Acceptable Use Policy

2. What you must not do

You must not use my-iris to:

1. 1.Phish, defraud or deceive. Send anything meant to obtain passwords, payment details, personal data or money by deception, or to mislead a recipient about who is contacting them or why.
2. 2.Impersonate. Pretend to be another person, company, authority or brand, or mislead recipients about the origin of a message. This includes spoofing or falsifying a sender identity.
3. 3.Send unsolicited messages. Send advertising, promotion, chain messages, surveys or any bulk message that recipients did not ask to receive. Alerts must be about a real operational event that the recipient has agreed to handle.
4. 4.Contact people who have not agreed. Add a person to a receiver group, or send to a number, unless that person is responsible for responding to your alerts and the contact is expected, for example an employee, a contractor, or a customer contact who asked to be alerted.
5. 5.Include web addresses. Put a web address or link, including disguised or shortened forms, in any text you send through my-iris, in alert names, messages, templates or reports.
6. 6.Harass, threaten or break the law. Send abusive, threatening, hateful or illegal content, or use the service in breach of any law that applies to you or to the recipient.
7. 7.Get around our controls. Avoid or test limits, verification, recipient confirmation, country restrictions, rate limits or suspensions. This includes opening several accounts to get round a limit or a refusal, and sending simulated phishing or other security tests to recipients.
8. 8.Share or misuse access. Share API keys, sign-in details or email trigger addresses outside your organisation, or use another customer’s workspace.

3. Plain text, no links

Alerts are sent as plain text. my-iris removes web addresses from alert text that your own systems send, and it refuses them in text that people save. If a message is removed or refused, nothing is wrong with the service; the rule is the same for everyone.

4. Recipients must confirm

Before a phone number receives an alert by text message or call, its owner must confirm it: by replying to a confirmation request that my-iris sends, or by signing in to the my-iris app with that number. Numbers that have not confirmed are left out. A person who replies STOP to a message will not receive further messages from that sender. You must respect these choices and must not try to work around them.

5. Monitoring, suspension and cooperation

• We check alert text for web addresses, and we review sending for signs of abuse, using automated checks and manual review.
• We may suspend, limit or stop your workspace, API keys or any sending immediately and without prior notice if we believe this policy has been broken, or if we need to protect recipients, other customers, the service or our providers. Where it is safe to do so we will tell you what happened.
• We cooperate with authorities, such as law enforcement, regulators, national cybersecurity centres and our providers, and we may disclose the information they lawfully require or that is needed to stop abuse.

6. Provider terms

my-iris sends messages and calls through telecommunications providers. You must also comply with their acceptable-use rules as they apply to your use. At the moment these include:

• Twilio Acceptable Use Policyhttps://www.twilio.com/en-us/legal/aup
• Twilio Messaging Policyhttps://www.twilio.com/en-us/legal/messaging-policy

You are responsible for the people who use your workspace and for making them aware of this policy and these provider terms.

7. Reporting abuse or a security problem

If you receive a message from my-iris that you believe breaks this policy, write to abuse@my-iris.io. To report a security problem, use the contact in /.well-known/security.txt.