1. Scope and relationship to the Terms
This Acceptable Use Policy governs your use of Databrush's hosted analytics application and related services (the "Service"), including connected databases and other supported sources, prompts, queries, results, and workspace content. It applies to you and everyone you authorize to use your workspace.
This policy forms part of the Terms & Conditions. Capitalized terms have the meanings given there. If this policy conflicts with the Terms, the Terms control, subject to the Order, Data Processing Addendum ("DPA"), and mandatory-law precedence in Section 1 of the Terms. This policy does not expand our rights to use Customer Data or reduce our confidentiality, security, or data-protection obligations.
2. Prohibited use and restricted information
You must not:
- access or disclose data without authority; infringe privacy, confidentiality, or intellectual-property rights; or use the Service unlawfully;
- attempt to bypass authentication, workspace isolation, query safeguards, usage limits, or other security controls, or access another customer's workspace;
- submit malware, disrupt the Service, or carry out vulnerability testing without our prior written authorization;
- resell access, provide a competing hosted copy of the Service, or reverse engineer protected software except where applicable law permits it;
- use the Service for unlawful surveillance, discriminatory decisions, fraud, or other harmful activity; or
- misrepresent your identity, authority, or the origin or reliability of Output.
Unless we first expressly agree in writing to the necessary safeguards and contractual terms, do not make available protected health information subject to HIPAA, special-category or criminal-offence data under European or UK data-protection law, biometric identifiers used for identification, government identification numbers, full payment-card data, financial-account access credentials, children's personal information, or other data requiring a specialized regulated environment. Ordinary transaction amounts and subscription information are not prohibited merely because they concern payments. Database access credentials are permitted only through the designated connection controls.
We do not represent the Service as HIPAA-authorized, PCI-certified, or suitable for regulated workloads requiring additional agreements. A customer's prohibited submission does not remove our applicable duties concerning data actually received.
3. Responsible access and use of results
Connect only sources you are authorized to access and instruct us to process. Keep account credentials secure, do not share an individual login, and manage your authorized users and their workspace permissions. Grant the narrowest source access appropriate to your use, preferably a dedicated read-only database role and restricted views.
Databrush is designed for bounded, read-only analytical queries against connected databases. A connection accepting credentials with write or elevated privileges does not authorize bypassing query safeguards. Submit database credentials and API keys only through designated connection controls, never in prompts, chart labels, or support messages. See Section 4 of the Terms for your source-connection responsibilities.
Review material AI-generated results against your source data and intended metric definition before relying on or distributing them. Do not use the Service as the sole basis for decisions with legal or similarly significant effects on individuals, including employment, credit, housing, insurance, education, or essential services. Do not present unverified results as independently verified. The limitations and protections in Section 6 of the Terms apply.
4. Reporting concerns
Report suspected misuse, unauthorized access, or a security concern to support@databrush.ai. Provide a description and enough non-sensitive context for us to investigate. Do not include passwords, access tokens, private keys, full connection strings, or unnecessary personal or confidential data. If credentials may be compromised, revoke or rotate them at the source and cooperate in reasonable containment steps.
Obtain our prior written authorization before vulnerability testing. Reporting a concern does not authorize testing or access to another customer's data. Copyright notices and counter-notifications follow Section 18 of the Terms. Nothing in this policy restricts lawful reporting to regulators or law enforcement, whistleblowing, or cooperation with a legally authorized investigation.
5. Enforcement and review
We may investigate suspected violations and request information reasonably needed to resolve them, subject to our confidentiality and data-protection obligations. Any restriction, suspension, or termination is governed by Section 12 of the Terms.
We may restrict or suspend affected access where reasonably necessary to address a security risk, unlawful activity, or material breach. When practicable and lawful, we will explain the reason and provide an opportunity to resolve it. Immediate action may be necessary to protect people, data, or the Service. We will limit the restriction and its duration to what is reasonably necessary.
A material breach may result in termination if it is not cured within 30 days after written notice, or immediately if it cannot reasonably be cured. The copyright process and repeat-infringer provisions in Section 18 of the Terms also apply. To request review of an enforcement decision or provide corrective information, contact support@databrush.ai.
Enforcement does not remove applicable cancellation, refund, data-retrieval, privacy, or other nonwaivable rights. The Terms, applicable DPA, and law continue to govern retention, return, and deletion of Customer Data. A prohibited submission does not remove our duties concerning information we actually receive.
6. Policy changes
Changes to this policy are subject to Section 16 of the Terms, including its advance-notice, renewed-agreement, and paid-term protections. We will identify the effective date of an update and will not apply it retroactively to accrued claims. Publication alone does not override those requirements or authorize a new use of personal information that requires another legal basis.