Acceptable Use Policy

This Acceptable Use Policy ("AUP") is part of the Arkrel Terms of Service. It exists so that every customer can trust the platform they are sharing.

No protected health information or medical records

Do not submit protected health information (PHI), medical records, lab results, prescriptions, insurance claims containing health data, or any other data governed by HIPAA or an equivalent health-privacy law. The Service is built and operated for financial and operational business documents (invoices, receipts, purchase orders, bank statements, delivery notes, and similar), and we do not offer the safeguards or a signed Business Associate Agreement that health data requires. If we discover PHI or medical records in your account, we will delete the affected documents and may suspend the account while we work with you to resolve it.

No illegal content

Do not submit documents obtained illegally, forged for the purpose of fraud, or that you do not have the right to process, and do not use the Service to facilitate money laundering, sanctions evasion, or any other illegal activity.

No abuse of the platform

Do not attempt to bypass plan quotas or rate limits, share or resell API keys across unrelated organizations, reverse-engineer or scrape the Service, or attempt to disrupt or gain unauthorized access to our infrastructure or to another customer's data.

URL fetching

The REST API does not fetch documents from arbitrary third-party URLs on your behalf; documents must be uploaded directly or submitted as file content. The one exception is the MCP server's `extract_document` tool, which fetches a document from a URL you provide, protected against server-side request forgery: private, internal and loopback addresses are rejected, redirects are capped and each hop is re-validated, and oversized content is rejected. Do not attempt to use webhook configuration, schema fields, the MCP tool's URL input, or any other input to make the Service issue requests to internal or private network addresses.

Webhook targets

Webhook destination URLs must be endpoints you own or control and must not point to a private, internal, or loopback network address.

Enforcement

Violating this policy may result in removal of the offending content, suspension, or termination of your account, at our discretion and in proportion to the violation. If you believe your account was actioned in error, email support@arkrel.com.