Acceptable Use Policy

This policy applies to everyone who uses the platform: account holders, their team members, and anyone acting through their credentials or API keys. It forms part of the Terms of Service, and breaching it is a breach of those terms.

You are responsible for the conduct of everyone in your organisation’s workspace, including contractors and agencies acting on your behalf.

Legitimate business-to-business activity by your own organisation: identifying companies that match your ideal customer profile, finding the people responsible for the relevant budget, and contacting them in their professional capacity about something plausibly relevant to their job.

Everything below follows from that.

• No scraping, crawling, harvesting or automated extraction of the interface. Use the features provided for getting data out.
• No scripting, automating or replaying requests to the application to obtain data outside the normal interface, and no reverse engineering of internal endpoints.
• No bulk enumeration — walking identifiers, paging systematically through results, or issuing high-volume queries designed to copy the database rather than answer a question.
• No using another product, agent or service to drive the platform on your behalf in order to achieve any of the above.

• No selling, licensing, sublicensing, renting, publishing or otherwise supplying our data to anyone outside your organisation.
• No using it to build, train, seed, enrich or improve a competing database, data product or lead-generation service.
• No operating a lead-generation service for third parties on the back of your subscription. Agencies contacting prospects for a named client should tell us — that use can be licensed, but not by default.
• No presenting our data as your own proprietary database, and no stripping or altering provenance information.

These restrictions continue to apply after your account closes.

The platform holds data about people in their professional capacity, on the basis that they will be contacted about business matters. Using it for consumer marketing breaks that basis and is prohibited.

• No business-to-consumer marketing of any kind.
• No contacting people at personal email addresses or personal phone numbers obtained through the platform.
• No promoting consumer products, personal finance offers, recruitment spam to individuals as consumers, or anything unrelated to the recipient’s professional role.
• No adding contacts to consumer marketing lists, SMS campaigns or automated dialler systems.

• No harassment, intimidation, threats or abuse.
• No repeated contact after someone has asked you to stop. One clear opt-out ends the conversation, in every channel.
• No doxxing, no publishing someone’s details, and no using the platform to compile information about an individual for a personal rather than a commercial purpose.
• No contacting people about anything unlawful, discriminatory, deceptive or fraudulent.
• No impersonating another person, company or Bluvense itself.

Outbound messaging is your responsibility as a controller. You must comply with the rules that apply where your recipients are, including the GDPR and UK GDPR, the Privacy and Electronic Communications Regulations, and the CAN-SPAM Act.

• Be honest about who you are. No forged or misleading headers, no deceptive “From” or subject lines, no pretending to be replying to an earlier conversation that never happened.
• Include what the law requires. A valid physical postal address and a clear indication that the message is a commercial approach.
• Provide a working opt-out in every message, and honour it promptly — within ten business days under CAN-SPAM, and without undue delay under the GDPR.
• Maintain your own suppression list and check against it before every send, including for records you exported earlier.
• Be able to evidence your lawful basis for each recipient. Where consent is required for the channel or the territory, hold it before you send.

Do not use the platform to send bulk unsolicited messages, to relay mail through our systems, or to operate any activity that would get a sending domain blacklisted.

The platform is built for business identifiers. The special categories under Article 9 of the GDPR — health, racial or ethnic origin, religious or philosophical belief, political opinion, trade union membership, sexual orientation or sex life, genetic and biometric data — are out of scope, and so is criminal offence data.

• No attempting to identify, infer, derive or reconstruct special-category data from records, names, employers or any combination of fields.
• No enriching, cross-referencing or combining our data with other sources in order to build profiles of that kind.
• No using the platform to target or exclude people on the basis of a protected characteristic.
• No uploading special-category data into your workspace.

If you come across a record that appears to contain sensitive personal data, tell us at support@bluvense.com and we will remove it.

• One account per person. Do not share a login, a password, or a session with anyone — including colleagues.
• Add team members to your organisation instead. Roles and permissions exist so that access can be granted properly and revoked cleanly.
• Do not share, publish or commit API keys, and do not let a third party use your credentials to access the platform on your behalf.
• Do not use one subscription to serve multiple businesses or clients as if each had their own.
• Report a suspected compromise immediately. We will revoke the affected sessions.

Credit allowances, plan limits and rate limits are how the service stays affordable and available. Working around them is a breach of this policy even where it is technically possible.

• No creating multiple accounts or organisations to obtain repeated free trials or extra credits.
• No disposable, temporary or throwaway email addresses at sign-up.
• No rotating IP addresses, proxies or VPNs to evade sign-up, sign-in or rate limits.
• No using the public assistant as a general-purpose model proxy, and no automating it to exhaust the free allowance.
• No tampering with client-side code, requests or responses to alter credit accounting, entitlements or limits.
• No exploiting a bug or pricing error in your favour. Report it instead — we would rather fix it.

• No attempting to access another organisation’s workspace, account or data.
• No probing, penetration testing or vulnerability scanning without our prior written permission.
• No interfering with the security controls — the Content Security Policy, CSRF protection, session handling, authentication or rate limiting.
• No uploading malware, and no using the platform to distribute it or to phish anyone.
• No denial-of-service activity, and nothing that degrades availability for other customers.
• No reverse engineering, decompiling or attempting to derive our source code, scoring methodology or database structure.

If you find a security vulnerability, report it to support@bluvense.com before disclosing it anywhere else. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

Enforcement is proportionate. Most problems are a misunderstanding and are resolved with an email. Where they are not, we may:

• Apply or tighten rate limits on your account.
• Suspend credit spending, exports or API access.
• Suspend or terminate the account and any related accounts.
• Withhold refunds for the period in which the breach occurred, as set out in the Refund & Cancellation Policy.
• Report unlawful activity to the relevant authorities, and cooperate with a lawful investigation.

Where circumstances allow we will warn you first. For serious breaches — bulk extraction, resale, attacks on the platform, unlawful use — we may act immediately and without notice. Access to security- and permission-relevant actions is logged, and those records are what we rely on when investigating.

To report abuse of the platform, a security issue, or a record that should not be in our database, write to support@bluvense.com. You do not need an account to do so.

We will update this policy as the product gains capabilities that need rules of their own — exports, the public API and the autonomous agent in particular. The date at the top reflects the current version, and account holders will be told by email about material changes.