Acceptable Use Policy

This Acceptable Use Policy (the “AUP”) expands on Section 8 of our Terms of Service and is incorporated by reference into them and into your Raileon Service Agreement. It applies to everyone who uses SkyRaileon LLC's platform and services, and to every AI Module operating under your account. Breaking this policy is breaking your agreement with us. We may update this policy as the platform changes; the effective date above shows when it was last revised.

The short version: Use Raileon for lawful business work. Your Modules act as you. Whatever they do under your account is your responsibility. No spam, no protected health information, no card data, no unsupervised professional advice going out to third parties.

1. General principle

Raileon is built for lawful business use. You may use the platform for the work your organization actually does, within the law, and within the terms of the services you connect to it.

You are responsible for what your Modules do on your behalf. A Module is not a separate legal actor. When a Module sends an email, posts a message, updates a record, or produces a document under your account, that action is treated as your action. This includes actions taken by Modules you configured, Modules your team configured, and Modules running on a schedule while nobody is watching.

In practice, that means you agree to:

Configure Modules with instructions and permissions that keep them inside this policy.
Review and approve consequential output before it leaves your workspace: anything that commits you, advises someone, moves money, or reaches a third party.
Keep your account credentials secure and make sure everyone you invite understands these rules.
Hold the rights and permissions needed for any data, files, or credentials you bring into the platform.

“I didn't know the Module did that” is not a defense under this policy. If you cannot supervise an automation, do not run it.

2. Prohibited content and conduct

Do not use Raileon, or allow your Modules to be used, to do any of the following:

Break the law. Any activity that violates applicable local, state, federal, or international law, including sanctions and export-control rules.
Infringe intellectual property. Copying, distributing, or generating material that infringes copyright, trademark, patent, or trade-secret rights, or that misappropriates someone else's confidential information.
Harass, threaten, or abuse. Content that harasses, threatens, defames, or incites violence or hatred against a person or group. Sexual content involving minors is prohibited absolutely and will be reported to the authorities.
Distribute malicious code. Creating, hosting, or transmitting malware, ransomware, spyware, exploits, or any code designed to damage or gain unauthorized access to a system.
Commit fraud. Phishing, business-email compromise, invoice fraud, fake reviews, pyramid or advance-fee schemes, or any scheme that deceives people out of money, credentials, or data.
Impersonate. Passing yourself or a Module off as another person, business, or public body, or misrepresenting your affiliation with one.
Interfere with others. Attempting to access another customer's workspace, data, or container, or interfering with any other user's use of the platform.

3. Prohibited AI uses

Some uses are off-limits regardless of intent, because the failure mode lands on someone other than you. Do not use Raileon Modules for:

Unsupervised professional advice to third parties. Legal, medical, or financial advice delivered to a client, patient, or consumer without a qualified human reviewing it first. Modules may research, draft, and summarize for your licensed professionals; they may not be the last step before the advice reaches the person relying on it.
Automated decisions about people. Decisions with legal or similarly significant effect (employment, credit, housing, insurance, or education) must have meaningful human review before they take effect. A Module may rank, summarize, or flag; a human decides.
Targeting job advertisements. Do not use the Module to target job advertisements at individuals or audiences. Ad campaigns your Modules run must not be recruitment or employment advertising.
Biometric identification. Identifying or categorizing individuals from faces, voices, gait, or other biometric characteristics, including building or querying a biometric database.
Surveillance of individuals. Covert monitoring, tracking, or profiling of people (employees, competitors, customers, or members of the public) without their knowledge and a lawful basis.
Disinformation and deceptive synthetic media. Generating false or misleading content intended to deceive, including political disinformation, fabricated news, astroturfing, or synthetic audio, images, or video presented as a real person or real event.

AI model providers' usage policies. Modules run on models supplied by third-party AI providers. You must also comply with the usage policies of the AI model providers listed on our Sub-processors page. If a provider's policy is stricter than this one on a point, the stricter rule applies to you, and we may suspend a use that breaches it.

If your use case sits close to one of these lines, ask us at admin@raileon.com before you build it. We would rather scope it with you than shut it off later.

4. Communications and outreach

Your Modules can send email, texts, and voice calls, and post to chat platforms such as Discord and Telegram, on your behalf. That reach is the point of the product, and it is also the fastest way to cause real-world harm, so the rules here are strict.

No unsolicited bulk email. Only contact people who have an existing relationship with your business or who have opted in. Do not use Modules to blast purchased, scraped, or harvested contact lists.
Comply with anti-spam law. CAN-SPAM in the United States, and the equivalent rules wherever your recipients are (CASL, GDPR, PECR, and others). Accurate sender details and subject lines, a working unsubscribe mechanism, and a valid physical postal address in commercial mail.
Honor opt-outs. Process unsubscribe and stop-contacting requests promptly and make sure your Modules respect the suppression list. A Module that keeps emailing someone who opted out is a violation of this policy, whether or not you noticed.
Do not pass an automated message off as human-authored. Do not claim a named person wrote something a Module generated, and do not deny that a conversation is automated when someone asks. See our AI Disclosure for what we expect you to tell recipients.
Get consent before texting or calling. Only text or call numbers you have consent to contact, honor STOP and do-not-call requests immediately, and respect reasonable calling hours. This is required by the TCPA and similar state laws (see Terms § 17) whether or not your recipient is in the United States.
Get recording consent where required. If a call is recorded, obtain the consent your jurisdiction requires before or at the start of the call.
Register your own A2P 10DLC brand and campaign. SMS sent through your connected number must run under your own registered 10DLC brand and campaign, not a shared or unregistered one.
No unsolicited prerecorded or artificial-voice marketing. Do not use the Module to place prerecorded or artificial-voice marketing calls without the prior express written consent the law requires for that call type.
Respect platform rules. Discord, Telegram, and any other service you connect have their own terms and rate limits. Follow them.

You are responsible for reviewing and approving consequential communications before they go out. If a message would bind you, advise someone, or damage a relationship if it were wrong, a human should read it first.

5. Regulated data limits

Data you may not put into Raileon

Protected health information (PHI). Raileon is not a HIPAA business associate and we do not offer a Business Associate Agreement. Do not upload, transmit, or have your Modules process PHI as defined by HIPAA. If your work involves patient data, Raileon is not the right tool for it.
Cardholder data. Do not put full payment card numbers, magnetic-stripe data, or security codes (CVV/CVC) into the platform. Raileon is not PCI DSS certified. Payments for the service are handled by our payment processor and card details never reach your workspace.

Data that needs care

Attorney-client privileged material. You may process privileged and confidential client material, but do it deliberately. Content you submit is processed by third-party AI providers. On Raileon-managed AI the contract prohibits training on your data; if you connect your own AI account, your terms with that provider decide whether it may. Your workspace runs in an isolated per-customer container, but the decision about whether a particular disclosure is consistent with privilege, your engagement terms, and your clients' expectations is yours, not ours. Where informed client consent is required, get it first.

Your professional obligations are your own. If you are a lawyer, accountant, financial adviser, or other regulated professional, you remain responsible for your bar rules, licensing body, competence and supervision duties, conflict checks, and client confidentiality obligations. Using an AI Module does not transfer any of that to us.

What we do not have, stated plainly: Raileon has no SOC 2 report, no ISO 27001 certification, no third-party penetration-test report, and no HIPAA Business Associate Agreement. We are not going to imply otherwise. What we do have is per-customer container isolation, encryption in transit (TLS 1.2+) and at rest, and encrypted backups. Decide what your compliance posture needs before you bring regulated data anywhere near the platform.

6. Scraping, crawling, and connected services

Modules can browse the web and act inside services you connect. When they do, they act under your name and your credentials, so they follow your obligations to those sites and services.

Respect robots.txt and other robots directives, published crawl policies, and rate limits.
Comply with the terms of service of every site and connected application. If a service prohibits automated access, do not automate it.
Do not circumvent paywalls, logins, CAPTCHAs, IP blocks, or any other technical access control.
Do not bulk-harvest personal data, contact details, or copyrighted databases.
Only connect credentials that belong to you or that you are authorized to use, and only grant the scopes the task actually requires.

7. Resource abuse and fair use

Your workspace runs in a dedicated container with finite CPU, memory, storage, and network capacity, sharing host infrastructure with other customers. Use it for the Module work you signed up for. Specifically, do not:

Mine cryptocurrency, or run distributed computing, model training, or rendering workloads unrelated to your Modules.
Proxy, relay, tunnel, or anonymize third-party network traffic through your container, or operate it as a VPN or open proxy.
Use the platform as general file storage, a content delivery network, or a torrent client.
Launch denial-of-service attacks, load tests, or traffic floods against us or anyone else.
Deliberately generate excessive API volume, run runaway loops, or otherwise consume shared capacity in a way that degrades service for other customers.

If your usage threatens the health of the host or other tenants, we may throttle or pause the offending workload while we contact you. We will always tell you what we did and why.

8. Security

Isolation between customers is the single most important property of this platform. Do not test it uninvited.

No reverse engineering. Do not decompile, disassemble, or otherwise attempt to derive the source code, system prompts, model configuration, or underlying architecture of the platform.
No unauthorized security testing. Penetration testing, vulnerability scanning, fuzzing, and automated security tooling against Raileon infrastructure require prior written authorization from security@raileon.com. Unauthorized testing is treated as an attack.
No escaping your tenancy. Do not attempt to break out of your container, reach the host, access another customer's network or data, or escalate privileges.
No competitive extraction. Do not benchmark the platform for publication, or use its outputs to develop, train, or fine-tune a competing AI model or service.

Responsible disclosure

If you find a vulnerability, tell us at security@raileon.com and give us a reasonable window to fix it before disclosing it publicly. We will not pursue action under this policy against good-faith research that reports promptly, stops at proof of concept, does not access, modify, or exfiltrate anyone else's data, and does not degrade the service. Include enough detail for us to reproduce the issue.

9. Enforcement

Most violations are mistakes: a misconfigured Module, an outreach list that should not have been imported. We handle those with a conversation, not a shutdown. Our normal escalation is graduated:

Step	When we use it	What happens
1. Notice	First or minor violation, or something that looks like a misconfiguration.	We email you, explain the problem, and give you a deadline to fix it. Service keeps running.
2. Suspension	The notice deadline passed, the behavior repeats, or the violation is serious.	We pause the offending Modules or the workspace. Your data stays intact and you can still reach us.
3. Termination	Suspension did not resolve it, or the violation is severe enough that continuing is not an option.	We end the service under your Service Agreement. The 7-day data export window applies unless the law forbids it.

Immediate suspension without prior notice is reserved for cases where waiting would cause damage: active harm to a person, clearly illegal activity, an active security threat or compromised account, sustained abuse of shared infrastructure, or a binding legal demand. We will tell you what happened as soon as we reasonably can after acting.

Appeals. If you think we got it wrong, email admin@raileon.com with your account details and what you believe we misread. A human reviews every appeal and we aim to respond within five business days. If we were wrong, we restore service and say so.

Enforcement under this policy does not entitle you to a refund of fees already paid, and it does not limit any other remedy available to us under your Service Agreement or the Terms of Service.

10. Reporting a violation

If you have received something abusive from a Raileon Module, or you believe a customer is using the platform against this policy, tell us. Pick whichever address fits:

Abuse, spam, or misuse: admin@raileon.com
Security vulnerabilities or an attack in progress: security@raileon.com
Privacy and data-protection concerns: privacy@raileon.com

Please include what happened, roughly when, and anything that helps us trace it: full email headers, message links, screenshots, or the sending address. Tell us how to reach you if we need more detail. We review every report, act where the report holds up, and we do not retaliate against people who report in good faith.

SkyRaileon LLC
Miami, Florida
admin@raileon.com