Acceptable Use Policy

This Acceptable Use Policy is part of NoClick's Developer Terms. It says what you, your users and your agents may not do with the NoClick Platform. Each section opens with a short summary in italics; the summaries help you read the policy and aren't part of it.

1. Who this applies to and how we enforce it

In short: these rules cover you, your users, your code and your agents, and breaking them can get a resource or an account suspended.

This policy applies to everything done through your account: by you, your team, your users, your code, your agents and any AI client you connect. "You" below includes all of them. It applies on top of the rules our vendors set, which the Developer Terms describe.

We may investigate suspected violations, including by reviewing the records of the activity involved. Depending on the harm, we may warn you, stop a single call, pause a resource, suspend a user, a key or your account, remove content, or report to the authorities, as the Developer Terms describe. Several of these rules are also enforced technically, and getting around a technical limit is itself a violation.

2. Never allowed

In short: nothing illegal, harmful, deceptive or abusive, anywhere on the Platform.

Don't use the Platform to:

• break any law, or help someone else break one;
• create, store or send child sexual abuse material, or anything that sexualizes minors;
• threaten, harass, stalk, intimidate or incite violence against anyone, or promote terrorism or violent extremism;
• defraud anyone, run scams or phishing, or collect passwords, card numbers or one-time codes from people who didn't knowingly give them to you;
• impersonate a person, company or government body, or misrepresent who you are or who an agent acts for;
• distribute malware, or build or control botnets;
• infringe anyone's copyright, trademark, privacy or other rights;
• collect or process personal data without a lawful basis or the notice the law requires, or track people without their knowledge;
• make decisions with legal or similarly significant effects on a person, such as about their credit, employment, housing, insurance, education, healthcare or legal rights, without the human review and the notices the law requires;
• deal with anyone on a sanctions list or in a sanctioned country, or export what export control law forbids;
• open several accounts, or create users or keys, to get around a quota, a cap, a review, a suspension or a price;
• share or sell your API keys, or resell the Platform's resources to others as a bare service, such as raw compute, a proxy or tunnel, phone lines or email sending, with nothing of your own product around them;
• probe, attack, overload or interfere with the Platform, our vendors or other customers, or try to reach data that isn't yours.

3. Sandboxes, machines and other compute

In short: compute is for running your product and your agents, not for mining, attacks, spam, proxies or hogging resources. This section is the machines usage policy.

These rules apply to sandboxes, machines, the containers agents run in, and anything else that runs your code or your agents' commands. When NoClick vets your company before its first machine, you accept this section as the machines usage policy.

No cryptocurrency mining. Don't mine or validate any cryptocurrency, run proof-of-work or proof-of-space workloads, or connect to mining pools. Mining ports and known pools are blocked.

No attacks or scanning. Don't scan ports, networks or hosts, probe for vulnerabilities, crack passwords, stuff credentials, or attempt denial of service against any system you don't own or don't have written permission to test. Testing your own systems is fine. Don't try to reach other customers' machines or the host's metadata service; both are blocked.

No bulk or direct email. Don't send email directly from sandboxes or machines; outbound mail ports are blocked. Send email through the Platform's email features (section 6), which handle consent, unsubscribes and reputation.

No open proxies. Don't run open proxies, open relays, public VPN endpoints, Tor exit or relay nodes, or any service that lets the public route traffic through NoClick. A port you expose must serve your own product.

No resource abuse. Use compute for your product's work. Don't run load that exists only to consume capacity, try to get around metering or billing, store or serve material you have no right to share (including through file-sharing networks), or host content this policy forbids.

Network limits. When you limit what a sandbox, machine or agent may reach, don't try to get around the limit, for example through a listed host that relays traffic elsewhere, or by tunneling data through name lookups.

The host's rules. Compute runs on infrastructure providers whose own acceptable use rules apply, and which may suspend a workload for a violation even if you didn't intend or authorize it. If one does, we may stop or delete that sandbox or machine to comply.

Vetting must be true. What you tell us when we vet your company (its name, website, country and what its machines are for) must be true. Using machines for something materially different needs a new submission.

4. Browsers

In short: browsers act for a person on sites they use, within those sites' rules, not for bulk scraping, mass sign-ups or getting around access controls.

Act for a person, with their permission. Sign a browser in only to accounts that belong to the person it acts for, with their permission, through a sign-in they complete themselves. Never put someone else's password into a browser or a browser profile.

Respect each site's rules. Don't use browsers in ways a site's terms forbid. In particular, don't bulk scrape: don't run browsers to copy content or data from a site at a volume or pace beyond what the person they act for could do themselves, when the site's terms forbid automated collection. Bulk scraping is suspended.

CAPTCHAs and access controls. Use automated CAPTCHA solving only on sites whose terms allow it, and turn it off (solve_captchas=False) for any other site. Never use a browser to get past a CAPTCHA, rate limit, paywall or access control that the person it acts for isn't entitled to pass.

No mass accounts or bot buying. Don't create accounts on other services in bulk, use browsers or inboxes to collect other services' sign-up codes at scale, or buy tickets or limited goods in ways that get around a seller's purchase limits.

Payment details. Never put payment card numbers or bank credentials in a prompt, a browser task or a message.

Live views and sign-in links. A live view or sign-in link gives control of a browser to whoever holds it. Send it only to the person it's for.

5. Phone calls, texts and numbers

In short: call only people who asked for it or agreed to it, never for marketing, say up front that it's an automated agent, and follow telecommunications law.

An agent's voice is an artificial voice. Under US law, a call placed with an AI-generated voice is a call made with an "artificial voice" (FCC Declaratory Ruling FCC 24-17, February 2024), so the Telephone Consumer Protection Act and the FCC's rules under it (47 C.F.R. § 64.1200) apply to every call an agent places, along with state law.

Who an agent may call. An agent may place a call only:

• to a person who asked to be called (for example, by asking for a callback), or who gave prior express consent to be called at that number by an automated agent about the subject of the call; or
• to a business, at a number it publishes for its customers, about a request or transaction of the person the agent acts for (for example, to book a table or ask about an order).

Keep a record of each consent (who gave it, when, how, and what they agreed to) and give it to us when we ask.

No marketing calls. Agents may not place calls that advertise or sell goods or services, or that are otherwise telemarketing, even with consent. Don't place calls to numbers from lists you bought, rented or scraped, run dialing campaigns, or place calls nobody asked for. If anyone asks not to be called again, stop calling them at once.

Say who's calling, and that it's an agent. At the start of every call an agent places, it must say whom it's calling for (your business, or the person it acts for) and that it's an automated AI agent. On any call, an agent must say it's automated whenever someone asks, and must give a way to reach the business it acts for when asked. Never make an agent claim to be human.

Calling hours. Unless the person asked to be called at another time, place calls to people only between 8 a.m. and 9 p.m. in their local time, or within stricter hours their state sets.

Recording and transcripts. Every call an agent handles is transcribed, and NoClick records the audio only when you turn recording on (record_calls), which plays "This call is recorded." before the agent speaks. Some states require everyone on a call to agree to it being recorded. Where the law requires notice of, or consent to, a call being recorded, transcribed or handled by an automated system, giving that notice and getting that consent is your responsibility, including for anyone a call is transferred to.

Caller ID. Calls show the number they come from. Don't make calls appear to come from someone else, or use a number to impersonate anyone.

Emergency services. NoClick numbers can't reach 911 or any other emergency service and don't provide the location information emergency services need. Don't have agents call emergency numbers, and don't offer a NoClick number to anyone as a way to reach emergency help.

Texts, where offered. Texting needs your business registered with the US carriers, and every fact in the registration (the legal business name, tax id, website, privacy policy, terms and contact) must be true and must belong to your business, or to the user's business you register for. An agent texts only the person it's on a call with, only after that person agrees during the call, and only what they asked for. Don't send marketing or promotional texts, don't text anyone who opted out until they opt back in, and don't send content the carriers prohibit, including sexual content, hate speech, and content about alcohol, firearms, tobacco, cannabis or illegal drugs. NoClick handles opt-out replies (STOP) automatically in your business's name.

Porting, where offered. Move a number to NoClick only if you, or the user you move it for, are authorized to move it, with a letter of authorization signed by the person authorized on that account. Everything in the letter must match the current carrier's records and be true.

Numbers you connect. A number you connect from your own phone provider stays under that provider's terms, and everything in this section still applies to calls on it.

6. Email

In short: send only email people expect or asked for, keep transactional and bulk mail apart, and follow anti-spam law.

Email agents send. An agent's email, such as a question to a person or an inbox's reply, must relate to something the recipient asked for, is part of, or expects. Inboxes reply only to the person who wrote. Don't use agents or inboxes to send unsolicited commercial email, or to receive mail meant for someone else.

App email, where offered. Use transactional sending for receipts, confirmations, reminders and replies tied to something the recipient did, and send sign-in codes only to the person signing in. Anything promotional, or sent to a list, goes out as a broadcast.

Broadcasts. Broadcast only to people who opted in to email from your app. Never use purchased, rented, shared, scraped or guessed lists. Each broadcast carries your postal address and a one-click unsubscribe; don't send to anyone who unsubscribed until they've confirmed they want mail again, by a link you emailed them.

Anti-spam law. Follow the anti-spam law of each recipient's country, including the US CAN-SPAM Act: truthful sender and headers, subject lines that aren't misleading, a valid postal address in commercial mail, and unsubscribes honored promptly.

Reputation limits. Sending pauses automatically when too many messages bounce or are marked as spam, or when a mailbox provider or blocklist flags the mail. Don't get around a pause by sending from another app, domain, inbox or account. Clean up the list you send to, then ask support to resume.

Content. Never send phishing, malware, links to either, or mail that pretends to come from someone else.

7. AI models and agents

In short: follow the model providers' policies, don't let agents deceive people, and don't turn agents against the Platform or other customers.

• Follow the usage policies of the providers of the AI models your agents use, and don't use any model to generate anything this policy forbids.
• Don't make an agent deny being an AI to someone who sincerely asks, or present its words as a specific real person's.
• Tell people they're dealing with an automated agent wherever the law requires it, for example when an agent tries to sell something to someone in California or to influence their vote.
• Don't use agents to get around the Platform's own controls, such as policies, approvals, network limits and spend caps.
• Don't try to make another customer's agent leak data, act against its owner, or spend its owner's money, whether by prompt injection or any other way.

8. Domain names

In short: where domains are offered, registrants' details must be true, and domains must not be used for DNS abuse or infringement.

• Register domains only in the name of the person or organization that will hold them, with true and complete details, kept current.
• Don't use domains for malware, botnets, phishing, pharming, or spam that delivers any of those.
• Don't register or use names that infringe others' trademarks or imitate brands, banks or government bodies. Search leaves out names that look like well-known brands, but that isn't permission to register the rest.
• Follow the registry's rules for each top-level domain, including the extra requirements for regulated ones (such as .bank, .law or .pharmacy), and the registrar's acceptable use policy.

The registrar or the registry can lock, suspend or delete a domain used for any of these, whatever we decide.

9. Reporting abuse

In short: tell us about abuse and we'll look into it.

Report abuse of the Platform, or a security problem in it, to support@noclick.com, with "Abuse report" or "Security report" in the subject. Say what you saw: the domain, number, address, page or account involved, when, and any evidence. Report copyright infringement to legal@noclick.com, as the Terms of Service describe.