Acceptable Use Policy

Service Velocity · Kraken Services LLC, d/b/a Service Velocity Version: 1.0-draft Effective date: Upon publication (target: before V1 commercial launch) Incorporated into: Cloud Service Agreement

This Acceptable Use Policy ("AUP") governs use of the Service Velocity platform, APIs, and mobile applications (collectively, the "Service"). Violations may result in suspension or termination per the Agreement.

"Customer" means the organization that subscribed to the Service. "Users" means individuals authorized by Customer to access the Service.

Customer and Users may use the Service only:

• For Customer's internal business operations in the field service industry (or other use case approved in writing)
• In compliance with the Agreement, this AUP, and all applicable laws
• Within plan entitlements (users, workspaces, usage limits)
• With valid credentials — no credential sharing

Customer and Users must not:

3.1 Unlawful or harmful activity

• Violate any applicable law, regulation, or third-party rights
• Send spam, phishing, or unsolicited bulk communications
• Harass, threaten, or defraud any person
• Facilitate illegal gambling, controlled substances, or weapons sales

3.2 Security and integrity

• Probe, scan, or test vulnerabilities without Provider's written consent
• Circumvent access controls, rate limits, or tenant isolation
• Introduce malware, viruses, or harmful code
• Access another tenant's data or accounts
• Use the Service to attack third-party systems (DDoS, credential stuffing, etc.)

3.3 Misuse of platform resources

• Mine cryptocurrency or run unrelated compute-intensive workloads
• Scrape or bulk-export data via automated means except through documented APIs within fair-use limits
• Resell, sublicense, or provide the Service to third parties as a hosted offering without written agreement
• Reverse engineer the Service except where prohibited by law

3.4 Prohibited content

Customer must not upload, transmit, or store:

• Prohibited Data as defined in the Common Paper CSA (e.g., full payment card numbers outside integrated payment flows, government ID numbers without agreement, protected health information without BAA)
• Content that is defamatory, obscene, or infringes intellectual property
• Child sexual abuse material (CSAM) — Provider will report to authorities

3.5 AI-specific restrictions

• Do not use AI features to generate deceptive, impersonating, or fraudulent customer communications
• Do not attempt to extract other tenants' data via prompt injection or jailbreaking
• Do not submit sensitive categories of data into AI prompts unless the feature is designed for that purpose

3.6 High-risk activities

The Service is not designed for use in:

• Emergency services, life-critical systems, or medical diagnosis
• Nuclear facilities, air traffic control, or other environments where failure could cause death or catastrophic harm
• Any activity where Service unavailability could create substantial bodily injury or environmental damage

When using SMS, email, or voice features, Customer is responsible for:

• Obtaining required consents and opt-outs (TCPA, CAN-SPAM, CASL, etc.)
• Honoring do-not-contact requests
• Accurate caller ID and sender identification
• Carrier and provider acceptable-use rules

Provider may suspend messaging features if carriers flag Customer traffic.

Customer must use integrated payment processors only as intended. Customer may not use the Service to store or process raw card data outside PCI-compliant flows provided by Helcim, Square, Stripe, or Paddle.

Where Customer enables GPS or geofencing:

• Customer must provide appropriate notice and consent to field technicians per applicable law and Customer's employment policies
• See mobile location policy templates in product documentation

Provider may monitor use for security, abuse prevention, and compliance with this AUP. Provider does not routinely review Customer Content except:

• As needed to provide the Service
• In response to support requests
• When required by law
• To investigate suspected violations

Enforcement steps (may vary by severity):

1. Warning and request to cure 2. Feature suspension (e.g., messaging, AI) 3. Account suspension 4. Termination per Agreement

Provider will attempt to notify Customer before suspension except where immediate action is necessary to protect the Service, other customers, or comply with law.

Report suspected violations: abuse@servicevelocity.ai

Material changes to this AUP will be posted at /legal/acceptable-use with at least 30 days' notice to account administrators.

Legal / compliance: legal@servicevelocity.ai

*Draft for counsel review — incorporated by reference into the CSA Framework Terms.*