Acceptable Use Policy

This Acceptable Use Policy ("AUP") forms part of the Agreement between SmartDry Technologies Limited, company number 17302780, whose registered office is at 3 Colndale Road Floor 1, Colnbrook, Slough, England, SL3 0HQ ("SmartDry") and the Customer.

This AUP sets the minimum rules for safe, lawful and responsible use of the SmartDry Services. It applies to the Customer, its Authorised Affiliates, Authorised Users and any person or system accessing the Services through the Customer's accounts, credentials, APIs, integrations or devices.

Capitalised terms not defined in this AUP have the meanings given in the SmartDry Master Software & Services Terms ("Master Terms").

1. Purpose and Relationship to the Agreement

This AUP is incorporated into the Agreement where identified in the applicable Order Form, onboarding record or contracting process.

The Customer must ensure that its Authorised Users and Authorised Affiliates comply with this AUP. A breach by an Authorised User or Authorised Affiliate may be treated as a breach by the Customer under the Agreement.

The examples in this AUP are illustrative and are not exhaustive. Conduct may breach this AUP where it has the same material effect as a prohibited example even if the precise method is not listed.

2. Lawful and Authorised Business Use

The Customer may use the Services only for lawful business purposes within the rights purchased or otherwise granted under the Agreement.

The Customer must not use, or permit use of, the Services:

• in violation of applicable law, regulation, court order or binding regulatory requirement;
• for fraudulent, deceptive or criminal activity;
• to facilitate conduct that the Customer knows or reasonably should know is unlawful;
• outside purchased locations, modules, users, devices, terminals, API entitlements or other contractual limits by deliberately circumventing licensing or access controls; or
• in a manner that materially infringes the rights of another person or organisation.

3. Accounts, Credentials and Access Control

The Customer must maintain reasonable control over access to its SmartDry environment.

The Customer must not:

• share individual credentials except where SmartDry expressly supports shared-terminal or shared-device operation;
• permit an unauthorised person to use an administrator account, API key, token or integration credential;
• sell, transfer or disclose credentials to a third party for unauthorised use;
• deliberately circumvent multi-factor authentication, access controls, tenant restrictions or other SmartDry security features;
• use another Customer's credentials, tenant, account or data without authorisation; or
• continue using credentials that the Customer knows or reasonably suspects have been compromised.

The Customer should promptly disable access for personnel who no longer require it and notify SmartDry of suspected compromise in accordance with the Agreement.

4. Unauthorised Access and Security Testing

The Customer must not attempt to gain unauthorised access to SmartDry systems, another customer environment, third-party systems connected to SmartDry, or computer material for which the Customer lacks permission.

Without SmartDry's prior written authorisation, the Customer must not conduct or cause:

• penetration testing, vulnerability scanning, port scanning, fuzzing or exploit testing against SmartDry production systems;
• credential stuffing, brute-force attacks or password spraying;
• attempts to bypass authentication, authorisation, rate limits, tenant isolation or security controls;
• probing intended to extract secrets, source code, non-public system prompts, model instructions or confidential security information; or
• security research that accesses, modifies, destroys or exfiltrates data belonging to SmartDry or another person.

Security research is permitted only within a scope expressly authorised by SmartDry or under a published SmartDry vulnerability-disclosure programme, if one is available.

5. Malware, Disruption and Resource Abuse

The Customer must not use the Services to introduce, distribute, execute or facilitate malicious code or to interfere with the availability, integrity or performance of SmartDry or another system.

Prohibited conduct includes:

• malware, ransomware, spyware, destructive scripts, cryptominers or similar malicious code;
• denial-of-service or distributed denial-of-service activity;
• deliberately excessive automated requests intended to exhaust capacity or degrade performance;
• load or stress testing against production systems without SmartDry's prior written approval;
• deliberately generating abnormal traffic to avoid pricing, messaging, API or platform controls; or
• interfering with another Customer's use of the Services.

6. Reverse Engineering, Scraping and Competitive Misuse

Except to the extent a restriction cannot lawfully be imposed, the Customer must not:

• reverse engineer, decompile, disassemble or attempt to derive SmartDry source code or non-public proprietary logic;
• systematically scrape, crawl, harvest or extract data or content except through functionality, exports or APIs SmartDry expressly provides for that purpose;
• use SmartDry proprietary information, Documentation, outputs or non-public functionality to build, train or materially improve a competing product;
• remove or obscure proprietary notices;
• replicate SmartDry interfaces, workflows or protected product elements for unauthorised commercial exploitation; or
• attempt to reconstruct or infer confidential algorithms, security controls, model architecture or system prompts through repeated automated querying.

7. APIs, Integrations, Bots and Automation

The Customer may use SmartDry APIs and integrations only within the permissions, authentication methods, rate limits and technical requirements made available by SmartDry.

The Customer must not:

• use undocumented or unauthorised interfaces to bypass product restrictions;
• rotate credentials, IP addresses or accounts for the purpose of evading rate limits or abuse controls;
• configure an integration to access data beyond what is reasonably required for its authorised purpose;
• deploy bots or automated agents that materially impair system stability or create security risk;
• allow an integration provider to reuse Customer Data for an unrelated purpose without appropriate authority; or
• misrepresent the identity, source or permissions of an integration.

The Customer is responsible for integrations and automated workflows it configures or authorises, except to the extent the relevant issue is caused by SmartDry or a SmartDry-appointed Subprocessor.

8. Customer Data, Personal Data and Sensitive Information

The Customer must ensure it has appropriate rights and lawful authority to submit Customer Data to the Services and must use SmartDry data fields for their intended operational purposes.

Unless a SmartDry feature is expressly designed for the relevant information and the Customer has a lawful basis to process it, the Customer must not intentionally place the following in notes, garment descriptions, images, free-text fields or similar general-purpose areas:

• passwords, authentication secrets or private cryptographic keys;
• full payment-card numbers, card security codes (CVV/CVC) or magnetic-stripe/card-track data;
• government authentication credentials or copies of identity documents unrelated to the Services;
• special-category Personal Data or criminal-offence data that is unnecessary for the relevant garment-care or operational purpose; or
• Personal Data about individuals unrelated to the Customer's legitimate use of SmartDry.

The Customer must not use Customer Data or SmartDry functionality to unlawfully monitor, profile, discriminate against, harass or otherwise misuse information about an individual.

9. Garment Images, Video, Barcode and RFID Use

SmartDry may support garment photography, video, care-label capture, barcode, RFID, scanning and related identity or inspection functionality.

The Customer must not use these capabilities:

• to record or surveil individuals where the Customer lacks appropriate authority or notice;
• to track people, vehicles or unrelated property for purposes outside legitimate business operations;
• to deliberately alter or falsify a garment identity, barcode, RFID association, inspection record, condition record or issue history;
• to associate one customer's garment or records with another customer in order to conceal loss, damage or an operational error; or
• to create deceptive evidence concerning garment condition, intake, treatment, custody or collection.

10. Driver, Dispatch, GPS and Chain-of-Custody Records

Where the Customer uses SmartDry Driver, Dispatch, collection, delivery, proof-of-service or location functionality, it must use those features for legitimate operational purposes and in accordance with applicable employment, privacy and communications laws.

The Customer must not:

• use driver or device location data to track an individual outside legitimate work-related purposes or beyond what is lawful and proportionate;
• falsify collection, arrival, delivery, route, signature, photograph, timestamp, scan, bag, locker or chain-of-custody records;
• instruct personnel to fabricate proof of collection or delivery;
• use SmartDry to conceal loss, theft, unauthorised access to garments or another operational incident; or
• misrepresent the identity of a driver, recipient, collector or person completing an operational event.

11. Customer Communications, Marketing and Messaging

Use of SmartDry Connect, SMS, email, push notifications, WhatsApp or similar communication functionality must comply with Section 25 of the Master Terms and applicable Electronic Communications Laws.

The Customer must not use the Services to:

• send unlawful unsolicited marketing or spam;
• send marketing to a recipient where the Customer knows the required consent, soft opt-in or other permission is absent;
• use purchased, scraped or third-party contact lists where the Customer lacks lawful authority to use them;
• circumvent suppression lists, unsubscribe requests, opt-outs or messaging-provider restrictions;
• spoof or materially misrepresent the sender, origin, business identity or purpose of a communication;
• send phishing, fraudulent, deceptive, threatening or unlawful messages; or
• split, rotate or duplicate campaigns for the purpose of evading SmartDry or provider anti-abuse controls.

The Customer must not treat a SmartDry template, suggested workflow or product label as a guarantee that a particular communication is lawful.

12. Payments, Transactions and Fraud

Where payment functionality is available, the Customer must not use SmartDry to facilitate payment fraud, laundering of criminal proceeds, unauthorised card activity, false refunds, fabricated transactions or other unlawful financial activity.

The Customer must not knowingly:

• process transactions that do not correspond to legitimate business activity;
• create false orders or refunds to disguise the movement of funds;
• use SmartDry to test stolen payment credentials;
• store prohibited card-security information in SmartDry free-text fields or images;
• manipulate transaction, invoice or audit records to mislead SmartDry, a payment provider, customer, auditor or regulator; or
• circumvent restrictions imposed by an applicable payment-services provider.

13. Artificial Intelligence and Automated Features

AI and automation functionality must be used consistently with Section 16 of the Master Terms.

The Customer must not use AI-enabled features to:

• generate, facilitate or optimise malware, phishing, credential theft, fraud or other malicious activity;
• extract or attempt to reconstruct SmartDry Confidential Information, system prompts, model secrets, proprietary training information or another customer's data;
• submit data to an AI feature where the Customer lacks the rights or lawful authority required for that processing;
• circumvent a Shared AI Model opt-in authorisation control or misrepresent the Customer's opt-in state;
• automatically make or implement a business-critical decision where the Agreement requires appropriate human oversight and the Customer has not provided that oversight; or
• use automated outputs to unlawfully discriminate against, deceive or materially harm an individual.

Attempting to manipulate AI functionality through prompt injection, adversarial input or similar techniques is prohibited where the purpose or effect is to bypass security, access restrictions, confidentiality protections or another requirement of the Agreement.

14. Content and Conduct

The Customer must not upload, store, transmit or knowingly facilitate content through the Services where doing so is unlawful or materially infringes another person's rights.

This includes content that is:

• fraudulent, deceptive or defamatory in circumstances where its use is unlawful;
• unlawfully threatening, harassing or discriminatory;
• exploitative or abusive material whose possession, distribution or creation is prohibited by law;
• used to facilitate unlawful violence, trafficking, terrorism or other serious criminal activity;
• malicious code or instructions intended to compromise systems; or
• intellectual property, confidential information or Personal Data used without required authority.

SmartDry is a business operations platform and is not intended to be used as a public-content hosting or general-purpose file-storage service.

15. Intellectual Property and Third-Party Rights

The Customer must respect intellectual-property, confidentiality, privacy and other legal rights of SmartDry and third parties.

The Customer must not knowingly use the Services to store, reproduce, distribute or exploit material where it lacks the rights necessary to do so, or use third-party logos, images, databases, documents or software in a manner that materially infringes applicable rights.

Nothing in this Section prevents lawful use of material under an applicable licence, statutory exception or other legal right.

16. Anonymous, Aggregated and Benchmarking Information

Where SmartDry provides aggregated, anonymised, benchmark or industry-comparison information, the Customer must not deliberately attempt to:

• re-identify an individual from information presented as anonymous or aggregated;
• identify another SmartDry customer or location from Customer-non-identifiable benchmarking;
• combine SmartDry benchmark information with other datasets for the purpose of defeating anonymisation or confidentiality protections; or
• misrepresent benchmark information as identifying a particular competitor where SmartDry has not made that identification.

17. Hardware, Kiosks, Lockers and Connected Devices

Where SmartDry is used with Hardware, kiosks, lockers, scales, printers, scanners, cameras, payment devices or other connected equipment, the Customer must not:

• modify firmware, device configuration or security controls in a manner that creates a material security risk or violates applicable Hardware Terms;
• connect compromised or malicious devices to SmartDry;
• use a connected device to capture data unrelated to its legitimate operational purpose without appropriate authority;
• tamper with measurements, timestamps, scans or device-generated evidence in order to create a false operational record; or
• use SmartDry-managed Hardware for unlawful surveillance, fraud or unauthorised access.

18. Sanctions, Export Controls and Restricted Use

The Customer must not use the Services in a manner that would cause SmartDry or the Customer to violate applicable sanctions, export controls, trade restrictions or other binding legal restrictions.

The Customer must not knowingly use SmartDry to provide prohibited services, make prohibited funds or economic resources available, or facilitate a transaction where doing so is unlawful under an applicable sanctions regime.

SmartDry may restrict or suspend access where reasonably necessary to comply with a binding sanctions, export-control or other legal requirement, subject to the Agreement.

19. Attempts to Evade Controls

The Customer must not take steps designed primarily to evade this AUP, the Agreement or SmartDry security and abuse controls.

Examples include:

• creating duplicate accounts or identities to continue activity previously suspended for abuse;
• rotating IP addresses, API keys, sending domains or devices to evade rate limits or enforcement;
• disguising prohibited activity as legitimate operational traffic;
• asking another person or third-party service to perform prohibited activity on the Customer's behalf; or
• altering records or logs to conceal a breach.

20. Customer Cooperation

If SmartDry reasonably investigates a suspected material breach of this AUP, the Customer must provide reasonable cooperation and information relevant to the suspected breach, subject to applicable law and the Agreement.

The Customer must take reasonable remediation steps where SmartDry identifies a substantiated security, abuse or compliance issue caused by the Customer's environment, users or integrations.

Nothing in this Section requires the Customer to disclose legally privileged material or information unrelated to the relevant issue.

21. Monitoring and Investigation

SmartDry may use Service Data, security logs, abuse indicators, messaging metrics, access records and other information reasonably necessary to detect, prevent and investigate misuse of the Services.

Where investigation requires access to Customer Data, SmartDry will limit that access to what is reasonably necessary and process Personal Data in accordance with the Agreement, the DPA and applicable law.

SmartDry is not required to pre-screen all Customer Data or communications and does not assume responsibility for Customer-controlled content merely because technical systems transmit or store it.

SmartDry may preserve relevant evidence and cooperate with a competent authority where legally required or permitted.

22. Enforcement

Where SmartDry reasonably believes this AUP has been breached, SmartDry may take proportionate action according to the nature, severity, frequency and urgency of the issue.

Measures may include:

• requesting remediation or additional information;
• warning the Customer or affected Authorised User;
• blocking or suppressing a particular communication, file, integration, API token or automated process;
• rate-limiting or restricting abusive traffic;
• requiring credential resets or disabling compromised access;
• temporarily suspending an affected feature, user or account in accordance with Section 40 of the Master Terms; or
• terminating affected Services where permitted by the Agreement for an unremedied material breach.

SmartDry may act without prior notice where immediate action is reasonably necessary to protect security, platform integrity, other customers, third parties or legal compliance. Where appropriate and legally permitted, SmartDry will provide notice and an opportunity to remedy the underlying issue.

23. Reporting Misuse and Security Concerns

A Customer that becomes aware of suspected misuse, compromised credentials, unauthorised access or another material security concern affecting SmartDry should notify SmartDry promptly through the designated support or legal channel.

Formal legal notices may be sent to:

SmartDry Technologies Limited
3 Colndale Road Floor 1
Colnbrook
Slough
England
SL3 0HQ

Email: legal@smartdry.ai

Where SmartDry publishes a dedicated vulnerability-disclosure or security-reporting process, security researchers should use that process for technical vulnerability reports.

24. Changes to This AUP

SmartDry may update this AUP where reasonably necessary to address changes in law, security threats, technology, product functionality, abuse patterns or operational requirements.

Material changes affecting existing Customers will be handled in accordance with the change provisions of the Master Terms.

SmartDry will maintain a version number and effective date for published versions of this AUP and reasonable historical records identifying the version applicable to a Customer.

25. Relationship With Other SmartDry Terms

This AUP supplements and does not replace the Master Terms, DPA, Product-Specific Terms, Hardware Terms, Payment Services Terms or other incorporated documents.

If this AUP conflicts with another part of the Agreement, the order-of-precedence provisions in Section 3 of the Master Terms apply.

A breach of this AUP may constitute a breach of the Agreement and may result in suspension or termination only in accordance with the applicable contractual provisions and law.

SmartDry Technologies Limited

Company Number: 17302780

© 2026 SmartDry Technologies Limited. All rights reserved.