Acceptable Use Policy

1You are responsible for your automation

• You are responsible for everything done through your account, API keys and sessions, whether it was done by you, your team, your customers, or an AI agent acting for any of them.
• You must have the right to access every site, account and system your sessions reach. Follow each site's terms of use, access rules and rate limits. If a site does not allow automated access, do not automate it.
• Keep a person accountable for your AI agents. Review what they do, and require a person's approval before consequential actions such as payments, purchases, sending messages, changing accounts or deleting data.
• Comply with all laws that apply to you and to the sites and people your automation affects, including computer misuse, anti-fraud, consumer protection, data protection and export control laws.

2No unauthorised access or fraud

You may not use Boxline to:

• access accounts, systems or data you are not authorised to access, including credential stuffing, password spraying, brute-forcing logins, session hijacking or account takeover;
• create accounts in bulk, create accounts with false identities, or use accounts that are not yours;
• commit fraud of any kind, including phishing, carding, testing stolen payment cards, refund or chargeback fraud, identity theft and forged documents;
• generate fake traffic, fake clicks or ad impressions, or fake reviews, ratings, votes, followers, likes or other manipulated engagement;
• buy tickets, limited goods, reservations or appointments at scale to resell them, or get around purchase limits and queues;
• manipulate elections or run coordinated inauthentic behaviour.

3No getting around sites' protections

Sites use logins, paywalls, rate limits, bot protection and CAPTCHAs to decide who may use them and how. You may not use Boxline to:

• get around a site's access controls, paywalls, login walls, rate limits, bans or blocks where the site does not allow it;
• solve, bypass or hand off CAPTCHAs or other checks that a person is present, on sites that do not permit automated access, or to do anything else this policy forbids;
• use proxies to hide abuse, to get around sanctions or legal restrictions, or to reach sites our proxy providers restrict (for example banking, government, ticketing and webmail sites).

By default, Boxline hands a CAPTCHA to a person instead of solving it. If you turn on CAPTCHA solving for a session, you confirm that you are allowed to automate that site, and that solving is not used to do anything this policy forbids. We may turn solving off for your account at any time.

4No attacks, spam or harmful content

You may not use Boxline to:

• attack, probe, scan or overload other people's systems, including denial-of-service attacks or load testing without the owner's written permission;
• send spam or bulk unsolicited messages by email, text message, social media, contact forms or chat;
• distribute malware, run command-and-control infrastructure, mine cryptocurrency, or host phishing pages;
• harass, stalk, dox or covertly monitor people, or collect personal data without a lawful basis;
• create, store, access or share content that sexually exploits or endangers children (we report it to the authorities), promotes terrorism or violent extremism, or is otherwise illegal;
• infringe other people's intellectual property or privacy rights.

5Respect the platform and other customers

You may not:

• try to break out of your session's sandbox, reach other customers' sessions or data, reach our internal network, or reach cloud metadata services;
• test our security except under our responsible disclosure policy, or share vulnerabilities before they are fixed;
• resell or share access to Boxline, or run a public proxy or anonymising service on it, without our written agreement;
• get around our limits, plans or billing, for example by opening several free accounts;
• interfere with or disrupt the service, or use it in a way that puts it, us, our providers or other customers at risk.

6Third-party providers

Some features run through other companies: residential and datacenter proxies, AI model providers, and CAPTCHA solving. Your use must also follow their acceptable-use rules. They may block some kinds of traffic or targets, and we may pass their notices and restrictions on to you.

7How we monitor and enforce

To keep Boxline safe we run automated and manual checks on metadata such as the sites sessions visit, request and error volumes, proxy and CAPTCHA use, and billing signals. We look at session content, such as recordings, logs and files, only when we investigate a suspected breach of this policy, a security incident, or a lawful request.

If we believe this policy has been broken, or that there is a risk of harm to others, we may, without notice:

• stop sessions and agent runs;
• revoke API keys and signed session links;
• turn off features such as proxies, CAPTCHA solving or agent runs;
• suspend or close the account, and cancel unused credits;
• keep records and evidence for as long as needed for the investigation and any legal claims;
• report illegal activity to the authorities, respond to lawful requests, and tell affected sites and providers.

Charges for usage up to a suspension remain payable. Accounts closed for abuse are not entitled to refunds.

8Report abuse

If you see abuse coming from Boxline, email abuse@boxline.dev with the address or site affected, the time (with time zone) and what happened. Report security vulnerabilities to security@boxline.dev.

Questions about this policy: legal@boxline.dev.