Acceptable Use Policy

This Policy applies to all use of the Services through Your Account, including use by Your Users, Your Affiliates and contractors, and AI agents connected through the MCP server.

You are responsible for their compliance with this Policy as for Your own.

You may use the Services only for Your own internal business purposes and in line with applicable law.

You may not use the Services:

• for any unlawful purpose, or in breach of any international or local law or regulation, including data protection law;
• to process data You do not have the right to process, or personal data for which You have no lawful basis;
• to infringe the intellectual property or other rights of a third party;
• to impersonate a person or organisation, or to mislead people about who is sending a message or where content comes from; or
• to collect, store or distribute content that is unlawful or defamatory, or that exploits or harms minors.

You are responsible for who can reach Your Account and what it can reach. You must:

• keep each User's login details confidential, and not share one login between several people;
• use single sign-on (SSO) for Your Users where Your plan includes it;
• give the Services only the access to Your data sources and destinations that they need, using read-only access to sources where possible;
• manage Your Users' access, and remove Users who no longer need it; and
• tell Us without undue delay if You become aware of unauthorised access to Your Account.

Only admins can create API keys, and an API key has full administrator access to Your workspace. Treat API keys as administrator credentials: create them only where You need them, store them as secrets, and revoke keys You no longer use.

Connect AI tools to the MCP server with OAuth where the tool supports it. OAuth limits the tool to what the signed-in User is allowed to do. Protect any other credentials that connect AI tools to the MCP server as You protect login details.

You may not use the Services in a way that harms Weld, the Services or Our other customers. In particular, You may not:

• resell, transfer, sublicense, lease or lend the Services, or give a third party access to them, except Your Affiliates and contractors acting on Your behalf;
• decompile, modify, reverse engineer or create derivative works of the Services, except to the extent mandatory law allows;
• load test, hack or scan the Services for vulnerabilities, or try to bypass their security controls, unless We have agreed to it in writing;
• try to access another customer's Account or data;
• upload or transmit malware or other harmful code;
• overload, disrupt or interfere with the Services or the infrastructure they run on, for example through excessive automated requests;
• get around plan limits, usage metering, including Monthly Active Rows, or rate limits;
• use the Services to build or help build a product or service that competes with them;
• use the Services' software, documentation, prompts or models, or systematically extract how Ed works, to develop or train AI models that compete with the Services; or
• use the Services in any other way that causes, or may cause, damage to Weld, directly or indirectly.

Unless You have agreed it with Us in writing, You may not use the Services to process protected health information under the US Health Insurance Portability and Accountability Act (HIPAA) or payment card data covered by the Payment Card Industry Data Security Standard (PCI DSS).

You may process special categories of personal data under Article 9 GDPR, such as health or biometric data, only where You have a lawful basis and have assessed the processing.

You may process personal identification numbers, such as Danish CPR numbers, only where You have a legal basis for it, for example under section 11 of the Danish Data Protection Act. Connect IT systems that contain them only where Your purpose needs those numbers.

When You connect a data source or destination, We read from it, and for reverse ETL write to it, on Your behalf. You must:

• connect only systems and accounts You are authorised to access;
• follow the terms of the Third-Party Services You connect, including their API terms and rate limits;
• hold the consents needed to use personal data in marketing and advertising audiences; and
• not use reverse ETL to send unsolicited bulk messages, or messages that breach electronic marketing law.

Ed, Our AI agent within the Services, and the MCP server are subject to every rule in this Policy, plus the rules in this section. Through the MCP server, AI tools You choose can read and change Your Weld workspace.

AI output may be wrong. You must review it before You rely on it, and You are responsible for decisions based on it.

You are responsible for every action that You, Your Users or AI agents connected through the MCP server take in Your Account and in the systems connected to it. AI tools You connect through the MCP server are engaged by You under their own terms, and are not Our sub-processors.

Give each AI agent only the workspace access and permissions its task needs. Where the AI tool supports approval, have a person approve actions that delete or overwrite data or write to a connected system, such as deleting a connection or sync, running a reverse ETL sync, or running SQL that changes data.

You may not use Ed or the MCP server to:

• make decisions based solely on automated processing, including profiling, that produce legal effects concerning individuals or similarly significantly affect them, in breach of Article 22 GDPR;
• carry out any practice prohibited under Article 5 of Regulation (EU) 2024/1689 (the EU AI Act), such as social scoring or manipulative techniques;
• try to make them access data or perform actions outside Your Account, or get around their safeguards, for example through prompt injection;
• present AI output as reviewed, verified or approved by Us; or
• produce content that breaks section 2 of this Policy.

You are responsible for how the AI tools You connect through the MCP server behave, including repeated or looping requests, and for the approval settings You choose in them. If You turn off a tool's human approval controls, You accept the risk of the actions it then takes without approval.

Ed answers by querying Your data as the User who asks it. Give Users access only to the data they need, restrict the connectors that hold personal or sensitive data, and avoid entering such data in a conversation with Ed unless Your task needs it.

You may not use the Services, or give access to them, in breach of the export control and sanctions laws of the EU, the UN or, where applicable, the United States. You confirm that You are not, and are not owned or controlled by, a sanctioned person.

We may monitor use of the Services to check compliance with this Policy and to keep the Services secure. We do this with Usage Data as defined in the Terms of Service, such as metadata, logs, sync volumes, run history and errors. We do not read the content of Your data for this, although error messages can include values from the rows that failed.

We may investigate a suspected breach of this Policy, including one reported to Us by a third party or a public authority. If We need to access the content of Your data to investigate, for example after a security incident, We do so only to the extent the Data Processing Agreement allows. You cooperate with Us in good faith and give Us the information We reasonably ask for.

If You breach this Policy, We may suspend all or the affected part of the Services, including the MCP server, a single AI tool's access or the access of individual Users. We limit a suspension to what is reasonably necessary, give notice in advance where practicable and otherwise promptly, and restore the Services once the cause is resolved. Suspension does not affect Your payment obligations.

If You believe We have suspended the Services or acted under this Policy in error, tell Us at hello@weld.app. We review Your request promptly, and if We made a mistake, We restore the Services and correct it.

We may terminate the Agreement with immediate effect if You use the Services unlawfully or in a way that poses a security threat to the Services, to Us or to Our other customers. For any other material breach of this Policy, We may terminate the Agreement if You have not remedied the breach within thirty (30) days of written notice.

You indemnify Us against third-party claims arising from a breach of sections 2, 4, 5 or 6 of this Policy, as set out in the Terms of Service.

Report suspected misuse, unauthorised access or security vulnerabilities to hello@weld.app. See also Security at Weld. If You come across a vulnerability and report it to Us in good faith, without accessing other customers' data or disrupting the Services, that is not a breach of this Policy.

We may update this Policy from time to time. We will notify You of material changes with at least one (1) month's notice, as for the Terms of Service.