Merchant Command BetaBack to home

Acceptable Use Policy

Effective and last updated: July 28, 2026

This Acceptable Use Policy ("Policy") describes prohibited and restricted uses of Merchant Command. It is incorporated into the Merchant Command Terms of Service and applies to all Customers, Authorized Users, agents, workflows, integrations, outputs, and actions.

1. Scope and Responsibility

This Acceptable Use Policy applies to every Customer, Authorized User, agent, workflow, integration, API call, output, and action using Merchant Command. Customers are responsible for their Authorized Users and for automated activity performed under their accounts.

The examples below are not exhaustive. Activity that is technically possible is not necessarily permitted. You must use reasonable judgment and comply with the Terms of Service, the AI and Automated Actions Policy, applicable law, and third-party platform rules.

2. Lawful and Authorized Use

You may not use the Service to violate or facilitate violation of any law, regulation, court order, contractual restriction, or third-party right. You must have authority to access every account, store, dataset, credential, and Connected Service you use.

You may not:

  • access, monitor, change, delete, or transmit data without the account owner's authorization;
  • use credentials obtained through theft, deception, credential stuffing, phishing, or another unauthorized method;
  • evade sanctions, export controls, licensing requirements, or geographic restrictions;
  • sell or facilitate illegal goods or services; or
  • use the Service in a manner that causes Mivaro or a provider to violate law or platform terms.

3. Security and System Abuse

You may not use the Service to compromise security or interfere with systems. Prohibited activity includes:

  • malware, ransomware, spyware, malicious code, credential theft, phishing, account takeover, or denial-of-service activity;
  • unauthorized vulnerability scanning, penetration testing, exploitation, or security research;
  • bypassing authentication, access controls, rate limits, approval controls, safety systems, usage limits, or billing mechanisms;
  • attempting to obtain another customer's data, credentials, prompts, system instructions, logs, or nonpublic information;
  • using agents to probe, exploit, or disrupt a Connected Service or third-party API; and
  • concealing malicious activity through obfuscation, proxies, coordinated accounts, or false account information.

Good-faith security testing requires Mivaro's prior written authorization and must comply with any published vulnerability-disclosure program.

4. Credentials and Connected Accounts

You may submit API keys, tokens, secrets, and similar credentials only when they are necessary to establish or operate an authorized connection. You must safeguard them and limit their scopes.

You may not:

  • place credentials in public prompts, shared files, public agent templates, or outputs;
  • connect an account you do not own or have authority to manage;
  • expose or transfer credentials to an unauthorized person or agent;
  • use a connection after authority has been revoked; or
  • attempt to extract credentials from Merchant Command, Pipedream, or another provider.

5. Privacy and Sensitive Information

You may not collect, process, infer, disclose, or act on Personal Information without required authority, notice, consent, and a lawful purpose. You must honor privacy requests, consent decisions, and opt-outs applicable to your use.

Unless Mivaro expressly approves the use in writing and appropriate safeguards are in place, do not submit:

  • Social Security numbers, government identification numbers, or authentication answers;
  • full payment-card numbers or data subject to PCI DSS;
  • protected health information or medical records;
  • biometric identifiers or templates;
  • precise geolocation used for surveillance;
  • highly sensitive employment, education, financial, or insurance records; or
  • passwords or secrets unrelated to an authorized connection.

You may not use the Service for unlawful surveillance, stalking, doxing, reidentification of deidentified data, or covert collection of personal information.

6. Fraud, Deception, and Commercial Abuse

You may not use the Service for fraud, deception, manipulation, or unfair commercial practices. Prohibited activity includes:

  • impersonating a person or business without authorization;
  • generating or publishing fake reviews, fake testimonials, fabricated endorsements, or deceptive social proof;
  • making false, unsubstantiated, or misleading product, pricing, performance, scarcity, health, environmental, or AI claims;
  • manipulating marketplace rankings, reviews, ad systems, attribution, or metrics through deceptive means;
  • counterfeiting, passing off, chargeback fraud, refund abuse, or payment fraud;
  • creating deceptive invoices, purchase orders, customer-service messages, or account notices; and
  • concealing that an automated system is communicating where disclosure is required by law, contract, or platform policy.

7. Communications, Marketing, and Customer Contact

Agents may send emails, SMS messages, support responses, review requests, and other communications only when the Customer has a lawful basis and all required consent. You must comply with applicable marketing and communications laws, including consent, identification, unsubscribe, quiet-hours, and suppression-list requirements.

You may not use the Service to:

  • send spam, unlawful commercial messages, robocalls, or unsolicited bulk communications;
  • ignore opt-outs, unsubscribe requests, do-not-contact requests, or platform suppression lists;
  • use purchased, scraped, or unlawfully obtained contact lists;
  • misrepresent the sender, purpose, or commercial nature of a communication; or
  • harass, threaten, intimidate, or repeatedly contact a person who has asked you to stop.

8. Harmful, Exploitative, or Illegal Activity

You may not use the Service to create, facilitate, promote, or meaningfully assist:

  • child sexual abuse or exploitation, grooming, trafficking, or sexual content involving minors;
  • credible threats, targeted harassment, extortion, or nonconsensual intimate content;
  • violent wrongdoing, terrorism, illegal weapons activity, or instructions intended to cause serious harm;
  • illegal controlled-substance distribution or other organized criminal activity;
  • encouragement or instruction for self-harm directed to a vulnerable person;
  • discrimination prohibited by law; or
  • sale of regulated goods or services without required licenses, controls, and Mivaro's approval where requested.

9. High-Impact Decisions and Professional Services

You may not use Merchant Command as the sole basis for a decision that determines a person's eligibility, selection, access, or terms in employment, housing, credit, lending, insurance, healthcare, education, legal services, government benefits, or another essential service.

Where AI assists a legally or similarly significant decision, you must provide qualified human review, appropriate notice, a lawful basis, a method to contest or correct the decision where required, and testing for accuracy and unlawful discrimination.

Do not present Output as legal, tax, accounting, investment, medical, or other licensed professional advice unless it has been reviewed and adopted by a qualified professional who assumes responsibility for it.

10. Intellectual Property and Data Rights

You may not use the Service to infringe copyright, trademark, patent, trade-secret, publicity, privacy, database, or other rights. You must have rights to prompts, files, images, listings, product data, customer information, and other material you provide.

You may not:

  • copy or republish protected content at scale without permission;
  • scrape websites or services in violation of law, terms, robots directives, or access controls;
  • remove rights-management information or proprietary notices;
  • misuse confidential information or trade secrets; or
  • use the Service, Output, system prompts, or nonpublic behavior to train or build a competing platform, model, or connector library.

11. Platform Integrity and Resource Abuse

You may not interfere with the Service or use it in a manner that imposes unreasonable load, degrades performance, or harms other users. Prohibited activity includes:

  • automated use outside approved interfaces or documented APIs;
  • excessive requests, data extraction, or concurrency designed to evade limits;
  • creating, permitting, or failing to stop recursive, self-replicating, uncontrolled, duplicative, or unnecessarily repetitive workflows that impose unreasonable load or generate excessive usage, costs, communications, or actions;
  • creating accounts to bypass suspension, quotas, trials, or charges;
  • reselling, sublicensing, or providing unauthorized shared access;
  • reverse engineering or attempting to discover source code or nonpublic prompts; and
  • using Merchant Command infrastructure for cryptocurrency mining, unsolicited proxying, or unrelated compute workloads.

12. Circumvention of AI and Safety Controls

You may test prompts and agent configurations for legitimate business purposes, but you may not intentionally defeat safeguards to enable conduct prohibited by this Policy. You may not use prompt injection, tool manipulation, data poisoning, or adversarial instructions to obtain unauthorized data or cause an agent to act outside approved permissions.

You may not attempt to escalate an Agent's permissions, cause it to disregard approval requirements or account limits, or exploit content from a Connected Service to trigger actions outside Customer's authorized scope.

You must not knowingly expose an agent to untrusted content without reasonable safeguards where that content could instruct the agent to disclose data or perform unauthorized actions.

13. Enforcement

We may investigate suspected violations and may block prompts or actions, disable agents or connections, restrict functionality, throttle usage, remove content, suspend or terminate accounts, preserve evidence, and cooperate with Connected Services, rights holders, or authorities as permitted or required by law.

Protective action may be triggered by runaway, recursive, anomalous, duplicative, unexpectedly high-volume, or rapidly escalating agent activity; suspected prompt injection; compromised credentials; attempted permission escalation; or behavior likely to cause material costs, data changes, communications, or third-party actions outside Customer's apparent intent.

We may act without advance notice when reasonably necessary to prevent harm, secure the Service, comply with law, or protect a third party. We are not obligated to monitor every use or to detect every violation.

Customers must cooperate with reasonable investigations and remediation, including rotating credentials, disabling workflows, preserving logs, and notifying affected parties where required.

14. Reporting and Contact

Report suspected abuse, security concerns, or violations to support@merchantcommand.com. Include enough detail for us to evaluate the issue, but do not send unnecessary sensitive information in ordinary email.

15. Changes

We may update this Policy as risks, laws, providers, and the Service change. Material changes will be communicated as described in the Terms of Service. Continued use after the effective date constitutes acceptance where permitted by law.