Acceptable Use Policy

01 Scope and responsibility

This Policy forms part of the CORD Terms and Conditions (the “Terms”) and governs the use of the account, the organization, the API, the MCP server, public links, documents, email, payments, invoicing, artificial intelligence, webhooks and integrations of CORD. “Flouvia”, “Customer”, “CORD” and other defined terms have the meaning given to them in the Terms.

The Policy binds the Customer and anyone who uses CORD with its credentials: owners, members, guests, systems connected through the API and assistants connected through the MCP server. The Customer is responsible for managing its team’s permissions, protecting its credentials and obtaining the authorizations its data, content and instructions require. The Customer may not use CORD or any Flouvia provider to do anything it could not lawfully do itself.

02 Prohibited conduct

The Customer shall not use CORD to:

• break the law, an order of an authority or the rights of others;
• impersonate another person, forge authorizations, hide the real issuer or mislead about the origin, price, recipient or nature of a transaction;
• harass, threaten, discriminate against or exploit others, or disclose confidential or personal information without a legal basis;
• infringe intellectual property, privacy or trade secrets;
• distribute malware, phishing, spam or exploitative material.

International sanctions. CORD may not be used by persons or entities listed on the sanctions lists of the United Nations Security Council, the U.S. Office of Foreign Assets Control (OFAC), the European Union or the United Kingdom, or by anyone acting on their behalf. Nor may CORD be used for transactions with countries or regions subject to comprehensive sanctions by those jurisdictions. The Customer represents that it is not in that situation and shall notify Flouvia if that changes.

03 Restricted businesses

To use Cord Payments, the Customer’s business must comply with Stripe’s list of prohibited and restricted businesses. To collect payments with Mercado Pago, it must comply with Mercado Pago’s prohibited activities policies. Those lists include, among others, gambling, adult content, weapons and certain virtual assets, and apply in the version each provider publishes.

In addition, regardless of the payment method, the Customer may not use CORD to sell illegal goods or services, or regulated ones without the licenses and controls the law requires.

04 Invoicing, payments and collections

The Customer shall not:

• simulate transactions or issue documents for transactions that did not happen;
• evade taxes;
• alter evidence;
• manipulate prices or identifiers;
• charge without authorization or use payment data obtained improperly;
• conceal refunds;
• dispute fraudulently;
• launder money or finance unlawful activities.

The Customer shall not present as an invoice, a confirmed payment or an authority’s response anything that is not one: a commercial or proforma document, a document marked “NO TAX VALIDITY”, a pending status or an internal record. It will use true issuer and recipient data and correct errors through the applicable procedure.

In collections, the Customer shall not harass, threaten non-existent consequences or contact third parties unrelated to the debt. Nor will it keep collecting from someone who asked it to stop where the law requires, or invent balances, interest, authority or acceptances. An installment plan requires the debtor’s express acceptance.

05 Security, artificial intelligence and vulnerability reports

The Customer shall not:

• attempt unauthorized access or bypass authentication, permissions, isolation between organizations, quotas, limits or anti-fraud controls;
• test credentials or cards;
• introduce malicious code;
• interfere with CORD’s availability;
• extract data from other organizations;
• use automation to overload CORD or third parties.

API keys, tokens, public links, certificates and provider credentials may only be used for their purpose and by authorized persons. The Customer shall not configure integrations to unsafe destinations or give an assistant connected through the MCP server more tools than it needs. An action with external effects requested by an assistant waits for approval by a person at the Customer. Attempting to induce an AI model, through hidden instructions in documents, emails or servers, to reveal secrets, bypass controls or carry out unauthorized actions violates this Policy.

The Customer shall not use CORD’s AI to deceptively impersonate a person, commit fraud, threaten, discriminate or carry out unlawful surveillance. Before sending them, it will review AI proposals that affect prices, payments, rights or communications, and will not present a suggestion as a confirmed fact.

Anyone who finds a vulnerability may report it to security@flouvia.com. Scope and commitments are on the Report vulnerabilities page, and the contact also appears in /.well-known/security.txt. Flouvia will not take legal action against anyone who reports in good faith within that scope.

06 Limits and reasonable use

This section is CORD’s only reasonable use rule; the Terms refer to it.

Each plan has resource limits and monthly quotas. An “unlimited” dimension has no ordinary quota, but it does not mean infinite capacity: security, rate, file size and concurrency limits still apply. Flouvia may reject or limit requests that compromise CORD’s operation or that do not show the authorization or quota they require. Special capacity, such as dedicated infrastructure, requires a written agreement.

07 Measures, suspension and appeal

If Flouvia has reasonable evidence of a breach of this Policy, it may take one of these measures, depending on its seriousness:

• ask the Customer to correct it;
• limit the affected feature;
• revoke credentials;
• suspend access for a user or the organization;
• terminate the agreement under the Terms.

Notice. Flouvia will email the organization owner which measure it took, why and how to correct it, and will give a reasonable period to do so before suspending. It will act without prior notice only when urgency, security, fraud, a legal obligation or risk to third parties justify it, and will then give notice as soon as possible.

Appeal. The Customer may appeal a measure by writing to legal@flouvia.com within 15 calendar days of the notice, with its reasons and any evidence. Flouvia will review the measure and reply in writing within 15 business days.

Effects. During a suspension, the Customer can export its data, unless a legal obligation or an investigation prevents it. Suspension does not by itself mean the loss of payments or refunds, which are governed by the Terms, the Payment Terms and applicable law.

Flouvia shares information with providers or authorities when there is a legal obligation, a valid request or a legitimate and proportionate need.

08 Reports of illegal content and final provisions

Point of contact. legal@flouvia.com is Flouvia’s single point of contact for the authorities of the Member States of the European Union, the European Commission and the European Board for Digital Services, and for recipients of the service, under Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act). It handles communications in Spanish and English. Flouvia is in the process of appointing its legal representative in the European Union under Article 13 of that Regulation; in the meantime, authorities and recipients of the service may use this point of contact, and this Policy will be updated with the representative’s details once appointed.

Reports. Anyone can report through that mailbox content they consider illegal or a use of CORD contrary to this Policy. The report must include:

• a sufficiently substantiated explanation of why the content is illegal or contrary to this Policy;
• the exact electronic location of the content, such as its URL, and any additional information needed to identify it;
• the reporter’s name and email address, except where the report concerns one of the offenses of sexual abuse or sexual exploitation of children referred to in Articles 3 to 7 of Directive 2011/93/EU;
• a statement confirming the reporter’s good-faith belief that the information and allegations in the report are accurate and complete.

Handling. Flouvia will acknowledge receipt without undue delay and process each report in a timely, diligent, objective and non-arbitrary manner. A person reviews each report and decides; Flouvia does not use automated means to process reports or to decide on them. Flouvia will notify the reporter of its decision without undue delay, together with the available means of redress.

Statement of reasons. If Flouvia takes a measure under section 7 regarding content or an account, it will inform the affected Customer, by email to the organization owner and no later than when the measure takes effect, of the measure, its scope and its duration; the facts and circumstances relied on, including whether it responds to a report; the legal ground, if the content is illegal, or the provision of this Policy that is breached; and how to challenge it, through the appeal in section 7 and through any other judicial or out-of-court means available under applicable law. It will do so unless a legal obligation or an order from an authority prevents it.

This Policy is read together with the Terms, the Payment Terms, the Invoicing Terms and the Privacy Notice. Governing law and jurisdiction are those in section 16 of the Terms. Amendments follow section 17 of the Terms.