You must not configure or use Frosty Agent to:

• give medical, legal, financial or tax advice to individuals, or anything a reasonable person would rely on for a safety-critical decision;
• handle emergencies, crisis or self-harm situations as a substitute for human or emergency services;
• sell or promote illegal goods or services, weapons, controlled substances, gambling where prohibited, or adult content;
• operate in a sector where automated advice requires a licence you do not hold;
• make automated decisions with legal or similarly significant effects on an individual (credit, employment, insurance, housing) without human review.

• Do not configure the agent to deny being an AI if a person asks directly.
• Do not impersonate a named real person, a government body, or another business.
• Do not use it to generate deceptive reviews, testimonials or endorsements.

You must not upload to the knowledge base, catalogue or configuration any content that:

• you do not have the right to use;
• infringes intellectual property or contains someone else’s confidential information;
• is unlawful, defamatory, harassing, hateful, or promotes violence;
• contains malware or exploit code;
• contains special-category personal data (health, biometric, religious or political data, sexual orientation, or similar) unless you have told us in writing and we have agreed in the DPA.

• Only send messages to people who have opted in as the relevant channel requires. For WhatsApp this is a Meta requirement and you carry it.
• Do not upload contact lists you have no lawful basis to process.
• Do not use the Service for unsolicited bulk messaging or spam.
• Do not attempt to re-identify, scrape or harvest data about visitors beyond what your own privacy notice discloses.

If you enable voice, you are recording a person’s voice and having it transcribed.

• Tell people before the recording starts.
• Some jurisdictions require all-party consent to record a conversation — several US states and a number of other countries. If you serve those markets, obtain it.
• Do not use voice features to attempt speaker identification, emotion inference, or any biometric categorisation of a person.

You must not:

• probe, scan or test the vulnerability of the Service except under a written agreement with us (see Section 7);
• circumvent authentication, rate limits, plan entitlements, quotas or billing;
• access another merchant’s data, or attempt to;
• use automated means to place unreasonable load on the Service;
• resell, sublicense or provide the Service to third parties as your own product without a written reseller agreement.

• Do not attempt to extract system prompts, model weights, or our proprietary configuration.
• Do not use the Service to train a competing model.
• Do not deliberately use prompt injection to make the agent violate this Policy.

We welcome good-faith reports. Write to security@frostyagent.com before testing. Do not test against another merchant’s account, do not access data that is not yours, and give us reasonable time to fix an issue before disclosing it.

You are responsible for your team members’ use, including any custom roles you create. Grant the narrowest permissions each person needs.