Legal

Acceptable Use Policy

Last Updated: 22 September 2026 | v1

This Acceptable Use Policy ("AUP") applies to all use of Spike (the "Service") and is incorporated by reference into the Business Terms of Service. Capitalized terms not defined here have the meaning given in the Business Terms. Customer is responsible for its Users' compliance with this AUP; a violation by any User is a material breach of the Business Terms.

1. Prohibited Uses

You may not use the Service to:

Violate any applicable law or regulation, or the rights of any third party (including intellectual property, privacy, and publicity rights);
Generate, distribute, or facilitate malware, exploits, phishing content, or other material intended to damage, disable, or gain unauthorized access to any system;
Harass, threaten, defame, or intentionally deceive or mislead any person;
Engage in or facilitate fraud, market manipulation, or deceptive commercial practices;
Scrape, crawl, or extract data from third-party websites or services in violation of that service's terms of use or applicable anti-circumvention law;
Attempt to reverse-engineer, extract training data or model weights from, or bypass usage limits or safety mitigations of any AI model accessed through the Service;
Build a product or service that competes with the Service by using outputs of the Service to train a competing AI model;
Interfere with or disrupt the integrity or performance of the Service, or attempt to gain unauthorized access to it or its related systems.

2. Agentic-Use Standards

The Service allows AI agents to take Actions on your behalf, including editing files, running commands, and interacting with connected websites, repositories, and Connected Apps. When using or configuring agentic features, you shall:

Maintain human review over consequential or irreversible Actions (e.g., deleting data, sending communications, publishing content, making payments, pushing to production branches or shared repositories);
Not configure the Service to operate unattended (e.g., an "auto-accept" or auto-run mode with approval flows disabled) in a context where an erroneous or manipulated Action could cause significant harm;
Not direct an agent to impersonate a specific real person without that person's consent, or to misrepresent that agent-generated output is human-authored where that distinction is legally or contractually required to be disclosed;
Not direct an agent to interact with a third-party website, API, or Connected App in a manner that violates that third party's terms of service, including restrictions on automated or bot access;
Not use the Service to build or operate an autonomous agent whose primary purpose is to circumvent rate limits, paywalls, CAPTCHAs, or other access controls of a third-party service.

3. High-Risk Use

Do not use the Service, or outputs of the Service, as the sole or primary basis for a decision in the following domains without review and sign-off by a qualified human professional in that domain: legal advice, medical or health decisions, insurance underwriting or claims decisions, credit or lending decisions, employment decisions (hiring, firing, promotion), housing decisions, admission or academic-testing decisions, or safety-critical infrastructure control. You are solely responsible for independently verifying any Output before relying on it in these or any other high-stakes contexts.

Do not connect the Service to, or use it to process data from, systems where a prompt-injection failure, hallucination, or erroneous Action could cause disproportionate harm, including live production financial-transaction systems without human approval flows, healthcare or patient-record systems, or critical infrastructure control systems, unless you have implemented compensating controls (e.g., mandatory approval flows, sandboxed/read-only access) adequate to that risk.

4. Regulated Data

Do not submit to, or process through, the Service any of the following unless you have a separate written agreement with Spike expressly permitting it: protected health information regulated under HIPAA or similar health-data law; payment card data subject to PCI-DSS; government-issued identification numbers or other data requiring heightened regulatory safeguards; or any other data category subject to a sector-specific regulatory regime that imposes obligations beyond general data-protection law.

5. AI Transparency

If you deploy a consumer-facing chatbot, agent, or other interactive AI system built using the Service, you must disclose to end users that they are interacting with AI rather than a human, where required by applicable law (e.g., Article 50 of the EU AI Act). If you use the Service to generate content that is distributed to third parties without further material human editorial review (e.g., mass communications, published articles, or automated responses), you are responsible for any AI-content-disclosure obligations that apply to that distribution under applicable law.

6. Prohibited Inputs

Do not submit to the Service:

Content you do not have the right to submit, including third-party confidential information, trade secrets, or copyrighted material used without permission;
Special-category personal data (e.g., health data, biometric data, data revealing racial or ethnic origin, religious beliefs, or sexual orientation) unless you have an independent lawful basis and have determined the Service is an appropriate processor for that data;
Malicious code, or content specifically crafted to manipulate, jailbreak, or extract the system prompts or safety configuration of an AI model accessed through the Service;
Content depicting or promoting child sexual abuse material, terrorism, or other content that is illegal in the jurisdiction where it is submitted.

7. Security-Related Conduct

You may not attempt to probe, scan, or test the vulnerability of the Service or its infrastructure except through Spike's coordinated disclosure process; circumvent authentication or access-control mechanisms; or introduce any virus, worm, or other harmful code into the Service. If you discover a security vulnerability, report it promptly to security@spike.app rather than exploiting or publicly disclosing it before Spike has had a reasonable opportunity to remediate.

8. Enforcement

Spike may investigate suspected violations of this AUP and may remove content, suspend or restrict access to the Service, or terminate an Account, with or without notice, where necessary to prevent harm or as required by law. Spike may report conduct that it believes violates the law to appropriate authorities.

9. Reporting Violations

To report a suspected violation of this AUP by another Customer or User, contact security@spike.app.

10. Changes to This Policy

Spike may update this AUP from time to time consistent with Section 11 of the Business Terms of Service.