Acceptable Use Policy

Effective Date: August 8, 2026 · Version 1.0

This Acceptable Use Policy ("AUP") governs your access to and use of the DSAR Engine platform, web application, APIs, and related services (collectively, the "Service"), operated by Ellis Intelligence LLC, a Colorado limited liability company ("we", "us", "our"). By accessing or using the Service, you ("Customer", "you") agree to this AUP. This AUP is incorporated into and forms part of our Terms of Service. This AUP is governed by the Terms of Service it accompanies, including its governing-law and dispute-resolution provisions.

If you violate this AUP, we may suspend or terminate your access without prior notice or refund and may pursue any other remedy available to us.

1. Permitted use

You may use the Service only:

• For your own internal business purposes, or, if you operate as a service provider, for purposes of providing services to your direct end customers under your own customer relationships;
• In compliance with all applicable laws, regulations, and the Terms of Service;
• Within the usage limits of your subscription tier (rate limits, seats, document counts, storage caps); and
• Subject to the additional restrictions in the DSAR Engine addendum below.

2. Account and access

2.1 Account Security. You are responsible for maintaining the confidentiality of your account credentials. You must enable multi-factor authentication where the Service offers it. You must notify us immediately at security@ellisintel.com of any unauthorized account access.

2.2 No Sharing. Each user account is for a single individual. You may not share login credentials. Each seat used must correspond to a distinct natural person identified by name and email.

2.3 Workspace Isolation. Multi-tenant data isolation is a feature of the Service. You will not attempt to access data belonging to any other tenant, account, or workspace (that is, data belonging to any other customer of the Service or its users).

3. Prohibited content

You will not upload, transmit, store, or generate through the Service any content that:

• (a) Violates any applicable law, including export-control law, anti-bribery law, or law applicable to the handling of regulated data;
• (b) Infringes any third party's intellectual property, privacy, publicity, or other rights;
• (c) Contains malware, ransomware, exploits, worms, viruses, or any other code designed to interfere with software or hardware;
• (d) Is unlawful, defamatory, harassing, threatening, hateful, obscene, or sexually exploitative;
• (e) Constitutes "sensitive personal information" in jurisdictions where the Service is not designed to process it, or constitutes regulated data (protected health information ("PHI"), Payment Card Industry ("PCI") cardholder data, classified national-security information, or Controlled Unclassified Information ("CUI") / Federal Contract Information ("FCI")) unless your subscription tier and a separate written agreement expressly permit such use;
• (f) You are not authorized to share, transmit, or process. This prohibition includes, without limitation, content covered by another party's confidentiality obligations that you cannot lawfully share with us.

4. Prohibited activities

You will not, and will not permit any third party to:

4.1 Service Integrity

• (a) Attempt to gain unauthorized access to any portion of the Service, including any other tenant's data;
• (b) Probe, scan, or test the vulnerability of the Service except through a coordinated security-research program we publish or pre-authorize in writing;
• (c) Interfere with or disrupt the Service, including by overloading, flooding, or sending malformed input designed to cause failure;
• (d) Reverse-engineer, decompile, or attempt to extract the source code, model weights, training data, or underlying architecture of the Service;
• (e) Circumvent or attempt to circumvent rate limits, usage caps, billing controls, or feature gates;
• (f) Use the Service to build or train a competing product, including by using Service outputs to train a model offered to third parties;
• (g) Scrape, harvest, or systematically extract data from the Service except through the documented API at the rates we permit.

4.2 Resale and Wrapping

Except where your subscription tier explicitly grants white-label or reseller rights (see the DSAR Engine addendum):

• (a) You will not resell, sublicense, lease, or wrap the Service for delivery to third parties as if it were your own;
• (b) You will not use the Service to provide services to end customers without disclosing that the Service is built on third-party infrastructure (you may disclose by reference to our brand or generically — your choice).

4.3 AI and Output Use

• (a) You acknowledge the Service uses artificial intelligence systems whose outputs may be inaccurate, incomplete, biased, or contain hallucinations;
• (b) Outputs may contain errors or omissions, and we make no warranty as to the accuracy, completeness, or reliability of any output. The Service assists your work; it does not make decisions for you. You will independently verify outputs before relying on them, and before submitting them to any third party, for any decision with legal, financial, professional, or safety consequences;
• (c) You will not represent any output as having been generated by a human, where representation as human is material to the recipient (deception about AI authorship);
• (d) You will preserve any disclaimers or attribution that the Service applies to outputs unless your subscription tier expressly grants removal rights;
• (e) You will not use outputs to take any action prohibited by law, including but not limited to unauthorized practice of law, unauthorized practice of medicine, unauthorized financial advice, or unauthorized insurance brokerage (the DSAR Engine addendum contains track-specific clarifications).

4.4 Data Hygiene

• (a) You will not upload personally identifiable information ("PII") of any individual without a lawful basis under applicable privacy law;
• (b) You will not upload data that you obtained through unauthorized access, theft, or breach of any third party's confidentiality;
• (c) You will not upload children's data (subjects under 13 in the U.S., or, in the EU, under the applicable age of digital consent — 16 by default under the GDPR, though Member States may set it as low as 13) without verifiable parental or guardian consent and proper safeguards;
• (d) You will not transmit sensitive data — including credentials, PII, or the regulated-data categories in §3(e) — to or from the Service over unencrypted channels. You will access the Service only through the encrypted (TLS) endpoints we provide and will not disable, downgrade, or bypass transport encryption. Our own commitments regarding encryption of data at rest and in transit are stated in the Data Processing Addendum and are not restated here.

4.5 Customer Responsibility; Indemnification. As between you and us, you are responsible for the lawfulness of the data you submit to the Service and of the instructions, configurations, and directions you give in using it, including every representation of lawful basis, authorization, or consent made in this AUP or in the DSAR Engine addendum applicable to your subscription. Violations of this AUP (including those representations) that give rise to a third-party claim against us are covered by the indemnification provisions of the Terms of Service, subject to the conditions and procedures stated there; where the DPA applies, this allocation does not excuse our own compliance with our obligations under the DPA.

5. Reporting and cooperation

5.1 Reporting Violations. Report suspected AUP violations to security@ellisintel.com. Include the relevant account or tenant identifier, a description of the issue, and any supporting evidence.

5.2 Legal Requests. We will respond to lawful subpoenas, court orders, and government requests in compliance with applicable law. We will notify the affected Customer where lawful to do so.

5.3 Cooperation. You will cooperate reasonably with any investigation of suspected AUP violations involving your account.

6. Enforcement

6.1 Range of Actions. Depending on severity, we may take any one or more of the following actions in response to an AUP violation: issue a written warning; temporarily throttle, restrict, or suspend specific features of your account; suspend your account in full pending investigation; terminate your account immediately for material breach; refer the matter to law enforcement; or pursue civil remedies, including monetary damages and injunctive relief.

6.2 Material Breach — Immediate Action. The following constitute material breach permitting immediate suspension or termination without prior notice or refund: (a) any activity prohibited under §3 (Prohibited Content) involving illegal content, malware, or regulated-data violations; (b) any activity prohibited under §4.1 (Service Integrity) involving unauthorized access, vulnerability probing without authorization, or denial-of-service activity; (c) use of the Service in violation of export-control law, sanctions law, or anti-bribery law; (d) repeated lower-severity violations after written warning.

6.3 Refund Policy on Termination for AUP Violation. No refund of pre-paid fees is owed for the billing period in which the violation occurred. Future billing periods are credited or refunded in accordance with the refund provisions of the Terms of Service.

6.4 Survival. Termination, suspension, or expiration of your account or subscription does not relieve you of obligations that by their nature should survive, including but not limited to: obligations of confidentiality; obligations regarding the return or destruction of data (as provided in the Terms of Service and, where applicable, the DPA); the representations in §4.5; and liability for AUP violations accruing before termination.

7. Modifications

We may update this AUP from time to time. Material changes will be communicated by written notice sent by email to the account's designated contacts (or by in-product notice) and, in addition, posted at dsarengine.com/acceptable-use. Written notice is deemed given when sent; failure to read a properly sent notice does not extend any period. Each change takes effect on the effective date stated in the notice, and continued use of the Service after that effective date constitutes acceptance of the updated AUP.

8. Contact

Questions about this AUP: legal@ellisintel.com
Security and abuse reports: security@ellisintel.com

DSAR Engine addendum

In addition to the base AUP above:

D1. Consumer Intake Page — Your Responsibility. DSAR Engine hosts a Customer-configurable public intake page at which consumers submit privacy requests and complete identity verification. We host and render that page as your processor and on your behalf. You are the controller of every request and of the consumer data collected through that page. You represent that you have a lawful basis to receive, verify, track, and fulfill each request, and you are responsible for the content of any copy, logo, or accent you apply to the page (light white-label only).

D2. Verification-PII Minimization. Identity verification on the public intake page is performed by emailed single-use confirmation link. The Service does not collect, request, or store identity documents, and it has no document-upload path. You will not repurpose the intake page or the verification flow as a general identity-collection or identity-verification service, and you will not attempt to collect identity documents through it.

D3. You Fulfill; We Track. The Service tracks deadlines and logs each step; it does not gather, redact, or transmit consumer data on your behalf, and it does not decide whether a request is valid. You will review and complete every fulfillment step (gather, redact, fulfill, close) yourself. You will not represent that DSAR Engine fulfills requests, validates requests, or guarantees compliance.

D4. Audit Export Is Integrity, Not Compliance. The chain-of-custody export evidences that a request record was not altered. You will not represent the export as a certification that you are compliant with any privacy law. The export renders as plain text/typography only — no seal, badge, ribbon, watermark, or certificate-style graphic — so it does not visually resemble a third-party validation mark.

D5. No Resale or Nested Tenancy. DSAR Engine is flat multi-tenant: one organization, one tenant. You may not provision Service access to other organizations as a resold, managed, or sub-tenant service without a separate executed agreement.

D6. Regulatory Contingency. If a regulatory body issues guidance or a rule that affects DSAR Engine's lawful operation in a state or for a use case, we may modify, restrict, or withdraw the Service accordingly, on written notice given per §7's notice mechanics and with pro rata refund per the Terms of Service.

D7. Fulfillment Reaches the Data Subject Directly; Heightened Responsibility. The Service does not auto-transmit any fulfillment response on your behalf; per D3, every delivery to a data subject requires your own affirmative action. Because a completed fulfillment step delivers a response directly to the data subject who submitted the request — an external party outside your control once delivered — and privacy regulators may examine your handling of that request, the disclaimers in D3 do not limit your responsibility for the accuracy, completeness, and legal sufficiency of what you deliver.