Acceptable Use Policy

1.1 What this policy applies to

• Every page served from webnuvexa.com, and its underlying APIs and forms.
• Anything you submit to us through those pages, including form contents and email.
• Any account, repository, staging environment, shared drive, documentation space or infrastructure that WebNuvexa provides as part of an engagement — including shared client environments, demo instances and trial access.
• Any interaction with WebNuvexa personnel, including by email, direct message or third-party platform.

Where a client agreement contains a stricter or more specific acceptable use policy for an environment we host for them, that policy applies to that environment and this one applies as a floor beneath it. Where they conflict, the stricter rule prevails.

1.2 The basic rule

Do not use anything we give you to cause harm. Everything in sections 3 and 4 is an application of that sentence, not a separate law.

You also accept the Terms of Service and the Privacy Policy when you use this site. This policy adds to those documents; where it is more restrictive, this policy applies.

• Reading anything on this site without an account.
• Sending us an enquiry, requesting a quote, or asking us a question.
• Sending us a security report about a real vulnerability, in good faith, without going further than is needed to demonstrate it. See section 7.
• Crawling or reading public pages for a reasonable purpose, at a rate that does not degrade the service for others. See section 8.
• Quoting and linking to our pages, with attribution and a link, in your own work.
• Sending us unsolicited material to pitch us. We will read it or we will not; either way it is not a policy breach.
• Reporting a problem, a bug, or a mistake on this site — including a factual error on a legal page like this one.

Where a general permission would be undermined by abuse, we may add conditions and tell you what changed.

3.1 Security and intrusion

• Attempting to gain unauthorised access to this site, to any account on it, to a server or network connected to it, or to any other system.
• Scanning, port-probing, vulnerability-scanning or fingerprinting our infrastructure without written authorisation, including any reconnaissance that is a step towards an attack.
• Exploiting a vulnerability beyond what is necessary to demonstrate it to us, or using it to access data, to change data, or to cause load.
• Bypassing, disabling or interfering with any security control, rate limit, authentication or access restriction, including by sharing or reusing another person’s credentials.
• Introducing malware, ransomware, a backdoor, a rootkit, a keylogger, or any code intended to damage, spy on, or take over a system.
• Credential stuffing, password spraying, brute-forcing, or attempting to guess, enumerate or confirm the existence of a user account.
• Conducting any denial-of-service, stress test or load test on our systems, on our own initiative and without prior written agreement on scope, timing and safeguards.

3.2 Spam, abuse of the forms, and unwanted contact

• Submitting form contents for anything other than a genuine enquiry, or knowingly submitting a form with false or misleading information.
• Sending unsolicited bulk commercial email, or using our email addresses to advertise to third parties.
• Harvesting email addresses from this site in order to send unsolicited contact.
• Using a leaked, purchased or guessed list of addresses with our contact details on it.
• Repeatedly submitting forms in order to displace legitimate enquiries, exhaust our rate limits, or test how the system responds.

3.3 Infringement and unlawful content

• Infringing any copyright, database right, trade mark, design right, patent or other intellectual property right, or misappropriating a trade secret.
• Publishing or distributing content that is unlawful where it is made available, including material that is defamatory, threatening, harassing, or that promotes hatred or violence against people on the basis of a protected characteristic.
• Distributing malware, or facilitating it — hosting a payload, linking to one, or selling access to compromised systems.
• Impersonating WebNuvexa, a client, or any other person or organisation.
• Gathering or publishing personal data about other people without a lawful basis, including doxxing, stalking, or building a dossier on an individual.
• Anything that encourages, facilitates or glorifies self-harm, suicide or violence towards others, or that is exploitative of a child.

3.4 Fraud, deception and abuse of the engagement

• Submitting a quote request, brief or specification that you know to be false or materially misleading in order to obtain a price that is not real.
• Representing that a deliverable was produced by us, or that an engagement existed, when it did not.
• Claiming our name, using our logo or branding, or holding yourself out as us or as an authorised partner, without written permission.
• Publishing a testimonial, review or case study attributing to us an opinion or an endorsement we did not give.
• Paying, incentivising or otherwise causing a person to post a review on your behalf without disclosing that it was incentivised.

3.5 Resource abuse

• Consuming disproportionate server, bandwidth, storage, database or API capacity, whether deliberately or through an automation you have not bounded.
• Leaving long-running or unattended processes running in any shared environment, including test scripts, continuous integration jobs and scrapers.
• Circulating large files, or sending mass email, through any channel we provide.
• Running cryptocurrency mining, or any computation unrelated to the engagement, on infrastructure we provide.
• Interfering with other users of shared infrastructure, including consuming capacity in a way that degrades their work or ours.

3.6 Reverse engineering and circumvention

• Reverse engineering, decompiling or disassembling our software, or attempting to derive its source, except to the extent that this is expressly permitted by applicable law and cannot lawfully be excluded.
• Circumventing, removing or overriding any licence, trial, rate or usage limit.
• Copying, reselling, sublicensing or redistributing our software, materials or methodology, or registering an account for someone else, except as expressly permitted by the Terms of Service.

4.1 You keep ownership

You keep ownership of everything you submit to us — your brief, your enquiry, your content, your documents, your personal data. We claim no ownership of it.

4.2 Licence to process

By submitting content you grant us a non-exclusive, worldwide, royalty-free licence to host, copy, transmit, display, process and adapt that content, strictly as necessary to: respond to your enquiry, deliver the engagement you have asked for, keep the site running, diagnose and fix problems, keep records we are required to keep, and defend or resolve any dispute about the content or the engagement.

The licence lasts as long as we need it for those purposes and no longer. See the Terms of Service, section 5, for the wider intellectual property position.

4.3 What you warrant

By submitting content you warrant that:

• You hold the rights necessary to submit it and for us to process it as described.
• It does not infringe anyone’s rights, and doing so would not breach any agreement you are party to.
• It complies with applicable law, and you have the authority to make any declaration it contains.
• You have a lawful basis for any personal data you send us, and any consent or notice required to send it to us has been obtained. See the Privacy Policy.

Please do not send special-category data unless an engagement genuinely requires it and we have agreed in writing how it will be handled. If we receive it unprompted, we will delete or redact it.

4.4 Content we may remove or refuse

We may refuse to accept or publish content, or remove content we have already received, where we reasonably believe it breaches this policy, infringes a third party’s rights, is unlawful, or creates a security or reputational risk. Where we can, we will tell you what we did and why. Where we cannot — for example because the content is a live security problem — we will act first and explain afterwards.

Removal under this section is not a termination of your engagement, and does not by itself entitle either party to a refund. Termination is governed by section 5.

5.1 Our rights

Where we reasonably believe that you, or someone using access we provided to you, has breached this policy or the Terms of Service, we may, at our discretion and without liability to you:

• Warn you and ask you to stop, giving a reasonable opportunity to comply.
• Remove or restrict content, including refusing to publish or publish further, or withdrawing access to a shared environment.
• Suspend access to this site, to an account, or to any environment we provide, immediately and without prior notice where the breach is capable of causing harm.
• Terminate the engagement under section 10.5 of the Terms of Service, without refund where work paid for has been performed or committed.
• Report the activity to a law enforcement, regulatory or network abuse contact where it appears to be unlawful or to threaten others, and disclose the minimum information necessary to do so.

5.2 When we act immediately

Notice is not a formality we are always able to give, and we will not delay acting where delay would increase harm. We will normally act immediately, without warning, where there is:

• an active compromise of a system, or malware being distributed;
• an ongoing attack, flood or resource-exhaustion event;
• credible evidence of a serious security vulnerability being exploited;
• child sexual exploitation material, or a credible threat of serious violence;
• content that is unlawful to host and is being hosted now;
• a breach that is repeated after a warning.

In those cases we will act first and explain afterwards, to the extent we safely can.

5.3 Narrow suspension, not a permanent cut-off

We prefer the narrowest action that resolves the problem. Suspending one capability is better than suspending an account. Refusing one request is better than blocking a network. Where a narrower measure works, we will use it.

Nothing in this policy entitles anyone to a service from us, or obliges us to continue providing one. Where a suspension is indefinite or permanent, the reason will be given in writing unless doing so is prohibited by law or would itself create a security risk.

6.1 What we weigh

Before acting we consider, in rough order of weight:

1. Actual and potential harm to other people, to clients, to our infrastructure, and to the public internet as a whole.
2. Whether the activity was accidental. A misconfigured script that caused one bad hour is treated very differently from deliberate abuse.
3. Intent and pattern. A single misstep is not a pattern. A repeated one after a warning is.
4. Precaution taken. Disclosing a vulnerability responsibly, stopping the activity yourself, and telling us promptly all count in your favour.
5. Legitimate purpose. Security research, interoperability work, accessibility testing, and automated monitoring of your own systems are legitimate. We will assume good faith where the facts support it.

6.2 We do not punish good-faith reporting

Telling us that you broke a rule, or that you think one of our pages is wrong, is not a breach. We will not retaliate against anyone who raises a concern in good faith, and we will not hold it against you commercially.

Likewise, nothing in this policy is a gag order: you are free to criticise us publicly and lawfully, including on social media, provided you do not defame anyone, do not doxx our staff, and do not lie about us.

6.3 Appealing a suspension

If we suspend or terminate you, you may appeal in writing to hello@webnuvexa.com with the subject line “Acceptable use appeal”, including the action, the date, and any evidence that would change our view. We will acknowledge the appeal, take a fresh look at it, and give you a decision.

An appeal will not automatically reinstate access while it is being considered — if the underlying activity is still happening, the suspension stays. A second appeal on the same facts will not be reopened.

7.1 Reporting abuse on this site

Send reports to hello@webnuvexa.com with the subject line “Abuse report”, or to not yet confirmed: abuse reporting address if that mailbox is monitored more closely. For an active security incident you can also call not yet confirmed: abuse escalation phone number — omit that option if no number is published.

Please include, where you have it:

• the URL or page, and what is wrong with it;
• the date and time you saw it, with your time zone;
• a screenshot or the text, if it is safe to send;
• whether anyone is being harmed right now.

We aim to acknowledge a report promptly and to investigate before acting. We do not publish a fixed response time here, because a number we cannot staff is worse than an honest “as soon as we can”. If a report concerns an active security incident, say so in the subject line and it will be treated as urgent.

We will keep your identity confidential to the extent we can while still investigating, and we will not share your details with the person reported without telling you.

7.2 Reporting a vulnerability in a system we operate for a client

Where the vulnerability is in a client’s system rather than on webnuvexa.com, tell us and we will pass it to the client without delay, and we will tell you that we have. We do not need your permission to forward a security report; we do need permission to disclose anything you send us that is not part of the report.

Do not access data that is not yours, do not persist anywhere after you have demonstrated the issue, and do not degrade the service. If you cannot demonstrate the issue without doing any of those things, stop and tell us what you tried.

7.3 Formal legal notices

Formal notices concerning intellectual property, which require us to remove material, should be addressed to not yet confirmed: designated copyright agent and must include the information a valid notice requires. A takedown request sent by email without that information may be delayed, because we have to check it and we are not permitted to remove material on the say-so of a stranger.

Complaints about how we handle your personal data go to the Privacy Policy route in the first instance; see section 8 of the Privacy Policy. If you are not satisfied, you may complain to not yet confirmed: named regulator or to the supervisory authority in your own country. A good faith complaint is never a policy breach.

8.1 Crawling

Search engine crawlers are welcome. Other automated readers are welcome too, provided they are identifiable and reasonably polite: a delay between requests rather than hammering, respect for any exclusion we publish, and no attempt to bypass authentication, rate limits or access controls.

We publish a robots.txt file. It is a clear signal about what we ask automated clients to do, and automated visitors are expected to honour it. Where a specific path is disallowed there, do not fetch it programmatically.

8.2 Large-scale copying and model training

Taking the whole site — every page, every article, every legal document — in bulk and republishing it, or using it as training data for a model, is a different act from a person reading a page. It is not permitted without our written permission.

This is not a technical control we can enforce perfectly, and we are not pretending otherwise. It is a request. If you are building something that needs bulk access, contact us at hello@webnuvexa.com. In most cases the answer is a straightforward yes, possibly with a licence attached.

Quoting and linking to our pages for your own purposes is fine. Summarising them is fine. What is not fine is reproducing them at scale as a substitute for the site itself, or training a model on them so that it can be presented as our work.

8.3 Bots that impersonate a browser

Automated clients should identify themselves honestly. Where a request is automated but presents itself as an ordinary browser in order to obtain access that an ordinary browser would not get, we treat that as circumvention under section 3.6.

Note that some legitimate services fetch pages on behalf of real users — for example a chat link preview or a search result snippet. Those are recognised and welcome. The distinction we care about is honest identification and honest purpose.

• Policy owner: not yet confirmed: the registered legal entity name, established in not yet confirmed: the country of establishment
• Abuse and security reports: hello@webnuvexa.com — subject line “Abuse report”
• Appeals: same address — subject line “Acceptable use appeal”
• Active incident: not yet confirmed: abuse escalation phone number
• Formal legal notices: not yet confirmed: designated copyright agent

If you are unsure whether something breaches this policy, ask before you do it. A quick email costs nothing and is far better than an account suspended and a dispute to unpick.