people at risk — malware, phishing, attacks on our systems, content involving minors. Where the law requires a report, we report it.

10Appeals

If you think we got it wrong, reply to the notice or write to [email protected] within 30 days. A person who was not involved in the original decision looks at it, and you get an answer within five working days. Send whatever context you have — most suspensions come from a misunderstanding and are lifted the same day.