Acceptable Use Policy

This Acceptable Use Policy (“AUP”) forms part of the Terms of Service and of any order form or agreement that references it. It applies to everyone who uses a service operated by Scolah, Inc.: individual users, organisations, and everyone those organisations give access to.

If you are an organisation, you are responsible for making sure your staff, contractors and end users follow this policy.

---

1. Prohibited Uses — All Services

You must not use our services to:

• Break any law or regulation, or help anyone else do so, including laws on data protection, consumer protection, export control, sanctions, anti-corruption and anti-money-laundering
• Store, send or publish content that is unlawful, defamatory, harassing, threatening, discriminatory or that sexualises, exploits or endangers children
• Infringe anyone’s intellectual property, privacy or publicity rights
• Impersonate any person or organisation, or misrepresent your affiliation with one
• Send spam, unsolicited bulk messages, or messages to people who have not agreed to receive them
• Distribute malware, or use the services to gain unauthorised access to any system, account or data
• Probe, scan or test the vulnerability of our systems except as permitted by our Vulnerability Disclosure Policy
• Circumvent authentication, rate limits, licence checks, bundle signature verification or any other technical control
• Place a load on our infrastructure that is unreasonable or disproportionate, including denial-of-service activity
• Resell, sublicense or offer the services to third parties as a service bureau, except as your agreement with us permits
• Scrape, crawl or bulk-extract data from the services without our written permission

2. Data About Vulnerable People

Scolah Compass and Scolah Care often hold data about children, elderly people, beneficiaries of social protection programmes, and people receiving health or care services. If you process such data through our services, you must also:

• Have a lawful basis, and any consent or legal authority required, before registering a person
• Use the data only for the programme, care or service for which it was collected
• Not use the data for surveillance, profiling or targeting based on ethnicity, religion, political opinion, sexual orientation, migration status or similar characteristics, except where the law requires it and with appropriate safeguards
• Not use the services to deny, reduce or end a person’s access to benefits, care or services solely on the basis of an automated output, including AI-generated scores or recommendations, without meaningful human review
• Not share records with law enforcement, immigration or security authorities except under a binding legal requirement that you have assessed

3. AI Features

When you use AI features in our services, you must not:

• Use AI outputs as the sole basis for decisions that have legal or similarly significant effects on a person
• Attempt to extract model weights, system prompts, or other users’ data through prompt manipulation
• Generate content that is prohibited by Section 1, or by the usage policies of any third-party model provider you configure

4. Scolah Compass Platform

Scolah Compass Platform (“Platform”) lets you install and operate software on servers you control. In addition to the rules above, you must not:

• Enrol a server or Kubernetes cluster that you do not own or are not authorised to administer
• Share enrolment tokens, agent keys or portal credentials outside your organisation
• Tamper with the Scolah agent or operator to bypass bundle signature checks, usage reporting or installation-day metering
• Use the Platform to deploy software for a purpose that breaks the licence of that software (see Open-Source Licences)
• Use the Platform to deploy software that violates this AUP, including for third parties

You are responsible for the security and lawful use of the servers you connect, including their operating system, network, physical security and backups. Our responsibilities are set out in the Terms of Service and the Data Processing Addendum.

5. Enforcement

If we reasonably believe you have broken this policy, we may, in proportion to the seriousness of the breach:

• Ask you to stop or correct the activity
• Remove or disable access to content held on Scolah-operated infrastructure
• Suspend or terminate accounts, or block an enrolled server from the Platform

Blocking a server stops its agent receiving instructions from the Platform. It does not stop, delete or access the applications already running on that server, and we have no technical means to do so.

We will normally give notice and a chance to fix the problem before suspending, unless the breach is serious, unlawful, puts others at risk, or notice would undermine an investigation.

6. Reporting Abuse

Report suspected abuse to abuse@scolah.com. Report security vulnerabilities as described in our Vulnerability Disclosure Policy.

7. Changes

We may update this policy. We will give at least 14 days’ notice of material changes, unless a change is needed to address a legal requirement or an immediate risk.