Draft pending legal review. This document is published for transparency during the closed access program and is not yet in force. Open drafting points are marked in the text.

Acceptable Use Policy

Version: 0.1-draft Effective date: not yet in force (draft)

Draft pending review by a qualified Romanian lawyer before use.

1. Purpose and scope

1.1 This Acceptable Use Policy ("AUP") sets out the rules for using 1ads, the platform operated by ALTTAB PROFIT SRL, a limited liability company, CUI RO17030480, registered with the Trade Register under no. J2004020548403, EUID {{EUID}}, with its registered seat at Str. Doamna Oltea nr. 70, Sector 2, Bucharest, postal code 020231, Romania (the "Company"). The platform includes the web application at https://app.1ads.net, its AI Features, automations (including Performance Guardian, Trend Radar and Web Intelligence), the client approval portal, white-label instances, the public REST API and the MCP server (together, the "Platform").

1.2 This AUP forms part of the Terms (terms-of-service.md) and of every Order Form. Capitalised terms that are not defined in this AUP have the meaning given to them in the Terms.

1.3 This AUP applies to the Customer, to all Authorized Users and to anyone to whom the Customer gives access to the Platform, including End Clients and End Client Users using the Client Approval Portal or white-label instances, and MCP clients, scripts or AI agents that act on behalf of an Authorized User. The Customer is responsible for their compliance with this AUP.

1.4 The Platform is offered exclusively to businesses and professionals (B2B). It is not intended for consumers.

1.5 This AUP works together with: (a) the Brand Safety and Sensitive Content Policy (brand-safety-and-sensitive-content-policy.md), which sets the minimum safeguards the Platform applies to sensitive topics (the "platform floor"); (b) the AI Transparency Notice (ai-transparency-notice.md), which explains the AI Features and the Customer's labelling obligations; and (c) the Security Overview (security-overview.md), which includes our vulnerability disclosure rules. If this AUP and the Brand Safety and Sensitive Content Policy set different rules for the same situation, the stricter rule applies. The AI Transparency Notice and the Security Overview are informational and do not create obligations beyond those in the Terms and this AUP; security testing is permitted only as set out in Section 12.2(f) of the Terms, which refers to the vulnerability disclosure rules in Section 13 of security-overview.md.

2. Core principles

2.1 You decide, you publish, you are responsible. The Platform analyses data and proposes changes, concepts and content. Changes on ad accounts and publications run only after an authorised human approves them (or, where later made available, under an auto-approval policy configured by the Customer within the Platform's hard caps). When an Authorized User approves a proposal, the approval is the Customer's decision. The Customer is responsible for its campaigns, content, targeting and data.

2.2 Follow the law and the rules of each Third-Party Platform. The Customer must comply with the laws of every country where its ads or posts are shown, and with the policies of every Third-Party Platform it connects to or publishes on.

2.3 Do not work around safeguards. Safeguards (approvals, hard caps, brand-safety gates, AI labels, rate limits, security controls) exist to protect the Customer, people affected by ads, the Company and our access to Third-Party Platforms. Circumventing them is a breach of this AUP even if no harm results.

3. Advertising and content rules

The Customer must not use the Platform to create, approve, schedule, publish, target, place or measure any of the following:

3.1 Unlawful, deceptive or unfair advertising, including: (a) false or misleading claims about price, discounts, availability, origin, composition, performance, results or the identity of the advertiser; (b) health, nutrition or medical claims without the substantiation or authorisation required by law; (c) environmental claims that are vague, unsubstantiated or otherwise prohibited, including under the rules of Directive (EU) 2024/825 on empowering consumers for the green transition, as applicable from 27 September 2026 under national transposing law; (d) hidden advertising, advertorials not identified as advertising, fake scarcity (for example false countdown timers or "only 2 left" claims), bait pricing and other unfair commercial practices under Directive 2005/29/EC and Romanian Law no. 363/2007; (e) fake, purchased or AI-generated reviews, ratings, testimonials or endorsements presented as genuine; (f) comparative advertising that does not meet the conditions of Directive 2006/114/EC and Romanian Law no. 158/2008, for example comparisons that are not objective, not verifiable, compare products that do not meet the same needs, denigrate competitors, create confusion with a competitor, or take unfair advantage of a competitor's trademark.

3.2 Content or ads that violate Third-Party Platform policies, such as the Google Ads policies, Meta Advertising Standards and Community Standards, TikTok Advertising Policies and Community Guidelines, LinkedIn Advertising Policies, Microsoft Advertising policies, Amazon Ads policies, YouTube Community Guidelines, the X Rules or Pinterest policies. The Customer must not use the Platform to evade Third-Party Platform enforcement, for example by cloaking landing pages, re-creating disapproved ads with cosmetic changes, rotating accounts or circumventing account restrictions.

3.3 Regulated products and services, unless the Customer holds every licence required and complies with all applicable advertising restrictions (including age restrictions and Third-Party Platform authorisation programmes). This includes, for example, gambling, alcohol, tobacco and nicotine products (including e-cigarettes), medicines and medical devices (advertising of prescription-only medicines to the general public is prohibited), food supplements, financial and investment products, crypto-assets, weapons, adult products, dating services and cosmetic medical procedures. The Customer must enable these categories in the brand profile, as described in brand-safety-and-sensitive-content-policy.md, and must never target minors with them.

3.4 Ads that exploit or unlawfully target minors, including direct exhortations to children to buy products or to persuade their parents to buy them, content that exploits minors' inexperience or credulity, and audiences built to reach minors with profiling-based advertising where the law or the Third-Party Platform prohibits it.

3.5 Political, electoral and social-issue advertising. (a) European Union. The Platform does not support political advertising within the meaning of Regulation (EU) 2024/900 on the transparency and targeting of political advertising ("TTPA"), in particular messages by, for or on behalf of a political actor, and messages liable and designed to influence the outcome of an election or referendum, a legislative or regulatory process, or voting behaviour. The Platform also does not support ads that a Third-Party Platform classifies as social-issue, electoral or political ads. The Customer must not use the Platform to plan, create, approve, target, schedule, place or measure such ads aimed at audiences in the EU. (b) Outside the EU. During the closed access programme, political and electoral ads are not supported outside the EU either. No Order Form can make an exception during the closed access programme. (c) Organic content. Unpaid posts on social, civic or public-policy topics are subject to the gates in brand-safety-and-sensitive-content-policy.md. They are allowed only if they are not liable and designed to influence the outcome of an election or referendum, voting behaviour or a legislative or regulatory process. Content that is liable and designed to have that effect is political advertising under Article 3(2) of the TTPA even when it is not paid for by the brand, where it is produced for remuneration (for example by an agency) or through in-house activities or as part of a campaign. The Customer must not create, schedule or publish such content through the Platform. Paying to promote such posts, or producing them for or on behalf of a political actor, also makes them political advertising.

3.6 Exploitation of tragedies, disasters and crises. Content that seeks commercial advantage from natural disasters, accidents, terrorist attacks, armed conflicts, epidemics, deaths, missing persons or periods of national mourning (for example a discount linked to a disaster, a product shown in disaster imagery, or promotional use of a hashtag created around a tragedy). Non-promotional messages (condolences, safety information, verified relief information, service updates) are allowed only as described in brand-safety-and-sensitive-content-policy.md.

3.7 Hate, harassment and threats, including content that attacks or dehumanises people based on protected characteristics, bullying, threats, doxxing, and the use of the Platform's comment or message features to harass, intimidate or spam people.

3.8 Discriminatory targeting. Targeting, exclusions, lookalike or similar audiences, or creative that unlawfully discriminates based on racial or ethnic origin, nationality, sex, gender identity, sexual orientation, religion or belief, disability, age, or other protected characteristics, in particular in ads for employment, housing, credit, insurance or education. The Customer must comply with Romanian anti-discrimination law (Government Ordinance no. 137/2000), equivalent laws in other target countries, and the special ad category rules of Third-Party Platforms.

3.9 Use of special-category or criminal-offence data. Uploading, inferring or using special categories of personal data (Article 9 GDPR: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation) or data relating to criminal convictions and offences (Article 10 GDPR) for targeting, audience creation, personalisation or measurement, and instructing the AI Features to infer such characteristics about individuals. Online platforms are also prohibited from presenting ads based on profiling with such data under Article 26(3) of Regulation (EU) 2022/2065 (Digital Services Act, "DSA"); the Customer must not try to achieve that result through the Platform.

3.10 Misleading AI-generated content and deepfakes. (a) AI-generated or manipulated images, audio or video of a real, identifiable person (their face, body or voice) without that person's documented prior consent covering the specific use. Sexualised content of real persons, and any synthetic depiction of a minor, is prohibited in all cases. (b) AI-generated content presented as genuine evidence, for example synthetic "customer" photos, synthetic before-and-after results, fabricated news articles or screenshots, or fake endorsements by celebrities, experts, doctors or public authorities. (c) Publishing AI-generated content without the disclosures required by Article 50(4) of Regulation (EU) 2024/1689 (the "AI Act") or by Third-Party Platform rules. (d) Intentionally removing, altering or obscuring C2PA Content Credentials, watermarks or AI labels applied by the Platform or by a Third-Party Platform in order to hide that content is AI-generated. (e) Impersonating any person, brand, organisation or public authority.

3.11 Infringement of intellectual property and personality rights, including: (a) memes, images, video clips or characters used without a licence or a legal exception that applies to the specific commercial use; (b) music used without the necessary rights (music libraries on social networks often restrict commercial use by business accounts); (c) third-party logos, trademarks or trade dress, except lawful descriptive or comparative use; (d) the image, name or voice of a person without the consent required by law (including Articles 58 and 73 of the Romanian Civil Code); (e) prompts designed to reproduce a specific protected work, logo or trademark. The Customer must check Outputs for similarity to existing works, marks and people before using them.

3.12 Undisclosed influencer and creator marketing. Commercial communications must be clearly identifiable as such, for example using the Third-Party Platform's paid-partnership tools and clear labels such as "#publicitate" or "#reclamă" in Romania, in line with Directive 2005/29/EC, Law no. 363/2007 and Third-Party Platform branded-content policies. Where a content creator qualifies as a provider of an on-demand audiovisual media service under the rules of the Romanian National Audiovisual Council (CNA Decision no. 116/2026, applicable from 27 September 2026), the creator must also comply with Law no. 504/2002 and the Audiovisual Code (CNA Decision no. 573/2025); according to public reports, this includes starting videos that contain advertising with the statement "Acest program conține publicitate" and disclosing the advertising in the description. Brands and agencies should include these requirements in their contracts with creators. The Platform must not be used to disguise ads as organic or user-generated content.

3.13 Spam and inauthentic behaviour, including bulk unsolicited messages, automated direct messages that breach Third-Party Platform rules, fake accounts, purchased likes or followers, engagement pods, coordinated inauthentic behaviour and astroturfing.

3.14 Other illegal content, including child sexual abuse material (which we report to the competent authorities), terrorist content, the sale of illegal or counterfeit goods, and content or transactions that breach sanctions.

4. Data rules

4.1 Lawful basis and notice. The Customer may upload or connect personal data (for example customer lists, CRM records, ecommerce orders or conversion events) only if it has a valid legal basis under the GDPR, has given the people concerned the information required by Articles 13 and 14 GDPR, and has collected any consent required by law, including consent for cookies and similar technologies under Romanian Law no. 506/2004 and the consent requirements of Third-Party Platforms (for example for customer-list audiences and server-side conversion uploads). For this data the Customer is the controller and the Company acts as its processor under the Data Processing Agreement (data-processing-agreement.md).

4.2 Hashing is not anonymisation. Hashed email addresses and phone numbers remain personal data. The Customer must have the same legal basis for hashed identifiers as for the original data.

4.3 No purchased, rented or scraped contact lists unless every person on the list has validly consented to the specific use and the Customer can prove it.

4.4 Data minimisation. The Customer must not upload more personal data than the feature needs, must not upload special-category data (see section 3.9), and must not upload data about children except where strictly necessary and lawful.

4.5 Social comments and messages. Comments and direct messages retrieved from the Customer's connected social accounts may be used only to read, answer, moderate and analyse interactions with those accounts. They must not be exported to build profiles of individual people. They are retained by default for 30 days.

4.6 Third-Party Platform data restrictions. Data obtained from Third-Party Platforms must be used only as their terms permit. In particular, the Customer must not: (a) sell, license or broker data obtained from Meta or other Third-Party Platforms, or ask the Company to combine such data across customers; (b) store LinkedIn member data beyond the limits set by LinkedIn's API terms (the Platform keeps it for no more than 24 hours); (c) use Platform data for surveillance, to track or monitor specific individuals, or to make eligibility decisions about people (for example for employment, housing, credit or insurance); (d) disclose such data to law enforcement or intelligence agencies except where required by law.

4.7 Data from third-party data providers. Market, search, trend and news data supplied through the Platform (for example from DataForSEO, SerpApi or news providers), and Outputs derived from it, may be used only for the Customer's internal business purposes. The Customer must not resell, redistribute or bulk-export such data, use it to build a competing dataset or product, or use it to train machine-learning models, unless the Company has agreed in writing that the provider's terms allow it.

5. Web Intelligence and automated access

5.1 Web Intelligence reads public web pages only. It respects robots.txt and machine-readable text-and-data-mining opt-outs (Article 4(3) of Directive (EU) 2019/790) and does not access content behind logins or paywalls.

5.2 The Customer must not: (a) direct Web Intelligence, or any other part of the Platform, at pages that require login, at paywalled content or at private profiles of individuals; (b) provide credentials, session cookies or access tokens to Web Intelligence; (c) attempt to bypass CAPTCHAs, rate limits, IP blocks, bot detection or other technical protection measures; (d) use the Platform to scrape Third-Party Platforms in breach of their terms.

5.3 Monitoring competitors through public pages, public ad libraries and other lawful public sources is permitted. Obtaining or using a competitor's trade secrets is not.

6. Security and Platform integrity

The Customer must not, and must not allow anyone to:

6.1 upload or distribute malware, phishing pages or malicious links or files;

6.2 test, scan or probe the security of the Platform except as permitted by Section 12.2(f) of the Terms and the vulnerability disclosure rules in Section 13 of security-overview.md; perform denial-of-service or load testing; or use the Platform to test Third-Party Platforms or the Company's sub-processors;

6.3 access, or attempt to access, another tenant's data, share credentials, let more people use an account than are designated as Authorized Users, or bypass SSO or multi-factor authentication;

6.4 circumvent usage metering, AI credits, automation slot limits, rate limits or plan limits, or create multiple accounts to obtain free or early access;

6.5 copy, reverse engineer or resell the Platform except as permitted by the Terms or by mandatory law;

6.6 use the REST API or the MCP server other than in accordance with the documentation, the granted scopes and the rate limits. API keys and OAuth tokens must be kept secret. MCP clients, scripts and AI agents connected by the Customer act on behalf of the Authorized User who connected them, and the Customer is responsible for what they do.

7. Rules on AI integrity

7.1 No manipulation of AI Features. The Customer must not try to make the AI Features ignore their instructions, reveal system prompts, secrets or other tenants' data, or bypass safety filters, the brand-safety gate or approval controls. This includes hiding instructions in web pages, product feeds, comments, documents, images or file names that the Platform will read ("prompt injection").

7.2 No bypassing of human approval. The Customer must not circumvent the human-approval model, for example by scripting approvals, sharing an approver's credentials, giving an approver role to a bot or shared account, letting an AI agent approve proposals outside a configured auto-approval policy, or splitting a change into several smaller changes to stay under a hard cap.

7.3 Model provider policies. Use of the AI Features must also comply with the usage policies of the AI model providers listed in ai-transparency-notice.md (currently Anthropic and OpenAI).

7.4 Prohibited AI practices. The Platform must not be used for any practice prohibited by Article 5 of the AI Act, in particular manipulative or deceptive techniques that materially distort people's behaviour and cause or are likely to cause significant harm, or techniques that exploit vulnerabilities due to age, disability or a specific social or economic situation.

7.5 No high-risk or legally significant decisions. The Platform is not designed for, and must not be used for, high-risk uses listed in Annex III of the AI Act (for example recruitment and selection of candidates, creditworthiness assessment, insurance pricing or access to essential services) or for decisions about individuals that produce legal or similarly significant effects (Article 22 GDPR). In particular, the AI Features must not be used to place, target or optimise job advertisements, or to screen or filter job applications (AI Act, Annex III, point 4(a)). Ads for employment, housing or credit must use the special ad category of the relevant Third-Party Platform, and the Customer must not ask the AI Features for audience, targeting or bidding proposals for them.

7.6 Review Outputs before relying on them. Outputs can be wrong (see ai-transparency-notice.md). The Customer must not present Outputs as verified facts unless it has verified them.

8. Reporting and enforcement

8.1 Reporting. Anyone may report content or activity on the Platform that they believe is illegal or breaches this AUP by writing to support@1ads.net. To help us act quickly, a report should include: (a) why the reporter considers the content illegal or in breach; (b) where it is (URL, account, campaign, post or other identifier); (c) the reporter's name and email address (except for reports of child sexual abuse material); and (d) a statement that the reporter believes in good faith that the report is accurate and complete. We confirm receipt, review reports diligently and objectively, and inform the reporter of our decision, as required by Article 16 DSA. Security vulnerabilities must be reported to ops@1ads.net (see security-overview.md).

8.2 Investigation. We do not generally monitor Customer Data. We use automated tools to detect security threats, abuse and spam. In addition, the brand-safety gates apply automatically to content generated, scheduled or published through the Platform; these rules and tools are described in brand-safety-and-sensitive-content-policy.md. Reports and suspected breaches of this AUP are reviewed by a person. When we have reason to believe this AUP has been breached, we may review the relevant content, metadata and logs, limited to what is necessary, in accordance with the Data Processing Agreement (data-processing-agreement.md) and the Privacy Policy (privacy-policy.md).

8.3 Proportionate measures. If we reasonably determine that this AUP has been breached, we may take one or more of the following measures, choosing the least restrictive measure that is effective: (a) a warning and a request to remedy the breach within a reasonable period (normally 5 business days); (b) removing or disabling specific content, proposals or scheduled publications; (c) restricting specific features, such as Trend Radar, image generation, automations, API keys or a specific Third-Party Platform connection; (d) suspending specific Authorized Users; (e) suspending the Customer's account, in whole or in part; (f) terminating the contract in accordance with the Terms. When choosing a measure we consider the severity and duration of the breach, whether it was intentional, whether it is repeated, the actual or likely harm to people, the risk to the Company's access to Third-Party Platforms, and the Customer's cooperation.

8.4 Immediate measures. We may apply a measure under section 8.3(b) to (e) without prior notice only where this is necessary because: (a) the law or an order of a competent authority requires it; (b) there is a risk of serious harm to people; (c) the content is child sexual abuse material or terrorist content; (d) there is a threat to the security or integrity of the Platform or of other customers' data; (e) a Third-Party Platform requires it, or the breach puts the Company's access to a Third-Party Platform at risk; or (f) the breach is serious and repeated. We limit any immediate measure to what is necessary and inform the Customer promptly afterwards.

8.5 Statement of reasons. When we restrict content or an account, we give the Customer a clear statement of reasons that explains what we restricted, the facts we relied on, the contractual or legal basis, whether automated means were used, and how to contest the decision, in line with Article 17 DSA.

8.6 Contesting a decision. The Customer may contest a decision by replying to our notice or by writing to support@1ads.net. Where feasible, the complaint is reviewed by a person who was not involved in the original decision. We aim to respond within 10 business days. This does not limit the Customer's right to go to court.

8.7 Restoration. We lift a measure as soon as the breach has been remedied and the reason for the measure no longer applies.

8.8 Fees during suspension. Subject to the Terms, fees remain payable during a suspension caused by the Customer's breach of this AUP.

8.9 Reports to authorities. Where required by law, we report information to the competent authorities, including where we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of persons has taken place, is taking place or is likely to take place (Article 18 DSA).

8.10 Third-Party Platform enforcement. Third-Party Platforms enforce their own policies independently of the Company and may reject ads, restrict accounts or revoke access. The Company is not responsible for those decisions.

8.11 Express acceptance. Sections 8.3, 8.4 and 8.8 contain clauses that may qualify as unusual clauses under Article 1203 of the Romanian Civil Code (including the right to suspend performance). They are expressly accepted by the Customer in writing in the Order Form (Part L, express acceptance of unusual clauses; see terms-of-service.md and order-form-template.md).

9. Changes to this AUP

9.1 We may update this AUP to reflect changes in the law, in Third-Party Platform policies, in the Platform or in risks we observe. We will notify material changes at least 30 days in advance by email or in the Platform, unless a shorter period is required by law, by a Third-Party Platform or to address a serious risk. The Customer's rights in case of changes are set out in the Terms.

9.2 Each version is identified by a version number and effective date.

10. Contact

Reports of illegal content or AUP breaches: support@1ads.net
Security vulnerabilities: ops@1ads.net
Personal data questions: privacy@1ads.net
General support: support@1ads.net