Structum AI Acceptable Use Policy

Effective Date: October 1, 2026

Last Updated: October 1, 2026

This Acceptable Use Policy (“AUP”) is part of the Structum AI Terms of Service. It describes what Customers and Authorized Users may not do with the Services and what data they may not put into them. Capitalized terms not defined here have the meanings given in the Terms of Service (the “Terms”). Customer is responsible for compliance with this AUP by every Authorized User, collaborator, integration, and AI Client it connects, and for any use of its accounts or credentials.

1. Scope

This AUP applies to all access to and use of the Services, including through the web application, the API, the MCP Server, integrations, AI Clients, and communications sent through the Services. Structum may update this AUP as described in the Terms. Where this AUP is stricter than the Terms, this AUP controls for the conduct it addresses.

2. Prohibited Data

The Services are designed for construction project records and ordinary business information. Unless an Order Form, DPA, or other signed writing from Structum expressly authorizes it and the required configuration is in place, Customer will not upload, submit, connect, transmit, or cause the Services to process any of the following (“Prohibited Data”):

• Protected health information regulated by the Health Insurance Portability and Accountability Act, or any medical, mental-health, or substance-use-disorder record, other than an incidental reference in an incident, safety, or daily-log record that Customer is required to keep and has the right to process.

• Payment-card data, including full primary account numbers, card-verification codes, magnetic-stripe or chip data, and PINs, and bank account credentials (online-banking usernames and passwords). Invoices and records that show a masked card number or a routing and account number that Customer is authorized to hold are not Prohibited Data, but Customer is responsible for their handling.

• Government-issued identification numbers (Social Security numbers, taxpayer identification numbers, driver’s-license numbers, passport numbers) of any individual, except to the extent a specific feature is designed to accept them, Customer has authority to process them, and Customer limits them to what the applicable workflow requires (for example, the last four digits on a certified-payroll record).

• Credentials of third parties, including passwords, API keys, tokens, or private keys belonging to any person or system other than Customer’s own credentials for the Services and for integrations Customer is authorized to connect.

• Classified information, criminal-justice information subject to CJIS requirements, controlled unclassified information requiring specialized controls, and technical data subject to the International Traffic in Arms Regulations or requiring an export license.

• Biometric identifiers used or intended to be used to identify an individual (facial-recognition templates, fingerprints, voiceprints). Ordinary project photos, videos, and meeting recordings are not Prohibited Data, but Customer will not use the Services to identify individuals from them.

• Consumer-report information governed by the Fair Credit Reporting Act, background-check results, and credit information about individuals.

• Children’s data collected online from a child under 13, or any data regarding minors that requires parental consent Customer has not obtained.

• Data Customer is not authorized to process, including documents subject to a confidentiality obligation that prohibits disclosure to service providers, documents obtained in breach of another person’s rights, and information covered by a court order or protective order that does not permit processing by a cloud service.

• Malicious code, including malware, viruses, ransomware, and files designed to exploit the Services or any system.

Structum may scan uploads for malware and for indicators of Prohibited Data, may quarantine or delete Prohibited Data, and may suspend accounts that repeatedly submit it. Unauthorized submission of Prohibited Data does not expand Structum’s obligations or create any obligation inconsistent with the Agreement.

3. Authority for Information About Others

Much of what the Services process is information about people and organizations other than Customer: owners, design professionals, subcontractors, suppliers, vendors, inspectors, employees, and project personnel. Customer will:

• upload or connect information about a person or organization only where Customer has the legal right to do so, including under the contracts, notices, and consents that govern Customer’s relationship with that person;

• provide any notice required by law to its own personnel and to project participants regarding the collection, monitoring, recording, transcription, and processing of their information through the Services, including for meeting transcripts, daily logs, timekeeping, and location-bearing photos;

• upload a recording only if it was made lawfully with any consent required in every jurisdiction where a participant was located;

• process certified-payroll, prevailing-wage, workforce, immigration-related, and union information only where Customer has authority and limits access to personnel who need it;

• not enter a vendor’s or subcontractor’s pricing, proposals, insurance, or other confidential information into the Services in breach of a non-disclosure or confidentiality obligation owed to that vendor; and

• respond to any request from an individual concerning information Customer has placed in the Services, as the Terms and the Privacy Notice describe.

4. Prohibited Conduct

Customer will not, and will not permit any Authorized User, collaborator, integration, or AI Client to:

4.1 Unlawful, Infringing, or Harmful Use

• use the Services in violation of any law, regulation, court order, or the rights of any person;

• upload, store, or transmit content that infringes or misappropriates any copyright, patent, trademark, trade secret, or other right, including drawings, specifications, or proposals Customer is not licensed to reproduce;

• use the Services to defraud, deceive, or mislead any owner, lender, surety, authority, vendor, or other person, including by altering documents, fabricating records, backdating, or misrepresenting Outputs as verified or professionally certified work;

• facilitate bid rigging, bid rotation, complementary bidding, price fixing, market allocation, or any other anticompetitive conduct, or share a competitor’s confidential pricing or bid information obtained through the Services;

• use the Services to make or support decisions about individuals that the AI Terms prohibit, or to discriminate unlawfully against any person;

• harass, threaten, defame, or abuse any person, or transmit content that is obscene, hateful, or incites violence; or

• use the Services to monitor employees or other individuals in a manner that violates applicable employment, labor, wiretap, or privacy law.

4.2 Security and Integrity

• probe, scan, or test the vulnerability of the Services or any related system without Structum’s prior written authorization;

• breach or circumvent any authentication, authorization, rate-limiting, permission, or confirmation control, including the human-confirmation controls for assisted and automated actions;

• access any account, project, tenant, or data that Customer is not authorized to access, or attempt to do so;

• introduce malware or interfere with the operation of the Services, including by denial-of-service, excessive load, or abusive automation;

• share accounts or credentials among individuals, or allow a departed person to retain access; or

• misrepresent the identity of the sender, source, or origin of any communication or request.

4.3 Misappropriation and Competitive Use

• copy, scrape, crawl, or bulk-export content from the Services other than Customer’s own Customer Content and Outputs through the tools and API Structum provides;

• reverse engineer, decompile, or attempt to derive the source code, models, prompts, weights, schemas, or methods of the Services;

• use the Services, Outputs, or Documentation to develop, train, benchmark for publication, or improve a product or service that competes with the Services;

• resell, sublicense, or provide the Services to third parties, or operate them as a service bureau, other than for collaborators and Vendor Recipients on Customer’s own projects as the Terms permit; or

• remove or alter any proprietary notice, or use the STRUCTUM AI™ marks without permission.

5. Communications Sent Through the Services

Customer will:

• send communications through the Services only to recipients Customer has the right to contact for the purpose of the communication, and only for legitimate project, procurement, and business purposes;

• not use the Services to send unsolicited commercial email, bulk marketing, or promotional text messages, and not send any text message to a recipient who has not opted in to receive messages from Customer;

• honor every opt-out or unsubscribe request, whether recorded by the Services or communicated directly to Customer, and not re-add a recipient who has opted out;

• ensure that every communication accurately identifies Customer as the sender and does not use deceptive subject lines, headers, or content;

• review every drafted communication before it is sent, and monitor and stop automated follow-ups when they are no longer appropriate; and

• comply with the CAN-SPAM Act, the Telephone Consumer Protection Act, state messaging and telemarketing laws, and carrier and messaging-provider policies, which Structum may enforce by suspending sending privileges.

6. Integrations, API, MCP Server, and AI Clients

Customer will:

• connect only Third-Party Services and AI Clients that Customer is authorized to use, using accounts and credentials that belong to Customer, and grant only the scopes and permissions the intended feature requires;

• comply with the terms of each Integration Provider and AI Client provider, including the Google API Services User Data Policy and Microsoft’s developer terms as they apply to Customer’s connected accounts;

• keep API keys and MCP authorizations confidential, rotate them when personnel change, and revoke connections that are no longer needed;

• respect documented rate limits and not use the API or MCP Server in a way that degrades the Services for others;

• not use the API or MCP Server to bypass the Services’ permission model, confirmation controls, or usage limits, or to bulk-extract data for use in a competing product;

• not connect an AI Client that Customer knows or should know retains or trains on Customer Content in a manner inconsistent with Customer’s obligations to third parties; and

• not configure an AI Client or automation to act on content from third-party documents without human review, in light of the prompt-injection risk described in the AI Terms.

7. AI Features

The prohibited uses of AI Features in Section 9 of the AI Terms are part of this AUP. In addition, Customer will not use AI Features to generate content that Customer represents to any third party as having been prepared, reviewed, sealed, or certified by a licensed professional when it was not, and will not attempt to induce an AI Feature to produce content that violates this AUP.

8. Customer Security Obligations

Customer will: enable multi-factor authentication for its administrators and, where offered, all Authorized Users; assign the minimum permissions each Authorized User, collaborator, integration, and AI Client needs; review permissions and connections at least quarterly and upon personnel changes; promptly deactivate access for departed personnel; maintain reasonable security on the devices and networks used to access the Services; not store Structum credentials in unsecured locations; and report any suspected compromise of an account, credential, integration, or AI Client connection to security@structumai.io without delay.

9. Public-Sector Work and Regulated Projects

If Customer uses the Services for a public project or on behalf of a public entity, Customer is responsible for compliance with the procurement, public-records, audit, retention, prevailing-wage, certified-payroll, and disclosure requirements that apply, and will not use the Services in a way that violates them. Customer will notify Structum in writing before submitting to the Services any data whose handling is subject to a specific government security or retention requirement that Structum has not agreed to in writing.

10. Monitoring and Enforcement

Structum may, but has no obligation to, monitor use of the Services for compliance with this AUP, including through automated scanning of uploads, communications, API and MCP activity, and Outputs for malware, abuse, and security indicators. If Structum reasonably believes that Customer or an Authorized User has violated this AUP, Structum may, with or without notice depending on the severity and urgency: warn Customer; remove, quarantine, or disable access to the offending content, communication, integration, or AI Client connection; suspend sending privileges, API or MCP access, or the affected accounts; suspend or terminate the Agreement under the Terms; and report the conduct to law enforcement or affected third parties where Structum reasonably believes it is required or appropriate to do so. Structum will use reasonable efforts to notify Customer and to limit any suspension to the affected portion of the Services. Fees continue to accrue during a suspension caused by Customer.

11. Reporting Violations

Report suspected violations of this AUP, security concerns, or abuse to security@structumai.io. Send notices of claimed copyright infringement to legal@structumai.io with the subject line “DMCA Notice,” including the information required by 17 U.S.C. § 512(c)(3). Do not include Prohibited Data or unnecessary Personal Information in a report.

12. Changes

Structum may update this AUP as described in the Terms. Material changes will be posted with a new Last Updated date and notified to Customer’s administrators. Continued use of the Services after a change takes effect constitutes acceptance.