Acceptable Use Policy

Tomtar builds assistants that act on your behalf. That is useful, and it is also why

there have to be limits: an assistant that contacts people is contacting real people,

and they did not agree to anything.

This policy applies to what you build, what you ask an assistant to do, and what you

approve it to send.

The rule underneath all of it

**An assistant may contact people who would expect to hear from you, about the thing

they expected to hear about.**

Your customers, your patients, your clients, people who filled in your form or asked you

for a quote. Not a list you bought. Not people who once gave you their details for

something else entirely. Consent is scoped to the purpose it was given for.

If you would be uncomfortable telling the recipient how your assistant got their address,

that is the answer.

Not allowed

Contacting people who did not ask to hear from you

Messaging lists that were scraped, bought, harvested, or collected for a different

purpose.

Bulk outreach to people who have no existing relationship with you.
Continuing to contact someone who has asked you to stop.
Volumes that only make sense as a mailshot.

Watching individuals

Monitoring, tracking or profiling a named person — their accounts, posts, movements,

or who they associate with.

Building a picture of someone's life from public sources.

Watching your own business — your reviews, your mentions, your numbers, your inbox —

is entirely fine and is most of what people use this for. What makes monitoring

unacceptable is a specific person as its subject.

Pretending to be someone, or something, you are not

Presenting an assistant as a human when messaging someone who has not been told.
Impersonating a real person, a company, or an official body.
Removing or suppressing the disclosure that a message came from an assistant, where

that disclosure is required.

Deception and harm

Fraud, phishing, or anything designed to mislead someone into acting against their

interest.

Harassment, threats, or intimidation.
Collecting credentials or personal data by pretence.
Content that sexualises children, incites violence, or targets people for who they are.

Breaking other people's rules

Accessing systems you are not authorised to access.
Scraping in breach of a site's terms.
Using a connected account in ways that provider forbids.

Regulated work we are not set up for

Health data. No patient records, diagnoses, or anything else that would make this

a HIPAA business associate arrangement. We have no BAA with you or our processors.

Financial, legal or medical advice presented as coming from a qualified person.
Credit, insurance, housing or employment decisions about individuals.

Text messaging, specifically

If you send SMS to numbers in the United States, you are responsible for prior express

written consent under the TCPA, for honouring opt-outs, and for A2P 10DLC registration.

The exposure for getting this wrong is $500–$1,500 per message. We will not carry it

for you.

What we do about it

The product refuses some of this by design. The Architect will not build an agent for a

scraped list, and the permission gates stop an assistant sending to people it should not.

Those are guardrails, not a licence to try — and they are not the whole of this policy.

If we believe an account is breaking this policy we may suspend the assistants involved,

suspend the account, or close it. Where we can, we will tell you what and why first, and

give you a chance to put it right. For anything involving harm to other people we will

act first and explain afterwards.

We are not obliged to monitor what your assistants do, and mostly we do not. Nothing here

makes us responsible for what you approve.

Telling us

If an assistant built on Tomtar has contacted you and you would rather it did not, or

you think something here is being broken, write to hello@tomtar.ai. Every

message an assistant sends is required to give recipients a way to report it.

Last updated: 7 August 2026

Terms Privacy Acceptable use