KabData logoKabData
Legal centre
Legal

Acceptable Use Policy

Rules designed to protect KabData, our customers, connected platforms, and the people represented in customer data.

Last updated: August 12, 2026Language: English

Draft — not yet effective

KabData's Cyprus company is still being incorporated. This document will become effective only after its full registered name, company number, registered office, and effective date are inserted and the stated operational controls are verified.

This Acceptable Use Policy (“AUP”) applies to use of the KabData Service and forms part of the agreement between the Cyprus company being incorporated under the intended name KabData (“Provider”) and the Customer. Capitalised terms have the meanings in the Terms of Service.

Customer must ensure that all Authorised Users, integrations, applications and persons using its accounts comply with this AUP.

1. Use the Service only with authority

You must:

  • use the Service only for legitimate business purposes within your authorised role;
  • access only organisations, applications, reports, campaigns, publishers, chats and records you are authorised to access;
  • use valid, lawfully obtained AppsFlyer and Third-Party Service credentials;
  • keep accounts, API tokens, login credentials, two-factor secrets, recovery codes, publisher tokens, OAuth tokens and invitation links secure;
  • promptly revoke access that is no longer required; and
  • notify Provider promptly if credentials, tokens, permissions or Customer Data may have been compromised.

You must not share a personal login, obtain access by using another person's identity without authority, transfer an invitation or token to an unauthorised recipient, or defeat organisation/role/publisher restrictions.

2. Prohibited unlawful or harmful activity

You must not use the Service to:

  • violate any law, regulation, court order, licence, contractual restriction or third-party right;
  • commit, facilitate or conceal fraud, deception, money laundering, bribery, corruption, sanctions evasion or other criminal activity;
  • infringe intellectual property, confidentiality, privacy, publicity or data-protection rights;
  • stalk, harass, threaten, discriminate against, defame or unlawfully monitor a person;
  • exploit, sexualise or endanger a child, or store or distribute child sexual abuse material;
  • distribute malware, ransomware, spyware, destructive code or content intended to compromise a system;
  • send unlawful or unsolicited marketing, spam, phishing or deceptive messages;
  • impersonate another person or organisation or misrepresent the origin, destination or performance of traffic;
  • manipulate attribution, installs, in-app events, conversions, fraud indicators, payouts, caps or reports dishonestly;
  • conceal prohibited traffic, bots, click fraud, install fraud, incentive abuse or another invalid acquisition practice; or
  • conduct an activity prohibited by the terms of AppsFlyer or another connected provider.

3. Privacy and Customer Data

You must not collect, import, disclose, export, query or use personal data unless you have a valid purpose, lawful basis, authority and required notice. You must respect data minimisation, retention and Data Subject rights.

Unless Provider expressly agrees in writing, you must not submit:

  • special-category or sensitive data revealing health, biometric/genetic traits, religion, political opinions, trade-union membership, sex life or sexual orientation;
  • information about children;
  • precise geolocation;
  • full payment-card data, bank authentication secrets or cryptocurrency private keys;
  • national identifiers, passport or driving-licence numbers;
  • passwords, API keys, TOTP secrets or authentication tokens in ordinary text fields, notifications or workflow descriptions; or
  • protected health information or regulated credit information.

Customer administrators must use least privilege and must not configure a publisher identifier, token share, export, chat, notification or automation that exposes one publisher's or advertiser's information to another without authority.

4. Security and platform integrity

You must not:

  • probe, scan, penetrate or test the vulnerability of the Service without Provider's prior written authorisation and agreed testing rules;
  • bypass authentication, rate limits, permissions, confirmation steps, quotas, feature restrictions or security controls;
  • attempt to access source code, non-public APIs, secrets, other customers' data, infrastructure or administrative functions;
  • interfere with availability or integrity, including by denial-of-service, excessive requests, resource exhaustion, malicious jobs or deliberately expensive queries;
  • upload corrupted, misleading or weaponised files;
  • use automated scraping, crawling or extraction against KabData except through a documented API or with written permission;
  • use the Service as a command-and-control, credential-harvesting, proxying or unauthorised surveillance system;
  • introduce a backdoor or persistence mechanism;
  • disable, evade or falsify logging, audit, security or retention controls; or
  • disclose a vulnerability publicly before Provider has had a reasonable opportunity to investigate and remediate it.

Good-faith security reports should be sent to [email protected]. Provider will coordinate good-faith security reports through its support and incident-response process.

5. Integrations, crawler access and tracking links

You may connect only an account you are authorised to use. If you enable AppsFlyer browser automation, you confirm that:

  • automated access is permitted by your agreement with AppsFlyer and applicable law;
  • the credentials belong to a dedicated or appropriately governed business account;
  • use of TOTP and browser-session persistence is authorised; and
  • you will rotate or revoke credentials promptly when personnel or authority changes.

You must not use a tracking link, publisher token, AppsFlyer parameter or deep link to mislead users, conceal destination content, bypass platform rules, distribute malware or attribute traffic contrary to the relevant commercial agreement.

You are responsible for recipients and content sent through Microsoft Teams, Slack, Telegram or email. Do not place sensitive Customer Data in a group/channel unless every recipient is authorised.

6. Customer-configured automations

You must not use automation features to:

  • execute or conceal unlawful, unsafe or unauthorised activity;
  • bypass a required human confirmation or high-risk system-tool restriction;
  • make a solely automated decision that produces legal or similarly significant effects on a person unless the use is lawful, expressly supported and agreed by Provider;
  • infer sensitive traits or profile a person unlawfully;
  • facilitate deceptive impersonation, phishing, malware or privacy-invasive surveillance; or
  • expose credentials, secrets or unnecessary personal data through workflow text or actions.

You must review, test and approve each material workflow before activation. You remain responsible for triggers, schedules, recipients, mappings, limits and actions. You must monitor active automations and disable them promptly if results are unexpected or harmful.

7. Fair use and technical limits

You must remain within the limits in your Order Form, Documentation and Third-Party Service plan. You must not artificially split accounts or organisations to avoid limits.

If usage threatens stability, security, a third-party quota or other customers, Provider may apply reasonable rate limits, queueing or temporary restrictions. Provider will, where practicable, contact Customer to agree a sustainable configuration or plan.

8. Regulated activities

The Service is not designed to determine eligibility for credit, employment, housing, insurance, education, health treatment, public benefits or another decision that may significantly affect a person. You must not use it for such a purpose without Provider's express written agreement and documented legal/safety controls.

If you use KabData in gambling, betting, financial services or another regulated sector, you are solely responsible for licences, age/geographic restrictions, marketing rules and platform-specific requirements. Provider's provision of general analytics functionality is not approval of a regulated use.

9. Investigation and enforcement

Provider may investigate a suspected violation and may request information reasonably needed to assess it. Customer will cooperate, preserve relevant records and take prompt corrective action.

Where reasonably necessary and proportionate, Provider may:

  • warn Customer or require remediation;
  • remove or quarantine malicious content;
  • disable an integration, token, workflow, export or affected account;
  • rate-limit or suspend affected access;
  • preserve evidence;
  • notify an affected customer, provider or authority where required by law; or
  • terminate for material or repeated breach under the Terms.

Where practicable and lawful, Provider will notify Customer and limit action to the affected feature or user. In urgent cases involving security, harm, unlawful activity or third-party platform integrity, Provider may act before notice.

10. Reporting abuse

Report suspected abuse to [email protected] and include the organisation, relevant URL/record, date/time and a concise description. Do not send credentials or unrelated personal data.

11. Changes

Provider may update this AUP to address new features, threats, laws or third-party requirements. Material adverse changes during a committed paid term are handled under the Terms.