Acceptable Use Policy

RHIZAR ACCEPTABLE USE POLICY

Last Updated: January 5, 2026

This Rhizar Acceptable Use Policy ("Acceptable Use Policy" or "AUP") governs any use of the Service provided under the Terms of Service located at https://rhizar.com/legal (or other written agreement covering the same subject matter executed by Rhizar) for the Service purchased by Customer (the "Agreement"). Capitalized terms not specifically defined in this Acceptable Use Policy shall have the meaning as defined in the Agreement.

---

1. General Use Restrictions

Customer and its Users may not use the Service in any way that:

1.1 Violates or Facilitates Violation of Applicable Law

This includes:

(a) Engaging in illegal activity such as terrorism, cybersecurity crime, organized crime, or child sexual exploitation or the generation of child sexual abuse material;

(b) Violating copyright, trademark, or other intellectual property laws;

(c) Violating any person's privacy rights, including by attempting to collect, infer, predict, store, process, or disclose protected or personally identifiable information (such as passwords, account information, credit card numbers, addresses, location, or other contact information) without a lawful basis for doing so;

(d) Engaging in the unauthorized practice of any regulated profession, including the financial, legal, or medical/health professions;

(e) Accessing or authorizing anyone to access the Service from an embargoed country or jurisdiction subject to U.S. export restrictions, including but not limited to Cuba, Iran, North Korea, Syria, or the Crimea, Donetsk, and Luhansk regions of Ukraine.

1.2 Harms or Impairs Service Operation or Other Users

This includes:

(a) Attempting to gain unauthorized access to the Service, acting to deny others' authorized access to the Service, or authorizing any third party to inappropriately access or use the Service on Customer's behalf (such as sharing usernames and passwords with unauthorized individuals);

(b) Using the Service to attempt to gain unauthorized access to any other service, data, account, system, or network by any means;

(c) Using content or technology that harms, interferes with, or limits Rhizar's or any other user's normal operation of Rhizar's products and services, including monitoring traffic or data, launching denial-of-service attacks, or introducing malicious code;

(d) Excessively burdening the Service through automated queries, scraping, or other high-volume activity that degrades performance for other users, except as expressly authorized by Rhizar in writing;

(e) Circumventing or bypassing any usage limits, rate limits, security measures, or access controls implemented by Rhizar.

1.3 Is Intended to Harm Others

This includes:

(a) Using the Service to store, generate, or transmit viruses, malware, malicious code, trojan horses, ransomware, or anything designed to impair the proper operation of any website, computer system, or network;

(b) Using the Service to harm, threaten, stalk, defame, defraud, deceive, or harass anyone for any reason;

(c) Using the Service to generate or disseminate content that promotes violence, hatred, discrimination, or harassment against individuals or groups based on protected characteristics;

(d) Using the Service to create or distribute misleading content intended to manipulate elections, public opinion, or democratic processes.

1.4 Violates Rhizar's Intellectual Property Rights or Competes with Rhizar

This includes:

(a) Accessing or using any intellectual property in or related to the Service, except as expressly permitted under the Agreement;

(b) Copying the Service, or any part, feature, function, or user interface thereof, except as expressly allowed for such Service under the Agreement;

(c) Using the Service to assist in the creation of similar or competitive products or services to be used apart from the Service;

(d) Reverse engineering, decompiling, or attempting to derive the algorithms, prompts, system instructions, or other proprietary elements of the Service, except as expressly permitted by applicable law;

(e) Benchmarking the Service against competing products or services for the purpose of developing competitive offerings.

---

2. AI-Specific Use Restrictions

If Customer elects to use AI features of the Service (including the Rhizar AI Analyst), Customer's use is subject to the following additional restrictions:

2.1 Human Review for High-Impact Decisions

Customer and its Users may not use the Service for purposes that may have a legal or material impact on individuals—such as making employment, housing, insurance, credit, legal, or other important decisions about them—without appropriate human review and verification. Customer must ensure that any such decisions comply with all applicable laws, including requirements for human oversight, audits, consent, notice, or disclosure.

2.2 Prohibition on Disabling Safety Systems

Customer shall not disable, evade, disrupt, bypass, or interfere with any content filters, safety systems, output moderation features, or other protective measures that are part of the Service's AI features. Any attempt to circumvent safety guardrails, including through prompt injection, jailbreaking techniques, or manipulation of system instructions, is strictly prohibited.

2.3 Misrepresentation of AI-Generated Content

Customer may not:

(a) Misrepresent the origin of any AI-generated Output by claiming or implying such Output was created solely by a human or representing the Output as an original work without disclosure;

(b) Remove any markings that are automatically applied to an Output to indicate that such Output was artificially generated;

(c) Use or communicate to third parties any Output in breach of any rules relating to "deepfake" content, synthetic media disclosure requirements, or AI-generated content labeling that are imposed on Customer by applicable law.

Customer will promptly stop using, displaying, or distributing any Output if it receives a claim that such Output violates a third party's intellectual property rights, or notice that such a claim has been made.

2.4 Verification and Validation Required

Customer must not use any AI features without first determining if its use of such features is effective, accurate, and safe for Customer's intended purpose. Customer acknowledges that:

(a) AI-generated Outputs may be inaccurate, incomplete, misleading, or contain hallucinations;

(b) Customer is solely responsible for verifying and validating all AI-generated insights, recommendations, and analyses before relying on them or sharing them with third parties;

(c) The Service is not intended to be a sole source of truth or factual information, or as a substitute for professional judgment in regulated domains.

2.5 Prohibited High-Risk and Sensitive Uses

The AI features of the Service are not intended to be used for, and Customer shall not use the AI features for:

(a) Prohibited practices under the European Union Artificial Intelligence Act (the "EU AI Act"), including social scoring systems, manipulative AI, or biometric categorization for sensitive attributes;

(b) Any use that would result in the AI features being declared a high-risk AI system under the EU AI Act, unless Customer has implemented appropriate conformity assessments, risk management systems, and human oversight as required by the EU AI Act;

(c) Any use that is critical, unsafe, high-risk, or hazardous, including any use that could result in death or serious bodily injury, catastrophic damage, warfare, or the operation of critical infrastructure (e.g., emergency response systems, nuclear facilities, air traffic control);

(d) Medical diagnosis, treatment recommendations, or other clinical decision-making without appropriate licensure, regulatory approval, and human medical professional oversight;

(e) Autonomous weapons systems or applications designed to cause physical harm.

Customer is solely responsible for any decisions, actions, and/or inactions arising from its use of AI features, including ensuring compliance with applicable laws, regulations, and other legal requirements.

2.6 Risk Disclosure to End Users

Customer must appropriately disclose to its end users (including employees, customers, or other third parties who interact with AI-generated Outputs):

(a) That they are interacting with or receiving content from an AI system;

(b) Any known risks, limitations, or dangers associated with Customer's use of the AI features;

2.7 Competitive Use Prohibition

Customer may not use the Service's AI features or any Outputs to aid in developing, training, re-training, fine-tuning, testing, improving, or enhancing products or services that compete with the Service, including other artificial intelligence models, business intelligence platforms, or housing analysis tools.

---

3. Data Privacy and Security Obligations

3.1 Prohibited Data Types

Unless expressly authorized in writing by Rhizar, Customer agrees not to process through the Service:

(a) Protected health information regulated by the Health Insurance Portability and Accountability Act ("HIPAA Data");

(b) Personal financial information regulated by the Gramm-Leach-Bliley Act;

(d) Genetic or genomic data;

(e) Government-issued identification numbers (e.g., Social Security numbers, passport numbers, driver's license numbers) unless necessary for Customer's legitimate business purposes and processed in accordance with applicable law;

(f) Payment card information subject to PCI-DSS requirements (e.g., full credit card numbers, CVV codes);

(g) Any other highly regulated or sensitive data that would subject Rhizar to additional regulatory obligations without prior written agreement.

3.2 Data Sharing Within Customer Organization

Customer acknowledges that:

(a) Users within Customer's organization may mark data as "private" (accessible only to that User) or "shared" (accessible to other authorized Users within Customer's organization);

(b) Customer is responsible for establishing and enforcing internal policies regarding appropriate data classification and sharing practices;

(c) Customer administrators may have visibility into shared workspace data for legitimate business purposes, including compliance monitoring and security incident response;

(d) Customer must obtain all necessary consents and provide appropriate notices to its Users regarding data access and sharing capabilities within the Service.

3.3 Cross-Customer Data Isolation

Customer acknowledges that Rhizar maintains technical and organizational measures to ensure that Customer Data from one customer organization is not accessible to other customer organizations. Customer may not attempt to:

(a) Access, view, or retrieve data belonging to other Rhizar customers;

(b) Exploit any vulnerability or misconfiguration to breach cross-customer data isolation;

---

4. Violations and Enforcement

4.1 Reporting Violations

Customer will report any known violations of this Acceptable Use Policy by its Users or Authorized Third Parties to Rhizar at legal@rhizar.com. Rhizar encourages good-faith reporting and will work collaboratively with Customer to address violations.

4.2 Investigation and Response

If Rhizar becomes aware of a potential violation of this AUP, Rhizar may:

(a) Investigate the alleged violation, including by reviewing Customer Data to the extent necessary and permitted under the Agreement;

(b) Contact Customer to discuss the alleged violation and seek a mutually agreeable resolution;

(c) Request that Customer provide a written plan to cure the violation within a reasonable timeframe (typically 10-30 days depending on severity);

(d) Provide technical assistance or guidance to help Customer achieve compliance.

4.3 Rhizar's Remedial Rights

If Customer or its Users violate this AUP, Rhizar reserves the right to:

(a) For Minor or First-Time Violations: Provide written notice to Customer and work collaboratively with Customer to cure the violation within a reasonable cure period;

(b) For Repeated or Significant Violations: Suspend access to all or part of the Service upon notice to Customer until the violation is cured, without limiting Rhizar's other rights under the Agreement;

(c) For Severe Violations: Immediately suspend access to the Service without prior notice if Rhizar reasonably believes that continued access poses an imminent risk of harm to Rhizar, other users, or third parties, or violates applicable law. Severe violations include:

- Illegal activity (child exploitation, terrorism, cybercrime);

- Deliberate circumvention of safety systems after prior warning;

- Unauthorized access to other customers' data;

- Activities that cause significant service disruption or security incidents;

(d) Terminate the Agreement in accordance with Section 12.2 (Termination for Cause) of the Terms of Service if the violation constitutes a material breach and is not cured within the applicable cure period.

Rhizar will exercise these remedies reasonably and in good faith, taking into account the severity of the violation, Customer's cooperation, and any mitigating circumstances.

4.4 No Waiver

Rhizar's failure to enforce any provision of this AUP in a particular instance shall not constitute a waiver of Rhizar's right to enforce such provision in future instances or to enforce any other provision of this AUP or the Agreement.

---

5. General Terms

5.1 Customer Responsibility

Customer is responsible for its Users' and Authorized Third Parties' compliance with this Acceptable Use Policy. Customer agrees to implement reasonable internal policies, training, and technical controls to ensure compliance.

5.2 Relationship to Agreement

In the event of any conflict between the Agreement and this Acceptable Use Policy, this Acceptable Use Policy shall govern with respect to acceptable use matters. All other terms of the Agreement remain in full force and effect.

5.3 Updates to this Policy

Rhizar reserves the right to update this Acceptable Use Policy from time to time to reflect changes in technology, legal requirements, or business practices. Updates will be indicated by the "Last Updated" date above. Material changes will be communicated to Customer via email or through the Service, and will become effective:

(a) Upon the start of Customer's next Subscription Term renewal; or

(b) Immediately for changes required by law or to address security or safety concerns.

Continued use of the Service after the effective date of an updated AUP constitutes Customer's acceptance of such updates.

---

Last Updated: January 22, 2026

Contact: legal@rhizar.com