Acceptable Use Policy

1. Purpose, Scope and Who This Policy Applies To

1.1 This Acceptable Use Policy ("Policy") sets out the rules for using Company's CelesteOS platform and related websites and tools. It exists to protect the integrity of vessel records, the security of the Service, the people whose information is held in it, and every Customer that relies on it.

1.2 This Policy applies to (a) each Customer and all of its Authorized Users; (b) anyone who uses the Service without a signed Agreement under the Terms of Use; (c) anyone who uses the Verifier; and (d) anyone who visits or uses the Sites (each, "you").

1.3 This Policy is part of, and incorporated by reference into, the Agreement and the Terms of Use. A breach of this Policy is a breach of the document that incorporates it. Each Customer is responsible for its Authorized Users' compliance with this Policy.

2. Definitions

2.1 "Agreement" means a written agreement for the Service signed by Company and a Customer, such as a Master Subscription Agreement and Order Form.

2.2 "AI Features" means features of the Service that use machine-learning or large-language-model technology; "AI Providers" means the third-party providers whose models power AI Features; and "Output" means content generated by an AI Feature.

2.3 "Authorized User" means an individual whom a Customer permits to access the Service.

2.4 "Collective" means Company's cross-fleet engineering-knowledge program at collective.celeste7.ai; a "Collective Contribution" is information derived from a Customer's records and contributed to it; a "Collective Insight" is a de-identified fault-and-fix statement built from Collective Contributions and made available to participating Customers; and "Public-Source Content" means content that Company collects or derives from publicly available third-party sources (such as public forums, question-and-answer sites, incident reports and published manuals) and makes available through the Collective, including any fields, labels, summaries, rankings and tallies derived from it.

2.5 "Customer" means an organization that has signed an Agreement with Company. "Customer Data" means data submitted to the Service by or for a Customer.

2.6 "Documentation" means Company's then-current user guides and technical documentation for the Service.

2.7 "Operational Records" means the maintenance, defect, work-order, inventory, certificate, handover, safety-management and other operational records of a Vessel created or stored in the Service.

2.8 "SealMark" means Company's record-sealing feature that produces a "Sealed Export" — an export of Operational Records with per-record SHA-256 digests and a Merkle root, designed so that later alteration is detectable.

2.9 "Service" means Company's hosted CelesteOS platform, including its AI Features; "Sites" means Company's websites at celeste7.ai and its subdomains.

2.10 "Vessel" means a ship or yacht in connection with which the Service is used; a "Fleet" is two or more Vessels under common management.

2.11 "Verifier" means Company's public record-verification tool at verifier.celeste7.ai.

2.12 "Aggregated Data", "De-identified Data" and "Subscription Term" have the meanings given in the Agreement. In summary: Aggregated Data is statistical usage and performance metrics about the Service that cannot reasonably be used to identify a Customer, Vessel or individual; De-identified Data is data that cannot reasonably be linked to an identified or identifiable individual, Customer or Vessel; and a Subscription Term is the period of a Customer's subscription under its Agreement. Where this summary differs from the Agreement, the Agreement governs.

3. Permitted Use

You may use the Service only for the legitimate operation, maintenance, record-keeping and management of the Vessels for which you are authorized, in accordance with the Agreement (or the Terms of Use), the Documentation, and applicable law. Permitted use includes creating and maintaining Operational Records; generating Sealed Exports; verifying Sealed Exports with the Verifier; using AI Features to search, summarize and draft from your own records; and exporting your organization's data using the export features provided.

4. General Prohibitions

You must not, and must not help or permit anyone else to:

4.1 Unlawful use. Use the Service or the Sites for any unlawful, fraudulent or deceptive purpose, or in violation of any applicable law, regulation or order.

4.2 Unauthorized access. Access or attempt to access any Vessel, Fleet, account, data or system you are not authorized to access, including the data of another Customer; probe for or exploit weaknesses in tenant isolation or access controls; or circumvent any authentication, rate limit, access control or usage limit.

4.3 Credentials. Share, sell or transfer sign-in credentials, or allow anyone to use your account. Each Authorized User must have and use their own account.

4.4 Malicious code and interference. Upload or transmit viruses, malware or other harmful code; interfere with or disrupt the integrity or performance of the Service or the Sites; or impose an unreasonable or disproportionate load on them, including by denial-of-service activity.

4.5 Scraping and bulk extraction. Use robots, scrapers or other automated means to access or extract content from the Service or the Sites, other than the export features and any API the Agreement expressly provides, used as documented.

4.6 Reverse engineering. Reverse engineer, decompile or disassemble the Service, or attempt to derive its source code, models or underlying algorithms, except to the extent applicable law expressly permits this despite this restriction.

4.7 Resale and competition. Resell, sublicense, rent, time-share or provide the Service to third parties except as the Agreement permits; or access the Service to build a competing product or to copy its features, design or content.

4.8 Infringing content. Upload, store or share material that infringes or misappropriates any intellectual-property, confidentiality or privacy right of any person.

4.9 Harmful content. Upload, store or share material that is defamatory, harassing, threatening, obscene, discriminatory, or that sexually exploits minors (which we will report to the authorities as required by law).

4.10 Spam. Use the Service or the Sites to send unsolicited commercial messages.

4.11 Misrepresentation. Impersonate any person or organization, or misrepresent your affiliation with any person, Vessel or organization.

5. Maritime-Specific Prohibitions

You must not use the Service to:

5.1 Falsify records. Create, alter or enter any Operational Record that you know, or ought reasonably to know, is false or misleading — including records of maintenance, inspections, defects, drills, certificates, equipment status, or matters within a Vessel's safety management system under the International Safety Management (ISM) Code.

5.2 Backdate to deceive. Backdate an entry, or present an entry as having been made at a time other than when it was made, in order to mislead a classification society, flag State administration, port State control officer, surveyor, auditor, charterer, purchaser, financier, court or any other person who relies on the record.

5.3 Defeat record integrity. Defeat, circumvent or misrepresent SealMark or the tamper-evidence it is designed to provide, including by altering a Sealed Export and presenting it as unaltered, or by presenting a record that was never sealed as a Sealed Export.

5.4 Evade sanctions. Use the Service in connection with any Vessel that is blocked property or is identified on a US, United Nations, European Union or United Kingdom sanctions list; for the benefit of any person on such a list, or owned 50% or more or controlled by such a person; in or for a country or region subject to comprehensive US sanctions; or to conceal a Vessel's identity, ownership, location, flag or activities (including AIS manipulation or ship-to-ship transfers) in order to evade sanctions or export controls.

5.5 Upload restricted manuals and documents without rights. Upload manufacturer (OEM) manuals, drawings, service bulletins, software, or other third parties' confidential or restricted documents unless you have the right to store and use them in the Service for the Vessel concerned — for example, under the terms on which they were supplied to the Vessel's owner or operator.

5.6 Unlawfully monitor crew. Use the Service to monitor, track or profile crew members or other individuals in a way that is unlawful, including covert surveillance of their location, communications or personal activities, or processing of their personal information without any notice, consent or other lawful basis required by applicable employment, labor, privacy or data-protection law.

5.7 Process sensitive personal information unnecessarily. Upload health, medical, biometric, criminal-record, identity-document or similar sensitive information about crew or other individuals except where it is necessary for the lawful operation of the Vessel (for example, certificates required by flag-State or international rules) and you have a lawful basis to do so.

6. AI-Specific Prohibitions

You must not:

6.1 Prompt injection and jailbreaks. Attempt to manipulate AI Features into ignoring their instructions or safeguards, including by prompt injection, jailbreak techniques, or embedding hidden instructions in documents you upload, in order to obtain information you are not authorized to access, to cause the Service to take unauthorized actions, or to produce content prohibited by this Policy.

6.2 Model extraction and training. Use AI Features or Output to (a) extract, reconstruct or replicate the underlying models, prompts, system instructions or weights; or (b) scrape, harvest or systematically collect Output to develop, train, fine-tune or benchmark any machine-learning model or competing product.

6.3 Automated decisions about people. Use Output as the sole basis for any decision about an individual's employment, engagement, discipline, pay, fitness for duty, medical status or certification. Any such decision must involve meaningful human review by an appropriately qualified person, and must comply with applicable law.

6.4 Data you lack rights to. Submit to AI Features any data that you do not have the right to submit, or that you are prohibited by law or contract from sharing with third-party processors.

6.5 Unreviewed reliance. Present Output as verified, authoritative or professionally certified without human review, or use it as the sole basis for any decision affecting the safety or seaworthiness of a Vessel. Output can be wrong.

6.6 Provider policies. Use AI Features in a way that would cause Company to breach the usage policies of its AI Providers, as notified to Customers by Company from time to time.

7. Collective-Specific Prohibitions

7.1 Public-Source Content. If you have access to Public-Source Content, whether or not your organization participates in the Collective, you must not: (a) scrape, bulk-download, systematically extract or compile it, or circumvent any rate limit or access control; (b) republish, redistribute, sell or license it, except as the original source's own license terms allow; (c) use any name, user name or other personal information that appears in it to identify, profile, contact or harass its author or any other individual; (d) remove or alter any source link, attribution, license notice, label, warning or disclaimer; or (e) use it to train, fine-tune or evaluate an AI model or to build a competing product or service. Public-Source Content is not engineering advice; Section 6.5 applies to it as it applies to Output.

7.2 Contributions and Collective Insights. Sections 7.3 to 7.5 apply if your organization participates in the Collective contribution program. If you participate in the Collective, you must not:

7.3 Re-identification. Attempt to re-identify any Customer, Vessel, Fleet, crew member or other individual from a Collective Insight, De-identified Data or Aggregated Data, or combine Collective information with other information for that purpose; or attempt to reverse the pseudonymization applied to Collective Contributions.

7.4 Poisoning. Submit false, fabricated, exaggerated or misleading fault reports, fixes or other Collective Contributions, or coordinate submissions intended to distort, manipulate or "poison" Collective Insights, including to disparage a manufacturer or supplier or to promote one.

7.5 Misuse of Insights. Share Collective Insights outside your organization except as the Collective Network Participation Agreement permits, or present a Collective Insight as an official manufacturer, classification-society or regulatory finding.

8. Verifier Rules

You must not misrepresent what a Verifier result means. In particular, you must not (a) describe a Verifier result as proof that the content of a record is true or accurate, as a certification, audit opinion or approval by Company, or as validation of a digital signature or timestamp; (b) alter, fabricate or edit a screenshot or report of a Verifier result; or (c) state or imply that Company has verified, endorsed or approved any record, Vessel or organization because a Verifier check passed. The Verifier checks structural content integrity only, as described in the Verifier Terms of Use.

9. Security Testing and Responsible Disclosure

9.1 Written permission required. You must not perform penetration testing, vulnerability scanning, load or stress testing, or any other security testing of the Service, the Sites, the Verifier, or Company's infrastructure without Company's prior written authorization, which will define scope, timing and rules of engagement. Testing of Company's third-party service providers' infrastructure is outside any authorization we can give.

9.2 Reporting vulnerabilities. If you discover a potential security vulnerability, please report it promptly to contact@celeste7.ai (subject line "Security") with enough detail for us to reproduce it. Do not publicly disclose it until we have had a reasonable opportunity to fix it.

9.3 Good-faith reporters. If you discover a vulnerability in the ordinary course of using the Service and you (a) stop as soon as you become aware of it; (b) access, retain and disclose no more data than necessary to demonstrate it, and delete any data obtained; (c) do not degrade the Service or affect other Customers; (d) report it to contact@celeste7.ai (subject line "Security") without delay; and (e) do not demand payment, then Company does not intend to pursue legal action against you in respect of that discovery and report. This Section 9.3 does not authorize testing that Section 9.1 prohibits and does not bind any third party.

10. Enforcement

10.1 Investigation. Company may investigate suspected breaches of this Policy. Investigations will be proportionate and, for Customer Data, conducted in line with the Agreement and Data Processing Addendum.

10.2 Actions. If we reasonably believe this Policy has been breached, we may take action proportionate to the breach, including (a) asking you to remedy it; (b) removing or disabling access to the content concerned; (c) suspending an Authorized User's or account's access, or specific features; (d) suspending or terminating access to the Service, the Verifier or the Sites; and (e) reporting the matter to, and cooperating with, law-enforcement, regulatory or sanctions authorities where required or appropriate.

10.3 Notice. Where practicable and lawful, we will notify the affected Customer (or you) before acting and give an opportunity to remedy. We may act without prior notice where the breach creates an immediate risk to the security or integrity of the Service, to other Customers, or to any person, or where law (including sanctions law) requires it. For Customers, suspension and termination are subject to, and carried out in accordance with, the Agreement.

10.4 Record preservation. Suspension does not delete Customer Data. Company will preserve and make available Customer Data in accordance with the Agreement, except where law (including sanctions law or a court order) prevents it.

10.5 No obligation to monitor. Company is not obligated to monitor use of the Service or Customer Data and does not independently verify the accuracy of content entered by users. Responsibility for the accuracy and truthfulness of Operational Records rests with the Customer and its Authorized Users.

11. Reporting Violations

11.1 Report suspected breaches of this Policy — including suspected falsification of records or misuse of AI Features, the Collective or Public-Source Content — to contact@celeste7.ai. Report unauthorized access, compromised credentials and security vulnerabilities to the same address with the subject line "Security" (see Section 9).

11.2 Copyright complaints should be sent to Company's designated agent as set out in the Terms of Use (Section 13).

11.3 Customers should report breaches by their own Authorized Users, of which they become aware, without undue delay.

11.4 We will not retaliate against anyone for a report made in good faith.

12. Changes and Interpretation

12.1 Changes. We may update this Policy to respond to new risks, laws or features. We will post the updated Policy with a new version number and effective date and, for material changes, give Customers at least 30 days' notice in accordance with the Agreement, except where a shorter period is required for legal, security or regulatory reasons. A change will not reduce a Customer's rights under its Agreement during the current Subscription Term without its consent.

12.2 Examples. The examples in this Policy are illustrative, not exhaustive.

12.3 Governing law and disputes. This Policy is governed by the governing-law and dispute-resolution provisions of the Agreement (for Customers and Authorized Users) or the Terms of Use (for everyone else).

12.4 Conflict. If this Policy conflicts with a Customer's signed Agreement, the Agreement controls.