Acceptable use policy

This policy is part of our terms of service. It applies to everyone who uses AgoraScan, including free scans, accounts, the embeddable website scanner, white-label reports and the API.

• Websites you own or run.
• Websites you've been asked or permitted to assess, for example by a client or employer.
• Other public websites where you have a legitimate reason, such as researching competitors or deciding whether to approach a business as a prospective client, provided you follow the rest of this policy.

Only submit addresses of public pages. Don't submit pages that need a sign-in, private or secret links (for example, password reset, order or document links), intranets, or pages you know contain confidential information or sensitive personal data such as health records.

We refuse adult, gambling and similar websites, government and NHS websites, sign-in pages, websites of Grid Design and its clients, and websites whose owners have asked us not to scan them. Don't try to get around these restrictions, for example by using redirects, shortened links or mirror sites.

• Use AgoraScan to test, attack, overload, probe for weaknesses in, or get unauthorised access to any website, server or network, including ours.
• Submit internal, private or local network addresses, or try to make our scanner reach systems that aren't public.
• Run large numbers of scans automatically, scrape our reports or rule library, or get around free-scan limits with multiple accounts, scripts or proxies. Use the API or a business plan for volume.
• Copy, reverse engineer or resell AgoraScan, or use our reports, rules or outputs to build a competing product or train an AI model.
• Publish or share a report about someone else's website in a way that is misleading, for example by editing it, presenting it as a certification or as a statement of fact about a business, or using it in advertising that compares you with a competitor without meeting advertising rules.
• Use reports or the website scanner to harass, threaten or defame anyone.
• Send spam or unlawful marketing using leads from the website scanner, or use the scanner without telling visitors who you are and how you'll use their details.
• Upload unlawful, infringing, offensive or misleading content as your branding.
• Interfere with other users, or with the security or running of AgoraScan.
• Use AgoraScan in breach of sanctions or export controls, or if you're a person or organisation subject to UK, EU, UN or US sanctions.
• Break any law while using AgoraScan.

Our scanner loads public pages like a normal visitor. It identifies itself as AgoraScan in its user agent. If you want a report about your website removed, or don't want it scanned again, email hello@agorascan.ai with your website address and any report links. We'll check you're connected to the site, remove public free reports of it where appropriate, and add it to our do-not-scan list.

To report misuse of AgoraScan, a report you think is unlawful, or illegal content in a user's branding, email hello@agorascan.ai with the link, why you think it breaks the law or this policy, your name and email, and a statement that your report is accurate and made in good faith. We'll confirm we've received it, decide promptly and tell you what we did. If we remove content or restrict an account, we'll tell the user why and how to challenge the decision, unless the law prevents us.

Authorities and users can contact our single point of contact for the EU Digital Services Act at hello@agorascan.ai in English. [Our legal representative in the EU is [name and address], if appointed.]

If you break this policy, we may refuse scans, remove reports, limit your account, suspend or close it, and where appropriate report unlawful activity to the authorities. We'll act in proportion to how serious the breach is and, where reasonable, warn you first. Business customers are responsible for their team members' use.