Acceptable Use Policy

This Acceptable Use Policy (the "Policy") applies to everyone who uses the Service provided by Attia AS (org.nr 937788185), Solheimgata 1a, 0267 Oslo, Norway ("Attia"), including AI Features, Loops, integrations and any application or AI client connected to a Customer's workspace. This Policy forms part of Attia's Terms of Service or any other agreement between Attia and the Customer (the "Terms"). Capitalized words that this Policy does not define have the meaning given in the Terms or in Attia's AI Addendum.

"AI Features" means any part of the Service that uses a machine-learning or generative AI model, including Attia Agent, Agent steps in Loops, AI writing help, document parsing and summaries. "Output" means content that AI Features produce.

The Customer is responsible for compliance with this Policy by its Users and by anyone, or any application or AI client, that uses the Service through the Customer's workspace, accounts or credentials.

1. Compliance with laws#

You must use the Service in compliance with all laws that apply to you. These include data protection law (including the GDPR and the Norwegian Personal Data Act), equality and anti-discrimination law, employment and working environment law, marketing law, export control and sanctions law, and, where it applies to you, Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act, "AI Act"), as amended or replaced, and including any law that implements it in Norway, in the version that applies at the time. You are responsible for deciding which laws apply to your use of the Service and for complying with them.

2. General acceptable use#

You must not, and must not help or allow anyone else to:

• (a) use the Service for any unlawful, fraudulent, deceptive or harmful purpose;
• (b) publish a job advertisement or send a message that is false or misleading, advertises a position that does not exist, asks a Candidate for payment, or collects personal data for any purpose other than recruiting for a real position;
• (c) harass, threaten, intimidate or defame any person, or publish content that is hateful, discriminatory, violent or sexually explicit;
• (d) infringe anyone's intellectual property, privacy or other rights;
• (e) send spam or unsolicited bulk messages, or contact any person without a lawful basis;
• (f) upload or spread malware, or interfere with or disrupt the Service, its infrastructure, its suppliers or other customers;
• (g) probe, scan or test the security of the Service, or bypass any security measure, authentication, access control, rate limit or usage limit, unless Attia has authorized it in writing;
• (h) access the Service by automated means, such as scrapers, bots or crawlers, other than through the interfaces and integrations Attia provides, or access data you are not authorized to access;
• (i) copy, modify, reverse engineer or decompile the Service, or use it to build or benchmark a competing product, except where the law allows this despite this restriction;
• (j) resell, sublicense or provide the Service to any third party, except as the Terms allow;
• (k) misrepresent your identity or affiliation, or impersonate any person or organization; or
• (l) use the Service in a way that could expose Attia, its suppliers or other customers to liability or harm.

3. AI-specific restrictions#

Output can be inaccurate, incomplete, out of date or biased, even when it looks detailed and specific. You must review Output before you rely on it, share it or act on it, and you are responsible for what you do with it.

When you use AI Features, you must not:

• (a) use Output as legal, medical, financial or other professional advice without review by a qualified professional;
• (b) present Output as written by a human, or use Output in a chatbot or other system that interacts with people without telling them that they interact with AI, where Article 50 of the AI Act or other law requires disclosure;
• (c) impersonate a real person, or create synthetic images, audio, video or text of a real person without that person's consent;
• (d) bypass, disable or manipulate the approvals, refusals, limits, instructions or other safety controls of AI Features, including by jailbreaks or prompt injection, or place content in a job advertisement, document or record that is designed to change how AI Features behave;
• (e) use the Service or Output to develop, train or improve an AI model or product that competes with Attia, or try to extract model weights, prompts or system instructions;
• (f) give third parties access to AI Features as a proxy, wrapper or resale service;
• (g) create or spread disinformation, or content intended to influence elections or other democratic processes;
• (h) create sexual content involving minors, or intimate images of any person without consent;
• (i) use AI Features for any practice that Article 5 of the AI Act prohibits; or
• (j) intentionally remove or tamper with a machine-readable mark that shows Output was generated by AI, except for legitimate security audit or research.

You must also comply with the usage policies of the AI model providers that Attia uses, to the extent they apply to your use. Attia lists these providers in its DPA.

4. Hiring and employment#

Attia is an applicant tracking system. Attia Agent is a general-purpose AI assistant inside it. It runs on general-purpose AI models from third-party providers, which Attia lists in its DPA. Like other general-purpose AI assistants, it does what a User asks, within the limits that Attia sets. It can help with many tasks inside and outside recruiting, such as writing, research, questions about the workspace, and work in applications and AI clients that the Customer connects. Attia Agent is not a hiring decision system.

AI Features are intended to help people with administrative and preparatory work. Examples of intended use are:

• (a) drafting and editing job advertisements, messages and other text for a User to review, edit and publish or send;
• (b) organizing, searching and updating records, such as jobs, applications, notes and documents;
• (c) extracting information from a document into structured fields, such as contact details, dates and work history, as the document states it;
• (d) summarizing the facts in a document, such as a CV, in the same format for every document, without any opinion about the person;
• (e) translating, correcting and formatting text;
• (f) reminders, schedules and reports about the work itself, such as how long applications have waited in a stage; and
• (g) carrying out actions that a User has asked for, or that Customer has set up in a Loop. In a chat, when Attia Agent changes an application's status, it moves the application only to the status a User named, and the change waits for a User's approval. In a Loop, Attia Agent moves an application only to a status that the Loop's instructions name, and a Loop step can also set a field, such as an application's status, to a fixed value or to a value that AI picks from that field's options. A Loop applies these changes without a further approval.

These are the actions AI Features can take in the Service, within the access and approvals described on the help page.

• Applications: assign one, set a delegate, move one to the status you name, add or remove a label, write and edit its own comments, delete its own comments, and write the brief in a private summary.
• Jobs: edit a job's fields and description, set its status, post a job update, add or remove labels, and edit its form questions.
• Candidates: edit a candidate's details and entries, add or remove a label, and add and edit notes.
• Documents: edit a document's body.
• Members: send a notification to members. It changes no record.
• With Allow changes outside the triggering record on, a Loop can also create a job, start a job from a job template, create or edit a job template, create a candidate, create a Loop, and edit a career site.

In a chat you can also ask Attia Agent to create a document, a job, a job template or a Loop, start a job from a job template, edit a job template, a job update or a Loop, set an SLA, add a link, restore a file, add or edit a library question, save a skill, set a reminder, change your own Inbox items, read a website for an import, and edit a career site.

In a chat you can also ask Attia Agent to do these, and each waits for your approval: create a candidate, add a candidate to a job, move an application to another job or team, set a review value, remove a link or a file, set a candidate's picture or PDF, send a candidate a message, edit a candidate's details, entries or notes, send a member a notification, set a label a candidate can see, publish a Loop, switch a Loop on or off, run a Loop now, apply a website import, delete an Inbox item, and delete a career-site page or block. Placing a job on a career site or taking it off waits too, unless the job is unpublished.

Attia does not intend, design or market AI Features as a high-risk AI system under the AI Act. In the use Attia intends, AI assists, and people at Customer make the decisions about Candidates.

Instructions, prompts, Skills, Loops and connected tools that the Customer or its Users write, choose or set up are the Customer's configuration. They do not change the intended purpose that this Section sets. If they give AI Features another purpose, that purpose is the Customer's, and the Customer is responsible for it.

Attia considers Attia Agent a general-purpose AI system within the meaning of Article 3(66) of the AI Act. Attia does not intend AI Features to be used as a high-risk AI system within the meaning of Article 6 and Annex III of the AI Act. For the purposes of Article 25(2) of the AI Act, Attia clearly specifies that AI Features are not to be changed into, configured as, combined into or used as a high-risk AI system.

Whether a use is high-risk follows Article 6 and Annex III of the AI Act as they read at the time, including the cases where Article 6(3) says that a system referred to in Annex III is not high-risk. The Customer makes any assessment, documentation or registration that the AI Act requires for its own use.

A Customer that uses AI Features for a purpose outside Section 4.1 does so outside the intended purpose and at its own risk. This applies also when the Customer does so through its own instructions, prompts, Skills, Loops or connected tools. If that use makes AI Features a high-risk AI system, the Customer may itself become the provider of that system under Article 25(1) of the AI Act, with the obligations that follow. Attia is then not the provider of that high-risk AI system. Because Attia has specified that AI Features are not to be changed into a high-risk AI system, Attia does not have to give the Customer documentation, technical access or other assistance for it. This does not limit Attia's rights under Section 8.

The Customer is the employer and, under data protection law, the controller of Candidate Data. Every recruiting and employment decision made with the Service is the Customer's decision. This includes every decision to advance, hold, reject, shortlist, interview, assess, make an offer to or hire a Candidate. The Customer must:

• (a) make sure that each such decision meets the requirements the law sets for it, including any human oversight that the AI Act or other law requires;
• (b) make sure that no decision with legal effects or similarly significant effects for a Candidate is based solely on automated processing, including through rules, Loops, automations, integrations or connected AI clients that the Customer sets up, unless the Customer has a lawful basis under Article 22 of the GDPR and has put in place the safeguards that article requires, including the right to obtain human intervention, to express a point of view and to contest the decision;
• (c) decide the selection criteria, qualifications and requirements for each position, and stay responsible for every job advertisement, requirement, message and other content it publishes or sends, including content drafted with AI Features;
• (d) give Candidates, workers and their representatives all information, notices and explanations that the law requires, including about the use of AI and automated processing, and handle their requests, objections and complaints;
• (e) carry out every data protection impact assessment, bias or fundamental rights assessment, consultation with employee representatives and other assessment that the law requires before it uses the Service or AI Features;
• (f) take the AI literacy measures that Article 4 of the AI Act requires of it;
• (g) keep the records that the law requires, including the records it needs to answer a Candidate's request under section 31 of the Norwegian Equality and Anti-Discrimination Act;
• (h) set up and review its rules, instructions, prompts, Skills, Loops, automations and connected tools so that they comply with the law and with this Policy, and be responsible for every action they take; and
• (i) meet every obligation the AI Act puts on it for its own use, as a deployer and, where Section 4.2 applies, as a provider.

You must not use the Service, including AI Features, Loops and automations, in a way that the law that applies to you prohibits. In hiring and employment this includes the AI Act, data protection law, including Article 22 of the GDPR, and equality and anti-discrimination law. Apart from Sections 4.2 and 4.5, this Section 4 adds no limit on hiring and employment uses beyond what the law sets.

Attia may build controls, such as approval steps, refusals and limits on what AI Features can do, and may change them at any time. You must not try to work around them. These controls do not transfer any of the Customer's responsibilities to Attia. Attia does not monitor whether the Customer complies with the law.

5. Anti-abuse, usage and AI Credits#

You must not:

• (a) create or use more than one account, workspace, organization, email address or payment method to get more free trials, free plans, AI Credits, Promotional Credits or usage than you are entitled to, or to avoid usage limits or fees;
• (b) share, sell, transfer or trade AI Credits, accounts or access, except as Attia allows;
• (c) create a new account or workspace to get around a suspension, block or termination;
• (d) manipulate usage metering, billing or credit accounting, or use a bug or error to get AI Credits or features you have not paid for. If you find such a bug or error, you must tell Attia promptly; or
• (e) put an unreasonable load on the Service or on Attia's AI providers, including through automated or excessive requests.

Attia may treat accounts or workspaces that it reasonably believes are linked, for example through shared payment details, domains, devices or Users, as one account for the purposes of this Section.

6. Sensitive data#

Do not upload to the Service, or give to AI Features, more personal data than recruiting needs. Unless the law requires or allows it and you have a lawful basis, you must not upload:

• (a) special categories of personal data, such as data about health, ethnicity, religion or belief, political opinions, trade union membership, sex life or sexual orientation, and genetic or biometric data;
• (b) personal data about criminal convictions and offenses, including police certificates;
• (c) national identity numbers, such as Norwegian national identity numbers or D numbers, or copies of passports or other identity documents;
• (d) payment card data, bank account details or other financial account credentials;
• (e) passwords, access keys or other credentials;
• (f) information that is classified under security or defense law; or
• (g) personal data about children, except where a position is lawfully open to young workers and only as the law allows.

If a Candidate gives you such data without being asked, you must handle it lawfully and delete what you do not need. The Service is not designed for these categories of data. The Customer is responsible for any such data it chooses to process in it.

7. Reporting#

If you see a violation of this Policy, a security issue, or Output that is unlawful, harmful or discriminatory, report it to Attia at oystein@attia.app. Give as much detail as you can. Attia may contact you about the report, but does not have to.

8. Enforcement#

Attia may investigate any suspected violation of this Policy. If Attia reasonably believes that you have violated this Policy, or that your use of the Service creates a legal, security, operational or reputational risk for Attia, its suppliers, other customers or any person, Attia may, with or without notice and without liability to you:

• (a) warn you, or ask you to change or stop the use;
• (b) limit, throttle or rate-limit your use, including your use of AI Features;
• (c) disable, block or refuse specific inputs, prompts, Output, Loops, automations, integrations, connected applications or features;
• (d) remove, unpublish or disable access to content, including job advertisements and career site pages;
• (e) suspend or terminate Users, workspaces, accounts or the Customer's access to the Service, in whole or in part;
• (f) cancel, revoke or refuse to issue Promotional Credits, trials or discounts that were obtained or used in violation of this Policy, and cancel AI Credits obtained by fraud or abuse or with a payment that is later reversed, as Section 8.4 of the AI Addendum describes, in each case without refund;
• (g) report the matter to the police, regulators or affected persons, and cooperate with them, including by sharing information as the law permits; and
• (h) take any other action that Attia considers appropriate.

Where it is reasonable and lawful, Attia will try to limit its action to the affected activity and to tell you about it. Fees remain payable during a suspension caused by your violation. Attia does not have to monitor the Service or its content. If Attia does not act on a violation, it keeps the right to act on it later. These rights are in addition to Attia's rights under the Terms.

9. Changes to this Policy#

Attia may update this Policy at any time by publishing a new version at attia.app/aup and changing the date at the top. A change takes effect when it is published, unless Attia states a later date. For a change that Attia considers material, Attia will try to give notice by email or in the Service. If you continue to use the Service after a change takes effect, you accept the updated Policy. If this Policy conflicts with the Terms, this Policy prevails for Section 3 and Section 4. For everything else, the Terms prevail.