Acceptable Use Policy

Acceptable Use Policy

This Acceptable Use Policy (the "Policy") governs use of the Virtik platform. It is incorporated into the Terms of Service and Online SaaS Subscription Agreement (LEG-001) and into any Master Services Agreement or Order Form that references it. Capitalized terms not defined here have the meanings given in the Terms.

Why this Policy is specific rather than generic. Virtik is a physical security platform. It handles camera and video data, detections, spatial models of real buildings, the live locations of people doing their jobs, and communications during incidents. Misuse of a platform like this harms identifiable people, most of whom are not Virtik's customers and never agreed to anything. This Policy is written accordingly.

Customer is responsible for its own compliance and for that of its Authorized Users, its administrators, and any third party Customer permits to access its Organization.

1. Lawful basis and jurisdiction

1.1 Customer must have a lawful basis for every processing activity it configures, in every jurisdiction where the affected individuals and the monitored premises are located.

1.2 Where a jurisdiction imposes a stricter requirement than another, Customer must satisfy the stricter one for the affected individuals.

1.3 Customer must not assume that a configuration lawful at one Site is lawful at another. Requirements for camera placement, audio recording, employee monitoring, works council consultation, signage, retention and location tracking differ materially between and within countries and US states.

1.4 Virtik does not provide legal advice and does not assess the lawfulness of Customer's configuration.

2. Prohibited surveillance

2.1 Customer must not use the Service to observe, record or analyse:

(a) the interior of a restroom, shower, changing room, locker room, nursing room, medical treatment room, or any other space where individuals undress or receive care;

(b) a residential interior that Customer does not lawfully control, or the interior of a neighbouring property;

(c) a place of worship, a legal consultation, a medical consultation, a union meeting, a grievance or disciplinary hearing beyond what the hearing's own rules permit, or a lawful protest for the purpose of identifying participants;

(d) a location Customer has no lawful right to monitor, including public space where the applicable jurisdiction restricts private monitoring; or

(e) any individual for a purpose unrelated to the security, safety or lawful operation of Customer's premises.

2.2 Customer must not orient, zoom, move or configure a camera to defeat a restriction in Section 2.1, including by capturing a prohibited area incidentally where that capture is foreseeable and avoidable.

2.3 Customer must not use the Service to conduct covert monitoring where applicable law requires notice, consultation or authorization, and must not disable, obscure or misrepresent notices required by law.

3. Discrimination and targeting

3.1 Customer must not use the Service to monitor, flag, profile, track or target any individual or group on the basis of race, colour, ethnicity, national origin, ancestry, immigration status, religion, disability, health condition, pregnancy, age, sex, sexual orientation, gender identity or expression, marital or family status, veteran status, union membership or activity, political affiliation or opinion, or the exercise of a legally protected right.

3.2 Customer must not configure a zone, rule, watchlist, threshold or alert with the purpose or foreseeable effect of applying different scrutiny to individuals on any basis in Section 3.1.

3.3 Customer must not use the Service to retaliate against any individual for raising a safety, privacy, employment, discrimination or legal concern, or for participating in an investigation.

4. Biometric and inference restrictions

4.1 Customer must not use the Service to perform biometric identification or verification, including facial recognition, unless the capability is expressly enabled for Customer in writing by Virtik and Customer satisfies every condition in Section 8.3 of the Terms. Virtik does not enable biometric identification, verification or facial recognition by default or by purchase of a Plan, and does not represent that the Service performs biometric identification. A capability, setting or configuration option that the Service makes technically available, including a policy that an Administrator can record in the Service, is not enablement by Virtik in writing (Section 8.3 of the Terms).

4.2 Customer must not use the Service to infer emotion, intent, deception, aggression, mental state, propensity to offend, or any protected characteristic. Customer must not use the Service for the predictive assessment or persistent tracking described in Section 11.1(d) and (e) of the AI Use and Human Oversight Terms (LEG-007). These restrictions are absolute and are not subject to enablement. See Section 11 of those terms.

4.3 Customer must not maintain a watchlist keyed to biometric data in the Service.

5. Employee, contractor and personnel monitoring

5.1 Where Customer uses the Service in respect of its own personnel, Customer must:

(a) provide the notices, policies and information required by applicable law;

(b) complete any consultation, impact assessment or registration required;

(c) limit monitoring to what is necessary and proportionate to the stated purpose; and

(d) not use security data for an undisclosed purpose such as productivity measurement, break monitoring or performance management, unless separately and lawfully disclosed.

5.2 Location and patrol tracking. Customer must not track an individual's location:

(a) outside their working time or duty period;

(b) after they cease to be within Customer's lawful operational control;

(c) at a granularity or frequency exceeding what the stated purpose requires; or

(d) without the notice required by applicable law.

5.3 Customer must configure retention of personnel, patrol and location data to the shortest period consistent with its stated purpose and applicable law.

6. Audio and communications

6.1 Recording of audio is subject to consent requirements that differ from those applying to video, including all-party consent requirements in some jurisdictions. Customer must not enable audio capture without confirming and satisfying the applicable requirement.

6.2 Customer must not use the Service's communications features to intercept, record or monitor a communication in breach of applicable wiretap, eavesdropping or interception law.

6.3 Customer must not use the Service to send unlawful, harassing, deceptive or unsolicited messages, and must comply with all applicable messaging law and carrier requirements. SMS use is additionally subject to the SMS Terms and Consent Notice (LEG-008).

7. Platform integrity and security

7.1 Customer must not:

(a) attempt to access another customer's Organization, data or configuration;

(b) probe, scan or test the vulnerability of the Service, or breach or circumvent any authentication, authorization, rate limit, entitlement or tenant boundary, except under a written authorization from Virtik;

(c) use automated means to access the Service in a manner that degrades it for others, or exceed documented rate limits;

(d) introduce malicious code, or use the Service to store or distribute it;

(e) misrepresent identity or affiliation, or share credentials;

(f) interfere with logging, auditing or monitoring of the Service; or

(g) remove, disable or interfere with a security control.

7.2 Customer must report a suspected vulnerability or security incident affecting the Service to security@virtik.ai and must not publicly disclose it before Virtik has had a reasonable opportunity to remediate.

7.3 Customer must not use the Service to attack, scan, disrupt or gain unauthorized access to any third-party system.

8. Content restrictions

8.1 Customer must not submit to the Service:

(a) content that is unlawful in the jurisdiction where it is processed;

(b) child sexual abuse material, which Virtik will report to the extent required by law;

(c) content that infringes a third party's intellectual property rights;

(d) credentials, payment card data, or government identification numbers, except where a Virtik feature is expressly designed to receive them;

(e) special category or sensitive personal data, unless Customer has confirmed a lawful basis and any additional condition applicable to it; or

(f) content Customer is contractually prohibited from disclosing to a processor.

8.2 Customer must not upload a spatial model, floor plan or Virtual Site that Customer is not authorized to use, including a copyrighted architectural drawing or a model of premises Customer does not control.

9. Emergency and life-safety misuse

9.1 Customer must not represent to any person that the Service constitutes emergency monitoring, alarm monitoring, dispatch, or a guaranteed response capability. Section 14 of the Terms applies.

9.2 Customer must not configure the Service as the sole mechanism by which a life-safety condition would be detected or escalated.

9.3 Customer must not disable or suppress an alerting path in a manner that would foreseeably prevent a human from becoming aware of a life-safety condition, without an alternative path in place.

9.4 Customer must not use the Service to generate a false report to law enforcement or an emergency service.

10. Resale, benchmarking and competitive use

10.1 Customer must not resell, sublicense, rent or provide the Service to a third party, or operate it as a service bureau, except as expressly permitted by an executed Order Form or a Provider Order.

10.2 Customer must not access the Service to build, train or benchmark a competing product, or publish a benchmark of the Service without Virtik's prior written consent.

10.3 Customer must not extract the Service's models, prompts, workflows, schemas or data structures for use outside the Service.

11. Enforcement

11.1 Reporting. Suspected misuse may be reported to legal@virtik.ai. Security matters should go to security@virtik.ai.

11.2 Investigation. Virtik may investigate suspected breaches. Virtik will limit access to Customer Data during an investigation to what is necessary and will act consistently with the DPA (LEG-010).

11.3 Response. Where Virtik determines that a breach has occurred, Virtik may, proportionately to the breach:

(a) notify Customer and require remediation within a stated period;

(b) disable a specific feature, integration, rule or configuration;

(c) suspend one or more Authorized Users;

(d) suspend the Organization under Section 17 of the Terms; or

(e) terminate for material breach under Section 23.2 of the Terms.

11.4 Immediate action. Virtik may act without prior notice where a breach presents a risk to an individual's safety, to the security of the Service, to another customer, or where required by law. Virtik will notify Customer as soon as reasonably practicable afterwards.

11.5 No obligation to monitor. Virtik does not undertake to monitor Customer's configuration or use for compliance with this Policy, and no failure to detect a breach waives any right.

11.6 Legal process. Virtik's handling of requests from law enforcement and other authorities is described in the Law Enforcement Request Guidelines (LEG-020).

12. Changes to this Policy

12.1 Virtik may update this Policy. Updates take effect as provided in Section 25 of the Terms, and Virtik makes prior versions available as that Section states.

12.2 Language. This Policy is drafted in English. Translations are provided for convenience. In the event of a conflict, the English version controls, except where applicable law requires otherwise.

Version history

END OF DOCUMENT