1. Scope

This Acceptable Use Policy is part of the Terms of Service. It applies to every use of the Service, including the snippet, SDKs, APIs, MCP server, Adaptive Journeys, and the Partner Network.

2. Prohibited data

You may not submit or configure the Service to collect:

Protected health information or any data that would make Apex a HIPAA business associate.
Payment card numbers, full bank account numbers, or other PCI cardholder data.
Government identifiers (Social Security numbers, passport numbers, national IDs).
Biometric identifiers used for identification.
Data about children under 18.
Special-category data under GDPR (health, politics, religion, sex life, and similar) unless an Order Form expressly allows a named use.

3. Prohibited conduct

Reverse engineering, scraping, or load-testing the Service except ordinary use or a written test agreement.
Using the Service or its outputs to build a competing product.
Interfering with other customers, or probing Apex systems except through a disclosed vulnerability program.
Uploading malware or using the Service to distribute it.
Impersonating Apex, a merchant, or a partner.
Circumventing usage meters, holdouts, consent gates, or suppression lists.
Using MCP tools, API keys, or agents to access another customer’s data or to exfiltrate Customer Data except through documented export.
Reselling the Service without a written partner agreement.

4. Communications

You may not use Apex to send:

Unsolicited marketing in violation of CAN-SPAM, TCPA, CASL, or ePrivacy rules.
Messages to purchased, scraped, or rented lists you do not have permission to use.
Phishing, spoofing, or deceptive From lines.
Content that is illegal, harassing, or that promotes violence or fraud.

Classifying a send as transactional in the dashboard does not make it lawful. You are responsible for the classification and the message.

5. Experiments and sites you do not control

You may run experiments and the snippet only on properties you own or are authorized to change. You may not inject Apex onto a third-party site without that party’s permission.

6. Partner promotion

Partners must follow the Partner Program Terms, including FTC endorsement disclosures. Cookie stuffing, bot traffic, trademark bidding without permission, and fake claims are prohibited.

7. Enforcement

Apex may investigate, suspend, or terminate accounts, reverse partner commissions, and report illegal activity. Apex has no duty to monitor Customer Data but may remove data or disable a use that appears to violate this policy or law.