Acceptable Use Policy

This Acceptable Use Policy (the "AUP") forms part of, and is incorporated into, the Terms of Service between you and SIA "MIMIR", Reg. No. 40203749446, Riga, Latvia. Breaching it breaches the Terms, and we may suspend or terminate your workspace for it.

1. Scope

This AUP covers every channel the platform can drive: the outbound AI voice agent (calls through your own number and SIP trunk), AI email (outreach, follow-ups and drafted replies through your own sending domain), AI messaging (WhatsApp Business, Instagram and Facebook Messenger, and Telegram bots you connect), the lead-research tools, the site Builder that generates and hosts preview sites, the embedded chat assistant, the security and SEO scans, and the client-facing reports, proposals and invoices the platform drafts. You are responsible for everything done through your workspace, whether by you, your staff, or an AI agent acting on your configuration.

2. Calling: what is allowed, and the guardrails we enforce

Business-to-business cold calling is lawful, and the platform is built to do it. The FTC's Telemarketing Sales Rule exempts most business-to-business solicitation calls from the TSR, including its do-not-call provisions. (16 C.F.R. §310.6(b)(7).) Calling a business that has published its number is ordinary commercial activity.

Our calling policy is call-by-default, with hard guardrails. The voice agent dials the publicly-listed business numbers you sourced. Before any call connects, the platform enforces, in this order:

• a serial-litigator scrub by number and by business name — a hard block that no consent record overrides;
• do-not-call and suppression records, including an opt-out given on any other channel;
• a calling window of 8:00–21:00 in the called party's local time;
• the voice agent's own AI self-disclosure on the call.

Line type — landline or mobile — is not a blocker. A valid, non-litigator, non-DNC, non-suppressed business number inside the calling window is allowed, and that is the default. Where you do hold a consent record or the contact came to you inbound, record it: the platform keeps a consent register and annotates the call's audit trail accordingly, which is exactly what you want to be able to produce later.

What stays on you. Honour every stop request promptly and across channels. Do not spoof or falsify caller ID. Identify the business on whose behalf the call is made at the start of the call, with a telephone number, as FCC rules require of artificial and prerecorded voice messages (47 C.F.R. §64.1200(b)). And check state law: several states — Florida, Oklahoma, Washington and Maryland among them — have their own telemarketing statutes with private rights of action, and some do not exempt B2B or require registration and a surety bond before you may call their residents.

3. What you promise for every contact

You represent, on an ongoing basis and for each recipient, number, address and dataset you process through the Service:

• Your lists are what you say they are. The numbers and addresses you load are business contacts you sourced lawfully — publicly listed, or given to you — and you hold whatever legal basis, consent or established business relationship applicable law requires for that channel and that contact. Where you hold a consent record, you record it in the platform.
• Do-not-call and suppression. You keep your own internal do-not-call and opt-out records current and load them into the platform, and you scrub against the National Do Not Call Registry and any applicable state list wherever those apply to your programme. You maintain the written internal do-not-call policy and the training FCC rules require of callers. (47 C.F.R. §64.1200(d).) The platform's DNC, suppression and litigator blocks are a backstop to your own list hygiene, not a substitute for it.
• Honouring revocation. You treat a request to stop as effective when made by any reasonable means and you honour it promptly — and in any event no later than the deadline in the FCC's current revocation rules. Do not resume contact afterwards on any channel you were asked to stop.
• Authorisation. You are entitled to contact that person or business on that channel and have not been asked to stop.
• Brand and IP clearance. You own or are licensed to use every name, trademark, logo, image, voice, likeness and piece of copy you upload, generate, publish or transmit — including anything the Builder publishes and anything a voice or chat agent presents as "you". You will not use MIMIR to impersonate a person, business or public body you are not authorised to represent, or to clone any person's voice without their documented consent.
• Truthful identification. Your outreach identifies you accurately — real "from" name, real header and return-path information, real caller ID — carries a valid physical postal address, and offers a working opt-out you honour.
• AI disclosure. Your calls, messages and chats disclose that the recipient is dealing with an artificial agent wherever the law of the recipient's jurisdiction requires it. Section 6 sets out where those duties currently bite; the voice agent and the chat assistant both disclose by default.

4. Email

Cold commercial email to a business is lawful under the CAN-SPAM Act without prior consent, provided every message meets the statute. That is the channel's advantage, and it is why we built the controls around it. It is also assessed per message: the maximum civil penalty is currently $53,088 per non-compliant email, so a single bad campaign is not a rounding error.

For every send you must:

• Use accurate header, "from", "reply-to" and routing information, and a subject line that is not deceptive about the message's contents.
• Identify the message as an advertisement or solicitation where it is one.
• Include a valid physical postal address for your business.
• Include a clear, working opt-out mechanism, honour opt-outs no later than 10 business days after receipt, keep the opt-out working for at least 30 days after sending, and never charge or require anything beyond an email or a single web page to opt out.
• Never sell, transfer or re-use an address after the person has opted out, except to a provider helping you comply.

You must not: send to harvested, scraped-into-a-list, purchased, rented or dictionary-generated addresses where you have no lawful basis to email them; send to anyone who has unsubscribed, or re-import a list to defeat a suppression; or disable, fake or route around the CAN-SPAM footer, the unsubscribe link or the suppression list the platform applies to your sends. If you send to recipients in the EU, UK, Canada or other consent-based regimes, those regimes — not CAN-SPAM — govern, and they generally require consent you must be able to evidence.

5. Messaging channels

WhatsApp, Instagram, Messenger and Telegram are governed by the platform's own policies in addition to law, and those policies are stricter than CAN-SPAM. You must respect each platform's messaging rules, template and opt-in requirements and customer-care windows, and you must not use a business messaging channel for unsolicited bulk outreach. SMS is subject to the same TCPA consent rules as calls. Carrier campaign registration, where required, is yours to obtain.

6. AI disclosure

Disclosure duties are multiplying and they now reach both the voice agent and the website chat assistant. At minimum, and without limiting your own diligence:

• EU. From 2 August 2026, Article 50 of the EU AI Act requires AI systems that interact directly with natural persons to be designed so those persons are informed they are interacting with an AI, unless that is obvious in context. It also requires providers to mark synthetic audio and text as artificially generated in a machine-readable form. This applies to anyone placing such a system on the EU market or whose output is used in the EU.
• California. It is unlawful to use a bot to communicate with a person in California to incentivise a sale or transaction while misleading them about its artificial identity, unless the bot clearly and conspicuously discloses that it is a bot. (Cal. Bus. & Prof. Code §17941.) California has since added further AI-transparency and chatbot-specific duties.
• Utah. Under the Artificial Intelligence Policy Act, a person using generative AI in a consumer transaction must disclose that fact when asked, and must disclose proactively in the provision of a regulated occupation's services.
• Other states. Colorado, Maine and others have enacted or amended chatbot-disclosure duties with staged effective dates. Assume the list grows.

The voice agent is configured to disclose that it is an AI. You must not disable, weaken, or instruct around that disclosure, and you must not configure any agent to claim it is human or to deny being an AI when asked.

7. Research and scanning

• Do not research, scan or profile the site or systems of anyone who is not a lawful subject of your legitimate outreach research.
• Do not collect data in violation of a site's terms of service, its robots.txt, or any technical access control; do not circumvent paywalls, logins, rate limits or anti-bot measures.
• Do not collect special-category or sensitive personal data, data about children, or consumer (non-business) personal data through the research tools except where lawful and necessary.
• Do not resell or redistribute contact data collected through the platform as a standalone data product.
• Security scans are consent-gated. Only run the exposure scan against a site you own or have written permission to test. The scan is non-intrusive by design, but pointing it at a third party without authorisation is your violation, not ours, and may breach computer-misuse law.

Note that business contact data can still be personal data. California's privacy law is the only US state regime with no business-to-business exemption, so a named business contact in California carries consumer rights. Under GDPR, a named individual at a company is personal data outright.

8. Content, sites and widgets

• Do not publish or transmit content that is unlawful, deceptive, defamatory, infringing, obscene or harassing, or that facilitates fraud, phishing or malware.
• Do not make regulated claims — financial, medical, legal, insurance or similar — that you are not licensed or authorised to make, and do not use the platform for a prohibited or high-risk vertical you cannot lawfully serve.
• Do not configure a chat or voice agent to make false claims, to pass as human where disclosure is required, or to collect end-user data without a compliant privacy notice on the site it runs on.
• Do not publish a preview site that copies a third party's site, branding or copy beyond fair use, or that presents itself as that third party's official site.
• Review AI output before it goes out. It can be wrong, and it is your name on it.

9. Platform and security

• Do not attempt to reach another tenant's workspace or break tenant isolation; do not probe, scan or load-test the platform; do not reverse-engineer it except where law expressly permits.
• Do not share your licence key or PIN, and do not run more than one business or workspace on a single subscription without our written agreement.
• Do not resell or sublicense the platform itself. Serving your own clients under your own brand is exactly what MIMIR is for; reselling workspaces to other agencies is not.
• Do not use the platform in breach of export controls or sanctions, or in breach of a connected provider's own acceptable-use terms.

10. Your providers remain yours

Email, calls and messaging run on accounts you connect and control, and those providers bill you directly. You must satisfy each provider's own sender and registration requirements, including carrier campaign registration, sender-domain authentication (SPF, DKIM, DMARC) and messaging-platform policy. Orchestrating those accounts on your instruction does not make us the sender, the caller or the advertiser.

11. Enforcement

We do not pre-screen your outreach. We may investigate suspected violations, and we may throttle a channel, suspend your workspace, or terminate the Terms — with or without notice where law, a provider, or ongoing harm makes immediacy necessary — if we reasonably believe you have breached this AUP or created legal risk. We may preserve and disclose information where required by law or valid legal process, and may cooperate with a provider, carrier or regulator. Suspension for breach of this AUP is not a service failure and does not entitle you to a refund; see the Refund Policy.

Report abuse originating from a MIMIR workspace to igor@mimirdesk.com.

12. Indemnity

You will defend, indemnify and hold harmless MIMIR and its officers, employees and agents against any claim, demand, investigation, fine, penalty, loss, liability, damage or cost (including reasonable legal fees) arising out of: (a) your outreach, calls, messages, research, published sites or widget activity; (b) your breach of Section 3 or any prohibition in this AUP; (c) your lack of consent, authorisation, do-not-call scrubbing or brand clearance for any contact or content; or (d) any claim that you were the sender, caller or publisher of a communication that broke the law. This survives termination and is in addition to the indemnity in the Terms.

13. Changes

We may update this AUP as channels, provider requirements and the law change; material changes are posted here with a new version and date, and continued use after that date is acceptance. This AUP is governed by the same law and dispute terms as the Terms of Service.