Loxis Acceptable Use Policy

1. Purpose of this policy

This Acceptable Use Policy (“AUP”) sets the rules for using the Services offered by Loxis.AI (“Loxis,” “we,” “us,” or “our”). The “Services” means our websites, QuickPlan, our behavioral surveys, Team Analysis, Loxi (the Loxis AI agent), the Loxis platform, and related products and services.

Loxis works with information about people: how they work, what drives them, and how their teams fit the goals they are asked to deliver. That information deserves care. This policy exists so the people inside a customer organization can trust that Loxis is used to understand and support them, not to harm, deceive, or surveil them.

2. Who this policy applies to, and how it fits with our Terms

2.1 Who it applies to

This AUP applies to everyone who accesses the Services. That includes customers, the administrators and managers they appoint, the employees, contractors, and applicants they invite, and anyone who creates a free account directly with Loxis. In this policy, “you” means any of those people.

2.2 Part of the Terms

This AUP is incorporated into and forms part of the Loxis Terms of Service (the “Terms”) and any order form or customer agreement that refers to it. Capitalized words not defined here have the meaning given in the Terms. If this AUP and the Terms conflict, the Terms govern.

2.3 Customer responsibility

A customer organization is responsible for the conduct of every user it invites or authorizes. A violation by one of those users is treated as a violation by the customer for the purposes of the Terms, subject to the proportionate approach in Section 6.

2.4 Examples, not a complete list

The prohibited uses in Section 3 are examples. If a use is not listed but would plainly harm people, break the law, or damage the Services, treat it as prohibited. If you are unsure whether a use is allowed, ask us before you do it.

3. What you may not do

3.1 Unlawful, harmful, or deceptive activity

You may not use the Services to:

• break any applicable law or regulation, including employment, anti-discrimination, privacy, data-protection, consumer-protection, and export-control laws;
• defraud, deceive, or mislead anyone, including by impersonating another person or organization or misrepresenting your authority to act for a company;
• harass, threaten, bully, or intimidate anyone, or promote violence against any person or group;
• collect or process personal data you have no lawful right to collect or process; or
• invite anyone under 18 to take a Loxis Survey or create an account. The Services are intended for business use and are not directed to children.

3.2 Content and intellectual property

You may not upload, submit, or share content that infringes anyone’s copyright, trademark, trade secret, or other rights, or that you do not have permission to use. This includes uploading a competitor’s confidential material into a Competitive Market Analysis.

3.3 Security and integrity of the Services

You may not:

• access, or try to access, any account, data, or system you are not authorized to use;
• probe, scan, or test the vulnerability of the Services, or breach any security or authentication measure, except as allowed below;
• introduce malware, or interfere with or disrupt the Services, their servers, or their networks;
• bypass rate limits, usage limits, access controls, or subscription restrictions;
• scrape, crawl, or harvest data from the Services by automated means, except through features or interfaces Loxis provides for that purpose; or
• reverse engineer, decompile, or try to extract the source code, scoring rules, models, or prompts behind the Services, except where the law expressly allows it despite this restriction.

Good-faith security research that follows our responsible-disclosure process in Section 3.3.1 is not a violation of this Section.

3.3.1 Responsible disclosure

If you believe you have found a security vulnerability in the Services, tell us before you tell anyone else.

• Send your report to security@loxis.ai, with enough detail for us to reproduce the issue.
• We will acknowledge your report within 2 business days and tell you what we intend to do about it within 10 business days.
• Please give us 90 days from your report before publishing details, and longer if we ask and explain why.
• While you research, do not access, change, or delete data that is not your own; do not degrade or disrupt the Services, including by denial-of-service testing, spam, or physical attacks; and do not social-engineer our staff, our customers, or their people. Stop as soon as you have shown that the issue exists.
• We will not pursue legal action against anyone who follows this process in good faith. We do not currently pay bounties, and we will credit you if you would like us to.

3.4 Competitive use and benchmarking

You may not use the Services to build, train, or improve a competing product, or copy the features, design, survey content, or outputs of the Services for that purpose.

You may not publish benchmark or performance tests of the Services without our prior written consent. This does not restrict evaluation for your own internal purposes.

3.5 Invitations, messages, and anti-spam

Loxis lets customers send Survey invitations, reminders, and other messages to their people. You may not use those features to:

• send messages to anyone who is not your employee, contractor, applicant, or another person you have a legitimate relationship with and a lawful basis to contact;
• send unsolicited marketing or bulk commercial messages; or
• disguise who a message is from or what it is about.

You are responsible for complying with the anti-spam laws that apply to your messages. These include, where applicable, the U.S. CAN-SPAM Act, the EU and UK ePrivacy rules and GDPR, and Canada’s Anti-Spam Legislation (CASL).

3.6 Responsible use of people data and Loxis results

This section reflects how Loxis is designed to work. It applies to Survey results, behavioral profiles, Team Analysis, vitality and momentum readings, role fit, and recommendations from Loxi. You may not:

• use a Loxis automated output as the sole basis for a decision about hiring, promotion, pay, discipline, or termination, or any other decision that has legal or similarly significant effects on a person. A person must review the output and make the decision;
• use the Services to discriminate against anyone on the basis of race, color, ethnicity, national origin, religion, sex, sexual orientation, gender identity, age, disability, pregnancy, genetic information, veteran status, or any other characteristic protected by law;
• use the Services for covert surveillance, or give anyone the impression that a Survey is anonymous or confidential when it is not;
• use the Services, or combine them with other tools, to infer a person’s emotions from biometric data such as facial images, voice, or keystroke patterns;
• try to identify, or single out, the individual behind results or data that the Services present as aggregated, de-identified, or pseudonymized, including by trying to obtain or reverse the codes Loxis uses in place of names;
• submit health records, government identifiers, precise location, biometric identifiers, or other sensitive personal data unless Loxis has expressly agreed to that processing and the required notices, consents, and safeguards are in place; or
• present a Loxis output as a clinical, psychological, or medical assessment. Loxis Surveys describe work style and behavior; they do not diagnose anything.

3.7 Loxi and other AI features

You may not:

• try to make Loxi or any other AI feature ignore its instructions, reveal its underlying prompts or configuration, or produce content this policy prohibits;
• use AI features to create content that is unlawful, defamatory, discriminatory, sexually explicit, or designed to deceive; or
• present AI-generated output to others as if a person wrote or verified it, where that would mislead them.

AI output can be wrong. You are responsible for reviewing it before you rely on it or share it.

4. What customers must do for their people

Before a customer invites anyone to use the Services, the customer must:

• give its people any notices the law requires, including what the Survey collects, how results are used, and who can see them;
• obtain any consents the law requires, and have a lawful basis for the processing;
• configure access so that results are visible only to people with a legitimate need to see them; and
• respond to its own people’s privacy requests about Customer Data, as described in Section 12 of our Privacy Policy.

5. Reporting a violation

If you believe someone is using the Services in a way this policy prohibits, email abuse@loxis.ai and describe what you saw, where, and when. Report a security vulnerability to security@loxis.ai instead.

We review every report. We may not be able to tell you what action we took, because that could reveal information about another customer.

6. How we enforce this policy

We may investigate any suspected violation. Depending on how serious it is, we may:

• warn you and ask you to stop;
• remove or disable access to specific content;
• suspend or end a specific user’s access;
• suspend or end a customer’s account, as allowed by the Terms; or
• report the matter to law enforcement where we believe the law requires it or a person is at risk of harm.

We will normally act on the individual user involved. We will suspend or restrict a whole customer account only where the violation is severe, repeated, or systemic, where the customer does not cooperate in resolving it, or where the law requires it. Where it is safe and lawful, we will tell the customer’s account administrator before suspending the account and give a reasonable chance to fix the problem.

We may act immediately, without notice, when needed to prevent harm to people, to protect the security of the Services, or to comply with the law.

7. Appeals

If we take action under Section 6 and you believe we got it wrong, reply to our notice within 30 days and explain why. A person who was not involved in the original decision will review it, and we will respond in writing within 10 business days.

8. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate or required by the Terms, give notice by email or through the Services. Earlier versions are archived and available on request.

9. How to contact us

Questions about this policy can be sent to the address below.