PΛRTYHAT

Partyhat Technologies Inc.

Acceptable Use Policy ("AUP")

Effective as of 4/16/2026.

Related documents: Terms of Service (Self-Serve) · Terms of Service (Enterprise / MSA) · Privacy Policy · Data Processing Addendum · AI / Model Terms · Customer Automation Acknowledgment · Customer AI-Disclosure Attestation · Creator Likeness Release & Biometric Consent · Third-Party / Non-Consenting Likeness Policy · Content Moderation & Pre-Generation Filter Policy · CSAM / NCMEC Reporting & Apparent-Minor Content Policy · §2257 / §2257A Compliance Statement · Appeals Policy · Complaints Policy · DMCA / Copyright Policy · Law Enforcement Guidelines · Sub-Processors List

1. Purpose and Relationship to Other Documents

1.1 Purpose. This Acceptable Use Policy ("AUP") sets the conduct, content, and operational limits that every user of the Services must observe. It is incorporated by reference into the ToS and is binding on every Agency, Creator, and Authorized User. This AUP complements, and does not replace, applicable law; where applicable law is stricter than a provision of this AUP, applicable law controls.

1.2 Who is bound. This AUP binds:

  • (a) the Agency that contracts for the Services;
  • (b) every Authorized User who accesses the Services under the Agency's account, including Agency employees, contractors, and any individual the Agency designates (Agency is responsible for every Authorized User's compliance and for making every Authorized User aware of this AUP);
  • (c) every Creator whose likeness or stylistic data is used in the Services, to the extent of the conduct expected of the Creator in connection with the Services and the Creator Likeness Release & Biometric Consent;
  • (d) any other person accessing the Services, including third-party integrators and consultants engaged by the Agency.

1.3 Cross-reference hierarchy. In the event of a conflict between this AUP and another document in the Service Agreement (as defined in the ToS), the order of precedence in ToS §[confirmed-order] governs, except that (i) the Creator Likeness Release controls as to the scope of consent for a specific Creator, (ii) the DPA controls as to processing of personal data on Agency's behalf, and (iii) this AUP controls as to content and conduct prohibitions unless the conflicting document explicitly overrides this AUP.

1.4 Non-exhaustive. The prohibited conduct in this AUP is not exhaustive. We retain discretion to treat other conduct that is illegal, deceptive, harmful, a violation of others' rights, or harmful to the integrity or reputation of the Services or of Company as a violation of this AUP.

2. Definitions

Capitalized terms used and not defined in this AUP have the meanings given in the ToS. For this AUP:

  • "Apparent Minor" means any individual depicted in content who appears, or could reasonably be interpreted to appear, to be under the age of eighteen (18), whether the depiction is photoreal, stylized, cartoon, anime, CGI, or otherwise, and whether the depiction is based on a real minor, a real adult made to appear as a minor, or a fully synthetic figure.
  • "CSAM" means child sexual abuse material as defined under 18 U.S.C. §§1466A, 2256, and 2258A and equivalent statutes in other jurisdictions, including visual depictions constituting "virtual" or AI-generated CSAM as clarified by the U.S. Department of Justice and state enforcement authorities.
  • "NCII" means non-consensual intimate imagery, including imagery that is sexual, nude, or otherwise intimate and that was created, obtained, or shared without the informed consent of the depicted individual, and including synthetic or AI-generated intimate imagery of any real or identifiable person produced without that person's informed consent.
  • "Non-Consenting Person" means any identifiable natural person other than a Creator with a valid Creator Likeness Release & Biometric Consent on file, and includes real fans, celebrities, other creators, friends, family members, public figures, or any other identifiable individual whose likeness, voice, or identifying features are used in content without that person's written, informed consent.
  • "Target Platform" has the meaning given in the ToS (third-party social-media, creator-platform, and messaging services on which the Services operate Creator accounts autonomously).
  • "Target-Platform Rules" means the terms of service, acceptable-use policies, community guidelines, developer or API terms, technical-protection measures, and published carrier/industry or platform guidance applicable to a Target Platform.
  • "Automation" means any use of the Services' automated-operation features to act on a Creator's account on a Target Platform, including scheduled posting, autonomous replies to direct messages, AI-generated chat, cross-posting, and any other non-manual action taken on an account.

3. General Prohibition

Do not use the Services — and do not cause the Services to be used — to engage in or encourage any activity that is illegal, deceptive, harmful, a violation of others' rights, or harmful to the integrity or reputation of the Services or of Company. Every prohibition in this §3 applies to inputs (prompts, uploaded materials, fine-tuning data, instructions to agents), to outputs (generated images, video, voice, text, chat), to inferred or derived artifacts (Models, embeddings, caches), and to the use of the Services to interact with third-party systems and individuals.

4. Absolute Prohibitions (Zero Tolerance)

The following are absolute prohibitions. Violation will result in immediate suspension or termination of the Agency and the responsible Authorized User, and where applicable in mandatory reporting to law enforcement and to the National Center for Missing & Exploited Children ("NCMEC") CyberTipline.

4.1 CSAM — actual, claimed, or role-played. You will not use the Services to prompt, generate, input, upload, store, transmit, publish, or cause the generation or distribution of CSAM. This includes content that depicts, describes, or purports to depict actual, claimed, or role-played sexual abuse, exploitation, or harm of individuals under eighteen (18) years old, whether real, stylized, cartoon, anime, CGI, fully synthetic, or otherwise.

4.2 Apparent-Minor Content — even without a real child. You will not use the Services to prompt, generate, input, upload, store, transmit, publish, or cause the generation or distribution of any sexually explicit content depicting an Apparent Minor, even where no real minor exists and the depiction is fully synthetic, stylized, or cartoon. This prohibition is absolute; consent is not a defense; claims of "aged-up," "18+ fictional," or similar labeling do not cure a depiction that a reasonable viewer could interpret as an Apparent Minor.

4.3 Non-Consensual Intimate Imagery (NCII). You will not use the Services to generate, distribute, or cause the generation or distribution of NCII. Without limiting the foregoing, you will not generate or cause the generation of any explicit, nude, or intimate depiction of a Non-Consenting Person, whether real or synthesized, and including any AI-generated likeness, "deepfake," or digital replica of a real or identifiable individual. Nothing in the Creator Likeness Release authorizes content outside the scope of that Creator's written consent.

4.4 Non-Consenting-Person Likeness (general). You will not prompt, generate, input, upload, or cause the Services to generate any content that depicts an identifiable person other than a Creator with a valid Creator Likeness Release on file, unless you have separately obtained that person's written, informed consent compliant with applicable right-of-publicity, digital-replica, and privacy statutes — including, without limitation, the Tennessee Ensuring Likeness Voice and Image Security Act (Tenn. Code §47-25-1105), New York Civil Rights Law §50-F, California Civil Code §3344, 765 ILCS 1075/ (Illinois Right of Publicity Act), and, if enacted, the federal NO FAKES Act. This prohibition extends to celebrities, public figures, private individuals, Fans referenced in DMs, other creators, and anyone whose likeness, voice, or identifying features a reasonable viewer could recognize. See also the Third-Party / Non-Consenting Likeness Policy.

4.5 Sexual content involving incest, bestiality, necrophilia, or non-consent — actual, claimed, or role-played. You will not use the Services to generate or cause the generation of content that depicts, describes, or purports to depict incest, bestiality, necrophilia, rape, or sexual assault, whether actual, claimed, or role-played, whether consensual as between actors or not, and regardless of Creator consent.

4.6 Terrorism, mass violence, and material support. You will not use the Services to generate, distribute, or cause the generation or distribution of content that promotes, incites, plans, or provides material support to terrorism, mass violence, or a designated terrorist organization under 18 U.S.C. §2339 or equivalent statute in any applicable jurisdiction.

4.7 Content sexualizing minors in ways that do not meet §4.1 / §4.2 definitions. Independent of §§4.1–4.2, you will not generate or cause the generation of content that sexualizes individuals under eighteen (18) in any manner, including suggestive depictions, scenarios, framing, or written material, whether real, stylized, or synthetic.

4.7A Actual Sexually Explicit Conduct — 18 U.S.C. § 2256(2)(A)(i)–(iv). You will not use the Services to prompt, generate, input, upload, cause the Services to generate, store, transmit, publish, or distribute any visual depiction of actual (as opposed to simulated) sexually explicit conduct as defined in 18 U.S.C. § 2256(2)(A)(i)–(iv), namely:

(i) sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex;

(ii) bestiality;

(iii) masturbation; [and]

(iv) sadistic or masochistic abuse.

This prohibition applies regardless of Creator consent and regardless of whether the depicted persons are verified adults. The Services are architected to restrict output to § 2256(2)(A)(v) lascivious exhibition and to § 2257A simulated sexually explicit conduct; the Content Moderation & Pre-Generation Filter Policy hard-blocks prompts and Outputs that cross the § 2256(2)(A)(i)–(iv) line, with human-review escalation for borderline cases. Bestiality is independently prohibited under §4.5. No appeal is available for filter hits in this category; appeals under §12.1 are limited to factual misidentification, consistent with the Appeals Policy's asymmetric-tolerance posture. Filter evasion producing § 2256(2)(A)(i)–(iv) content is handled under the Company's internal filter-evasion incident-response SOP (not a ground for appeal).

4.8 Enforcement. Company may and will report suspected CSAM (including AI-generated CSAM and Apparent-Minor content reasonably suspected to constitute CSAM) to the NCMEC CyberTipline pursuant to 18 U.S.C. §2258A, cooperate with law-enforcement investigation, and suspend or terminate the Agency account without prior notice. See the CSAM / NCMEC Reporting & Apparent-Minor Content Policy.

4.9 Targeting of Excluded-Jurisdiction data subjects. You will not use the Services to operate any Target-Platform account for the purpose of targeting, engaging, transacting with, or collecting personal data from Fans or other data subjects located in an Excluded Jurisdiction. "Excluded Jurisdictions" has the meaning given in the Terms of Service (Self-Serve §2(i); Enterprise MSA §2.2(h)) and comprises the European Economic Area (EU Member States plus Iceland, Liechtenstein, Norway), the United Kingdom, Switzerland, Brazil, Canada, Australia, Japan, South Korea, India, the People's Republic of China, and Singapore. Agency attests to compliance with this §4.9 at onboarding and per Target-Platform account via the in-product Modal-Confirm flow. Breach is a material breach and triggers Agency's uncapped indemnification obligations under the ToS.

5. Content Prohibitions

The following are additional content prohibitions. They apply to inputs, outputs, derived artifacts, and anything posted by the Services on a Target Platform.

5.1 Illegal activity. Content or conduct that is illegal under any law applicable to the Agency, the Creator, an Authorized User, or the Target Platform on which content is posted.

5.2 Sanctions and export controls. Content, Services use, or transfers that violate U.S. economic sanctions administered by the Office of Foreign Assets Control ("OFAC"), the Export Administration Regulations, the International Traffic in Arms Regulations, or equivalent non-U.S. regimes. You will not use the Services to or on behalf of any individual or entity identified on a denied-parties list, or in a comprehensively sanctioned jurisdiction, except as expressly permitted by general or specific license.

5.3 Fraud, deception, scams. Financial scams; phishing; pretexting; "catfishing" for financial gain in a manner that involves impersonation beyond the AI-persona scope authorized by the Creator and the AI-Disclosure Attestation; unauthorized robocalling; spam distribution; chargeback fraud. Specifically, the AI-persona operation of a Creator account is permitted only within the scope of the Creator Likeness Release and the Customer AI-Disclosure Attestation — deception that exceeds that scope (for example, soliciting a Fan to transfer funds off-platform through false pretenses, representing that a generated voice note was recorded live when it was not for purposes that materially deceive the Fan to their detriment, or inducing investment on the basis of false statements) is prohibited.

5.4 Unauthorized impersonation. Content that impersonates any real person, entity, Government Entity, or official account without authorization. You may operate a Creator's persona on that Creator's own accounts under the Creator Likeness Release; you may not cause the Services to impersonate any person who has not granted you that right in writing. Political candidate, elected-official, and public-figure impersonation are prohibited even where the target is a public figure.

5.5 Electoral interference and political-candidate impersonation. You will not use the Services to generate voice, video, image, or chat content that (a) purports to be from a political candidate or elected official without that person's written authorization, (b) interferes with voter registration or the exercise of the franchise, (c) disseminates false information about voting location, time, or eligibility, or (d) engages in campaign-finance activity in violation of applicable law. Use of the Services for political campaigning — even for a real, authorized candidate — requires our prior written consent.

5.6 Health, legal, financial advice without qualified review. Generating content that presents as professional advice in health, medicine, law, finance, insurance, or other regulated fields without a qualified human professional in the decision loop. Satirical, fictional, and clearly-labeled entertainment use is not prohibited; use that a reasonable consumer would rely on is prohibited.

5.7 Hateful conduct. Attacking a person or group on the basis of race, ethnicity, national origin, caste, sexual orientation, gender, gender identity, religious affiliation, age, disability, disease, or other legally protected characteristic.

5.8 Harassment, stalking, doxxing, defamation. Harassment or sustained targeting of any individual; stalking; doxxing (publication of non-public personal information with intent to facilitate harassment); defamation.

5.9 Self-harm, suicide promotion. Promotion or glorification of self-harm or suicide, including generation of content that instructs or encourages such conduct.

5.10 Violence and gore. Generating depictions of real-world violence with intent to intimidate, threaten, or incite; gore without legitimate artistic or journalistic context and without appropriate labeling and age-gating on the Target Platform.

5.11 Controlled substances, weapons. Content facilitating the sale or transfer of controlled substances or weapons in violation of applicable law; use of controlled substances or weapons depicted in a manner likely to cause physical harm.

5.12 Infringement of intellectual-property and publicity rights. Content that infringes another party's copyright, trademark, patent, trade secret, right of publicity, digital-replica right, or moral right. See also the DMCA / Copyright Policy.

5.13 Breach of privacy. Publication of another person's non-public personal information without consent (outside of statutorily permitted disclosures); unauthorized wiretapping, recording, or surveillance in jurisdictions requiring consent; violation of applicable biometric-privacy statutes.

5.14 Sexual content involving non-Creator identifiable persons. Per §4.3 / §4.4 — absolute prohibition.

5.15 Outputs for Services unauthorized by the Agency's Creator roster. Using the Services to generate content featuring a person other than an onboarded Creator, even where you claim to have that person's consent, unless they are separately onboarded with a valid Creator Likeness Release.

6. Automation of Target Platforms — Agency-Allocated Decision

6.1 Acknowledgment that Target Platforms may prohibit automation. The Services include Automation features designed to operate Creator accounts on Target Platforms autonomously, including posting, replying to direct messages, and AI-generated chat with Fans. The Target Platforms the Services support include platforms whose Target-Platform Rules prohibit or restrict automated, third-party, or bot-driven access to their services. The product's universal-automation posture means that Agency's use of Automation will frequently implicate one or more Target Platforms' prohibitions on automation.

6.2 Decision rests with Agency. The decision whether to enable Automation on a particular Target Platform — and thereby to assume the risk that such Automation violates that Target Platform's Target-Platform Rules — rests exclusively with Agency. Agency represents and warrants, each time it enables Automation on a Target Platform:

  • (a) that Agency has read the Target-Platform Rules for that Target Platform and independently evaluated the legality, contractual permissibility, and enforcement-risk posture of the contemplated Automation;
  • (b) that Agency has determined to proceed notwithstanding any Target-Platform Rules that may restrict or prohibit the Automation;
  • (c) that Agency has authority, via the Creator Likeness Release or equivalent instrument, to cause Automation on the Creator's accounts on the Target Platform;
  • (d) that Agency will maintain the consent records and Creator authorizations supporting (c) for inspection by Company and as required by law.

See also the Customer Automation Acknowledgment, which contains the operative representations and risk-allocation language for Automation.

6.3 No Company representation that Automation complies with Target-Platform Rules. Company makes no representation that Automation of any Target Platform complies with that Target Platform's Target-Platform Rules. Company may offer, withdraw, or restrict Automation support for particular Target Platforms at any time and without notice, including in response to Target-Platform enforcement, technical-protection-measure changes, or Company risk assessment. Agency is solely responsible for any consequence — including account suspension, account termination, chargebacks, contractual liability, or claims by the Target Platform — arising from Automation of a Target Platform whose Target-Platform Rules the Automation implicates.

6.4 Anti-circumvention and technical protection measures. Notwithstanding Agency's decision to enable Automation, Agency will not use the Services to circumvent, bypass, disable, impair, or defeat any technical protection measure a Target Platform has implemented (for example, CAPTCHAs, rate limits, access-control lists, authenticated-session binding, device-fingerprinting, or anti-bot instrumentation), except as necessary to (i) deliver inputs the Target Platform solicits from the authenticated account (e.g., solving a CAPTCHA issued to the account during ordinary session use) or (ii) perform operations consistent with the Target Platform's public API. This restriction is independent of Agency's §6.2 representation and is not waived by that representation.

6.5 17 U.S.C. §1201. Agency will not use the Services in a manner that would constitute circumvention of a technological measure that effectively controls access to a copyrighted work under 17 U.S.C. §1201(a)(1)(A), or circumvention of protection afforded by a technological measure under §1201(b)(1).

6.6 Credential use. Agency's supply of Target-Platform Credentials to the Services is governed by ToS §3.3 and the Sub-Processors List. Agency will not supply Target-Platform Credentials Agency is not authorized to supply, and will not direct the Services to log in to any account Agency is not authorized to operate.

6.7 Posting destinations. Agency may only direct the Services to post Outputs to, or to operate, Target-Platform accounts of Creators whose Creator Likeness Release is in force. Agency may not direct the Services to operate a personal account of a non-Creator, a business account not authorized to Agency, or any account for which Agency cannot produce evidence of authorization on reasonable request.

6.8 Rate, volume, and courtesy. Agency will not use the Services to overwhelm a Target Platform with volume beyond the rate limits published by that Target Platform or beyond what a single human operator could generate; will not use the Services to evade the Target Platform's spam or abuse controls; and will cease use of a Target Platform when the Target Platform notifies Agency or Company of a violation or asks that access stop.

7. Service-Integrity Prohibitions

7.1 Interference with the Services. You will not interfere with or negatively impact any aspect of the Services, the Company network, or any third-party network to which the Services connect.

7.2 Reverse engineering. You will not reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code, model weights, architecture, or training data of the Services, any Company-trained Model, any per-Creator fine-tuned Model, or any third-party vendor Model used by the Services, except to the extent this restriction is prohibited by applicable law.

7.3 Bypassing service limitations. You will not attempt to bypass, exploit, defeat, or disable limits, restrictions, or safeguards placed on the Services, including account-plan limits, generation quotas, content-moderation filters, pre-generation filters, jailbreak-prevention instrumentation, or identity-verification requirements.

7.4 Security vulnerabilities. You will not exploit a security vulnerability of the Services, bypass any security mechanism, or bypass any filtering capability. Good-faith security researchers participating in Company's responsible-disclosure program described in the Security Practices are not prohibited by this §7.4 from conduct that falls within that program's scope, provided it is consistent with the program's rules.

7.5 Denial-of-service / availability attacks. You will not launch or participate in a denial-of-service, distributed-denial-of-service, or other availability-impacting attack on the Services or any Company systems.

7.6 Harmful code or bots. You will not transmit code, files, scripts, agents, or programs designed to harm the Services or third parties (viruses, worms, malware, cryptominers, keyloggers), and you will not use automated means other than the Services' own Automation features to access the Services.

7.7 Unauthorized access. You will not attempt to gain unauthorized access to the Services, any Authorized User's account other than your own, any Creator's account data (except as authorized by Agency's roster), or any Target-Platform account other than the one the Services are authorized to operate.

7.8 Service output misuse. You will not use Outputs to train, fine-tune, or otherwise improve a competing AI model, a model intended for use outside the Services, or any model in violation of the license limits in ToS §5. You will not download, export, re-host, or redistribute Outputs outside the Services' Automation flow except as expressly permitted.

7.9 Credential harvesting. You will not use the Services to harvest, scrape, phish, or otherwise collect credentials, API keys, authentication tokens, or session cookies of any person or account (including any Fan, any Target-Platform account not authorized to Agency, or any other platform user).

7.10 Scraping for training. You will not use the Services to scrape, crawl, harvest, or otherwise collect content or data from any website, platform, or source for the purpose of training or fine-tuning any AI or machine-learning model, whether the Services' Models or any other. This prohibition is independent of any robots.txt directive or Target-Platform Rules and applies whether the scrape is technically successful or not.

7.11 Competitive-model training. You will not use the Services, Outputs, Models, or derived artifacts to train, fine-tune, or evaluate any model intended to compete with the Services or to circumvent the Services' licensing, per-Creator fine-tuning, or access controls.

7.12 Falsification of identity or origin. You will not create a false identity within the Services, falsify the origin of any input or output, or mislead Company, any Authorized User, any Creator, or any Fan or recipient as to the identity of the sender of any communication generated by the Services, except as permitted by the AI-persona operation authorized under the Creator Likeness Release and the Customer AI-Disclosure Attestation.

7.13 Resale, sublicense, and wrapping. You will not resell the Services, sublicense access, wrap the Services within another product, or expose the Services through an API, SDK, or interface to any party that has not itself accepted the ToS, unless and until Company offers an enterprise distribution or API program authorizing such resale or wrapping.

8. Data Safeguards and Privacy

8.1 Customer-side determination of safeguards. Agency is responsible for determining whether the Services offer safeguards appropriate for Agency's intended use, including safeguards required by applicable law, before transmitting or processing any personal data via the Services. Company publishes its security and privacy posture in the Privacy Policy, DPA, and Security Practices; Agency must independently evaluate whether those safeguards meet Agency's compliance obligations.

8.2 Creator consent. Agency will not upload any Creator Biometric Identifier, Creator Stylistic Data, or Creator Identity & Onboarding Data absent a valid Creator Likeness Release & Biometric Consent and an executed KYC record. Agency's upload of any such data without consent is an immediate AUP violation.

8.3 Third-party data. Agency will not upload personal data of any third party (including Fans, non-Creator persons, and celebrities) unless Agency has the right to do so under applicable law and the contemplated use is within the scope of that right. In particular, Agency will not upload Fan-originated personal data received on a Target Platform for the purpose of training a Model or generating content depicting the Fan.

8.4 Consent for recording, monitoring, and collection. Where applicable law requires consent prior to transmitting, recording, collecting, or monitoring data or communications (including two-party-consent wiretap statutes, TCPA/CAN-SPAM/CASL, ePrivacy), Agency will obtain that consent. Where applicable law requires opt-out honoring (CAN-SPAM, TCPA, Do-Not-Call, ePrivacy), Agency will honor opt-outs.

8.5 Prohibited special-category processing. Agency will not use the Services to process biometric, health, genetic, political-opinion, religious, or sexual-orientation data of any individual other than the Creator-as-data-subject whose Creator Likeness Release authorizes the processing, except as strictly necessary to comply with applicable law.

9. Agency Disclosure Attestation Duties

9.1 AI disclosure. Agency is responsible for making the AI-disclosure attestations required by ToS §[AI-disclosure] and the Customer AI-Disclosure Attestation, including disclosures required by FTC Act §5 (15 U.S.C. §45), California SB-243, the Utah AI Policy Act, the Colorado AI Act, the EU AI Act Art. 50, and applicable state and jurisdictional impersonation / deepfake / AI-transparency statutes. Failure to make required disclosures is an AUP violation.

9.2 §2257 / §2257A recordkeeping. Agency is responsible for maintaining §2257 and §2257A records per the §2257 / §2257A Compliance Statement, including as to AI-generated content depicting identifiable real performers. Failure to maintain such records is an AUP violation.

9.3 KYC. Agency must maintain the KYC records required by the ToS and the Creator Likeness Release. Stale, inconsistent, or falsified KYC is an AUP violation.

10. Reporting and Cooperation

10.1 Immediate reporting. Agency will immediately report any suspected violation of this AUP of which Agency becomes aware, including suspected CSAM, Apparent-Minor content, NCII, Non-Consenting Person likeness, credential compromise, account takeover of a Creator or Authorized User account, or unauthorized access to any Target-Platform account. Reports: trust@partyhat.ai for general AUP reports; trust@partyhat.ai for CSAM, Apparent-Minor content, and child-safety issues; security@partyhat.ai for security-incident reports.

10.2 Third-party reporting. Anyone — not only Agencies, Creators, and Authorized Users — may report suspected AUP violations via the channels in §10.1 or through the in-product reporting form.

10.3 Cooperation with investigation. Agency will cooperate with any investigation of an AUP violation, including by preserving relevant records, providing access to relevant logs, participating in interviews, and producing Creator consent artifacts.

10.4 Preservation of records. On written request from Company, Agency will preserve records relating to a suspected violation pending investigation and will not alter, delete, or spoliate such records.

11. Enforcement

11.1 Range of actions. Company may take any of the following actions for actual or suspected violation of this AUP:

  • issue a warning;
  • remove, quarantine, or block specific content or prompts;
  • require Agency to implement remediation (e.g., re-training, re-onboarding, consent reconfirmation);
  • restrict Agency's access to specific Services features (including suspending Automation on specific Target Platforms);
  • suspend the Agency account in whole or in part;
  • terminate the Agency account;
  • withhold, pause, or claw back Outputs generated in violation;
  • delete Model artifacts derived from violating inputs;
  • report violations to law enforcement (including the NCMEC CyberTipline for CSAM), regulatory authorities, or Target Platforms;
  • seek indemnification and other legal remedies under the ToS;
  • withhold refund of unused prepaid Fees to the extent permitted by the ToS.

11.2 Emergency and without-notice actions. For Absolute Prohibitions (§4), for imminent legal exposure, for serious security incidents, and for incidents that threaten the integrity, availability, or reputation of the Services, Company may act without prior notice or cure period. For other violations, Company will use reasonable efforts to provide notice and, where feasible, an opportunity to cure, consistent with the ToS.

11.3 Automation-specific enforcement. Where a violation involves Automation of a Target Platform, Company may (in addition to the actions in §11.1) suspend Automation on the specific Target Platform, revoke Target-Platform Credentials Agency supplied, and cooperate with the Target Platform's enforcement action against Agency's account.

11.4 Mandatory reporting. Where applicable law requires Company to report a violation (for example, 18 U.S.C. §2258A reporting of CSAM to the NCMEC CyberTipline), Company will report notwithstanding any Agency objection. Agency's indemnification obligations under the ToS extend to such reports.

11.5 Non-exhaustive remedies. Nothing in this §11 limits any other right or remedy Company has under the ToS, the DPA, applicable law, or equity. Equitable relief (including injunctions) is available in addition to damages.

12. Appeals

12.1 Scope. An Agency or Authorized User whose content has been removed or whose account has been suspended or terminated for a non-Absolute-Prohibition AUP violation may appeal under the Appeals Policy. Where the violation falls within the Absolute Prohibitions (§4), no appeal is available; appeals on Absolute-Prohibition decisions are limited to factual error (for example, mistaken identification of content as CSAM where it is not).

12.2 Human review. Appeals are decided by trained Trust & Safety personnel not involved in the underlying decision. Where the decision involved an automated pre-generation or post-generation filter, a human reviewer will re-examine the content before denying the appeal.

12.3 Timeline. Appeals are acknowledged within two (2) business days and resolved within fifteen (15) business days, subject to extension for complex cases with notice.

12.4 Complaints. In addition to appeals, the Complaints Policy describes the channel for complaints against Company's handling of content or accounts, including complaints by third parties (e.g., a Fan or Non-Consenting Person concerned about Services-generated content depicting them). Complaints concerning personal-data rights follow the DSAR Procedure and not this AUP.

12.5 Distinction from DSAR appeals. Account-suspension and content-moderation appeals under this AUP and the Appeals Policy are distinct from DSAR-outcome appeals under the DSAR Procedure. DSAR appeals route to privacy@partyhat.ai (with subject line "DSAR Appeal"); AUP / content-moderation appeals route to trust@partyhat.ai.

13. Contacts and Reporting Channels

14. Changes to This AUP

14.1 Changes. Company may update this AUP from time to time. Updates will be posted with a revised "Last updated" date. Material changes (including any expansion of prohibitions in a manner that materially affects Agency operations) are effective thirty (30) days after posting; other changes are effective on posting. Continued use of the Services after a change takes effect constitutes acceptance of the updated AUP.

14.2 Compliance-compelled updates. Changes required to comply with applicable law, regulation, or regulator order, or to respond to a Target-Platform enforcement action, may be effective immediately or on a shorter timeline where necessary; Company will notify Agency as promptly as practicable in such cases.

14.3 Where to find the current version. The current AUP is always posted at [AUP URL]. The Change Log at the foot of this document records the history of material updates.

Change Log

  • 2026-04-16 — initial draft.
  • 2026-04-21 — added §4.7A hard prohibition on actual sexually explicit conduct under 18 U.S.C. § 2256(2)(A)(i)–(iv), quoting statutory language verbatim, with forward-ref to the pre-generation filter hard-block and to internal filter-evasion SOP; per architecture-review-post-aylo.md §6 and 2257-posture-analysis.md §6(1) / §7.