Acceptable Use Policy

This Acceptable Use Policy (the “AUP”) governs use of the itogai Subscription Service (the “Services”) wherever and however accessed, including through any itogai website, application, client, extension or interface. It is incorporated into the Customer Terms of Service by reference, and capitalized terms not defined here have the meanings given there.

1. Purpose

itogai exists so that people can take care of the relationships they already have. Every rule below follows from that, and each one describes conduct that either harms a person, harms a service a User connects, or turns a warm network into a list.

Violating this AUP is a material breach of the Customer Terms of Service.

2. Prohibited conduct

The Customer and each User shall not, and shall not permit a third party acting on the Customer’s behalf to, use the Services to do any of the following.

2.1 Illegal or harmful activity

• Engage in activity that violates applicable law, including any anti-spam, anti-fraud, export control, sanctions, anti-bribery, data protection, telemarketing or consumer protection law in any jurisdiction in which the Customer, the User or a recipient is located.
• Harass, stalk, dox, intimidate or threaten any individual.
• Promote, organize or incite violence, terrorism, hate speech, discrimination or self-harm.
• Engage in human trafficking, child exploitation, or any activity that endangers a minor. itogai has zero tolerance for content that sexually exploits or endangers children. Any account involved in such conduct is terminated immediately and reported to the National Center for Missing and Exploited Children and to the applicable authorities.

2.2 Spam, automation and unsolicited communication

• Send unsolicited bulk commercial communication, send to a recipient who has opted out, or send communication that violates the CAN-SPAM Act, CASL, the GDPR including the ePrivacy consent rules, the LGPD, or any equivalent law.
• Misrepresent a sender’s identity, use a deceptive subject line, or disguise a commercial message as personal correspondence.
• Circumvent any third-party platform’s anti-spam, anti-abuse or rate limiting controls, including by sending volumes through a connected mail provider that violate that provider’s terms or trigger its abuse heuristics.
• Operate a sequence, cadence, drip campaign, automated reply, automated follow-up, automated direct message, or any other form of automated multi-step messaging in which a message goes out without the sending User having reviewed that specific message and clicked send on it. The Services are built for one decision and one send.
• Operate any third-party automation tool, browser extension, scripted agent or scheduler that simulates a User’s click in order to send or schedule a message through the Services.
• Engage in any pattern of cold outreach manifestly inconsistent with itogai’s purpose, which is warm, network-based relationship building. This is deliberately a standard rather than a list, because the patterns change faster than a list can.
• Broadcast to a list of people the User does not already have a relationship with. Broadcast is the only multi-recipient send the Services support, it requires one composition and one click to an explicit recipient set drawn from the User’s own network, and it is for that network rather than for cold outbound.
• Brand, label or describe any workflow built on or alongside the Services as an outreach sequence, an outreach engine, outreach automation, a cadence or a drip campaign, or as any other category name implying that the Services automate outbound messaging. They do not.

itogai’s own transactional and system mail sits outside this Section. A message itogai sends in its own name because a person took an action inside the Services, such as accepting or declining a request, is a system notification rather than a send on any User’s behalf. A message a User sends goes out from the User’s own connected account, and the User is its sender; an introduction email that account can’t send can go out from itogai’s introductions address, intros@itogai.com, carrying the User’s text and identified as sent via itogai, when the User chooses it. Section 3 describes how to tell the two apart.

2.3 Privacy

• Submit Personal Data about an individual without a lawful basis under applicable data protection law.
• Scrape, crawl or harvest Personal Data from any service or website. Uploading a copy of the User’s own data that a service provides through its own download feature is an acquisition method under Section 1.5a of the Customer Terms of Service, not harvesting.
• Bring data into the Services by any means other than the five acquisition methods in Section 1.5a of the Customer Terms of Service: a connected account through the provider’s own sign-in; a copy of the person’s own data, an archive or a file the person requests, exports or maps themselves; a conversation export the person produces in compliance with the source service’s terms; a conversation the person saves with the itogai companion, on their own click; and manual entry. In particular: scraping; automated or background collection from any service; the use of any tool, extension, script or service the Customer brings in that automates the person’s account with the source service or collects data from it for the Services; supplying another service’s credentials, keys or backups, or a file produced by getting around a service’s security; and collection of data about people who are not users from anywhere other than the conversations, contacts and records the person holds in their own account with the source.
• Get around a limit, a block or a restriction that a source service places on an account, or that the Services place on a connection, or use several accounts, a shared account or an account the person isn’t authorized to use to read more than one person’s own account shows.
• Surveil, profile or build a dossier on an individual for a purpose that individual would not reasonably expect, including intimate-partner surveillance, employment surveillance not disclosed to the affected workers, and tracking of political opponents.
• Submit any excluded category of data, as Section 7.6 of the Customer Terms of Service sets out in full. Those categories include every special category of personal data under Article 9 of the GDPR and every category of Sensitive Personal Information under the CCPA, together with protected health information, payment card data, government-issued identifiers, precise geolocation, and information about a person under the age of eighteen (18).

2.4 Security and integrity

• Attempt to gain unauthorized access to the Services, to itogai’s infrastructure, to another Customer’s Account, or to any third party’s Data Source.
• Probe, scan or test the vulnerability of the Services or any related system without itogai’s prior written authorization through the coordinated disclosure route in Section 5.
• Interfere with the functioning of the Services, including by transmitting malicious code, by conducting a denial-of-service attack, or by deliberately overwhelming a rate limit, queue or capacity constraint.
• Reverse engineer, decompile or attempt to derive the source code, models, weights or algorithms underlying the Services, except to the extent applicable law expressly permits.
• Use any automated system to access the Services in a manner exceeding reasonable human use or violating a technical or contractual restriction.

What itogai asks of every Customer, because only the Customer can do it. itogai never stores a password, offers multi-factor authentication to every Account through its identity provider, and runs the controls on its side that the security page at itogai.app/legal/security describes. On the Customer’s side, itogai expects each Customer to keep Account credentials confidential and never share an Account between people; to turn multi-factor authentication on for the Account Owner and for every User who administers a Team or a Group; to remove a User who leaves the Customer or no longer needs access, promptly; to revoke a Data Source it no longer wants read; to report a suspected compromise of an Account, a credential or a device to legal@itogai.com as soon as it learns of it; and to read and act on the security notices itogai sends. Section 2.6a of the Customer Terms of Service lists these controls and more, and Annex IV of the Data Processing Agreement records them as the controls itogai’s own measures assume. These are expectations, not prohibitions: failing one is not a violation of this AUP, but it can be the reason an incident happened, and itogai says so plainly here so that nobody learns it afterwards.

2.5 Intellectual property

• Upload, post or transmit content infringing a third party’s intellectual property rights.
• Use the itogai, Trustbound™, TrustGraph™, TrustRings™, TrustReach™ or Akai™ marks, or the itogai logo, in a manner suggesting an endorsement, partnership or affiliation that does not exist, or in a manner inconsistent with the Trademark Notice and Usage Guidelines.

2.6 Misuse of scores, outputs and Akai

• Represent any output of the Services, including a TrustGraph score, a TrustRings organization, a TrustReach recommendation, or an Akai draft, as a deterministic, audited or guaranteed assessment of any individual or relationship. Every output is probabilistic and supports rather than replaces a person’s own judgment.
• Use a score as a factor in a decision producing a legal or similarly significant effect on a person, including any decision about employment, credit, housing, insurance, education or access to a benefit. A TrustGraph score is not, and may not be used as, an assessment of character, creditworthiness, employability or eligibility for anything.
• Produce content for the purpose of deceiving, defrauding or impersonating any individual or organization.
• Represent Akai to a third party as an autonomous agent, an automated sender, or a service that takes action without a person’s review and click. Akai drafts, surfaces and explains. The person decides and sends.

2.7 Facilitated introductions and fees

Where a User offers or requests an introduction involving a fee, the Bridger Terms apply in addition to this AUP, and the following are prohibited:

• Misrepresenting what was agreed, or what happened against it. A fee may be fixed, or may depend on a future event the two parties define. Stating a fee basis that was not agreed, reporting an outcome that did not occur, or withholding a report of one that did in order to avoid a fee that was agreed, is prohibited. itogai does not verify any of these, which is precisely why misreporting them is a violation of this AUP rather than a private disagreement.
• Publishing a rate card. A fee is agreed for a specific request. Listing a price, posting a standing public offer to make introductions for money, or advertising oneself as available to do so at a published rate is prohibited.
• Affirmatively stating that no fee was involved when one was. Whether a person discloses a fee to the person being introduced is that person’s own decision, and this AUP does not compel disclosure. It does prohibit a false denial, and itogai will answer honestly if a person who was introduced asks whether a fee was involved in that introduction.
• Charging a fee for an introduction made in connection with any of the following:
  • healthcare services, patient referrals, or anything reimbursed by a health program;
  • securities, fund placement, or an investment introduction that would require registration;
  • lending, mortgage origination, or credit brokerage;
  • insurance placement;
  • legal services; or
  • government procurement, a public tender, or any public official.
  These are prohibited contexts whether or not a license is held, and the prohibition covers an introduction to a person acting in one of those capacities. Free introductions remain available in every one of them: the prohibition attaches to the fee, never to the introduction. Referral compensation is restricted or unlawful in other sectors and jurisdictions as well, and the person paying and the person receiving are each responsible for their own compliance.
• Structuring a fee, a payment or a series of introductions in order to avoid any of the above.

2.8 Commercial misuse

• Resell, sublicense or rent access to the Services, including by means of a service bureau, time-sharing or hosted-service offering.
• Use the Services to develop, train or improve a product, service or model that competes with the Services.
• Misrepresent eligibility in order to obtain an adjusted price, including by misrepresenting the location in which the Customer’s legal entity is registered.
• Share Account credentials with anyone who is not an authorized User under the Customer’s Account.

2.9 Introductions

Whether or not a fee is involved, the following is prohibited:

• Exchanging contact details without both sides having agreed, except where the person making the introduction holds an existing relationship with both people and attests to that at the moment of sending. A false attestation is itself a violation of this AUP.

2.10 Groups

• Using what a Group makes visible to reach a contact outside the introduction flow. Seeing that a colleague knows a person confers no right to contact that person. Reaching them runs through an introduction with the colleague as the person making it, and every consent rule applies unchanged.
• Contributing, or attempting to contribute, another member’s contacts to a Group, or presenting a colleague’s contact as one’s own.

2.11 Conduct as a person making or requesting an introduction

Whether or not a fee is involved, a User who makes or requests an introduction agrees to the following, and a breach is handled under Section 4:

• Ask with context, and respect a decline. A request says why this person and why now, and a no is the end of it.
• Never share a contact’s details outside the Group or the introduction they were shared in.
• Settle what was agreed. What the two of you agreed is what is paid, on the terms the Bridger Terms state.
• Never route around the person who introduced you to reach the rest of their network.
• Report a concern. Never retaliate.

How itogai enforces this Section. In this order, and never skipping a step where the circumstances allow: a warning; tightened caps on requests; paid requests paused; the Account restricted. Every step is decided by a person at itogai, is logged with its reason, and is never automated. The User a step is taken against sees the step and the reason, and never sees who reported them.

3. Reporting abuse

To report a violation of this AUP, write to legal@itogai.com with the account or message in question and enough detail to investigate. If you received a message you believe violates this AUP, tell us. itogai investigates reports from people who are not customers on the same basis as reports from people who are.

If you received a message because someone holds your details in itogai, or you learn that you appear in a conversation someone imported into itogai or read on screen, and you want your information gone, write to privacy@itogai.com with the address or number you want removed. itogai forwards your request to that customer, removes every enrichment result about you in every account, together with its shared copy and what profile completion wrote about you, and, where the customer does not answer within thirty (30) days, suppresses your record itself. Section 13.6 of the Privacy Policy sets out the steps and the timing.

To be clear about what itogai did and did not do: itogai never sends a message on a User’s behalf on its own. Every message sent to you through itogai by one of its customers was reviewed by a person and sent by that person clicking send, from that person’s own email account or, where that account can’t send it, from itogai’s introductions address, and an introduction email says that it was sent via itogai and links itogai’s notice for people in its users’ networks. itogai’s own transactional and notification mail is sent by itogai and is identified as such. This removal route exists so that you have one well-known way to break the chain regardless of who sent it.

4. Enforcement

4.1 What itogai may do. Where itogai reasonably determines that this AUP has been violated, itogai may remove or disable the offending content; suspend or limit a User’s or the Customer’s access, in whole or in part; terminate the Account; and report the conduct to the appropriate authorities.

4.2 Notice. itogai gives notice and an opportunity to cure where the circumstances allow it. itogai acts without prior notice where the conduct endangers a person, endangers the security of the Services or of another customer, or is of a kind that itogai has zero tolerance for.

4.3 No refund. Termination for a violation of this AUP does not entitle the Customer to a refund of prepaid fees.

4.4 Proportionality. itogai applies the least restrictive measure that addresses the conduct, and escalates where the conduct continues.

4.5 Reinstatement. A Customer may write to legal@itogai.com to contest a suspension or termination. itogai answers within ten (10) business days and states its reasons.

4.6 Remedies are cumulative. The remedies in this AUP are in addition to, and never in place of, every right and remedy itogai holds under the Customer Terms of Service or applicable law.

5. Coordinated security disclosure

To request authorization to test, write to legal@itogai.com describing what you propose to test and when. itogai answers, and testing carried out within the scope itogai authorizes in writing is not a violation of Section 2.4.

To report something you have already found, write to the same address with enough detail to reproduce it. Reporting in good faith is never a violation of Section 2.4, whether or not you sought authorization first.

itogai will acknowledge receipt within five (5) business days, investigate in good faith, tell you what it found and what it intends to do within thirty (30) days, and credit you where you would like to be credited. itogai does not operate a paid bounty program and does not offer one.

Please give itogai a reasonable opportunity to remediate before disclosing publicly; do not access, modify or delete data belonging to anyone else; do not degrade the Services for others; and do not use a finding to extract payment.

itogai will not pursue a claim against anyone who follows this Section in good faith.

6. Changes to this AUP

itogai may update this AUP. A change that reduces a right the Customer holds, or that expands the conduct prohibited in a way affecting existing use, takes effect thirty (30) days after notice. A clarification, a correction, or the addition of conduct already prohibited by another provision is published immediately with the Document Version incremented.

7. Contact

Abuse reports, enforcement questions, appeals and security disclosures: legal@itogai.com. Information removal and privacy rights requests: privacy@itogai.com.

Postal address: Itogai LLC Attn: Legal Department 4821 Jumping Way Lake Worth, Florida 33467 United States of America

Changelog

Amended October 15, 2026, version AUP-2026-10-15 v5.1. Section 2.3 keeps every prohibition, states that a tool, extension, script or service the Customer brings in to read or collect from a source service stays prohibited, and adds a prohibition on getting around a limit a source service or the Services place on an account. Section 2.2 states that a User’s message goes out from the User’s own account. Section 3 describes a message sent through itogai as reviewed and sent by a person from their own account, no longer says that the person composed it, and extends removal to every copy. For an Account existing on October 15, 2026 this version takes effect thirty (30) days after notice, because it expands the conduct prohibited.

Amended September 21, 2026, before first publication, on the security, privacy and AI governance layer. Section 2.4 adds what itogai asks of every Customer on its own side of the Services (credentials, multi-factor authentication for administrators, removing departed Users, revoking unused sources, reporting a compromise), stated as expectations rather than prohibitions and mirrored in Section 2.6a of the Customer Terms of Service and Annex IV of the Data Processing Agreement.

What changed from AUP v2.0, May 11, 2026, and why.

• New Section 2.7 covers facilitated introductions involving a fee, including the six prohibited contexts and the prohibition on a false denial.
• Section 2.6 now prohibits using a score as a factor in a decision with legal or similarly significant effect, where the prior version prohibited only using it as the sole basis.
• Section 5 now provides a route to request authorization before testing, which the prior version required but did not offer.
• Section 3 states plainly to a message recipient that every message was composed and sent by a person, and covers removal from the enrichment store.
• Section 2.3 states that the five acquisition methods in the Customer Terms of Service are the only permitted ways to bring data into the Services, and prohibits scraping, automated or background collection, unofficial clients, credential, key or backup sharing, and bulk collection about people who are not users. Section 3 extends the removal route to anyone who appears in an imported or on-screen conversation.
• Acknowledgement and response times were added to the coordinated disclosure commitments.

Amended September 21, 2026, before first publication. The prohibition on charging for an outcome is replaced by a prohibition on misrepresenting the fee basis or misreporting what happened against it, because a fee that depends on a future event is now permitted and the enforceable risk moved from the structure of the fee to the honesty of the report. Section 2.2 gains a note placing itogai’s own system mail outside the automated-messaging prohibition.

Also amended September 21, 2026, before first publication. The consent rule moved from Section 2.7 to a new Section 2.9, because it applies whether or not a fee is involved, as Section 1.11h of the Customer Terms of Service reads it. New Section 2.10 covers misuse of Group visibility. New Section 2.11 states the conduct expected of a person making or requesting an introduction, whether or not a fee is involved, and the order in which itogai responds to a breach, every step of it decided by a person. The age floor is eighteen (18), raised from sixteen. itogai applies eighteen wherever a lower figure would otherwise apply, because eighteen is the age of majority in most jurisdictions itogai serves.

A copy of the prior version is available on written request to legal@itogai.com.

Document version: AUP-2026-10-15 v5.1. Published at itogai.app/legal/acceptable-use-policy.

© 2026 Itogai LLC. All rights reserved. itogai, the itogai logo, Trustbound, TrustGraph, TrustRings, TrustReach, and Akai are trademarks of Itogai LLC.