Acceptable Use Policy

1. Principles

Every Case must be:

• authorised: someone entitled to approve it has done so, and the authorisation note says who and on what basis;
• lawful: you have a lawful basis for processing each Subject's personal data, and the investigation does not break any law;
• necessary and proportionate: you look only for what the purpose requires, and stop when it is achieved; and
• accountable: you can explain and justify every search, decision and disclosure you make.

Capitalised terms have the meanings given in the Terms of Service.

2. Never permitted

You must not use the Service, any Finding, or anything derived from them, to:

1. stalk, harass, intimidate, threaten, bully, blackmail or monitor any person, or help anyone else do so;
2. locate, identify or contact a person who does not want to be found by you, including a current or former partner, a family member, someone who has left a relationship or a group, or someone protected by a court order, refuge or witness programme;
3. publish or expose a person's identity, home address, contact details, workplace or other personal information to shame, target or endanger them ("doxxing");
4. investigate a child, other than in a lawful child-protection or safeguarding role that requires it;
5. infer, record or act on a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation, or criminal record, except where Applicable Law expressly permits it and you have the safeguards it requires;
6. discriminate against any person, or make any decision about them on the basis of a protected characteristic;
7. gain or attempt to gain unauthorised access to any account, device, system or non-public data, including by using breach data, leaked credentials or password-reset flows to access accounts, by credential stuffing, or by social engineering;
8. impersonate any person or organisation, or create false or misleading accounts, to obtain information;
9. bypass, disable or interfere with the lawful-basis confirmation, authorisation note, retention, audit or access controls of the Service;
10. investigate someone on behalf of a person you have not verified, or for an undisclosed purpose, or resell investigations as a service to the public;
11. sell, license, rent or broker Findings, or compile them into a database or dataset offered to others;
12. train or improve a machine-learning model on Findings about identifiable people, unless Applicable Law permits it and you have a lawful basis;
13. carry out surveillance of journalists, activists, political opponents, protesters, trade unionists or lawyers because of their work or beliefs;
14. support any unlawful act, any act of violence, or any violation of human rights; or
15. breach the terms of any Third-Party Source, or any sanctions, export-control or anti-corruption law.

3. Only with extra safeguards

The following uses are allowed only if Applicable Law permits them and you have first put its required safeguards in place (for example notice, consent, a permissible purpose, an impact assessment, or a documented legitimate-interests test), and recorded them in the Case's authorisation note:

• screening candidates, employees, contractors, tenants, borrowers or insured persons (see section 6 of the Terms: the Service must not be used as a consumer report);
• investigations by or for law enforcement, which must follow the legal process required in your jurisdiction;
• investigating a current or former employee, customer or member of your organisation;
• investigating anyone who has asked you not to process their data, or who has objected to it; and
• watch mode (repeated scanning over time) on a named individual, which must be justified as proportionate for its whole duration.

4. Handling results

• Treat every Finding as unverified until you have checked it yourself. Record your conclusion, and your reasons, in the analyst assessment.
• Do not disclose Findings to anyone who is not authorised to receive them under the Case's authorisation, and do not forward share links.
• Keep only what you need. Delete Cases, exports, snapshots and downloaded copies when the purpose is complete or the retention period ends.
• If a Finding relates to someone other than your Subject, do not use it, and mark it "Not them".
• Respect Subjects' rights, including to be informed, to access, to correct and to object, where Applicable Law gives them.

5. The Service itself

You must not: probe, scan or test the Service's security without our written permission (see the disclosure policy); overload or disrupt it; circumvent rate limits or access controls; reverse engineer it except as permitted by law; access it with automated means other than its documented features; share accounts; or use it to send spam or malicious content.

6. Enforcement

If we reasonably believe this policy has been breached, we may, without notice or liability: suspend or close accounts; disable Cases, share links or features; preserve and review audit records and Customer Data involved; notify the affected person where that is lawful and necessary to protect them; and report the matter to, and cooperate with, law enforcement, regulators or courts. These steps are in addition to our rights under the Terms, including your indemnity.

7. Reporting misuse

If you believe someone is using the Service against you or anyone else, contact the operator of this service. If you are in immediate danger, contact your local emergency services first.