Acceptable Use Policy

Version 1.0 — effective 26 September 2026.

This policy is part of the Terms of Service of {{COMPANY_LEGAL_NAME}} (company number {{COMPANY_NUMBER}}), trading as Commercial Intelligence Partners ("CIP", "we"). It applies to every client and every user of the CIP service, including owners, managers and staff users. The client is responsible for its users following it.

1. Use CIP lawfully

1.1 Use CIP only for your own lawful business purposes.

1.2 Do not use CIP to break any law, including data protection, consumer, tax, anti-money-laundering, intellectual property or employment law.

1.3 Do not use CIP to commit or help anyone commit fraud — for example by creating false invoices, false expense claims or misleading financial records.

2. Emailing your customers (invoices and reminders)

2.1 You may use CIP to send invoices and payment reminders to your own customers. You are the controller for these emails and are responsible for them.

2.2 Lawful basis. You must have a lawful basis under UK GDPR to use your customers' details this way. For sending an invoice or chasing payment for goods or services you have supplied, this will normally be that the email is necessary for the contract with that customer, or your legitimate interests in being paid. You must tell your customers how you use their data (for example in your own privacy notice).

2.3 Service messages, not marketing. Invoices and payment reminders about a real transaction are service messages, not direct marketing. Keep them that way. Do not add promotions, offers, newsletters or other marketing content to invoice or reminder emails unless you have the recipient's consent, or can rely on the "soft opt-in" for existing customers who were given a simple way to opt out and have not done so.

2.4 No spam. Do not use CIP's email features to send bulk or unsolicited messages, to email people who are not your customers, or to send to bought or scraped email lists.

2.5 Fair chasing. Payment reminders must be accurate, polite and fair. Do not send reminders that are threatening, harassing, misleading (for example falsely suggesting legal action or official status), or so frequent that they cause distress. Only chase amounts that are genuinely owed.

2.6 Accurate details. Only send to addresses you believe are correct. Deal promptly with bounces and with any request to stop contact that you are not entitled to ignore.

2.7 Sender identity. Do not disguise who an email is from. Use your real business name and a reply-to address you control — replies go to you, not to CIP.

2.8 We may limit, pause or stop email sending from your account if we see high bounce or complaint rates, reports of spam, or content that breaks this section.

3. What you upload

3.1 Only upload data and files you have the right to use.

3.2 Do not upload anything that: (a) is unlawful, defamatory, obscene, or infringes anyone's rights (including copyright and trade marks); (b) contains viruses, malware or other harmful code; (c) contains special category data (such as health information) or criminal offence data, unless you have a lawful condition for it — the service is not designed for this; (d) you are not allowed to share, for example another business's confidential information.

3.3 Tell your staff not to put health or other sensitive details in free-text fields such as holiday request notes.

4. Staff and users

4.1 Invite only people who work for or with your business and who need access.

4.2 Give each person the least access they need (for example, limit staff users to the right venue).

4.3 Remove users promptly when they leave.

4.4 Each user must keep their own login secure and must not share it. We recommend turning on multi-factor authentication.

5. Protecting the service

5.1 Do not: (a) try to access another client's data, or any part of the service you are not authorised to use; (b) probe, scan or test the security of the service, except under section 7; (c) interfere with or disrupt the service, or place an unreasonable load on it; (d) copy, decompile, reverse engineer or try to extract the source code of the service, except where the law expressly allows it; (e) scrape, crawl or harvest data from the service by automated means, other than through our published API; (f) build a competing product using the service, our content or our templates; (g) remove or hide any proprietary notices.

6. API use

6.1 Use the API only with API keys issued to your account, and keep them secret. If a key may have been exposed, revoke it at once in your account and create a new one.

6.2 Stay within the rate limits and usage limits shown in our API documentation or your account. We may throttle or block requests that exceed them.

6.3 Do not use the API to get around plan limits, access controls or this policy.

7. Security testing and reporting

7.1 You may only carry out security testing (including penetration testing and vulnerability scanning) of the service with our prior written permission. Ask at info@commercialintelligencepartners.co.uk.

7.2 If you find a vulnerability, report it to info@commercialintelligencepartners.co.uk and do not exploit it, access other clients' data, or disclose it publicly until we have had a reasonable time to fix it. See our Security Overview (/legal/security).

8. AI features

8.1 If AI features are enabled, CIP uses an AI model to write commentary on figures calculated by our own software.

8.2 AI commentary is for information only. It is not financial, investment, tax, legal or accounting advice. It can be incomplete or wrong. Check it against your figures, and take professional advice before making significant decisions.

8.3 Do not present AI commentary to others (for example lenders, investors or HMRC) as professional advice or as a verified statement, and do not use it to make decisions with legal or similarly significant effects on individuals (for example about a staff member's employment) without meaningful human review.

8.4 Do not try to make the AI produce harmful, unlawful or misleading content, or to extract other clients' data or our system instructions.

9. If you break this policy

9.1 We may remove content, limit features (including email sending), suspend users or suspend your account, where reasonably needed. Where we can, we will tell you first and give you a chance to fix the problem.

9.2 Serious or repeated breaches may lead us to end your subscription under our Terms of Service.

9.3 We may report unlawful activity to the relevant authorities.

10. Reporting misuse

If you think someone is misusing CIP (for example sending you unwanted emails through it), tell us at info@commercialintelligencepartners.co.uk.

Legal basis

UK GDPR Art. 6(1)(b) and 6(1)(f) (lawful bases for invoicing and debt chasing), Arts. 9 and 10 (special category and criminal offence data), Arts. 13–14 (transparency), Art. 32 (security), Arts. 22A–22D (automated decision-making); Privacy and Electronic Communications (EC Directive) Regulations 2003 regs. 22–23 (electronic mail marketing and sender identity), with penalties raised to UK GDPR levels by the Data (Use and Access) Act 2025 (in force 5 February 2026); DPA 2018 s.122(5) (definition of direct marketing) and ICO direct marketing guidance (service messages are not marketing); Administration of Justice Act 1970 s.40 and Protection from Harassment Act 1997 (harassment when chasing debts); Computer Misuse Act 1990 ss.1–3 (unauthorised access and interference); Copyright, Designs and Patents Act 1988 ss.50A–50C and 296A (limited statutory rights to decompile and study software that cannot be excluded); Fraud Act 2006. Financial Services and Markets Act 2000 — CIP does not provide regulated investment advice.