Acceptable Use Policy

This Acceptable Use Policy ("Policy") sets out how you may and may not use the services of Arct Technology LLC ("Arct Cloud", "we", "us", "our"). It is incorporated by reference into, and forms part of, the Agreement described in our Terms of Service (the "Terms"). Capitalised terms that this Policy does not define, such as "Agreement", "Customer Content", "End User", "Business Customer" and "EU/UK Consumer", have the meanings given in the Terms.

The "Services" are the virtual servers and related infrastructure, add-ons and support we provide. A "Server" is one virtual server you order. The "Platform" is arct.cloud, console.arct.cloud, docs.arct.cloud, our API and related subdomains. "You" means the customer that holds the Account.

This Policy applies to you, to anyone who uses your Account, with or without your permission, and to your End Users, including anyone who uses services you run on Arct Cloud. You agree to comply with this Policy and to require your End Users to comply with it. You are responsible for any breach of this Policy by any of them.

1. Scope and Lawful Use

You may use the Services and the Platform only for lawful purposes. You must comply with every law and regulation that applies to you or to your use of them, including criminal, privacy and data-protection, consumer-protection, intellectual property, telecommunications, export-control and sanctions laws. This includes:

• the laws of the country, state or territory where you are located or established;
• the laws of the United States and of the State of Wyoming, which apply to Arct Cloud; and
• the laws of the country where your Server is located.

Where these laws differ, you must comply with all of them. An activity that is lawful where you are may still breach this Policy if it is unlawful in one of the other places. Some rules also look to where other people are, such as the recipients of your email (section 6).

You must also comply with the sanctions and export-control rules in the Terms.

Sections 2 to 7 describe the main prohibited categories. The lists and examples in them are illustrative and not exhaustive. Conduct that is unlawful under the laws above is prohibited even if no list in this Policy names it. Conduct that threatens the security, integrity or availability of the Services, our network or any third party's systems, or that exposes Arct Cloud, our suppliers or other customers to legal liability or to attack, is also prohibited even if no list names it. Some activities in this Policy are prohibited even where they are lawful, such as cryptocurrency mining and running open network services.

You may not use the Services to encourage, promote, facilitate or instruct anyone to do anything this Policy prohibits, or to help another person do anything that would breach this Policy if you did it yourself. Doing so is a breach of this Policy by you.

2. Prohibited Content

You may not store, host, publish, transmit or distribute any of the following on or through the Services:

• Child sexual abuse material (CSAM). Any visual depiction of a minor engaged in sexually explicit conduct, whether real, computer-generated, AI-generated or altered, and any other content that sexualises minors. Section 11 explains how we handle it.
• Grooming, sextortion and trafficking. Content or activity that grooms or entices a minor, that extorts any person with sexual images or the threat of sharing them, or that facilitates human trafficking of any kind, including the sex trafficking of children.
• Non-consensual intimate imagery. Intimate images or video of a person that are shared, or threatened to be shared, without that person's consent. This includes synthetic or altered images that depict a real person, such as sexually explicit deepfakes.
• Terrorist and violent extremist content. Content that incites, promotes, glorifies or gives instructions for terrorist acts or violent extremism, or that recruits for or raises funds for a terrorist or violent extremist group.
• Threats and incitement. Content that threatens or incites violence against a person or group, or that threatens or encourages harm to a person or group on the basis of race, ethnicity, national origin, religion, caste, sex, gender, gender identity, sexual orientation, disability, serious disease or immigration status.
• Harassment and privacy violations. Content or activity intended to harass, stalk, intimidate or abuse a person, and the publication of a person's private information, such as a home address, identity documents or financial details, without their consent and in breach of applicable law.
• Dangerous content. Content that creates a serious risk to the physical safety or health of any person, or to public safety or public health, such as instructions for building weapons capable of causing mass casualties.
• Unlawful and defamatory content. Content that is unlawfully defamatory, and content that a court or other competent authority has determined to be unlawful.
• Intellectual property infringement. Content or software that infringes or misappropriates copyright, trademark, patent, trade secret, database, privacy, publicity or other intellectual property or proprietary rights. This includes pirated software and media, tools or services built to defeat copy protection or licence controls, the removal or alteration of copyright management information or licence notices, and software you are not licensed to use. Windows Server images are subject to the licensing terms in our Service Terms. Copyright notices are handled under our DMCA Copyright Policy, which, as it applies to customers, forms part of this Policy. In appropriate circumstances, we terminate the Accounts of repeat infringers, as that policy describes.
• Fraud. Scam websites, fake shops, fraudulent investment or giveaway schemes, Ponzi and pyramid schemes, chain letters, pharming, and any other content designed to obtain money, data or access by deception.
• Impersonation. Content that impersonates a person, company, government body or brand, or falsely claims an affiliation with one, in order to mislead.
• Phishing. Pages, kits or messages that imitate a trusted party to collect login credentials, payment details or other personal data.
• Illegal goods and services. Content that offers or sells goods or services that are illegal under the laws in section 1, such as controlled substances, prescription medicines sold without the required authorisation, weapons, stolen data or forged documents.

3. Prohibited Activities

You may not use the Services, or allow them to be used, to do any of the following:

• Malware. Distribute, host for download, install on other people's systems or control viruses, worms, ransomware, spyware, stalkerware, adware, trojans, logic or time bombs, exploit kits, unauthorised cryptocurrency miners (cryptojacking) or other malicious code.
• Command and control. Operate command-and-control (C2) infrastructure for malware, botnets or compromised systems.
• Botnets. Run a botnet node or controller, or recruit systems into a botnet.
• Unauthorised access. Access, or attempt to access, any system, network, account or data without the owner's permission. This includes brute-force attacks, password spraying and credential stuffing (testing stolen or leaked credentials against login services).
• Customer and Platform data. Access, or attempt to access, another customer's Account, Servers or data, or our Platform, network, hypervisors, internal systems or their data, beyond what the Services give you. This includes exploiting a bug, vulnerability or misconfiguration, breaking out of your Server's isolation, and avoiding usage limits, billing or security controls. Report what you find to security@arct.cloud instead.
• Interception. Monitor or intercept traffic or data that is not yours without the permission of its owner.
• Denial of service. Launch, take part in or sell denial-of-service attacks. This includes DDoS-for-hire, booter and stresser services, mail bombing and other flooding techniques, and "stress tests" against systems you are not authorised to test.
• Scanning and probing. Scan, probe, map or test the security of any system or network without its owner's authorisation. This includes the Platform, our network and hypervisors, and other customers' Servers. Section 7 covers testing our systems.
• Spoofing. Forge or falsify IP packet headers, email headers, sender identities or other origin information; omit, delete or misreport transmission or identification information in order to hide your identity; use IP addresses that we have not assigned to your Server; or announce, hijack or otherwise use IP address space that you are not authorised to use.
• Harvesting. Collect email addresses, usernames, other identifiers or personal data by deception or covert means, or without the authorisation the law requires.
• Carding. Test, trade, buy, sell or use stolen payment card data or other stolen financial credentials.
• Account fraud. Open an Account with false information, use another person's payment method without permission, open a new Account to avoid a restriction we have imposed, or use the Services after we have terminated your Account.
• Circumventing limits. Use manual or automated means to avoid or exceed any limit, quota, port block, rate limit, throttle, suspension or other restriction we apply to the Services or to an Account, including by opening or using several Accounts.
• Sanctions evasion. Use a VPN, proxy, false information, an intermediary or any other means to access or pay for the Services from a sanctioned country or region, or for or on behalf of a sanctioned person, or to hide that access; or use the Services for an end use that export-control law prohibits, such as the development of nuclear, chemical or biological weapons or missiles.
• Purchasing bots. Run bots that automatically buy tickets, limited-release goods or other inventory in breach of the seller's terms, or other automation that is likely to cause third parties to block our IP addresses or network.
• Robocalls. Operate autodialers or software that places automated or prerecorded voice calls, without our prior written consent.
• Conduct that invites retaliation. Engage in conduct that is likely to provoke attacks or other retaliation against Arct Cloud, our network, our suppliers, our staff or other customers, such as conduct that makes our infrastructure the target of a denial-of-service attack.
• High-risk use. Use the Services to operate systems where a failure or interruption of the Services could lead to death, personal injury or severe physical or environmental damage, such as nuclear facilities, aircraft navigation or air traffic control, life-support systems or weapons systems.
• Unlicensed gambling. Offer gambling, betting or lottery services unless you hold every licence required in each place where the service is offered and where the Server is located.
• Spam. Send unsolicited messages in breach of section 6.
• Other unlawful activity. Any other activity that is unlawful under the laws in section 1.

Scraping and Crawling

You may run scrapers, crawlers and other automated data collection only if:

• the collection complies with applicable law, including data-protection, copyright and computer-misuse laws;
• it does not bypass logins, rate limits, CAPTCHAs, paywalls or other access controls; and
• its request rate does not degrade or disrupt the target.

You may not scrape, crawl or harvest the Platform by automated means, other than through our API in line with its documentation and limits.

Artificial Intelligence

You may run artificial intelligence and machine learning models on the Services. Section 2 applies to the content they generate in the same way as to any other content. You may not use them, or any other software on the Services, to:

• generate, store or distribute child sexual abuse material or non-consensual intimate imagery, including synthetic or altered material;
• create or distribute synthetic audio, images or video that falsely depict a real person, or that misrepresent the origin of content, in order to deceive, defraud or harm others;
• remove, alter or defeat watermarks, content credentials or other provenance information in order to deceive, or where the law prohibits it;
• bypass the safety controls, usage restrictions or licence terms of a third-party model or AI service; or
• make fully automated decisions that have legal or similarly significant effects on individuals, such as decisions on employment, credit, housing, education or healthcare, unless the law permits it and you provide the human review and safeguards the law requires.

You are responsible for holding the rights, licences and consents needed for the data you use to train, fine-tune or run models on the Services, and for their outputs.

4. Network Services

You may not run the following open network services, or any other service that lets third parties relay, hide or amplify traffic through your Server without authentication:

• open proxies, including HTTP, HTTPS and SOCKS proxies;
• open mail relays, meaning mail servers that forward mail from any sender to any recipient;
• open recursive DNS resolvers;
• Tor exit nodes; and
• similar open services, such as UDP services that answer requests from anyone and can be used to amplify attacks.

This applies whether a service is open by design or by misconfiguration. If we find an open service on your Server, we may ask you to close it and may block the affected port until you do.

Without our prior written consent, you may not use the Services to provide denial-of-service mitigation, traffic scrubbing or similar protection services to third parties.

VPNs

You may run a VPN for your own lawful use. A VPN or proxy that requires authentication and that you provide to your own End Users is not an open service under this section. You are responsible for its traffic under section 8, and you must be able to act on abuse complaints about it, for example by blocking the End User responsible.

5. Resource Use

Servers share physical hosts, storage and network capacity with other customers. These rules apply on every tier and plan:

• No cryptocurrency mining. You may not mine, farm or plot any cryptocurrency or other digital asset, or run a mining pool or mining proxy. This covers proof-of-work mining and proof-of-space or proof-of-storage farming.
• No sustained full CPU use. You may not run a Server at 100% of its vCPU capacity on a sustained basis. Short periods of full CPU use are allowed.
• No excessive use of shared resources. You may not use CPU, memory, disk input and output, network capacity or other shared resources in a way that consumes a disproportionate share of them, degrades the host, degrades other customers' Servers or interferes with the normal operation of the Services.
• No abuse-related workloads. You may not run any workload whose purpose is to support conduct this Policy prohibits, whatever resources it uses.

Outbound transfer above your plan's allowance is billed at the rate on the pricing page. It is not a breach of this Policy.

If a Server breaches this section, we may limit (throttle) its CPU, disk or network capacity, or suspend it, and we may require you to correct the software, scripts or configuration that cause the problem. Where practical, we contact you first and give you time to reduce the load. Where the load harms the host or other customers, we may throttle the Server first and tell you afterwards. If a Server is infected with malware or otherwise compromised in a way that threatens the host, other customers or third parties, we may isolate it until the problem is fixed. Section 10 describes notices and disputes.

6. Email and Spam

Outbound connections on ports 25 and 465 are blocked by default. Port 587 is open. Our Service Terms explain how to request an unblock and when we may block these ports again.

You may not send spam, or help others send it. Spam means unsolicited bulk or commercial messages sent by email, SMS, messaging apps, forums, comments or social media. If you send email or other messages from the Services, you must:

• comply with the anti-spam and electronic marketing laws of your location and of each recipient's location, such as the US CAN-SPAM Act and the EU and UK electronic privacy rules;
• send bulk or marketing messages only to recipients who have opted in to receive them, and take reasonable steps to confirm that the person who opted in controls the address;
• keep records of each recipient's opt-in and give them to us within 72 hours if we ask;
• include a working opt-out method in every bulk or marketing message, and honour opt-outs within the time the law requires;
• authenticate your sending domains with SPF, DKIM and DMARC;
• identify the sender accurately and not hide or falsify where a message comes from;
• not use purchased, rented, harvested or scraped address lists;
• publish a privacy notice on each website associated with the mailing; and
• publish a working address for complaints and act on them.

You may not host a website or service that is advertised through spam, whether the spam is sent from the Services or from another network, and you may not use the Services to collect replies to messages sent from another network in breach of this section or of that network's acceptable use policy.

These rules apply to messages sent from the Services and to messages sent from any other network, by you or on your behalf, that promote or link to a site or service hosted on the Services. They apply to address lists compiled by third parties as if you had compiled them. You may not use a third-party sending service for those messages unless it applies standards equivalent to this section.

You must secure your Servers and mail software so that others cannot use them to send spam, for example by keeping software up to date and closing open relays.

Blocklistings

You may not take any action that directly or indirectly causes our IP addresses or ranges to be listed on a blocklist or abuse database. If mail or other traffic from your Server causes such a listing, we may block the affected ports again or suspend the Server until the cause is fixed. We may recover from you the reasonable, documented costs we incur because of the listing, including the charges that third parties make to remove it.

7. Vulnerability Testing

Without our prior written consent, you may not:

• probe, scan, penetrate or test the vulnerability of any Arct Cloud system or network;
• attempt to breach or bypass our security or authentication measures, whether by passive or intrusive techniques; or
• carry out security research or malware research on or using the Services.

This section does not prevent you from testing the security of your own Servers, or from authorised testing permitted under section 3, provided the testing does not affect the Platform, our network or other customers. If you find a vulnerability in our systems, report it to security@arct.cloud. Do not exploit it, access data beyond what is needed to show it exists, or disclose it publicly before we have had a reasonable opportunity to fix it.

8. End Users and Resale

You may resell the Services and use them to host services for third parties, as the Terms allow. You are responsible for your End Users, meaning anyone who uses the Services or accesses Customer Content through you, including your staff, contractors and customers. You are also responsible for all activity on your Account and Servers, whether or not you authorised it, including activity caused by an attacker who has compromised them.

If you let others use the Services, you must:

• bind them to terms at least as protective as this Policy;
• keep a working abuse contact that a person monitors, and make it available to people who want to report abuse of your services;
• act on complaints we forward to you within the time stated in our notice;
• give us the information we reasonably request to identify and stop the activity responsible for a complaint, to the extent the law allows; and
• enforce those terms, including by removing End Users who breach them.

You must keep your Servers, software and credentials secure, and act promptly to contain a compromise when you become aware of it.

You may not resell or provide the Services to any person whose Account we have suspended or terminated for a breach of this Policy, or to any person covered by the sanctions section of the Terms, and you may not present yourself as Arct Cloud.

A breach by one of your End Users is a breach by you. We may act against the Server or Account involved under section 10.

9. Reporting Violations

To report abuse of the Services, such as spam, phishing, malware, attacks or illegal content, use our Report abuse page. Include the IP address or URL involved, the date and time with time zone, a description of the problem, and any evidence such as logs or message headers.

For a notice of illegal content under the EU Digital Services Act, also explain why you consider the content illegal, give your name and email address, and confirm that you believe in good faith that the notice is accurate and complete. Name and email address are optional for reports of child sexual abuse material, grooming or another offence under Articles 3 to 7 of Directive 2011/93/EU.

If a report includes an email address, we confirm receipt and tell you what we decided. Where a report concerns a customer Server, we forward it to the customer with a deadline to act. We remove your name and contact details before forwarding, unless you agree or the law requires otherwise. Copyright notices and trademark complaints are forwarded in full, including your contact details.

Customers control what runs on their Servers. We act on a whole Server or IP address and cannot remove individual files. If a customer does not act by the deadline, we may suspend the Server under section 10.

Sending a report does not create a contract with us or oblige us to take any particular action, except as the law requires. We may decline to act on reports that are incomplete, manifestly unfounded or made in bad faith. After a warning, we may suspend for a reasonable period the processing of reports from a person who frequently sends manifestly unfounded reports.

Send trademark complaints through the trademark category on our Report abuse page. Identify the mark, your right to act for its owner and the material concerned.

Send copyright notices as our DMCA Copyright Policy describes. Report security vulnerabilities to security@arct.cloud.

If you find child sexual abuse material, do not copy, download or send it to us. Report the URL or IP address through our Report abuse page and to the NCMEC CyberTipline at report.cybertip.org, or to the police or a national hotline in your country.

Authorities should follow our Law Enforcement Guidelines page.

If you become aware of a breach of this Policy involving your Account, your Servers or your End Users, you must promptly take steps to stop it. If we ask, you must tell us what happened and help us investigate and remedy it.

10. Enforcement

Investigation

We have no obligation to monitor the Services or Customer Content, and we do not monitor Customer Content generally. We monitor network traffic and resource use to operate the Services, run DDoS protection and enforce this Policy. We have the right, but not the obligation, to investigate any suspected breach of this Policy or misuse of the Services, including when we receive a report or an order from an authority, or when our systems flag one.

We access, preserve and disclose Customer Content as section 6.4 of the Terms allows, including to investigate and enforce this Policy. We may also use and disclose Account information and Usage Data to investigate and enforce this Policy and the Agreement, to establish, exercise or defend legal claims, and as our Privacy Policy describes. We may cooperate with law enforcement agencies, regulators and other competent authorities in the investigation and prosecution of illegal conduct, and with network operators and abuse and security teams to address abuse of the Services, as the law permits.

We do not control or endorse Customer Content, and we are not responsible for it.

We apply this Policy diligently, objectively and proportionately, with due regard to the rights and legitimate interests of everyone involved, including the freedom of expression and information. Applying that standard, we decide whether content or conduct breaches this Policy, subject to your right to dispute our decision and to seek redress as described below.

Actions We May Take

If we reasonably believe that you, anyone using your Account or your End Users have breached this Policy, we may take one or more of these actions, in proportion to the breach:

• send a warning;
• require you to remove or disable content, close a service or fix a configuration by a deadline we set;
• block specific traffic, ports or IP addresses;
• limit (throttle) Server resources;
• isolate a Server by disconnecting it from the network;
• suspend a Server or the Account;
• terminate a Server or the Account;
• refuse new Orders, Servers or Accounts from you;
• take legal action to enforce our rights; and
• report the matter to law enforcement or other competent authorities and share information with them as the law permits.

We may act even if you did not cause or know about the breach, and even if it was unintentional, for example when an attacker has compromised your Server. Isolation and suspension do not delete your data. If we terminate, deletion follows the Terms, except for data we must preserve by law.

These are rights, not obligations. We may exercise them at any time, subject to this section, and taking one action does not prevent us from taking another. A decision not to act, or a delay in acting, does not waive our right to act on that breach or on any other breach.

If we become aware of information that gives rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the competent authorities, as the EU Digital Services Act requires.

Severe Cases

We may isolate, suspend or terminate immediately and without prior notice where:

• the Server hosts or distributes child sexual abuse material, or is used for grooming, sextortion or trafficking;
• the Server is taking part in an active attack, such as a denial-of-service attack, intrusion attempts or malware distribution;
• the Server hosts phishing or acts as command-and-control infrastructure;
• a court or other competent authority orders us to act;
• sanctions laws require it; or
• there is an imminent threat to the life or safety of a person.

Where we have credible signs of abuse, fraud, a sanctions issue or a security threat, such as a compromised Server, an open service being used to amplify attacks, or spam sent from a Server, we may also isolate or suspend the affected Server or Account at once while we investigate, as section 10.3 of the Terms allows.

Other Cases

In other cases, we generally send a notice to your Account email address first. The notice describes the problem and sets a deadline to fix it or respond. We need not give notice or a deadline first where we may throttle a Server under section 5; where section 10.3 or 10.4 of the Terms applies; where the breach cannot be remedied or has happened before; where we reasonably consider that prompt action is needed to prevent harm or liability; or where the law or a competent authority prohibits advance notice.

If you do not fix the problem or reply by the deadline, or the problem comes back, we may take further action, usually in this order: traffic blocking or throttling, isolation, suspension, and termination. Once the problem is fixed, we lift the restriction, unless we have terminated the Server or Account.

Statement of Reasons

When we restrict a Server, an Account or content on the ground that the content or activity is illegal or breaches this Policy or the Terms, we send you a statement of reasons by email. It states:

• the action we took, its scope, including any territorial scope, and, if it is temporary, its duration;
• the facts and circumstances we relied on, including whether we acted on a report or on our own investigation;
• whether we used automated means to detect the issue or to make the decision;
• the rule in this Policy or the Terms, or the law, that the action is based on, and why the content or conduct falls under it; and
• how to dispute the decision through a ticket, and how to seek redress in court or in arbitration as the Terms and the law provide.

We send it no later than the day the restriction takes effect, unless the law or a competent authority prohibits it.

Disputes

You may dispute a decision by opening a support ticket in the Console at console.arct.cloud or by emailing support@arct.cloud. A person reviews the dispute and any evidence you provide, and we tell you the outcome and the reasons. If we find the action was not justified, we reverse it. This process does not affect your right to seek redress in court or in arbitration under the Terms.

Refunds

We do not refund unused prepaid fees or unused account credit after a suspension or termination under this Policy. This includes protective action without an established breach by you.

Your Liability and Ours

You are liable for any breach of this Policy by you, by anyone using your Account and by your End Users. Section 16 of the Terms applies to any third-party claim arising from such a breach, within the limits that section sets for Consumers. To the extent the law allows, we may also recover from you the reasonable costs we incur because of a breach, including the costs of investigating and remedying it.

To the maximum extent permitted by applicable law, we are not liable to you, your End Users or any other person for any loss or damage arising from action we take, or decide not to take, in good faith under this Policy, including loss of availability, revenue or data caused by blocking, throttling, isolation, suspension or termination. This does not limit liability that cannot be limited or excluded by law, such as liability for fraud, wilful misconduct, or death or personal injury caused by negligence. It does not affect the rights of EU/UK Consumers under the Terms or under mandatory law, or the reversal of an unjustified action under the dispute process above.

11. Child Sexual Abuse Material

When we become aware of apparent child sexual abuse material on the Services, or of apparent child sex trafficking or enticement of a minor, we report it to the CyberTipline of the National Center for Missing & Exploited Children (NCMEC), as US law (18 U.S.C. 2258A) requires. We may also report it to other competent authorities, including in the country where the Server is located.

We may isolate the Server and suspend or terminate the Account immediately and without notice. Isolation disconnects the Server from the network. It does not delete the Server or its data.

We preserve the reported material and related Account data for at least one year after the report, as US law requires, and longer where the law allows and an authority asks us to. While we preserve them, the deletion periods in the Terms do not apply to the Server, its backups and its snapshots.

We cooperate with law enforcement investigations as the law permits.

12. Changes to This Policy

Changes to this Policy follow section 18 of the Terms. We assess conduct under the version of this Policy in force when the conduct took place.

13. General

In this Policy, "including" and similar words mean "including without limitation", and headings are for convenience only. If this Policy conflicts with the Terms, the order of precedence in section 1.4 of the Terms applies. If any part of this Policy is held to be invalid or unenforceable, that part is enforced to the maximum extent permitted and the rest of this Policy remains in effect. Our failure to enforce any part of this Policy is not a waiver of our right to enforce it later.