Acceptable Use Policy

Drytis, Inc. — Acceptable Use Policy

Effective Date: September 15, 2026 | Last Updated: September 15, 2026

1. Purpose and Scope

1.1. This Acceptable Use Policy (this "Policy") establishes the content and conduct standards that apply to the Drytis websites, platform, applications, APIs, hosting and deployment infrastructure, and Engineer Services (collectively, the "Services") made available by Drytis, Inc. ("Drytis," "we," or "us").

1.2. This Policy is incorporated into the Drytis Terms of Service (the "Terms"). Capitalized terms used but not defined in this Policy have the meanings given to them in the Terms.

1.3. This Policy governs only the content and conduct standards it addresses. All other matters including fees, ownership and licensing of Workspace Content and Generated Output, confidentiality, processing of personal data, warranties, indemnities, limitations of liability, and dispute resolution are governed by the Terms, the Data Processing Addendum (the “DPA”), and the Privacy Policy. In the event of a conflict or inconsistency, Section 1.5 of the Terms governs the order of precedence.

1.4. A breach of this Policy is a breach of the Terms.

2. Application of this Policy

2.1. This Policy applies to (a) Customers and their Authorized Users, across individual, team, and enterprise Accounts; (b) Customer’s and its Authorized Users’ interactions with Engineers in connection with Engineer Services; (c) visitors to the Drytis websites; and (d) Deployed Applications and, to the extent set out in Section 8, their end users.

2.2. Customer is responsible for the acts and omissions of its Authorized Users in connection with the Services as if they were Customer’s own. Customer is also responsible for ensuring that its Deployed Applications and the activity they enable comply with this Policy, including, where necessary, through appropriate terms, disclosures, controls, or other requirements applicable to their end users.

3. General Use Requirements

3.1. Customer shall use the Services lawfully; shall obtain and maintain all rights, permissions, and consents necessary for the Workspace Content it submits to, and the activity it conducts through, the Services; and shall not use the Services in a manner that harms, or is reasonably likely to harm, Drytis, another Customer, an Engineer, or any third party.

3.2. Customer shall not access or use the Services (a) in or for the benefit of any country, region, or person subject to comprehensive sanctions administered by the United States or another applicable authority, or (b) in violation of applicable export control, sanctions, or anti-corruption laws.

3.3. Sections 4 through 6 describe categories of prohibited content and activity. Those categories are illustrative of the standard in Section 3.1 and are not exhaustive; conduct presenting a materially equivalent risk may be treated as a violation of this Policy notwithstanding its omission, provided that Drytis exercises this Section 3.3 reasonably and by reference to the categories described.

4. Prohibited Content

4.1. The Services may not be used to generate, upload, store, host, transmit, deploy, or otherwise make available content that:

a) is unlawful, or that promotes, facilitates, or provides operational instructions for unlawful activity;

b) infringes or misappropriates a patent, copyright, trademark, trade secret, right of publicity, or other proprietary right;

c) sexually exploits or endangers a minor, including child sexual abuse material ("CSAM"), or that sexualizes, grooms, or solicits a minor;

d) constitutes non-consensual intimate imagery, or that facilitates sexual exploitation, human trafficking, or coercion;

e) incites or threatens serious violence, or that promotes, or provides material support to, terrorism or violent extremism;

f) is fraudulent or materially deceptive, including phishing pages, spoofed authentication interfaces, payment or investment scams, and impersonation of a person or organization;

g) is synthetic media presented in a manner intended to deceive, defraud, or cause harm, or that misrepresents AI-generated material as human-generated where doing so is deceptive or unlawful;

h) unlawfully discloses another person's private or personal information, or that facilitates stalking, harassment, or unlawful surveillance of an identifiable individual;

i) encourages or provides instructions for suicide or self-harm; or

j) offers, advertises, or facilitates the sale of goods or services in violation of applicable law, including weapons, controlled substances, and unlicensed gambling or financial services.

4.2. Drytis may remove or disable access to apparent CSAM, preserve associated information, and report it to the National Center for Missing & Exploited Children ("NCMEC"), law enforcement, or other authorities as required or permitted by applicable law. Drytis will treat reports of apparent CSAM as a priority matter.

5. Prohibited Activities

5.1. Customer shall not access, or attempt to access, any Account, workspace, system, network, or data without authorization or in excess of authorized access, and shall not circumvent, disable, or interfere with authentication, encryption, rate-limiting, usage metering, or other security or access controls. Vulnerability probing, scanning, and testing are permitted only as provided in Section 10.

5.2. Customer shall not use the Services to develop, host, or distribute malware, ransomware, spyware, exploits, or other malicious code, or to conduct denial-of-service attacks, operate botnets, or carry out credential- stuffing, brute-force, or comparable intrusion activity, whether directed at the Services or at any third-party system.

5.3. Customer shall not use the Services for cryptocurrency mining or other activity that places a disproportionate load on Drytis infrastructure, and shall not scrape, crawl, harvest, or bulk-extract data, code, or Generated Output from the Services except through documented interfaces, to the extent expressly permitted by the applicable Documentation and the Terms, and within applicable usage limits.

5.4. Customer shall not use the Services to send or facilitate spam, unsolicited bulk messaging, or marketing that violates applicable law.

5.5. Customer shall not:

a) reverse engineer, decompile, or disassemble the Services, or attempt to derive their source code, model weights, or underlying architecture, except to the extent this restriction is unenforceable under applicable law;

b) resell, sublicense, rent, or otherwise make the Services available to a third party, except as expressly permitted under the Terms;

c) create Accounts by automated means, or use multiple Accounts, to circumvent trial restrictions, usage allowances, or an existing suspension or termination; or

d) misrepresent identity or affiliation, impersonate any person or organization, or attribute content or Generated Output to Drytis without authorization.

6. AI Features and Generated Output

6.1. The Services incorporate artificial intelligence, including third-party foundation models. Customer shall not use the AI features of the Services to:

a) produce content prohibited by Section 4, including malicious code, exploit tooling, and phishing or fraud infrastructure;

b) bypass, degrade, or manipulate safety systems, content filters, or usage controls, including through prompt injection, jailbreaking, or obfuscation of intent;

c) extract, reconstruct, or disclose system prompts, model weights, safety instructions, or other proprietary components of the Services, or use Generated Output to train, fine-tune, benchmark for competitive purposes, or otherwise develop a model, product, or service that competes with the Services; or

d) act in violation of the usage policies of a third-party model provider or other third-party service underlying a feature Customer uses.

6.2. Generated Output may be inaccurate, incomplete, insecure, or unsuitable for a given purpose. Customer is responsible for reviewing, testing, and validating Generated Output before relying on it or placing it into production, and for the operation, security, and legal compliance of anything Customer builds with it.

7. High-Risk Uses

7.1. The Services are not designed, tested, or authorized for use in circumstances where failure or error could reasonably be expected to result in death, personal injury, or severe environmental or property damage, including the operation or control of aircraft or other transportation systems, nuclear or other critical- infrastructure facilities, life-support or other medical systems, weapons systems, and emergency response systems (each, a "High-Risk Use").

7.2. High-Risk Use is prohibited unless Drytis has expressly agreed to the use in writing. Where Drytis provides such authorization, Customer shall implement independent safeguards, redundancy, and qualified human review appropriate to the risk, shall obtain and maintain all required regulatory approvals, and assumes all risk arising from the High-Risk Use. To the fullest extent permitted by applicable law, Drytis disclaims all liability arising out of any High-Risk Use.

8. Deployed Applications and End Users

8.1. Customer is solely responsible for each application it builds, hosts, or deploys using the Services (each, a "Deployed Application"), including its content, functionality, security, third-party integrations, and compliance with applicable law.

8.2. In connection with each Deployed Application, Customer shall:

a) ensure that the Deployed Application and the activity it enables comply with this Policy and applicable law, including data protection, consumer protection, and accessibility requirements;

b) publish and maintain its own terms and privacy notices for end users, and obtain any consents, disclosures, or authorizations required for its collection and use of end-user data; and

c) not use Drytis hosting, deployment, or custom-domain functionality to distribute content or operate services prohibited by this Policy.

8.3. Drytis has no obligation to review Deployed Applications, and Customer’s compliance obligations are not diminished by any review Drytis elects to perform. Drytis may restrict, disable, remove, throttle, or decline to host a Deployed Application, custom domain, or hosted content where it reasonably determines that doing so is necessary because of a violation of this Policy or the Terms, a material security, legal, reputational, or operational risk, a threat to Drytis, its Customers, or another person, or a valid legal or regulatory demand.

9. Interactions with Engineers

9.1. Engineer Services, including Drytis Edge and Albert, are delivered by Drytis personnel. Customer and its Authorized Users shall interact with Engineers professionally and lawfully, and shall not harass, threaten, abuse, or unlawfully discriminate against an Engineer.

9.2. Customer shall not:

a) request or direct an Engineer to perform work that would violate this Policy, the Terms, or applicable law, or that is intended to circumvent Drytis billing, access-control, or security processes;

b) solicit or use an Engineer's personal contact information for any purpose unrelated to the Engineer Services being provided; or

c) record, reproduce, or redistribute an Engineer session except as permitted under the Terms and the Privacy Policy.

9.3. Engineer sessions may be recorded and reviewed as described in the Privacy Policy. Engineers are subject to Drytis’s internal policies and applicable confidentiality obligations with respect to Workspace Content.

10. Security Research and Responsible Disclosure

10.1. Drytis welcomes good-faith security research conducted within the boundaries of this Section 10. Testing of the Services is authorized only with the prior written authorization of Drytis and only within the scope and conditions specified in that authorization.

10.2. Authorized testing does not permit accessing, modifying, or exfiltrating data belonging to Drytis or another Customer; degrading or disrupting the Services; establishing persistence; or exploitation beyond what is reasonably necessary to demonstrate a vulnerability. Findings may not be publicly disclosed except through coordinated disclosure with Drytis.

10.3. Suspected vulnerabilities should be reported to legal@drytis.com. Drytis will not pursue action under this Policy against research that complies with this Section 10 and any applicable program terms. Nothing in this Section 10 limits Drytis's rights with respect to testing conducted outside that scope.

11. Third-Party Services and Integrations

11.1. Where Customer connects or uses third-party models, tools, repositories, infrastructure, or other services through the Services, Customer does so at its own election and is responsible for complying with the applicable third-party terms and usage policies and for the data it makes available to those services.

11.2. Except as expressly provided in the Terms, Drytis is not responsible for third-party services, and may modify, suspend, or discontinue an integration where the third party's terms, availability, or conduct so require.

12. Reporting Violations

12.1. Suspected violations of this Policy, including by a Deployed Application, may be reported to legal@drytis.com with sufficient detail to permit review. Suspected security vulnerabilities should be reported to legal@drytis.com in accordance with Section 10.

12.2. Reports of apparent CSAM should be sent to legal@drytis.com and will be handled as described in Section 4.2. Drytis reviews reports as it considers appropriate and does not undertake to investigate, respond to, or act on any particular report.

13. Monitoring and Enforcement

13.1. Drytis has no obligation to monitor the Services, Workspace Content, or Deployed Applications. Drytis may, however, use automated and manual means to operate, secure, and protect the Services and to identify violations of this Policy, and does not assume responsibility for Customer content by doing so.

13.2. Where Drytis reasonably believes that a violation of this Policy or the Terms has occurred or is occurring, that there is a security incident, fraud, or threat to Drytis, its customers, or another person, or that action is required by applicable law, Drytis may: a) investigate, including by reviewing relevant Account activity and content; b) issue a warning or require corrective action within a stated period; c) remove, disable, restrict, throttle, or rate-limit access to content, features, workspaces, or Deployed Applications; d) suspend or terminate an Account or an Authorized User’s access in accordance with the Terms, or restrict or discontinue Engineer Services where reasonably necessary to address the relevant violation, risk, or legal requirement; e) preserve information and disclose it to NCMEC, law enforcement, or other authorities where required or permitted by applicable law; and f) pursue any other remedy available under the Terms or at law.

13.3. Drytis will take enforcement action proportionate to the circumstances and, where practicable, will provide notice. Drytis may act immediately and without prior notice where it reasonably believes such action is necessary to prevent harm, protect the integrity or security of the Services, or comply with applicable law.

13.4. Any processing of Personal Data in connection with enforcement of this Section 13 will be handled in accordance with the Privacy Policy and, to the extent such processing involves Customer Personal Data processed on Customer’s behalf, the DPA.

13.5. A decision not to enforce a provision of this Policy in a given instance is not a waiver of the right to enforce it subsequently.

14. Suspension and Termination

Suspension and termination for a violation of this Policy are governed by the Terms. Customer remains responsible for Fees incurred through the effective date of suspension or termination, and, except as required by applicable law or expressly provided in the Terms, is not entitled to a refund or credit on account of enforcement action taken under this Policy.

15. Relationship to Other Documents

This Policy supplements the Terms, the DPA, and the Privacy Policy. The AUP governs the permitted and prohibited use of the Services within the scope expressly addressed by this Policy, and the Terms, including Section 1.5, govern all other matters. Nothing in this Policy creates rights or remedies for any third party except as expressly provided in the Terms.

16. Changes to this Policy

Drytis may update this Policy from time to time to reflect changes to the Services, technology, security practices, or legal requirements. Material changes will be subject to the notice requirements applicable to incorporated policies under the Terms. The updated Policy will take effect on the stated effective date. Continued use of the Services after that date constitutes acceptance of the updated Policy, to the extent permitted by applicable law.

17. Contact

Drytis, Inc. 1985 Riviera Dr, Ste 103 - 1033, Mount Pleasant, SC 29464, USA Legal and abuse reports: legal@drytis.com & contact@drytis.com