Acceptable Use Policy

This is Version 1.0. It applies until November 18, 2026, when Version 1.1 replaces it. Version 1.1 →

Effective date: October 16, 2026 · Version 1.0 · Previous versions: none yet

This Acceptable Use Policy ("Policy") explains what you may not do with the ReCaptured platform: the web app at app.recaptured.io, our mobile and desktop apps, our APIs and our MCP server (together, the "Service"). It is part of the Terms of Service and of each Customer Agreement. Words defined in the Terms of Service ("Terms") have the same meaning here.

ReCaptured is built for businesses to run their operations. Most of this Policy describes things any responsible business would avoid anyway. It exists so that everyone using the Service, and everyone whose information is in it, can rely on the same rules.

1. Who this Policy applies to

1.1 Everyone who uses the Service

This Policy applies to:

• every user who signs in, whatever their role (owner, administrator, member or external client);
• every guest who joins a meeting, views a shared file or transcript, or signs a document through the Service;
• every AI app, integration, script or automation that reaches the Service through our APIs or MCP server, and the person or Customer who set it up.

1.2 Actions taken for you

You are responsible for actions taken in the Service on your behalf, including by the assistant when you approve its actions; by an AI app you connect through our MCP server; and by automations and workflows you create or turn on. "It was the AI" or "it was an automation" is not a defence to a violation of this Policy.

1.3 Customers

Each Customer is responsible for making sure its users, guests and integrations follow this Policy, and for the content it and its users put into the Service.

2. Illegal, harmful and abusive activity

Do not use the Service to:

• break any law or regulation, or help anyone else break one;
• infringe anyone's intellectual property, privacy or publicity rights (see our Copyright (DMCA) Policy for how to report infringing content);
• harass, threaten, bully, stalk, defame or intimidate anyone;
• discriminate unlawfully against anyone, including in hiring, housing, lending or access to services;
• create, store or share material that sexually exploits or endangers children. We report such material to the National Center for Missing & Exploited Children and to law enforcement.
• promote or incite violence, or provide material support to terrorism or violent extremism;
• commit or facilitate fraud, including phishing, false invoicing, fake reviews or impersonating another person or organization;
• launder money, evade sanctions or export controls, or deal with sanctioned persons.

3. Security and access

The Service separates each Customer's data from every other Customer's. Do not try to weaken that, or any other protection.

Do not:

• access, or try to access, any account, organization, record, file or data you are not authorized to access;
• try to reach another Customer's data, or to move data between organizations other than through features built for it;
• share your sign-in details, authentication devices, passkeys, API keys or MCP access with anyone, or use anyone else's;
• bypass, disable or interfere with multi-factor authentication, permissions, field-level access controls, file malware scanning, AI content screening, share-link passwords or expiry, usage limits or any other security feature;
• upload or link to malware, or files designed to harm devices, networks or the Service;
• probe, scan, load-test or test the Service for vulnerabilities without our prior written permission. If you find a security issue, report it to security@recaptured.io (see Section 13). We welcome good-faith reports;
• access the Service by automated means except through our documented APIs and MCP server, within the permissions you have been given.

Our staff can view an organization only through time-limited, read-only support sessions that are recorded in our audit trail. Do not imitate or claim to be ReCaptured staff.

4. AI features

The Service uses AI for the assistant, summaries, transcription, search, knowledge features and data enrichment. Content is screened before it reaches an AI provider, and the request is blocked if screening cannot be completed.

4.1 Do not misuse the AI

Do not:

• put instructions into records, files, messages, emails, web pages or any other content in order to manipulate the assistant or a connected AI app into acting against the interests of the user or Customer it serves (often called "prompt injection");
• try to get the AI to reveal another user's or another Customer's data, its system instructions or our security configuration;
• try to get around content screening, for example by splitting, encoding or disguising content;
• use the AI features to create content this Policy prohibits.

4.2 Check before you rely on it

• AI output can be wrong. Review it before you rely on it or send it to others, as the Terms explain.
• Do not remove or hide the labels that show content was generated by AI where people would reasonably expect to know.
• Do not present AI output as professional advice (legal, medical, financial, engineering or safety) unless a qualified person has reviewed it and takes responsibility for it.

4.3 Approving actions

When the assistant or a connected AI app asks you to confirm an action, such as creating or changing records, sending a message or scheduling an event, read the summary before you confirm it. Do not set up automations or connected apps designed to approve actions without a person reviewing them where the Service asks for confirmation.

4.4 Building other models

Do not use the Service, or its output, to develop or train an AI model or product that competes with the Service. This does not restrict a Customer's use of its own Customer Data.

5. Connecting your own AI apps (MCP and APIs)

A Customer can connect its own AI app or integration to the Service through our MCP server or APIs. If you do:

• connect only apps your organization has approved. Your administrators can limit which apps may connect and can revoke access at any time;
• give each app only the access it needs;
• do not use an app to bulk-extract data from the Service in a way that bypasses the permissions, field restrictions or export controls that apply to you;
• remember that data your app takes out of the Service is handled by that app's provider under your organization's own arrangements with it, not ours.

6. Information about people

The Service holds information about real people: your colleagues, clients, contacts, subcontractors, leads, website visitors and meeting guests. You and your organization are responsible for handling it lawfully.

6.1 General rules

• Collect and use information about people only where you have a lawful basis and have given any notice the law requires.
• Do not put information about people into the Service in breach of the terms of the source you got it from (for example, data scraped from a site whose terms prohibit it).
• Do not use the Service to stalk, track or build a profile of a person for purposes unrelated to your business relationship with them.
• Honour people's requests to access, correct or delete their information, and their requests to stop being contacted, where the law requires it. Our tools are there to help you do this.

6.2 Decisions about people

Do not use the Service's AI or data-enrichment features as the basis for a decision that has a legal or similarly significant effect on a person, such as one about employment, credit, housing, insurance, education or healthcare, unless a qualified person reviews the decision before it takes effect, and you meet every legal requirement for notice, explanation, opt-out and appeal that applies to it.

6.3 Data enrichment

Enrichment looks up public or connected-source information about a company or person and offers candidates for you to choose. Use it only to keep records about your own business relationships accurate. Do not use it to:

• identify or profile individuals who have no business relationship with you;
• find personal contact details for people who have asked not to be contacted;
• infer sensitive characteristics about anyone, such as health, ethnicity, religion, sexual orientation, political views or immigration status.

6.4 Web forms and the visitor-insights script

If your organization uses our public web forms or puts our visitor-insights script on its website:

• publish your own privacy notice and link to it where information is collected. The Service requires this before a form can be published;
• place the script only on websites your organization controls and has registered in the Service;
• keep the script's consent setting appropriate for your visitors. By default it collects nothing until the visitor consents. Do not change that default unless you have confirmed the law allows it for your visitors, and never to get around a visitor's refusal;
• do not use the script or form data to identify individual visitors who have not chosen to identify themselves, except as the law allows.

7. Recording, location and monitoring

7.1 Meetings

• The Service asks every participant for consent before a meeting is recorded or transcribed. Do not get around that request, for example by recording a meeting with another tool and uploading it, unless everyone in it has agreed as the law requires.
• Do not record anyone who has refused.

7.2 Field audio, location and timekeeping

• If your organization uses field audio, GPS time tracking or other location features, it must give its people the notice, and obtain the consent, that the law requires before they are used. The Service records that notice or consent; it does not replace it.
• Use these features only for legitimate work purposes, during working time, and in the places the law allows. Do not use them to monitor anyone outside work, or to record conversations in places where people have a reasonable expectation of privacy (for example, restrooms or private homes) without the consent the law requires.

7.3 Voices and faces

Do not use the Service to identify people from their voice or face, or to create voiceprints or other biometric identifiers. The Service is not designed for it.

8. Communications

The Service can send email from a connected Google or Microsoft account, post to Slack and Microsoft Teams, send in-app messages and notifications, and run automations that do these things.

Do not:

• send spam, or bulk or automated messages to people who have not agreed to receive them where consent is required;
• send commercial email without what the law requires, including an accurate sender, a truthful subject line, your postal address and a working way to opt out (for example, under the U.S. CAN-SPAM Act and Canada's CASL);
• send phishing messages, or messages that impersonate another person or organization;
• use connected accounts in a way that breaks the email or messaging provider's own terms or sending limits;
• harvest email addresses or contact details from the Service to send unsolicited messages.

The Service does not send text messages (SMS). If ReCaptured itself texts you from one of its own phone numbers, our SMS Terms apply.

9. Restricted data

Follow Section 8 of the Terms. In particular, unless ReCaptured has designated your organization in writing for that kind of data and any required agreement is in place, do not put into the Service:

• protected health information as defined by HIPAA (a Business Associate Agreement must be in effect first);
• Controlled Unclassified Information, or technical data controlled under the ITAR or the EAR;
• payment card numbers or card security codes. Payments go through Stripe's own forms.

Also do not put in the Service, except where your business genuinely needs it and you protect it with the Service's sensitive-field controls:

• government identification numbers (such as Social Security, passport or driver's licence numbers);
• bank account numbers;
• passwords or secrets for other systems. Use your organization's password manager or vault instead.

10. Files, sharing and signatures

10.1 Files and share links

• Do not use the Service as a general public file host or content-delivery network.
• Share links are for sharing files with specific people for a limited time. Do not post them publicly, and do not use them to share other people's personal information without a lawful basis.
• Do not upload content you do not have the right to store or share. Rights holders can report infringing content under our Copyright (DMCA) Policy.

10.2 Electronic signatures

• Sign only as yourself, and only documents you are authorized to sign.
• Do not send a document for signature to someone while impersonating another person, or change a document after it has been signed in a way that misrepresents what was agreed.
• Do not use electronic signatures for documents the law says cannot be signed electronically. In the United States these include wills, codicils and testamentary trusts; adoption, divorce and other family-law matters; court orders, notices and other official court documents; notices of utility shut-off; default, foreclosure, repossession or eviction notices for a primary residence; cancellation of health or life insurance; product recall notices affecting health or safety; and documents that accompany hazardous materials.

11. Fair use of the Service

Do not:

• overload or disrupt the Service, or use it in a way that degrades it for other Customers. We may set limits on requests, storage, imports, AI usage and similar resources, and may change them to protect the Service;
• get around usage limits, AI allowances or billing;
• copy, scrape or frame the Service, or reverse engineer it except where the law expressly permits;
• use the Service or its design to build a competing product;
• resell, sublicense or provide the Service to anyone outside your organization, except as the Customer Agreement allows.

12. Connected third-party services

When you connect Google Workspace, Microsoft 365, Slack, SAM.gov or another service:

• connect only accounts you are authorized to connect, and grant only the access the feature needs;
• follow that service's own terms and policies. For example, data from SAM.gov is subject to its terms of use;
• do not use the Service to get around restrictions that service places on its data.

13. Reporting

• Security vulnerabilities: security@recaptured.io. Please give us a reasonable chance to fix an issue before disclosing it.
• Abuse or violations of this Policy: legal@recaptured.io.
• Copyright complaints: see our Copyright (DMCA) Policy for our designated agent and the notice and counter-notice procedure. Other legal notices: legal@recaptured.io.

If you are a user and believe someone in your own organization is breaking this Policy, you can also tell your organization's administrator.

14. Enforcement

14.1 What we may do

If we reasonably believe this Policy has been broken, we may do any of the following, in proportion to the problem:

• ask you or your organization to fix it;
• remove or disable access to specific content, or disconnect a specific integration, connected app or share link;
• suspend or end a user's access, or a Customer's access, as described in Section 13 of the Terms and in the Customer Agreement;
• report the matter to law enforcement or other authorities where the law requires it or where there is a risk of harm.

14.2 How we do it

• Investigation. We investigate suspected violations using the information we need, under the access controls and audit trail that apply to our own staff.
• Notice. Where reasonable, we will tell the Customer's administrators first and give them a chance to fix the problem. In an emergency, or where the law prohibits notice, we may act immediately and explain afterwards.
• Your data. Enforcement action does not delete Customer Data by itself. Where content must be removed or preserved, we will follow the Customer Agreement and the law.
• Disagreeing with a decision. If you think we got it wrong, reply to our notice or write to legal@recaptured.io. We will review it.

14.3 No duty to monitor

We are not obliged to monitor content in the Service, and we do not review Customer Data except as described in the Privacy Notice and the Customer Agreement. Not acting on a violation does not mean we accept it.

15. Changes to this Policy

We change this Policy the same way we change the Terms (Section 17 of the Terms):

• Material changes: at least 30 days' notice by email and in the app, with a summary. You will be asked to accept the new version on its effective date.
• Other changes, such as clarifications and corrections, take effect when published with a new effective date.
• Past versions stay available on this page.

16. Contact

RECAPTURED, LLC
2305 Pennsylvania Avenue
Wilmington, DE 19806

Legal: legal@recaptured.io · Security: security@recaptured.io · Privacy: privacy@recaptured.io