Acceptable Use Policy

This policy is part of the Terms of Service. It applies to you, to every member of your workspace, to agents acting on your instruction, and to anyone using an application you deploy through NovaBuild. If you resell or embed NovaBuild output, you are responsible for the behaviour of your own users under this policy.

1. Be lawful in your own jurisdiction and in the jurisdictions you serve.
2. Do not harm people, whether through content, code or automated conduct.
3. Do not take more than your share of shared compute.
4. Do not attack, probe or degrade the platform or other tenants.
5. Be honest about what your application does and who runs it.

You may not generate, store, host, link to or deploy content that:

• sexually exploits or endangers minors in any way, which we report to the relevant authority without notice;
• is non consensual intimate imagery, or sexual content produced from a real person's likeness without consent;
• incites or celebrates violence, terrorism, genocide or self harm, or provides operational instructions for weapons, explosives or biological, chemical, radiological or nuclear harm;
• harasses, stalks, doxxes, threatens, or targets a person or group with hateful abuse based on protected characteristics;
• is fraudulent or deceptive, including phishing pages, fake stores, fake support desks, romance scams, investment scams and impersonation of a brand, institution or person;
• distributes malware, ransomware, spyware, stalkerware, keyloggers, credential stealers or exploit kits;
• facilitates the sale of illegal drugs, stolen data, forged documents, hacked accounts or trafficked goods and services;
• constitutes unlicensed regulated activity, for example offering securities, gambling, lending, insurance, pharmaceuticals or weapons without the required authorisation;
• infringes copyright, trademark, patent, trade secret, database or publicity rights;
• presents AI generated media of a real person as authentic without clear disclosure.

• Creating multiple accounts or workspaces to multiply free credits, evade quotas, or evade a suspension.
• Sharing a single account across a team instead of adding members, or reselling access to your workspace.
• Manipulating referral, gallery, template or credit systems, including self referral loops and fake signups.
• Reverse engineering platform prompts, extracting our internal system prompts for republication, or using the service to build a competing model of our orchestration layer from scraped internals.
• Misrepresenting NovaBuild as endorsing, reviewing, auditing or certifying your application.
• Using the service to make automated decisions about people, such as credit, employment, housing, insurance or benefits, without human review and lawful basis.

Sandboxes are isolated for a reason. You may not attempt to escape a container, access another tenant's data, read orchestration metadata, tamper with billing or audit records, abuse service accounts, or interfere with rate limits and quotas.

Fair use is enforced technically as well as contractually. Current controls include a cap on concurrent sandboxes per workspace, request rate limits on chat, build and deploy endpoints, per command wall clock limits, disk and memory ceilings inside the container, and an idle reaper that stops machines with no activity.

If your legitimate workload needs higher quotas, email support@novabuild.dev and describe it. We would rather raise a limit for a real use case than have you work around it.

• Do not use prompts designed to extract another user's data, our credentials, or provider system prompts.
• Do not attempt to disable guardrails, safety filters or audit logging in the platform.
• Do not use the agents to generate content in the prohibited categories in section 3, including code whose only purpose is abuse.
• Do not feed untrusted third party content into an agent with full autonomy and then blame the outcome on us. Treat external content as data, not instruction.
• Respect the model providers' own usage policies. A provider ban can force us to stop serving your workspace on that model.

You may automate your own workflow through documented endpoints within your rate limits. You may not send unsolicited bulk email, SMS or messages from a NovaBuild deployment, harvest contact details, or run outreach that breaches anti spam law such as CAN SPAM, CASL, the UK PECR or the Australian Spam Act. Transactional email from your app must include a real sender identity and an unsubscribe path where the law requires one.

You may build in regulated spaces, and you carry the compliance burden. NovaBuild is not a HIPAA business associate, is not PCI certified for cardholder data storage, and is not designed for classified or export controlled material.

• Do not store protected health information, full payment card numbers, or government issued identity numbers in project files or prompts.
• Do not use generated output as the sole decision maker in medical, legal, financial, safety or employment decisions.
• If your application serves children, you are responsible for age assurance and parental consent.
• Tell us before running anything where downtime creates physical risk. Sandboxes and previews are not built for that.

You must have the rights to everything you upload, and you must comply with the licences of open source packages your project installs, including attribution and copyleft duties. Notices of claimed infringement are handled under the Copyright and Trademark policy, which includes our takedown, counter notice and repeat infringer process.

When you publish, you are the publisher. Your deployment must not host prohibited content, must not mislead visitors about who operates it, and must carry its own privacy and cookie notices where required. Custom domains must be domains you control, and we may stop serving a domain whose verification lapses or which is used for abuse.

Report abusive projects, deployments or domains to abuse@novabuild.dev with the URL, a description, and any evidence. Report security weaknesses to security@novabuild.dev under the Responsible Disclosure policy. Report suspected exploitation of a minor to abuse@novabuild.dev with the subject line marked urgent, and we escalate immediately.

1. We triage the report and assign a severity.
2. We review the minimum data needed, which may include project metadata, deployment content and audit logs. We do not read private chat history unless it is necessary to assess severe abuse or we are legally required to.
3. We may contact the workspace owner for an explanation, unless notice would increase harm or destroy evidence.
4. We record the decision and the reason in the platform audit log.

Content that endangers people, clear illegality, active attacks and platform threats bypass the ladder and are actioned immediately.

Every enforcement decision can be appealed by emailing appeals@novabuild.dev within 30 days with the workspace name and your explanation. A person who was not involved in the original decision reviews it, and we aim to answer within 10 business days. If we got it wrong we restore access and any credits consumed by the mistake. Reinstatement after a genuine breach requires the underlying content or conduct to be fixed first.

We update this policy as new abuse patterns appear. The effective date and version at the top reflect the current text, and material changes are announced in the app.

Abuse reports: abuse@novabuild.dev. Security: security@novabuild.dev. Appeals: appeals@novabuild.dev. Everything else: legal@novabuild.dev.