Acceptable Use Policy

This Acceptable Use Policy (the "Policy") applies to everyone who uses the Service provided by Attia AS (org.nr 937788185), Solheimgata 1a, 0267 Oslo, Norway ("Attia"), including AI Features, Loops, integrations and any application or AI client connected to a Customer's workspace. This Policy forms part of Attia's Terms of Service or any other agreement between Attia and the Customer (the "Terms"). Capitalized words that this Policy does not define have the meaning given in the Terms or in Attia's AI Addendum.

"AI Features" means any part of the Service that uses a machine-learning or generative AI model, including Attia Agent, Agent steps in Loops, AI writing help, document parsing and summaries. "Output" means content that AI Features produce.

The Customer is responsible for compliance with this Policy by its Users and by anyone, or any application or AI client, that uses the Service through the Customer's workspace, accounts or credentials.

1. Compliance with laws#

You must use the Service in compliance with all laws that apply to you. These include data protection law (including the GDPR and the Norwegian Personal Data Act), equality and anti-discrimination law, employment and working environment law, marketing law, export control and sanctions law, and the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) where it applies to you. You are responsible for deciding which laws apply to your use of the Service and for complying with them.

2. General acceptable use#

You must not, and must not help or allow anyone else to:

• (a) use the Service for any unlawful, fraudulent, deceptive or harmful purpose;
• (b) publish a job advertisement or send a message that is false or misleading, advertises a position that does not exist, asks a Candidate for payment, or collects personal data for any purpose other than recruiting for a real position;
• (c) harass, threaten, intimidate or defame any person, or publish content that is hateful, discriminatory, violent or sexually explicit;
• (d) infringe anyone's intellectual property, privacy or other rights;
• (e) send spam or unsolicited bulk messages, or contact any person without a lawful basis;
• (f) upload or spread malware, or interfere with or disrupt the Service, its infrastructure, its suppliers or other customers;
• (g) probe, scan or test the security of the Service, or bypass any security measure, authentication, access control, rate limit or usage limit, unless Attia has authorized it in writing;
• (h) access the Service by automated means, such as scrapers, bots or crawlers, other than through the interfaces and integrations Attia provides, or access data you are not authorized to access;
• (i) copy, modify, reverse engineer or decompile the Service, or use it to build or benchmark a competing product, except where the law allows this despite this restriction;
• (j) resell, sublicense or provide the Service to any third party, except as the Terms allow;
• (k) misrepresent your identity or affiliation, or impersonate any person or organization; or
• (l) use the Service in a way that could expose Attia, its suppliers or other customers to liability or harm.

3. AI-specific restrictions#

Output can be inaccurate, incomplete, out of date or biased, even when it looks detailed and specific. You must review Output before you rely on it, share it or act on it, and you are responsible for what you do with it.

When you use AI Features, you must not:

• (a) use Output as legal, medical, financial or other professional advice without review by a qualified professional;
• (b) present Output as written by a human where the law or the context requires disclosure, or use Output in a chatbot or other system that interacts with people without telling them that they interact with AI;
• (c) impersonate a real person, or create synthetic images, audio, video or text of a real person without that person's consent;
• (d) bypass, disable or manipulate the approvals, refusals, limits, instructions or other safety controls of AI Features, including by jailbreaks or prompt injection, or place content in a job advertisement, document or record that is designed to change how AI Features behave;
• (e) use the Service or Output to develop, train or improve an AI model or product that competes with Attia, or try to extract model weights, prompts or system instructions;
• (f) give third parties access to AI Features as a proxy, wrapper or resale service;
• (g) create or spread disinformation, or content intended to influence elections or other democratic processes;
• (h) create sexual content involving minors, or intimate images of any person without consent; or
• (i) use AI Features for any practice prohibited by Article 5 of the EU Artificial Intelligence Act, whether or not that Act applies to you. These include:
  • subliminal, manipulative or deceptive techniques that distort a person's behavior and cause or are likely to cause significant harm;
  • exploiting a person's vulnerabilities due to age, disability or social or economic situation;
  • social scoring, meaning evaluating or classifying people based on their social behavior or personal characteristics in a way that leads to unjustified or unfavorable treatment;
  • assessing or predicting the risk that a person will commit a criminal offense based only on profiling or personality traits;
  • creating or expanding facial recognition databases by untargeted scraping of images;
  • inferring the emotions of a person in the workplace or in education;
  • biometric categorization to deduce a person's race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation; and
  • real-time remote biometric identification in publicly accessible spaces for law enforcement.

You must also comply with the usage policies of the AI model providers that Attia uses, to the extent they apply to your use. Attia lists these providers in its DPA.

4. Hiring and employment#

Attia is an applicant tracking system. AI Features are intended to help people with administrative and preparatory work in recruiting. This includes drafting and editing job advertisements for a User to review, edit and publish, organizing and searching records, extracting information from documents into structured fields, summarizing the facts in a document, drafting internal notes, and carrying out actions that a User has asked for. When Attia Agent changes an application's status, it moves the application only to the status a User named, and the change waits for a User's approval.

AI Features are not intended, designed or provided to evaluate, score, rank, rate, match, shortlist or recommend Candidates, to assess whether a Candidate is suitable for a role, or to make any decision about a Candidate or a worker. AI assists. A human decides.

Attia does not intend AI Features to be used as a high-risk AI system within the meaning of Article 6 and Annex III of the EU Artificial Intelligence Act. Attia specifies that AI Features are not to be changed into, configured as, combined into or used as a high-risk AI system. A Customer that uses AI Features for a purpose outside Section 4.1, including a use listed in Section 4.4, does so outside the intended purpose and at its own risk, and may itself become the provider of a high-risk AI system under Article 25 of that Act, with the obligations that follow.

The Customer is the employer and, under data protection law, the controller of Candidate Data. Every recruiting and employment decision made with the Service is the Customer's decision. This includes every decision to advance, hold, reject, shortlist, interview, assess, make an offer to or hire a Candidate. The Customer must:

• (a) make sure that a qualified person, with the authority and competence to change the outcome, makes each such decision and does not rely on Output as the sole basis for it;
• (b) make sure that no decision with legal effects or similarly significant effects for a Candidate is based solely on automated processing, including through rules, Loops, automations, integrations or connected AI clients that the Customer sets up, unless the Customer has a lawful basis under Article 22 of the GDPR and has put in place the safeguards that article requires, including the right to obtain human intervention, to express a point of view and to contest the decision;
• (c) set the selection criteria, qualifications and requirements for each position itself, and review every job advertisement, requirement, message and other content drafted with AI Features before it is published or sent;
• (d) give Candidates, workers and their representatives all information, notices and explanations that the law requires, including about the use of AI and automated processing, and handle their requests, objections and complaints;
• (e) carry out every data protection impact assessment, bias or fundamental rights assessment, consultation with employee representatives and other assessment that the law requires before it uses the Service or AI Features;
• (f) make sure that Users who use AI Features have the knowledge, training and instructions to use them responsibly and to understand their limits;
• (g) keep the records it needs to explain each decision and to answer a Candidate's request, including a request under section 31 of the Norwegian Equality and Anti-Discrimination Act; and
• (h) set up and review its rules, Loops and automations so that they comply with the law. The Customer is responsible for every action they take.

You must not use the Service, including AI Features, Loops and automations, to:

• (a) evaluate, score, rank, rate or grade Candidates, or sort them by suitability, fit or potential, with AI Features;
• (b) let AI Features select, shortlist, recommend or choose a Candidate for an interview, assessment, offer or rejection, or decide which Candidate is better than another;
• (c) reject, disqualify or take any other decision with legal or similarly significant effect for a Candidate based solely on automated processing, except in compliance with Section 4.3(b);
• (d) infer or predict a Candidate's or worker's emotions, personality, mental state, honesty or intentions from their voice, face, text, writing style or any other data;
• (e) categorize or identify people based on biometric data;
• (f) infer, predict or reconstruct a person's protected characteristics or special categories of personal data, such as gender, pregnancy, family plans, ethnicity, national origin, religion or belief, disability or health, sexual orientation, gender identity or expression, age, political opinions or trade union membership, including from proxies such as names, photos, addresses, gaps in a work history or language;
• (g) screen, filter or treat Candidates differently based on a protected characteristic, or use criteria that discriminate directly or indirectly, unless the law expressly allows it;
• (h) collect information that the law does not allow an employer to collect in recruitment, including information about pregnancy, family plans, religion, ethnicity, disability, sexual orientation, gender identity or expression, political views or trade union membership, or health information beyond what the law allows;
• (i) collect information about Candidates from social media or other sources to build profiles of them, or score them based on their social behavior or personal characteristics;
• (j) target or exclude groups of people from job advertisements based on protected characteristics; or
• (k) monitor, evaluate or make decisions about the performance, behavior, task allocation, promotion or termination of workers with AI Features.

Attia may build controls that enforce this Section, such as approval steps, refusals and limits on what AI Features can do, and may change them at any time. You must not try to work around them. These controls do not transfer any of the Customer's responsibilities to Attia. Attia does not monitor whether the Customer complies with the law.

5. Anti-abuse, usage and AI Credits#

You must not:

• (a) create or use more than one account, workspace, organization, email address or payment method to get more free trials, free plans, AI Credits, Promotional Credits or usage than you are entitled to, or to avoid usage limits or fees;
• (b) share, sell, transfer or trade AI Credits, accounts or access, except as Attia allows;
• (c) create a new account or workspace to get around a suspension, block or termination;
• (d) manipulate usage metering, billing or credit accounting, or use a bug or error to get AI Credits or features you have not paid for. If you find such a bug or error, you must tell Attia promptly; or
• (e) put an unreasonable load on the Service or on Attia's AI providers, including through automated or excessive requests.

Attia may treat accounts or workspaces that it reasonably believes are linked, for example through shared payment details, domains, devices or Users, as one account for the purposes of this Section.

6. Sensitive data#

Do not upload to the Service, or give to AI Features, more personal data than recruiting needs. Unless the law requires or allows it and you have a lawful basis, you must not upload:

• (a) special categories of personal data, such as data about health, ethnicity, religion or belief, political opinions, trade union membership, sex life or sexual orientation, and genetic or biometric data;
• (b) personal data about criminal convictions and offenses, including police certificates;
• (c) national identity numbers, such as Norwegian national identity numbers or D numbers, or copies of passports or other identity documents;
• (d) payment card data, bank account details or other financial account credentials;
• (e) passwords, access keys or other credentials;
• (f) information that is classified under security or defense law; or
• (g) personal data about children, except where a position is lawfully open to young workers and only as the law allows.

If a Candidate gives you such data without being asked, you must handle it lawfully and delete what you do not need. The Service is not designed for these categories of data. The Customer is responsible for any such data it chooses to process in it.

7. Reporting#

If you see a violation of this Policy, a security issue, or Output that is unlawful, harmful or discriminatory, report it to Attia at oystein@attia.app. Give as much detail as you can. Attia may contact you about the report, but does not have to.

8. Enforcement#

Attia may investigate any suspected violation of this Policy. If Attia reasonably believes that you have violated this Policy, or that your use of the Service creates a legal, security, operational or reputational risk for Attia, its suppliers, other customers or any person, Attia may, with or without notice and without liability to you:

• (a) warn you, or ask you to change or stop the use;
• (b) limit, throttle or rate-limit your use, including your use of AI Features;
• (c) disable, block or refuse specific inputs, prompts, Output, Loops, automations, integrations, connected applications or features;
• (d) remove, unpublish or disable access to content, including job advertisements and career site pages;
• (e) suspend or terminate Users, workspaces, accounts or the Customer's access to the Service, in whole or in part;
• (f) cancel, revoke or refuse to issue Promotional Credits, trials or discounts that were obtained or used in violation of this Policy, and cancel AI Credits obtained by fraud or abuse or with a payment that is later reversed, as Section 8.4 of the AI Addendum describes, in each case without refund;
• (g) report the matter to the police, regulators or affected persons, and cooperate with them, including by sharing information as the law permits; and
• (h) take any other action that Attia considers appropriate.

Where it is reasonable and lawful, Attia will try to limit its action to the affected activity and to tell you about it. Fees remain payable during a suspension caused by your violation. Attia does not have to monitor the Service or its content. If Attia does not act on a violation, it keeps the right to act on it later. These rights are in addition to Attia's rights under the Terms.

9. Changes to this Policy#

Attia may update this Policy at any time by publishing a new version at attia.app/aup and changing the date at the top. A change takes effect when it is published, unless Attia states a later date. For a change that Attia considers material, Attia will try to give notice by email or in the Service. If you continue to use the Service after a change takes effect, you accept the updated Policy. If this Policy conflicts with the Terms, this Policy prevails for Section 3 and Section 4. For everything else, the Terms prevail.