Acceptable Use Policy

Version 1.0 · Effective May 2026

Konductro (Pty) Ltd · konductro.com · legal@konductro.com

This Acceptable Use Policy applies to all users of the Konductro Platform. It is incorporated by reference into the Master Subscription Agreement and governs the conduct of the Customer and all Authorised Users.

1. Purpose and Scope

This Acceptable Use Policy ("Policy") sets out the rules and standards that apply to all use of the Konductro platform, website, and related services (collectively the "Platform"). It applies to:

• The Customer — the organisation that subscribes to the Platform under the Master Subscription Agreement ("MSA")
• All Authorised Users — any employee, contractor, or agent of the Customer who accesses the Platform
• Any individual who accesses konductro.com or platform.konductro.com

The Customer is responsible for ensuring that all of its Authorised Users are aware of and comply with this Policy. A breach of this Policy by an Authorised User is treated as a breach by the Customer.

This Policy forms part of the MSA and is incorporated by reference. Defined terms in this Policy bear the meanings assigned in the MSA.

2. Permitted Use

The Platform may be used only for the following purposes:

• Managing and orchestrating software delivery workflows within the Customer's organisation
• Planning, decomposing, assigning, and tracking software development work
• Using the Conductor AI assistant to assist with requirements, architecture, ticket generation, and related delivery tasks
• Integrating the Platform with supported tools (Azure DevOps, GitHub, Bitbucket, Microsoft Teams) in accordance with the Platform documentation
• Conducting code reviews, quality assurance activities, and sprint retrospectives
• Facilitating optional client UAT workflows with the Customer's own clients

All use must comply with applicable South African law, the MSA, and this Policy.

3. Prohibited Conduct

3.1 Unlawful and Harmful Activities

You must not use the Platform to:

• Engage in any activity that is unlawful under South African law or the laws applicable in any jurisdiction in which you operate
• Harass, threaten, defame, or harm any person
• Transmit, store, or process child sexual abuse material or any content that sexually exploits minors
• Facilitate any form of discrimination on the basis of race, gender, religion, disability, sexual orientation, or any other protected characteristic
• Process or store material that constitutes hate speech, incitement to violence, or terrorism-related content
• Commit or facilitate fraud, identity theft, phishing, or other deceptive practices

3.2 Platform Integrity

You must not:

• Attempt to gain unauthorised access to any part of the Platform, any other user's account, or any connected system
• Probe, scan, or test the vulnerability of the Platform or any connected system without the Provider's express prior written consent
• Introduce malware, viruses, Trojan horses, worms, or any other harmful code
• Circumvent, disable, or interfere with any security features, access controls, or usage monitoring
• Use automated bots, scrapers, or crawlers to access or extract data from the Platform except through officially supported APIs
• Reverse engineer, decompile, disassemble, or attempt to derive source code from the Platform
• Attempt to circumvent the AI Usage Cap through artificial means, including creating multiple accounts or artificially inflating or deflating usage data

3.3 AI and Conductor-Specific Restrictions

You must not use the Conductor AI assistant or any AI-generated output from the Platform to:

• Generate, distribute, or store content that is unlawful, harmful, defamatory, obscene, or in violation of any third-party rights
• Create deepfakes, synthetic media, or misleading content that misrepresents real people or events
• Develop weapons, malware, exploit code, or any tool designed to cause damage to systems, infrastructure, or people
• Attempt to extract, reverse engineer, or replicate the underlying AI models, training data, or weights used by the Conductor assistant
• Use AI-generated outputs from the Platform as training data for any competing AI model or system without the Provider's express written consent
• Represent AI-generated content as independently authored human work in circumstances where that representation is fraudulent or misleading
• Attempt to 'jailbreak' the AI assistant — that is, to manipulate it into bypassing its safety guidelines or operational parameters
• Submit prompts designed to extract confidential information about the Platform's AI infrastructure, system prompts, or internal configuration

3.4 Data and Privacy Violations

You must not use the Platform to:

• Process personal information in violation of POPIA or any other applicable data protection law
• Collect, process, or store Special Personal Information (as defined by POPIA, including health data, race, religion, and similar categories) without explicit consent and without notifying the Provider
• Process personal information of individuals who have not been informed that their data is being processed through the Platform
• Use the Platform's work activity and delivery data (cycle times, QA failure rates, developer performance metrics) to make employment decisions, disciplinary actions, or retrenchments without: (a) conducting a separate, independent assessment; and (b) complying with the Labour Relations Act and all applicable employment law
• Share Customer Data with third parties without appropriate authorisation

3.5 Intellectual Property

You must not use the Platform to:

• Infringe the intellectual property rights of any third party, including submitting source code or documentation to which the Customer does not have appropriate rights
• Remove, obscure, or alter any copyright, trademark, or proprietary notice in the Platform
• Create derivative works of the Platform or any component thereof
• Use Konductro's name, logo, or trademarks without express written authorisation

3.6 Resource Abuse

You must not:

• Use the Platform in a manner that unreasonably burdens the Provider's infrastructure or degrades performance for other customers
• Conduct load testing, stress testing, or penetration testing against the Platform without prior written authorisation from the Provider
• Mine cryptocurrency or use Platform compute resources for any purpose other than the contracted services

4. User Responsibilities

4.1 Account security. Each Authorised User is responsible for maintaining the confidentiality of their login credentials. You must not share your credentials with any other person. You must notify the Provider immediately at security@konductro.com if you suspect your account has been compromised.

4.2 Access control. The Customer is responsible for ensuring that only current, active employees and contractors are provisioned as Authorised Users. The Customer must promptly deprovision users who leave the organisation or change roles.

4.3 Accuracy of information. You are responsible for the accuracy and legality of all information and Customer Data you submit to the Platform, including requirements, architecture decisions, and acceptance criteria.

4.4 Integration configuration. If you connect the Platform to third-party systems (including Azure DevOps, GitHub, or Microsoft Teams), you are responsible for ensuring those integrations are configured correctly and that you have the necessary permissions and authorisations from those systems.

4.5 AI review obligation. AI-generated outputs from the Conductor assistant must be reviewed and validated by a qualified human before being relied upon for architectural, technical, commercial, or legal decisions. You may not rely solely on AI-generated content without independent verification.

4.6 Labour and employment. If the Platform's reporting and analytics features are used in the context of employee performance, the Customer is solely responsible for compliance with the Labour Relations Act 66 of 1995, the Basic Conditions of Employment Act 75 of 1997, and all applicable employment law.

4.7 Platform Metrics Data. By using the Platform, the Customer acknowledges that Konductro collects and processes Platform Metrics Data — including aggregate project, task, story, and test case volumes; delivery cycle metrics; AI usage patterns; and industry sector information — in its own right as a Responsible Party, for the purpose of platform analytics, industry benchmarking, and marketing. This processing is governed by the Master Subscription Agreement and the Konductro Privacy Policy (konductro.com/privacy). Platform Metrics Data is always aggregated and anonymised before any external publication. The Customer may opt out of having its data included in published Benchmark Reports by notifying privacy@konductro.com. Users must not deliberately submit false, misleading, or artificially inflated data to the Platform with the intent of corrupting Konductro's benchmarking datasets.

5. Enforcement and Consequences

5.1 The Provider monitors Platform usage for violations of this Policy through automated systems and manual review.

5.2 If a violation is detected or suspected, the Provider may, in its sole discretion and without prior notice:

• Issue a warning to the Customer or affected Authorised User
• Temporarily suspend access to the Platform or specific features
• Permanently terminate the Customer's subscription in accordance with the MSA
• Remove or disable content or outputs that violate this Policy
• Report violations to the relevant authorities (including the South African Police Service and the Information Regulator) where required by law

5.3 Suspension or termination for breach of this Policy does not entitle the Customer to a refund of any Fees paid or accrued.

5.4 The Provider reserves the right to cooperate with law enforcement investigations and to provide information as required by valid legal process.

6. Reporting Violations

If you become aware of any violation of this Policy — including by another Authorised User — please report it to the Provider promptly:

• Security vulnerabilities or suspected breaches: security@konductro.com
• Harmful or prohibited content: legal@konductro.com
• Privacy or data protection concerns: privacy@konductro.com

Reports may be submitted anonymously. The Provider will investigate all good-faith reports and will take appropriate action. The Provider will not take adverse action against any person who reports a genuine concern in good faith.

7. Amendments

7.1 The Provider may amend this Policy at any time. Amendments become effective 30 days after the Provider notifies the Customer in writing (including by email) of the changes.

7.2 Continued use of the Platform after the effective date of an amendment constitutes acceptance of the amended Policy.

7.3 If an amendment materially reduces the Customer's rights or materially increases the Customer's obligations, the Customer may terminate the MSA within 30 days of the notice without penalty, as their sole remedy.

8. Governing Law

This Policy is governed by and construed in accordance with the laws of the Republic of South Africa. Any dispute arising from this Policy is subject to the dispute resolution provisions in the MSA.

9. Contact

For questions about this Policy, please contact:

• Email: legal@konductro.com
• Website: konductro.com/legal