Acceptable Use Policy

1. Purpose and scope

This policy applies to everyone who uses Avonao ID: members, businesses and their teams, and anyone who uses Avonao Business Circle or our APIs. It is part of the Terms of Service and the Business Terms. Avonao ID lets you sign in to apps with one account, lets businesses connect their apps and list themselves in Avonao Business Circle, and shows members which apps hold which data. The rules below protect both our members and third parties. You are responsible for use by your team and anyone you give access to.

In plain language: use Avonao ID for lawful purposes, do not abuse it, and do not mislead people about who you are or what you are asking for.

2. Prohibited uses

You may not use Avonao ID to:

2.1 Break the law or attack others

• break the law, or help others do so, including by offering content that is illegal where it is offered, selling illegal goods or services, or sexually exploiting children;
• try to access accounts, data or systems that are not yours;
• overload, scan, probe or disrupt the service, or interfere with other members' use of it;
• upload or link to malware.

2.2 Deceive people or use content you have no right to use

• deceive people to obtain money, data or access;
• use names, logos, text or images you have no right to use. The "Sign in with Avonao ID" button and the Avonao ID mark may only be used as the button kit allows.

2.3 Use member data lawfully (businesses)

• Use member data only as your own privacy policy says and the law allows.
• Do not try to link the identifiers of different businesses or otherwise re-identify members across the network.
• Do not sell, rent or publish member data obtained through Avonao ID.
• Stop using access a member has revoked, and delete data when you are told a member deleted their Avonao ID, where the law or your privacy policy requires it.

2.4 Misrepresent who you are or what you are asking for

• Do not pretend to be another person, business, brand or authority, including Avonao.
• Business profiles must show the real business. Names, logos, descriptions, categories and countries must not mislead.
• Do not suggest that a verified domain label or an early-adopter status is an endorsement by Avonao.
• Do not imitate the Avonao ID sign-in, consent or verification screens, and do not ask anyone for their Avonao ID codes, links, passkeys or recovery codes.
• Do not send people to a fake "Sign in with Avonao ID" page.

2.5 Use consent and sign-in as they are meant to be used (businesses)

• Request only the scopes your app needs.
• Do not pressure or trick members into allowing access, for example by hiding a refusal option on your own pages or making false claims about why you need the data.
• Your app's name, icon, launch URL and privacy policy must match the real app.

2.6 Abuse the service

• Do not create accounts or business accounts in bulk or by automated means, and do not trade accounts.
• Do not get around rate limits, bot checks, domain verification, the go-live rule or any other protection.

2.7 Interfere with the Service

• Do not probe, test or interfere with the Service or other members' accounts, except as allowed by our Responsible disclosure policy.
• Do not bypass authentication or any other security protection.

2.8 Businesses that may not use Avonao ID

The following businesses may not create a business account, connect apps or appear in Avonao Business Circle:

• weapons, ammunition and explosives;
• drugs and drug paraphernalia, including CBD products;
• adult content and sexual services, and dating services;
• gambling, betting and lotteries;
• multi-level marketing and pyramid schemes;
• debt collection;
• financial services without the licence they need, and crypto-assets (trading, exchange, issuance, wallets);
• medical or health services and products without the licence or approval they need.

3. Enforcement

• Anyone can report a business that seems to break this policy or the law. See Notice and action.
• A person at Avonao reviews each report. Depending on how serious the breach is, we may:

1. take no action;
2. warn you and ask you to fix the problem;
3. remove a business from the network (unlist);
4. suspend a business and its apps; or
5. suspend or end an account under the Terms of Service.

• We tell the person concerned which section of this policy or which law the decision is based on, and how to contest it, unless the law forbids it or telling them would put others at risk.
• We may report illegal activity to the competent authorities where the law requires or allows it.

4. Reporting

4.1 Report abuse

If you see Avonao ID used in a way that breaks this policy, report it through Notice and action, or write to support@avonao.com with what you saw, the time (UTC), any business name, app or URL involved, and how to reach you. If you report content that you believe is illegal under EU law, we tell you our decision about that content and how to challenge it, as described on the Digital Services Act page.

4.2 Report a vulnerability

Found a vulnerability? Follow our Responsible disclosure policy and write to security@avonao.com. We welcome good-faith security research. Do not access other people's data, do not disrupt the service, and give us reasonable time to fix an issue before you publish it. Good-faith research that follows that policy is not a breach of this one.

5. Changes

We may update this policy. For material changes we tell members by email at least 30 days ahead.

6. Contact

support@avonao.com, security@avonao.com.