Acceptable Use Policy

This Acceptable Use Policy (the "Policy") is part of the Terms of Service between Vitabyte, Inc. ("Vitabyte") and each Customer, and it binds every Authorized User and every other person who uses the Services, including any demo, sandbox, trial or preview. Words with capital letters have the meanings given in the Terms.

The Policy gives concrete examples of conduct that is not allowed. The examples are not a complete list. If something is not listed but breaks the law, harms other people, or undermines the security or integrity of the Services, it is also prohibited. The Terms, especially sections 9 to 12, contain the full rules on reverse engineering, extraction and competitive use, and the remedies for breaking them; this Policy reinforces them.

You accept this Policy by ticking its box before you use the Services. You agree that Vitabyte records that acceptance, as the Terms describe.

You may not:

• probe, scan, map or test the vulnerability of any part of the Services, or attempt to breach or bypass any security or authentication measure, without Vitabyte's prior written authorization for a specific test;
• access, or attempt to access, any account, organization, location, device, data or system that you have not been given permission to use, including by changing identifiers in a URL, request or API call;
• interfere with or disrupt the Services, other customers or their devices, including by denial-of-service attacks, flooding, resource exhaustion or deliberately malformed requests;
• upload, install, send or link to malware, ransomware, spyware, worms, logic bombs or any other harmful code, including through a VitaRemote agent, a file transfer or a remote session;
• use VitaRemote or any other remote-management feature to access or control a device without the knowledge and authority required by law and by the device owner's policy;
• tamper with, root, jailbreak or alter a device enrolled in the Services in a way that defeats its security, or enroll a device you do not control;
• circumvent any licence check, device enrollment, attestation, key or other technological protection measure, which the Terms describe; or
• reverse engineer, decompile, disassemble or derive the source code of any app, APK, agent, firmware or protocol, as the Terms prohibit.

Responsible disclosure. If you find a security weakness, report it in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, with enough detail to reproduce it. Do not access or keep more data than needed to show the problem, do not disclose it publicly before Vitabyte has had a reasonable time to fix it, and do not test against live customer accounts. Good-faith reports made this way will not be treated as a breach of this Policy.

You may not:

• use the Services for fraud, money laundering, terrorist financing, sanctions evasion or any transaction you know or suspect is unlawful;
• process transactions for another business through your merchant account, split transactions to avoid limits, or run fictitious, test or self-funded transactions on a live account;
• misrepresent prices, taxes, surcharges, card fees or tips to guests, or charge fees that card network rules or the law do not allow;
• enter, store, photograph, export, email or message full card numbers, card security codes, magnetic-stripe or chip data, or PIN data anywhere in the Services except in the fields and devices designed to capture them;
• copy card data out of receipts, screens, logs or exports, or keep it beyond what the Payment Card Industry Data Security Standard allows; or
• use the Services to evade a processor's or card network's monitoring, reserve or risk controls.

You may not use the Services to create, store, send or display content that:

• is unlawful, defamatory, harassing, threatening, or discriminatory on a basis the law protects;
• infringes or misappropriates anyone's copyright, trademark, trade secret, privacy or publicity rights;
• sexually exploits or endangers minors, in any way;
• promotes or sells goods or services that are illegal where offered, or sells age-restricted goods without required checks; or
• impersonates any person or business, or falsely suggests a connection to Vitabyte or anyone else.

You may not send marketing messages through the Services, including through VITABYTE CRM, Angie or receipts, without the consents and opt-out mechanisms that telemarketing, text-messaging and email laws require. You may not collect personal information through the Services without the notices and consents the law requires, or use it for a purpose its owner was not told about.

The Services include features that use artificial intelligence, including Angie, Angie Eats ordering and the in-portal assistant. You may not:

• attempt to make an AI feature reveal its system instructions, prompts, configuration, tools, other customers' data, or data your role cannot see;
• use prompt injection, which means hiding or inserting instructions in a message, menu item, product description, review, document, file name, web page or other content so that an AI feature follows them instead of its user or its safeguards;
• try to make an AI feature act outside the permissions of the person or binding it acts for, approve its own actions, skip a required human review, or place, change or refund orders or payments without authority;
• use an AI feature to produce content that this Policy prohibits, or to impersonate staff, guests or Vitabyte;
• feed an AI feature with personal or card data it does not need; or
• extract outputs from an AI feature at scale, or use them to train, fine-tune or evaluate another model.

Treat AI output as a suggestion to check, not as a decision. Report any AI behaviour that looks unsafe or wrong in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103.

One person, one login. Every login, passkey, one-time code, API key and device enrollment code belongs to one named person or one registered integration. You may not:

• share, lend, sell or post credentials, including a password given to you for a demo or trial;
• use a shared "front desk", "team" or "demo" login, or let several people use one account;
• create accounts with false information, or create several accounts to evade a limit, a suspension or a trial period; or
• use another person's credentials, even with their permission.

No automated access outside the API. Except through Vitabyte's documented API under the Developer and API Terms, you may not access the Services with bots, scripts, crawlers, spiders, headless browsers, browser automation, macros or robotic process automation.

No scraping or AI ingestion. You may not scrape, crawl, harvest or mirror any part of the Services or Documentation, and you may not feed any screen, export, Documentation, content or data from the Services into an AI agent, large language model, embedding, vector store, retrieval index or training, fine-tuning or evaluation dataset, except as the Developer and API Terms expressly allow for data you own.

Rate and volume limits. The Services enforce limits to keep them fast and safe for everyone. The table below states the default ceilings the Services enforce today. Vitabyte may set a lower limit for an account, device or address where needed to protect the Services, for example for a demo, sandbox, trial or new account. A higher limit applies only where Vitabyte has confirmed it in writing.

Other uses, such as concurrent connections, webhooks, messages to AI features, file uploads, and the use of demo, sandbox and trial accounts, are subject to reasonable limits that Vitabyte may set and change.

You may not evade a limit by spreading requests across accounts, keys, IP addresses, devices or organizations, or by repeating requests after receiving a limit response. Requests over a limit may be slowed, refused or blocked, and repeated attempts may lead to suspension.

You may not use the Services, any demo, sandbox or trial, or anything learned from them, to benchmark, compare, copy or build a competing product, or to help anyone else do so, without Vitabyte's prior signed written consent. You may not publish screenshots, recordings, comparisons or test results of the Services without that consent. The Terms state this rule in full and set out its remedies, including injunctive relief and liquidated damages.

The Customer is responsible for its Authorized Users and for anyone who uses the Services through its account, keys or devices. You must make sure your staff, contractors and integrations follow this Policy, and act promptly when you learn that someone has not.

If you see something that breaks this Policy, including abuse of the Services by another customer, a phishing site pretending to be Vitabyte, a lost or stolen enrolled device, or an exposed credential or key, report it in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103. Include what you saw, when, and any account, device or link involved. Do not attempt to investigate by accessing other people's accounts or data.

Vitabyte may investigate any suspected breach of this Policy and may review Usage Data, audit trails and records of acceptance to do so. Depending on the seriousness of the breach, Vitabyte may, with or without notice:

• warn you and ask you to stop or fix the conduct;
• slow, limit or block requests, exports or features;
• revoke credentials, API keys or device enrollments, or deactivate enrolled devices;
• remove or disable content;
• suspend or terminate Authorized Users, accounts or the whole agreement under the Terms;
• seek injunctive relief, liquidated damages and other remedies under the Terms; and
• report conduct to processors, card networks or law enforcement where Vitabyte believes the law requires or permits it.

Vitabyte will usually give notice and a chance to fix a breach that is minor and accidental. It need not do so where the breach is deliberate, repeated, threatens security, harms others, or breaches the Terms' rules on reverse engineering, extraction or competitive use. Vitabyte's failure to act on a breach does not waive its right to act later.

Vitabyte may update this Policy, including the default limits. Each update changes the version number. A material change must be accepted by ticking its box before you continue to use the Services, as the Terms describe.

Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103. Reports and notices: in writing by mail (certified mail or courier) to that address.