Acceptable Use Policy

1. Who this applies to

This Acceptable Use Policy applies to every user of a Vedatricks service: account holders, the Users they add, visitors to this website, and anyone who talks to the Veda assistant. It forms part of the Terms of Service. If you let someone else use your account, you are responsible for what they do.

Nothing here narrows your rights under Indian law; it sets out the conduct we require in return for access.

2. General rules

• Use the services lawfully, and only for the purpose they were sold to you for.
• Do not use them to harm, harass, defraud, deceive or endanger anyone.
• Do not misrepresent who you are, or imply an association with Vedatricks that does not exist.
• Do not resell, sublicense, white-label or provide the services to a third party unless we have agreed that in writing.
• Do not use the services to build or train a competing product, or to benchmark them for publication without telling us first.
• Respect other users, our staff and our support team. Abusive or threatening behaviour ends the conversation.

3. Content you must not publish, store or transmit

4. Businesses we cannot serve

5. Technical integrity

• Do not attempt to gain access to a system, account or dataset you are not authorised to access.
• Do not probe, scan or test the vulnerability of our systems except under section 11.
• Do not circumvent authentication, rate limits, plan limits, quotas, seat caps or billing.
• Do not scrape our sites or APIs beyond published limits, and do not use automated agents to create accounts.
• Do not run a denial-of-service or stress test, or knowingly consume shared capacity in a way that degrades service for others.
• Do not reverse engineer, decompile or disassemble the services, except to the extent that right cannot be excluded by law.
• Do not upload code or content that interferes with the operation of the services or another tenant’s data.

6. Data you put into our products

• Only record personal data you have a lawful basis to record, having given the individuals the notice the DPDP Act requires.
• Obtain verifiable consent from a parent or lawful guardian before recording a child’s personal data, and use the consent features our products provide to evidence it.
• Only record health, financial or other sensitive data in a product that is designed for it, and keep your own role-based access controls tight.
• Do not use our products as a general file locker, a backup target or a media host unrelated to the product’s purpose.
• Do not export another organisation’s data, and do not attempt to access data belonging to a different tenant.

7. Using the AI assistant and AI features

Veda on this website, and the AI features inside our products, are described at /legal/ai-disclosure/. When you use them:

• Do not send Aadhaar numbers, PAN, card numbers, passwords, health records or any other person’s sensitive data.
• Do not attempt prompt injection, jailbreaks, or any technique intended to make the assistant ignore its instructions, reveal them, or act outside its scope.
• Do not use the assistant to generate unlawful, deceptive or defamatory content, or content that impersonates a real person or organisation.
• Do not present the assistant’s output as human-authored where that would deceive someone, and do not remove provenance or “AI-generated” labels.
• Do not rely on an AI answer as medical, legal, financial or tax advice. The assistant refuses these questions and offers a human instead — take the human.
• Do not automate or script the assistant, and do not use it as a general-purpose model endpoint. Per-session, per-IP and daily limits apply, and exceeding them results in a temporary block.

8. Messaging, email and outreach

• Do not send unsolicited bulk messages of any kind through our services or from a mailbox we host.
• Comply with TRAI’s commercial-communication rules and the DND registry for any telephone or SMS outreach you run.
• Where our products generate a WhatsApp link or an email, the message is yours: you must have a lawful basis to contact that person and must honour opt-outs.
• Do not forge headers, spoof sender addresses or relay mail through our infrastructure for third parties.
• Keep your own SPF, DKIM and DMARC configuration correct where you send from your own domain.

9. Domain names

• Give accurate registrant details and keep them accurate; ICANN and registry policy require it.
• Do not register a domain in bad faith to profit from someone else’s trademark, and do not use one for phishing, malware distribution or command-and-control.
• Respond to registrar or registry verification requests, including .IN e-KYC where it applies.
• A domain used for abuse may be suspended by the registrar or registry regardless of what we think.

10. Fair use and resource limits

Plans include stated limits on users, branches, storage, documents and API calls. Beyond those, fair use applies: shared hosting, database and AI capacity is finite, and one account should not consume it at the expense of others. If your usage is materially outside normal patterns for your plan, we will contact you and propose a plan that fits before taking any action. Published API rate limits are the hard boundary; a request over the limit gets an HTTP 429 with a Retry-After header.

11. Security testing

Security research is welcome inside the rules of engagement in our Security & Responsible Disclosure policy. Testing outside those rules — particularly denial of service, testing another tenant’s data, social engineering, or testing a system that is not in scope — is a breach of this policy and may be an offence under the Information Technology Act 2000.

12. How we enforce this policy

Our response is proportionate to the harm and to whether the breach is repeated:

1. Contact. For most issues we write to you and ask you to fix it, with a deadline.
2. Throttle or restrict. We may rate-limit, disable a feature or move an account to read-only.
3. Remove or disable content. We may take down specific content, and we tell you what and why.
4. Suspend. Where there is a live risk to people, data or the platform, we suspend immediately and explain afterwards.
5. Terminate. For serious or repeated breach, under section 19 of the Terms of Service.
6. Report. Where the law requires it, or where there is a risk to life or to a child, we report to the authorities.

You may appeal any action to our Grievance Officer, whose details are below. We aim to review an appeal within [ ● ]term not yet agreed; this document is in legal review, and we restore access if the action was wrong.

13. Reporting abuse

To report abuse of a Vedatricks service — a phishing page, spam from a mailbox we host, a domain used for fraud, or content that breaches section 3 — email hello@vedatricks.com with the URL or address, a short description and any headers or screenshots. Security vulnerabilities go to /legal/security/ instead. We acknowledge abuse reports within 24 hours.