Acceptable Use & User Content Policy

This policy is part of the Terms of Service. It exists so that Playfair stays safe, reliable and trustworthy for everyone who uses it, and for everyone whose data flows through it. It applies to every account, workspace, share link, embed and API key.

1. What counts as User Content

“User Content” is anything you or your team create, upload, store or share through the Service, including:

• questions you ask and the threads they form;
• saved questions, tags, dashboards, text tiles and their titles;
• table and column descriptions, synonyms, metric definitions, joins and semantic rules;
• corrections and notes on answers;
• files you upload (CSV, XLSX, logos) and data you connect from your sources;
• AI-generated output that you save, pin, share or schedule;
• the content of share links, embeds and scheduled reports.

2. Your responsibilities

You are responsible for your User Content and for making sure that:

• you own it or have every right, licence and consent needed to use it in the Service;
• connecting a data source or uploading a file is lawful, including under data-protection law, and consistent with your obligations to the people whose data it contains;
• the people you share content with are entitled to see it.

3. Prohibited content

You must not create, upload, store or share User Content that:

1. is illegal, or promotes or facilitates illegal activity;
2. infringes intellectual property, privacy, publicity or other rights of others;
3. contains personal data you are not entitled to process, or special categories of data (health, biometric, political opinions, etc.) without a valid legal basis and appropriate safeguards;
4. contains payment card numbers, government identifiers or authentication secrets in free-text fields such as descriptions or questions;
5. is defamatory, harassing, hateful, discriminatory or threatening;
6. sexually exploits or endangers minors — we report such content to the competent authorities;
7. contains malware, exploits or any code designed to harm systems or data;
8. is deceptive, including dashboards presented to third parties as something they are not (for example, impersonating another organisation).

4. Prohibited conduct

You must not:

• attempt to modify, delete or write to any data source through the Service, or to bypass the read-only safeguards, statement validation, timeouts, row caps or cost guards;
• probe, scan or test the vulnerability of the Service, or breach authentication, except through our coordinated disclosure programme at security@asrar.example;
• access another workspace, account or share link without authorisation;
• overload or disrupt the Service, including with automated traffic that exceeds reasonable use or our published rate limits;
• circumvent plan limits, usage meters or the demo session limits, for example by creating accounts in bulk;
• resell, sublicense or provide the Service to third parties as a standalone product without a written agreement with us;
• scrape the Service or use it to build a competing product;
• reverse engineer the Service except where the law expressly allows it;
• use scheduled reports, invitations or share links to send spam or unsolicited messages;
• use the Service to make decisions producing legal or similarly significant effects on individuals based solely on automated output.

5. The licence you give us

To run the Service, we need permission to handle your User Content. You grant Asrar a worldwide, non-exclusive, royalty-free licence to host, store, copy, process, transmit, render and display User Content solely to provide, secure, maintain and support the Service for you and the people you choose to share with. This licence:

• ends when you delete the content, subject to our backup and legal retention periods;
• does not allow us to sell your content, use it for advertising or use it to train AI models;
• allows our subprocessors to process content on our behalf under the Data Processing Addendum.

6. AI-generated output

The Service generates SQL, charts, descriptions, narratives and analyses automatically. You are responsible for reviewing generated output before you save, share, schedule or rely on it. Do not present generated output to others as verified fact without checking the query and the caveats shown with it. See the AI Policy.

7. Public and shared content

Content shared through a public link can be viewed by anyone who has the link. Password-protected and expiring links reduce that risk but do not eliminate it. Shared pages are excluded from search engines. Before sharing, make sure the content does not expose personal data or confidential information to people who should not see it. You can revoke a link at any time.

8. Moderation and enforcement

We do not monitor User Content in advance, and we do not read private workspace content except where needed to provide support you requested, to investigate a report, to keep the Service secure or to comply with the law. When we become aware of content or conduct that violates this policy, we may, proportionately to the severity and recurrence:

1. contact the workspace Owner and ask for the issue to be fixed;
2. disable a share link, embed, schedule or integration;
3. restrict or remove specific content;
4. suspend a user, a workspace or an API key;
5. terminate the account, and report to the competent authorities where required by law.

We inform the affected user of our decision and the reasons for it, unless the law prevents us or doing so would compromise an investigation or someone’s safety.

9. Reporting abuse

If you believe content accessible through Playfair — for example, a public dashboard — is illegal or violates this policy, report it to abuse@asrar.example. Please include:

• the link to the content (share link or embed URL);
• why you believe it is illegal or violates this policy, with enough detail for us to assess it;
• your name and email address (you may report anonymously, but we cannot then follow up with you);
• for intellectual-property claims, a statement that you are the rights holder or authorised to act for them.

We acknowledge reports without undue delay, review them diligently and objectively, and tell you what we decided.

10. Appeals

If we removed your content or restricted your account and you think we made a mistake, reply to our notice or write to legal@asrar.example within six months. A person who was not involved in the original decision will review it. You also keep every right to seek redress before the courts.

11. Repeat infringers

We terminate, in appropriate circumstances, the accounts of users who repeatedly infringe intellectual-property rights or repeatedly violate this policy.

12. Changes

We may update this policy to address new risks or legal requirements. Material changes follow the notice and acceptance process described in the Terms of Service.

13. Contact

Abuse reports: abuse@asrar.example · Security: security@asrar.example · Legal: legal@asrar.example