← Legal documents

Contract · 02

Acceptable Use Policy

Acceptable use conditions and guidelines for NexToCloud products and services in Colombia Operated by NTC CAPITAL HOLDING S.A.S. · NIT (Colombian tax ID) 902.096.121-7 Version 2.0 · Effective as of: October 20, 2026 · Last updated: October 20, 2026

1. Purpose and scope#

1.1. This Policy sets out the acceptable use rules for all NexToCloud products, modules and applications (the "Services"), including the Platform, its APIs, the messaging and voice channels and the AI Features.

1.2. It applies to the Customer, its Administrators and Authorized Users, and any person who accesses the Services. The Customer is responsible for compliance with this Policy by every person to whom it grants access.

1.3. It forms an integral part of the General Terms of Service. Capitalized terms have the meaning defined there.

2. Principles of use#

Use of the Services must be:

  • Lawful: in accordance with Colombian law and the law of the place where the Services are used or to which they are directed.
  • Legitimate: limited to the Customer's own operations and the purposes for which it subscribed.
  • Authorized: based on the authorizations of the data subjects and of the recipients of communications.
  • Secure: without putting the Platform, other customers or third parties at risk.
  • Supervised: with human oversight of relevant decisions, especially those supported by AI.

3. Prohibited uses#

You may not use the Services, or allow them to be used, to:

3.1. Unlawful or fraudulent activities

a) Commit, facilitate or promote crimes, including the computer crimes under Law 1273 of 2009, fraud, scams, identity theft, money laundering or terrorist financing. b) Offer prohibited goods or services, or goods or services without the required licenses or authorizations. c) Impersonate another person, company or entity, or falsify the origin of a communication. d) Evade sanctions, court orders or decisions of authorities.

3.2. Platform security and integrity

a) Access or attempt to access, without authorization, accounts, other customers' Workspaces, systems or networks. b) Perform vulnerability tests, scans, penetration tests or load tests without NexToCloud's prior written authorization. c) Introduce viruses, malicious code, malicious payloads or any element that damages, interferes with or intercepts systems or data. d) Circumvent, disable or tamper with security controls, authentication, usage limits or the metering of Usage Charges. e) Reverse engineer, decompile or attempt to extract the source code, models, prompts or System Configuration. f) Use robots, scrapers or other automated means to extract data from the Platform outside the authorized APIs and export functions.

3.3. Resource abuse

a) Place a disproportionate or deliberately excessive load on the infrastructure. b) Share credentials, use the same credential simultaneously or create accounts to circumvent Plan limits. c) Resell, sublicense, lease or give third parties access to the Services, or provide "white-label" services with them, without a written agreement with NexToCloud.

3.4. Content

Upload, store, transmit or generate content that:

a) Infringes copyrights, trademarks, trade secrets or other third-party rights. b) Is defamatory, slanderous, discriminatory, threatening, harassing or that incites violence or hatred. c) Contains child sexual abuse material or exploits minors in any way. NexToCloud will report these cases to the authorities. d) Is misleading or constitutes misleading advertising under Law 1480 of 2011. e) Contains data or information obtained unlawfully.

3.5. Communications and messaging

a) Send messages to people who have not authorized being contacted through that channel or who have asked not to be contacted (opt-out). b) Send unsolicited bulk communications (spam), chain messages or commercial messages without the recipient's prior authorization. c) Contact consumers for collection efforts or to send advertising outside the days, times and frequencies permitted by Law 2300 of 2023, when that law applies to the Customer. d) Use templates or messages that contravene the policies of WhatsApp Business, Meta or other channel providers. e) Conceal the Customer's identity as sender or use third-party numbers without authorization. f) Use the messaging or voice channels for surveillance, harassment or tracking of people.

3.6. Personal data

a) Upload or process personal data without the data subject's authorization when such authorization is required, or for purposes other than those disclosed. b) Upload sensitive data (such as health or biometric data) without the data subject's express authorization, or data of minors without the authorization of their legal representatives and without respecting their best interests. c) Upload personal data that is unnecessary for the purpose of the service (data minimization principle). d) Use the Services to build profiles, lists or databases for the purpose of selling, exchanging or marketing personal data. e) Export personal data from the Platform for purposes unrelated to the Customer's operations.

3.7. Artificial intelligence

a) Use the AI Features to issue medical diagnoses, prescriptions, legal or financial opinions, or to make decisions with legal or similarly significant effects on individuals without human review. b) Present the AI as if it were a human being when the End User asks or when the law requires disclosure; conceal that a conversation is being handled by an automated agent. c) Generate content to deceive, manipulate or exploit people's vulnerabilities. d) Attempt to defeat the models' filters, instructions or safeguards (for example, through "jailbreaks" or prompt injection). e) Use AI Outputs to train or develop models that compete with the Services. f) Clone or imitate a person's voice without that person's express authorization.

3.8. Use of the brand and relationship with NexToCloud

a) Use the trademarks, logos or names of NexToCloud, NexToCloud HealthCare or NextoCare without written authorization, or suggest a sponsorship or partnership relationship that does not exist. b) Use the Services to analyze them or to develop a competing product.

4. Customer security obligations#

The Customer and its Authorized Users must:

a) Use strong, unique passwords and enable two-factor authentication when available. b) Protect the email address and phone number associated with their credentials. c) Log out on shared devices and not save credentials in browsers on public devices. d) Immediately deactivate anyone who should no longer have access, especially departed personnel and third parties whose contracts have ended. e) Grant each user only the permissions they need. f) Report any improper access, loss of credentials or anomalous behavior within twenty-four (24) hours to apps@nextocloud.ai or privacidad@nextocloud.ai.

5. Oversight and NexToCloud's powers#

5.1. NexToCloud does not review or monitor the content of Customer Data on a general basis. It does operate automated controls over technical metrics, access, volumes and usage patterns to protect the Platform, detect abuse and meter Usage Charges.

5.2. NexToCloud may investigate any suspected breach of this Policy. To do so, it may review technical logs and, when strictly necessary, information in the Customer Workspace, subject to confidentiality and the Data Processing Agreement.

5.3. NexToCloud may block, remove or disable content, templates, flows, integrations or features that breach this Policy or put the Platform at risk.

6. Consequences of non-compliance#

6.1. Depending on the severity, recurrence and risk of the conduct, NexToCloud may adopt, on a graduated or direct basis, one or more of the following measures:

a) A written warning with a deadline to cure. b) Suspension of the feature, user, channel or integration involved. c) Full suspension of the Customer Workspace. d) Termination of the subscription for breach, in accordance with the Terms. e) A criminal complaint or report to the competent authorities.

6.2. In cases of risk to the security of the Platform, other customers or third parties, allegedly criminal conduct, or a request from a channel provider, NexToCloud may suspend immediately, notifying the Customer as soon as possible.

6.3. The measures adopted do not entitle the Customer to any compensation or refund and do not release it from paying amounts already accrued. The Customer is liable for the damages and penalties that its non-compliance causes to NexToCloud or to third parties.

7. Cooperation with authorities#

NexToCloud will cooperate with the competent judicial and administrative authorities when required by law and will provide the information requested of it under a lawful order. When legally permitted, it will notify the Customer in advance.

8. Abuse reporting#

Anyone may report misuse of the Services, a security vulnerability or the receipt of unauthorized messages sent from the Platform by writing to privacidad@nextocloud.ai (subject: "Abuse report" or "Security report"), with the information available (number or sender, date, content and evidence). Good-faith vulnerability reports will be handled confidentially.

9. Amendments#

NexToCloud may update this Policy in accordance with the amendment procedure set out in the Terms. The current version is published at nextocloud.ai/legal.

Versioned document. Previous versions are retained at nextocloud.ai/legal.