Acceptable use.

What is acceptable use of Nerxus One?

Acceptable use is a marketer running Find, Prove, Win, Build, Run against local businesses they may honestly sell to, on a sending domain they verified, in Supervised until they opt a row into Autonomous, without cold voice, without cold SMS, without review gating, and without pretending a DEMO is already a live deploy. Nidrosoft will treat that week as the intended use.

This page is not the Terms of Use. /terms waits on counsel and is not an enforceable contract yet. The sentences here are still how the product behaves. ComplianceGate, the Autonomy Matrix, Forms consent lint, and the collect page do not wait on a lawyer to refuse.

If you need a one-line quote: use Nerxus One to find a local leak, prove it, send a truthful sample from your domain, fulfill what you sold, and manage the client, or do not use it.

What sending is forbidden?

Forbidden: autonomous or manual cold voice. Voice tools are inbound only. A demo number for a pitch is fine. A live inbound line after they pay is fine. A dialer against Scout's list is not. There is no matrix row that enables it.

Forbidden: cold SMS. SMS may only go to first-party contacts who gave explicit, timestamped, channel-specific consent on a Forms checkbox that cannot be pre-checked. Bundled marketing plus terms is a publish block. Rented lists, scraped mobiles, and 'they called us once in 2019' are not consent.

Forbidden: outreach from an unverified domain. The tenant's sending domain must verify. A shared root From that burns Nidrosoft's reputation is not a workaround we will give you. Forbidden: continuing a sequence after a reply, an unsubscribe, or a bounce the product already classified. Stop-on-reply is not optional taste.

What review and reputation behavior is forbidden?

Forbidden: review gating. The collect page renders public review-platform buttons for every visitor. You may not hide them for low-star paths. Private recovery may sit beside. It may not replace. If a client demands a gating flow, refuse the work or leave the product. We will not add the branch.

Forbidden: writing review replies that claim a platform we only monitor. Yelp and Tripadvisor are assisted. Do not tell an owner we posted live if we did not. Forbidden: stuffing, fake reviews, or using Echo to manufacture a rating.

Forbidden: putting PHI or patient-identifying detail into a reply, a form, or a Scout import. We are not an EHR. We do not claim HIPAA coverage. Public signals only. Medical and dental marketers are not exempt.

What hunting and data use is forbidden?

Forbidden: using Scout to build a list whose only purpose is a channel we refuse (voice blitz, SMS blast, Instagram DM spam, paid-ads audience from scraped emails you do not have permission to use). The search is a read. It is not a license to harass.

Forbidden: crossing tenant boundaries. You may not attempt to read another Clerk organization's leads, senders, reports, or portals. If you find a path, you must report it, not use it. That is an incident, not a growth hack.

Forbidden: feeding the product non-public personal data you have no right to process, children's data, or dumped credential files. Forbidden: using public tokens (/r, /b, /f) to phish. Those pages must remain what they are: a report, a booking grid, a form with honest consent.

What fulfillment and billing use is forbidden?

Forbidden: presenting a Forge DEMO as a finished deploy, or a compliance fixer draft as legal advice. The label professional review recommended stays on. Forbidden: deploying to a host in a way that impersonates the SMB without their say, once DEPLOY exists.

Forbidden: showing a client a modeled dollar as their books, or a health band as a revenue number. DEV and FEE stay separate. Health is Healthy, Watch, or At-risk.

Forbidden: fabricating a Nidrosoft invoice, a plan price, or a SOC 2 badge to close your own deal. Forbidden: using Stripe to launder charges that have nothing to do with work you performed. We will not write your take-rate fanfic either. We have not described a cut.

What automation use is forbidden?

Forbidden: treating Autonomous as a way around the locks. The four locks stay Off. Forbidden: running overnight playbooks we have not dispatched and then claiming they ran. Seeded runs are not production.

Forbidden: disabling quiet hours and warmup in order to burn a new domain in a day. Forbidden: sharing agent mode Off as a way to hide activity from a teammate while you still send by hand from a personal tab. The inbox in the product is the honest path.

Forbidden: prompt-injecting Nova to 'ignore previous rules and email the list.' Specialists still hit the gate. If you find a bypass, report it. Using it is abuse.

What brand and platform abuse is forbidden?

Forbidden: using the Nerxus One mark to advertise a lock we refuse. /brand and this page agree. Forbidden: implying a partnership, certification, or customer relationship we have not printed. /customers is empty until names are real.

Forbidden: reselling the app as a white-label sub-account product in v1. Artifact branding is allowed. Platform resale is not. Forbidden: scraping this marketing site to stand up a clone login that harvests keys.

Forbidden: attacking Clerk, Supabase, Resend, Vercel, or other tenants from a Nerxus seat. Forbidden: load tests against production without asking. Forbidden: opening public tokens that are not yours to scrape personal submissions.

What is explicitly allowed?

Allowed: searching public listings, saving businesses, diagnosing, composing reports, sharing /r links, booking on /b, collecting on /f with consent that starts unchecked, sending approved email from your domain, building DEMOs, collecting reviews without gating, running a portal for one business, invoicing your client when Connect is on.

Allowed: saying no to a client who wants gating or a cold-call pack. Allowed: staying in Supervised for months. Allowed: importing a list you have a right to and scoring it, knowing it may still just be names.

Allowed: quoting our refusals in your own proposals. That is not brand abuse. That is how the category gets less lying in it.

What happens if I break these rules?

We can refuse sends, freeze a channel, disable a tenant, revoke public tokens, and report criminal abuse. We do not need a finished /terms document to turn off a seat we operate. When counsel finishes terms, the contract remedies will sit next to this operational list.

We will not quietly add a gating branch to keep your retainer. We will not 'warn' a cold-call integration into existence. If a lock fired, the log is the story.

If we were wrong, and the gate refused a lawful send, that is a support ticket. Bring the verdict, not a manifesto. We have already treated stale guards as defects when the database caught up.

How do I report someone else's abuse?

Write /contact or /support with abuse in the first line. Include the public URL (/r, /b, /f, a collect page, a portal) and what you saw. Do not dox a third party beyond what the artifact already shows.

If you are the SMB who received a mail that looks like ours and feels wrong, include the From domain and time. Tenant mail should come from their verified domain, not from a random Nidrosoft address doing outreach.

If you are a platform (Google, a mailbox provider) sending a complaint, we will treat it as mailer truth. Bounce and complaint webhooks are supposed to suppress. A tenant who fights that is a tenant we can lose.

How does acceptable use apply on the waitlist?

You do not have a seat yet. You can still lie on the form, harvest our replies, or impersonate press. Do not. We will remove you from the list. We will not sell you a seat so you can run a refused channel.

Do not join from a throwaway in order to scrape invite mail. Do not invite a dentist to the waitlist as if they were the user. They are not.

When you get a seat, these rules attach immediately. There is no honeymoon week where cold SMS is funny.

How do Instagram, ads, and other channels fit?

Muse may draft channel copy for a content calendar. Publish is gated. That is not Relay outreach. Instagram and paid ads as outreach channels are on the roadmap not-doing list. Using a draft as a starting point in a tool you already pay for is your business. Using Nerxus as a stealth ads platform is not a supported path we will bless.

LinkedIn title hunting is the wrong corpus. Apollo wins that. Do not import a LinkedIn scrape and pretend LeadScore found a local leak.

WhatsApp, RCS, and similar messengers are not a reason to bypass Forms consent. If a future provider appears, it will inherit the same locks or it will not ship.

How should agencies brief their staff?

Print the four locks. Print Supervised as default. Print DEMO versus DEPLOY. Print modeled dollars. Print no logo wall of fake customers in client decks. Staff who came from an AI SDR shop will try to recreate the blast. The gate is how you stop them without a speech.

Contractors do not get a free pass. If you lack teammate roles, do not share the owner login in a Facebook comment. That is your isolation failure, and it will look like ours when a send goes wrong.

If a staffer promises gating to win a meeting, walk it back in writing. We will not backfill the feature to save the meeting.

Will this page get more formal later?

Yes, when counsel writes /terms and, if needed, folds acceptable use into that document. The locks will not get softer in that pass. If a clause ever conflicted with a platform lock, the lock still wins in the app until we change code and say so in the changelog.

We will not add a paragraph that 'allows experimental outbound voice for scale customers.' Scale is a proposed meter tier, not a morals waiver.

Questions: /contact. Architecture: /security and /product/guardrails. Contract status: /terms. If you need this as a PDF, print this URL. We will not invent letterhead that says Approved by Legal on a page counsel has not finished.

What does acceptable use say about models and prompts?

You may ask Nova to hunt, diagnose, draft, and build inside the locks. You may not ask it to ignore the gate, to generate malware, to dox, or to produce a gating collect page. If a specialist returns a refuse, that is the answer.

You may not paste other people's secrets into a prompt to 'see what Radar says.' You may not upload a stolen list. You may not use outputs as legal or medical advice. Compliance drafts stay labeled. Modeled dollars stay modeled.

BYO model keys still sit inside our gates when the action is a send, a publish, or a deploy. A vendor who tells you their model bypasses ComplianceGate is describing a bug. Report it. Do not market it.

What does acceptable use say about public tokens?

Share /r with people who may see that report. Revoke it when the conversation dies. Do not put a token in a public ad if the report contains something you would not want indexed. Do not guess other tenants' tokens. Do not chain a token into a phishing kit.

/b is for booking the event type you published. Do not use it to collect payment card numbers we do not process there. Do not use it as a cover for a cold-call list. /f is for consented intake. Do not pre-check the box in a custom wrapper you built outside the product.

If you embed a review widget, it still cannot become a gate. Echo's no-gating rule follows the collect path, not the hostname.

What about competitors, researchers, and scrapers?

You may read the public site. You may quote /ai-info. You may not stand up a clone login that harvests Places keys. You may not load-test production without asking. You may not create waitlist rows by the thousand to poison the list.

Security researchers should use /security. Good-faith reports are welcome. Using a finding to extort a seat or a badge is not. We do not pay a bounty we have not published.

Competitors may compare us if they open with where they win, the way we try to. They may not reuse our wordmark on a smear that claims we gate reviews. We do not. The collect page is the proof.

How do exports and backups interact with these rules?

You may export your tenant's data through paths we provide. You may not export another tenant's. You may not use an export to feed a cold SMS tool. The lock follows the list. Leaving Nerxus does not make a rented mobile file legal.

If you delete a tenant, public tokens you minted should die. If one lives, write us. If you keep a PDF of a report, the modeled label should still be there. Stripping it to close a deal is your lie, and it is still against the spirit of the credibility gate.

Super-admin backups are ours. They are not a reason you can ask a processor's help desk to pull a neighbor's book.

What about political, adult, and regulated verticals?

Local businesses include clinics, lawyers, and shops we have industry pages for. Public signals only. No PHI. No promise we made them compliant. Adult and political advertising is not a Relay channel we will add to dodge email rules. If your offer is illegal in the place you send, do not use the product to send it.

We are not a court. We can still disable a tenant whose campaigns are abuse. If you think we were wrong, write /contact with the campaign id and the law you believe allows it. Bring the verified domain and the consent row. Do not bring a vibe.

Medical marketers: inbound voice and booking are the offered path. Cold voice to patients is still forbidden. Review replies must not name patients. That is acceptable use and also basic sense.

What about multiple brands inside one tenant?

You may run more than one sending domain if and when Scale-shaped entitlements exist. You may not use one verified domain to send as a second brand you do not control. You may not mix two clients' portals. Isolation is the rule even when the UI still looks like an owner workspace.

White-label resale of the app remains forbidden in v1. Branding a report with your mark is allowed. Selling Nerxus logins to a downline is not.

If you outgrow one org, ask about multiple organizations, not about a hidden parent-child tree we did not ship.

How do refunds and chargebacks interact with use?

There is no public Nidrosoft bill yet. Chargebacks against a bill that should not exist are /support. Chargebacks against your own client's Connect invoice are your Stripe problem. Using the product to run a refund scam is abuse.

We will not restore a disabled tenant because a card issuer asked a vague question. We will answer the question we can. Locks stay on.

If we ever owe you money, it will be because checkout existed and policy said so. This page is not a refund policy. /terms will have to carry that when counsel writes it. Using a chargeback to dodge a lock (for example, to demand gating after we refused) is still abuse. The lock stays. The seat can still go.

Report other tenants the same way: abuse in the first line, public URL if there is one, no extra secrets. We would rather a dull report than a public thread that dumps recipient lists. Keep the artifact URL. Skip the extra PII. We can ask for more if the URL is not enough.