E-LEMENTO — ACCEPTABLE USE POLICY (AUP)

1. Purpose, scope and contractual relationship

1.1. This Acceptable Use Policy (AUP) sets objective conditions for the safe and lawful use of the E-lemento SaaS platform, including accounts, administrative areas, dynamic QR Codes, redirect URLs managed by E-lemento, files, images, content, automation, integrations and associated services, where available.

1.2. It applies to individual and corporate customers, representatives, administrators, guests and other authorized users. The person responsible for the Account must communicate these rules to users under their management and take reasonable steps to ensure compliance, without assuming liabilities not provided for by law.

1.3. It forms part of the Terms of Use when made available before acceptance and incorporated into them. In the event of a conflict, applicable law and the Terms of Use prevail, followed by specific commercial conditions validly agreed on the matter, subject to consumer protection. The Privacy Policy governs information on personal data processing.

1.4. E-lemento provides infrastructure for creating, managing and redirecting QR Codes; it does not endorse products, offers, landing pages or messages created by the Customer. Merely providing the tool does not imply editorial approval of content.

2. General principles and Customer duties

2.1. The Customer shall use the service in accordance with the law, the objective duty of good faith, the Terms, purchased offers, communicated security instructions and third-party rights.

2.2. The Customer is responsible for obtaining the applicable rights of use, licenses, authorizations and legal bases for content and data they choose to incorporate or disclose. They must not lead visitors to believe that a promotion, institution, authority, brand or person has endorsed a particular QR Code without authorization.

2.3. Public information, identifiers and destinations must be consistent with what the QR Code promises the user. Destination changes must not be used to deceive readers or secretly redirect them to fraud, malware or illegal content.

2.4. The Customer must maintain reasonable controls over the Account, collaborators, permissions, integrations and credentials. Upon identifying a compromise, they must stop using affected credentials, report the incident and cooperate with mitigation, without unnecessarily exposing data.

3. Fraud, social engineering and malicious content

3.1. Creating, promoting or distributing QR Codes, pages, messages, files or redirects intended for the following is prohibited: (a) phishing, credential theft and fraudulent social engineering; (b) malware, ransomware, spyware or code that compromises devices; (c) cloning pages to impersonate a bank, authority, brand or person without authorization; (d) deceptive transactions, fraudulent schemes, false promotions or unauthorized charges; (e) improper acquisition of personal data, authentication codes, card details or secrets; (f) compromising systems or facilitating unauthorized access.

3.2. Shortening or hiding destinations to circumvent security filters, blocklists, provider restrictions or legitimate moderation decisions is also prohibited, as is chaining redirects for unlawful or deceptive purposes.

3.3. E-lemento may use proportionate measures to prevent and detect abuse, subject to transparency, data minimization and privacy obligations. Automated detection may produce false positives and shall be subject to appropriate review.

4. Illegal activities, third-party rights and risky content

4.1. Using the Platform to facilitate, publish or distribute material that is unlawful under applicable law is prohibited, including unlawful advocacy or threats of violence, child sexual exploitation, extortion, illegal sale of goods and services, intellectual property infringement, invasion of privacy and unauthorized disclosure of data.

4.2. Trademarks, trade names, photographs, visual identities or protected works must not be used without a license or another applicable legal basis; nor may third-party confidential information obtained improperly be disclosed.

4.3. Campaigns involving legally regulated activities — for example, financial services, healthcare, medicines, gambling, age-restricted products and fundraising — must comply with sector legislation, advertising rules and authorization requirements, including payment provider rules where applicable. Using the Platform does not replace licenses or authorizations.

4.4. E-lemento does not generally prohibit opinions, journalistic information, legitimate criticism, lawful competition or ordinary activities protected by law. Content restrictions must have an identifiable basis and be applied proportionately, including where a report is disputed.

4.5. Sensitive data and data concerning children or teenagers must not be exposed through a public QR Code without a legitimate purpose, an appropriate legal basis and suitable protective measures. Simply possessing a public QR Code is not presumed to prevent access by third parties.

5. Spam, advertising and unsolicited communications

5.1. The Customer shall not use QR Codes and associated features for spam, unsolicited bulk messaging, misleading advertising, fabricated opt-ins, concealed consent collection or data collection without transparency.

5.2. Under these Terms, E-lemento does not provide a service certifying the legality of campaigns. The Customer must comply with advertising, telecommunications, consumer and data protection rules and the rules of the channels used for distribution.

6. Systems, security and authorized research

6.1. Without prior authorization or a mandatory legal basis, the following are prohibited: (a) attempting to access third-party accounts, databases, private APIs or infrastructure; (b) exploiting or disclosing vulnerabilities involving data exfiltration or service disruption; (c) conducting intrusive scans, load tests, brute-force or denial-of-service attacks; (d) bypassing authentication, billing, rate limits, permission controls or other legitimate barriers; (e) introducing malicious code; (f) manipulating records, metrics, counters or events.

6.2. Researchers may report flaws through the official channel. Responsible reporting does not grant general authorization to exploit vulnerabilities, establish persistence, extract data or access third-party accounts. Any formal coordinated disclosure program requires a specific publication.

6.3. E-lemento may impose technical security controls and require credential changes, token revocation or temporary blocking of exposed access where proportionate and necessary.

7. Protection of software, trade secrets and platform data

7.1. Improperly accessing or reproducing source code, trade secrets, non-public architecture, internal mechanisms, protected databases, authentication, confidential business models or other exclusive E-lemento assets is prohibited.

7.2. Without authorization or a legal right, the following are prohibited: unlawful reverse engineering, decompilation outside statutory exceptions, abusive scraping or crawling, systematic replication of non-public databases, resale of access, creation of a white-label environment not covered by a contract, and use of improperly extracted protected material to clone substantial parts of the service.

7.3. This clause does not seek to prevent legally permitted interoperability, authorized research, analysis of public information, independent development, observation of unprotected features, lawful competition or the exceptions under Brazilian Law No. 9,609/1998.

7.4. Rights to Customer content remain with their respective holders, as provided in the Terms of Use. E-lemento does not claim ownership of trademarks, texts, artwork or documents lawfully made available by the Customer.

8. Automation, traffic, limits and resource use

8.1. Limits on plans, storage, downloads, capacity, users, QR Codes, API calls and other resources are those disclosed in the offer, dashboards and technical specifications actually made available. The AUP does not create secret or retroactive numerical limits.

8.2. Scripts, bots, distributed systems or automated calls must not be used with the intent or demonstrable effect of overloading resources, circumventing limits, falsifying metrics, multiplying accounts to avoid charges, harming other users or compromising availability and security.

8.3. Officially authorized integrations and automation are permitted within the published conditions. Automation alone is not a violation when contractually permitted and performed without abuse.

8.4. In the event of technically abnormal consumption or an incident, E-lemento may apply proportionate mitigation, temporary restrictions, rate limiting or quarantine, or request operational adjustments, preferably after notice where this would not increase risk. Permanent limitations on a contracted essential feature shall comply with the Terms, the offer and legal rights.

8.5. High legitimate traffic and campaigns with a large audience do not, by themselves, constitute abuse. For foreseeably exceptional operations, prior contact for capacity planning is recommended; the absence of such contact does not remove E-lemento’s legal obligations.

9. QR Code integrity, printing and redirects

9.1. The Customer must test the final QR Code’s readability, domain, destination and operation before printing, distribution or large-scale production. The Platform does not, by itself, guarantee advertising results, conversion, compatibility with every camera or the continued operation of third-party systems.

9.2. Redirects must not be used to replace an apparently legitimate destination, after distribution, with a fraudulent, dangerous or materially misleading page, or to conceal violations identified by providers, rights holders or authorities.

9.3. QR Codes may stop redirecting in circumstances provided for in the Terms — for example, closure, archiving, lawful suspension or deletion. The contractual obligation concerning availability of the core feature, where applicable, remains governed by section 11 and Annex I of the Terms, including the limited 97% commitment and commercial credits.

10. Personal data, tracking and confidentiality

10.1. The Customer must not create QR Codes whose destinations collect personal data unlawfully, deceptively or inconsistently with the information provided to the data subject. The Customer must comply with the LGPD and applicable rules, including those concerning children, sensitive data, transparency and security.

10.2. E-lemento’s collection of scan metrics, IP addresses and device signals is described in the Privacy Policy. The Customer must not automatically assume that statistics identify unique people or prove an acquisition, purchase or physical presence.

10.3. Publishing passwords, tokens, full payment details, medical records or confidential information in QR Codes or publicly accessible pages without adequate controls and legal grounds is prohibited.

10.4. Instructions for processing data on behalf of business customers may be detailed in a specific DPA. The AUP does not automatically change the legal roles of controller and processor or release E-lemento from its own duties.

11. Integrity of reviews, statistics and AI use

11.1. Generating artificial visits or fraudulently manipulating counters, metrics or campaign evidence, including to mislead third parties, is not permitted.

11.2. Using or attempting to use the AI assistant to obtain unauthorized data, exploit vulnerabilities, automate fraud, generate unlawful operational instructions or circumvent permissions is prohibited. This includes manipulating messages, attachments, links or other content to make the assistant ignore its security restrictions, reveal non-public internal instructions, credentials, secrets or data from other accounts, or perform actions outside the user’s permissions, including through prompt injection. Using AI, scripts or external agents does not waive these rules.

11.3. The assistant’s availability and limits depend on the offer and the features actually enabled. Requesting an action from the assistant does not grant additional permission or waive authentication, required confirmation, quotas or usage limits. This Policy does not authorize unrestricted model training with customer data or promise accurate results.

11.4. Artificial or repetitive consumption of the assistant with the intent or demonstrable effect of exhausting resources, generating abusive costs, harming other users or circumventing limits is prohibited, including by multiplying accounts, sessions or automated requests. Legitimate use within the published conditions does not, by itself, constitute abuse.

11.5. The user must review a proposal before confirming an assisted action, especially QR Code data and destinations. AI outputs require human review where they may affect rights, people or sensitive operations. Mandatory confirmations cannot be replaced by instructions intended to bypass them.

11.6. Indications of assistant abuse may lead to temporary limitations, interruption of requests, suspension of credentials or other proportionate measures under section 13, preserving necessary evidence and the opportunity to contest the measure. Data processing during such investigations shall comply with the Privacy Policy.

12. Reports and abuse assessment

12.1. Reports may be sent to info@e-lemento.com with the subject “Abuse/Security”, including, where possible, the URL/QR Code, an objective description, approximate date and lawfully obtained evidence. Do not send passwords, full card details, unnecessary documents or unnecessary personal data concerning third parties.

12.2. Reports shall be assessed according to plausibility, severity, urgency, available evidence, the possibility of fraud and the impact on the parties’ rights. E-lemento may request additional information and preserve relevant records within the applicable legal bases and retention periods.

12.3. A report alone does not prove a violation. Where appropriate and safe, the affected Customer may provide explanations or a challenge through support, without prejudice to immediate measures in the event of a serious risk or legal order.

12.4. Copyright or trademark infringement notices must identify the claimed right, the work or mark, the disputed content, its location and available evidence of ownership. Content removal and liability shall comply with applicable law, including any specific judicial requirements under Brazil’s Internet Civil Framework.

13. Response measures and suspension

13.1. Depending on risk and severity, E-lemento may: issue a warning; require a correction; limit abusive traffic; disable a specific QR Code or destination; temporarily suspend features or credentials; preserve evidence; block risky content; terminate the contract for cause where appropriate; or cooperate with orders and competent authorities.

13.2. Measures must seek the least reasonable impact sufficient to mitigate the risk. Preventive restrictions do not amount to a final finding of fault, and E-lemento may review them following additional verification or a substantiated challenge.

13.3. Notice shall be given in advance where possible and safe. It may be given afterwards in urgent cases involving fraud, malware, data exposure, threats to infrastructure, legal orders or risks to third parties. Measures and notices shall comply with applicable law and any duties to preserve evidence.

13.4. Lawful suspension arising from a Customer violation does not, by itself, generate commercial compensation for interruption of the suspended resources; mandatory rights and E-lemento’s own liabilities remain preserved. E-lemento may not characterize downtime for which it is responsible as a Customer violation without grounds.

14. Contractual consequences and remedies

14.1. Proven violations may justify measures to stop or remedy the violation, proportionate contract termination, removal requests, compensation for actual damages and the exercise of statutory rights, where applicable.

14.2. The AUP does not establish automatic fines, unspecified financial penalties, indiscriminate forfeiture of amounts paid or an obligation to compensate unproven allegations. Liability shall be subject to causation, evidence, legal limits and the provisions of the Terms of Use.

14.3. Any distinct B2B contractual clause limiting E-lemento’s liability remains governed exclusively by the Terms; it does not limit administrative fines, data subjects’ rights or other mandatory obligations.

15. Updates, communication and validity

15.1. E-lemento may update this AUP to reflect security risks, technologies and legal requirements. Material changes affecting contractual obligations shall be communicated in accordance with section 22 of the Terms of Use and shall not apply retroactively where prohibited.

15.2. Publication of this Policy alone does not establish acceptance or retroactively change contracted conditions. Recording the accepted version, making the text available in advance and documenting changes must be part of the operational process.

15.3. Brazilian law and the dispute resolution methods provided in the Terms apply, preserving access to consumer protection bodies, ANPD and the courts where applicable.