Acceptable Use Policy

This is a proposed Acceptable Use Policy for a future U.S. Dohos service. It is not current, binding, approved, or operational. It does not authorize monitoring, suspension, a Restricted Product, or any capability. The future Dohos legal entity, applicable customers, incorporated agreement version, Providers, capabilities, enforcement process, jurisdictions, and reporting channels remain unverified. This draft must not be published, incorporated, or enforced until its activation conditions are satisfied.

01Purpose

This Acceptable Use Policy protects people, Restaurants, Dohos, Providers, communications networks, payment systems, and the integrity of the Dohos Service. It explains conduct and content that are prohibited when a Restaurant or other authorized person uses an activated Dohos capability.

The policy is intended to be specific and proportionate. It does not give Dohos an unlimited right to inspect content, change commercial terms, impose new fees, expand data use, or suspend a customer for an undisclosed reason.

02Who and what this policy covers

This policy applies only when it is validly incorporated into an agreement with:

• a Restaurant
• an authorized Restaurant Administrator or Restaurant User
• a contractor or integration partner granted access to the Dohos Service
• another person whose activated terms expressly incorporate it

The policy covers use of the activated:

• Account and administrative interfaces
• voice, SMS, email, web, API, and integration channels
• AI-assisted features and generated or transformed content
• menu, order, payment-integration, fulfillment-status, and support functions
• reports, exports, logs, and data-access tools
• credentials, numbers, domains, brands, and Provider resources assigned for the service

It does not apply to a capability that is disabled, merely present in source code or schema, shown in a demo, listed on a roadmap, or not selected in an activated Order Form.

03Responsibility and authority

The contracting Restaurant is responsible for use it authorizes through its Restaurant Account, including use by its administrators, personnel, contractors, and systems. That responsibility is limited by actual authority, applicable law, the agreement, and Dohos's own duties.

The Restaurant must:

• grant access only to people and systems with a legitimate business need
• assign the least privilege reasonably required
• promptly remove access when authority ends
• keep Restaurant Content and operational instructions accurate
• use only Restaurants, locations, brands, channels, products, and Programs approved in the Order Form
• report suspected unauthorized activity through the approved route

Dohos remains responsible for its own service design, configurations, access controls, Provider choices, security, representations, legal duties, and enforcement decisions. A general obligation to comply with this policy does not transfer Dohos's nondelegable or role-specific duties.

04General lawful-use rule

You may use the Dohos Service only for the lawful Restaurant-business purposes and activated capabilities stated in the applicable agreement.

You must not use, direct, enable, assist, or knowingly permit the service to:

• violate applicable law, regulation, court order, sanction, license, Provider rule, or a binding agreement
• infringe or misappropriate another person's rights
• facilitate fraud, deception, abuse, exploitation, violence, or a credible safety threat
• conceal the identity of the Restaurant, sender, caller, seller, merchant, advertiser, or responsible principal when disclosure is required
• evade a consent, authorization, opt-out, age, identity, payment, security, privacy, accessibility, food-safety, or licensing control
• cause Dohos or a Provider to make a false or misleading statement about the service or a Restaurant

The stricter applicable requirement controls when a use is regulated by multiple rules.

05Fraud, impersonation, and deceptive conduct

You must not:

• impersonate a person, Restaurant, government agency, Provider, carrier, bank, payment network, or Dohos
• create a Restaurant Account, location, brand, caller ID, sender ID, domain, payment account, or integration using false or unauthorized information
• misrepresent an affiliation, endorsement, certification, license, approval, charity, price, discount, scarcity, review, or transaction status
• place or solicit fake orders, fake reviews, sham disputes, test charges against another person's payment method, or fabricated support cases
• manipulate an AI-assisted system to state that a Restaurant accepted, prepared, refunded, delivered, or guaranteed something when it did not
• use synthetic voice, caller-ID spoofing, cloned identity, misleading bot identity, or altered media to deceive
• conceal material fees, recurring charges, marketing purpose, recording, or another legally required fact

An internal test must use an approved test environment, data, number, account, payment method, label, and evidence plan. Calling activity "testing" does not authorize contact with real people or production systems.

06Harassment, abuse, and dangerous conduct

You must not use the service to:

• threaten, stalk, harass, intimidate, extort, shame, or incite harm
• promote or coordinate violence, terrorism, human trafficking, sexual exploitation, or abuse
• target a person based on a protected characteristic with unlawful discrimination or hateful abuse
• repeatedly contact a person after a legally sufficient revocation or clear request to stop
• expose a person's sensitive information to cause harm
• provide instructions intended to bypass food, health, emergency, security, or age controls
• interfere with a person seeking emergency assistance, accessibility assistance, a legal remedy, or a safety escalation

Good-faith reports, lawful criticism, employee rights, whistleblowing, regulatory contact, and honest reviews are not prohibited merely because they are unfavorable.

07Communications and telemarketing

Voice, SMS, email, and other communications may be used only for an activated Program, approved Restaurant/brand, registered identifiers, disclosed purpose, and lawful audience.

You must not:

• send marketing without the consent or other lawful basis required for the exact sender, brand, channel, purpose, and Program
• buy, rent, scrape, append, share, or upload contact lists without documented rights and provenance
• treat a prior order, business relationship, inbound call, Restaurant customer list, or provision of a number as universal marketing consent
• misclassify promotional content as transactional to avoid consent or opt-out rules
• ignore, obstruct, delay, or narrow a legally sufficient opt-out or revocation
• remove required sender identity, AI identity, call-recording notice, STOP/HELP disclosure, frequency, rate, privacy, or terms information
• send outside legally permitted times or after a suppression rule applies
• use prohibited caller-ID practices, evasion patterns, rotating identifiers, snowshoeing, or deceptive routing
• contact emergency lines, healthcare lines, protected categories, reassigned numbers, do-not-call records, or minors contrary to the approved rule set
• use an unregistered, unverified, suspended, or unauthorized campaign, number, domain, or sender

Transactional content must remain limited to the requested or existing Restaurant Transaction or service event. Adding advertising can change its legal classification.

Dohos may require consent evidence, source records, campaign registration, sample content, frequency, audience, suppression, and complaint data before enabling or continuing a Program. The full rules for a specific communications Program are in the SMS and Communications Notice.

08AI-assisted use

You must not use an AI-assisted capability to:

• make an undisclosed automated system appear to be a human
• generate or communicate information the Restaurant has not supplied or approved about prices, taxes, fees, availability, hours, ingredients, allergens, dietary suitability, licensing, refunds, fulfillment, or acceptance
• make a high-impact decision about employment, credit, housing, healthcare, education, insurance, legal services, or another regulated domain unless a separately approved capability and legal program expressly covers it
• create a Voiceprint, identify emotion, infer sensitive traits, or authenticate a person from voice without a separately approved lawful program
• train, fine-tune, benchmark, evaluate, or improve a general model using Restaurant Content, Diner content, Personal Data, recordings, or transcripts outside the approved data rights and notice
• generate deceptive reviews, endorsements, testimonials, calls, messages, receipts, or Restaurant records
• remove provenance, safety instructions, uncertainty, required disclosure, or human/alternative fallback
• make autonomous commitments, refunds, substitutions, discounts, payments, or contract changes outside approved authority
• use output as the sole basis for an allergy, medical, legal, tax, financial, emergency, or safety-critical decision

Prompt injection, jailbreak testing, red teaming, and evaluation against the production service require Dohos's written authorization and the approved security/testing procedure.

Restaurant personnel must review and correct material AI-assisted output through the activated workflow. Human review is not a cure when the reviewer lacks adequate information, time, authority, training, or a practical correction mechanism. The full disclosure rules for AI-assisted channels are in the AI and Voice Transparency Notice.

09Recording, transcription, and biometric restrictions

No call-content analytics, speaker identification, Voiceprint, or biometric processing is authorized by this policy.

You must not:

• activate, configure, request, or represent that a call is recorded or retained beyond the standard post-call transcript unless the exact capability, jurisdiction, participants, notice/consent, purpose, retention, Provider, access, and agreement are approved
• covertly record or cause Dohos or a Provider to record a communication
• reuse a recording or transcript for marketing, discipline, profiling, training, or another secondary purpose outside the approved program
• upload a recording, transcript, or voice sample without documented authority and lawful basis
• use voice or conversation content to infer identity, health, disability, emotion, ethnicity, religion, age, or another sensitive characteristic
• request that payment credentials, authentication secrets, or unnecessary sensitive data be spoken into an ordinary recording or transcript path

A text transcript of each completed call is retained as part of standard service delivery, described in the Privacy Notice and the AI and Voice Transparency Notice — this policy alone is not the consent mechanism for it. Where the Order Form does not separately activate a Recording Capability, the service must remain configured to avoid retaining raw call audio beyond transient processing needed to deliver the interaction.

10Privacy and Personal Data

You may collect, access, use, disclose, and retain Personal Data through the service only for the approved purpose, under documented authority and instructions, and in compliance with the applicable agreement and privacy law.

You must not:

• upload or collect data unrelated to the activated Restaurant purpose
• sell, share for cross-context behavioral advertising, broker, enrich, or combine Diner data outside the approved agreement and notice
• disclose Personal Data to an unapproved person, location, Provider, model, plug-in, extension, or integration
• use data from one Restaurant to benefit or profile another Restaurant
• export data to a personal device, consumer cloud drive, private email, public AI tool, or unapproved application
• reidentify deidentified data or attempt to link pseudonymous records to a person
• retain data beyond the approved schedule or defeat deletion, legal-hold, rights-request, or suppression controls
• collect sensitive data, children's data, precise location, government identifiers, health details, or biometric data unless the activated program expressly requires and permits it
• use a privacy request, accessibility request, dispute, or support interaction for retaliation or unrelated marketing

Restaurant instructions cannot require Dohos to violate law or the agreement. Dohos may reject or suspend an unlawful instruction and should identify a lawful alternative where practical. Full detail is in the Privacy Notice.

11Payment and financial restrictions

Payment functions may be used only through the approved Payment Provider and Restaurant payment configuration.

You must not:

• enter, request, store, log, transmit, copy, or expose a full card number, security code, PIN, bank credential, wallet secret, authentication value, or other prohibited Payment Credential outside the approved Provider path
• use Dohos as a wallet, escrow, stored-value, money-transfer, cash-advance, lending, debt-collection, check-cashing, remittance, or cryptocurrency service
• create a charge for a fictitious or unauthorized Restaurant Transaction
• split, reroute, hold, net, transfer, refund, reverse, or disburse Restaurant funds outside the approved configuration and authority
• disguise a Dohos fee, Restaurant amount, tax, tip, delivery charge, surcharge, or recurring charge
• process another merchant's transactions through a Restaurant Payment Account
• misuse test cards, card-network credentials, Provider objects, refunds, disputes, evidence, or chargeback tools
• submit false evidence, discourage a lawful dispute, or retaliate against a person who disputes a charge
• use payment data for advertising, identity enrichment, or unrelated profiling

The Restaurant remains responsible for its own transaction facts, but Dohos remains responsible for its integration, configuration, statements, security, and any direct payment role it performs.

12Restaurant Products and restricted activity

Only ordinary Restaurant Products approved for the Restaurant, location, channel, fulfillment method, and jurisdiction may be offered through the service.

The following are prohibited unless an Order Form, Provider approval, licenses, age/identity controls, product design, counsel review, and jurisdiction matrix expressly authorize the exact category:

• alcohol
• tobacco, nicotine, vaping, and related products
• cannabis, controlled substances, drug paraphernalia, and intoxicants
• prescription or regulated drugs, medical devices, and healthcare services
• weapons, ammunition, explosives, and dangerous materials
• gambling, lottery, sweepstakes, and wagering
• gift cards, prepaid access, stored value, cash equivalents, cryptocurrency, and money services
• adult sexual services or unlawful explicit content
• live animals, protected species, and unlawfully sourced products
• recalled, adulterated, counterfeit, stolen, unsafe, or illegally imported goods
• charitable solicitation, political fundraising, debt relief, credit repair, lending, insurance, or another specially regulated service
• any item prohibited by law, the Payment Provider, a communications Provider, the Restaurant agreement, or the approved risk matrix

A menu label or Restaurant license does not automatically activate a category. Dohos may require documentary evidence and technical controls before activation and throughout use.

13Food, allergen, and fulfillment integrity

You must not knowingly provide or approve false, stale, incomplete, or misleading Restaurant Content about:

• ingredients, major food allergens, cross-contact, dietary attributes, nutrition, or preparation
• price, tax, fee, tip, discount, quantity, availability, hours, or timing
• licensing, inspection, certification, sourcing, health, or safety
• Restaurant identity, location, brand, fulfillment provider, or delivery area
• cancellation, substitution, refund, pickup, delivery, or complaint terms
• whether an order was received, accepted, prepared, ready, delivered, cancelled, or refunded

Do not instruct an AI system to infer missing food-safety facts or guarantee accommodation. Material corrections must be propagated through the approved source-of-truth process and preserved with version and provenance evidence.

14Security and system integrity

You must not:

• share credentials or use another person's credentials without authority
• bypass multifactor authentication, role limits, tenant boundaries, approval steps, rate limits, geofencing, logging, or other controls
• probe, scan, exploit, reverse engineer, or access nonpublic systems or data without written authorization, except to the extent a restriction is prohibited by law
• introduce malware, ransomware, destructive code, credential theft, cryptomining, botnets, or denial-of-service traffic
• scrape, enumerate, harvest, or exfiltrate data, model assets, prompts, secrets, tokens, numbers, accounts, or Provider identifiers
• alter, suppress, fabricate, or destroy logs, consent evidence, acceptance evidence, transaction records, legal holds, or security alerts
• use an unapproved integration, browser extension, plug-in, model, device, network, or automation
• disclose a vulnerability publicly before the approved coordinated process reasonably addresses the risk, unless protected by law
• interfere with investigation, containment, notification, remediation, or evidence preservation

Suspected security, privacy, payment, communications, or safety incidents must be reported promptly through the vulnerability disclosure route. Do not include prohibited credentials or unnecessary Personal Data in a report.

15Intellectual property and content rights

You must not use the service to:

• infringe copyright, trademark, patent, trade secret, publicity, privacy, or other rights
• upload Restaurant Content, media, menu data, customer data, model assets, or software you lack authority to use
• remove ownership, attribution, provenance, watermark, disclosure, or rights-management information
• create a confusingly similar Restaurant, Dohos, Provider, or third-party brand
• use content to suggest an endorsement, certification, or affiliation that does not exist
• demand assignment of a Diner's honest review, suppress protected speech, or retaliate for a lawful complaint

An infringement report must use the approved route and provide enough information for a reasonable review. Dohos should not remove content solely on an unsupported accusation or use an IP process to decide unrelated disputes.

16Resource abuse and unauthorized automation

You must not use the service in a way that unreasonably degrades shared resources, evades plan or technical limits, or imposes disproportionate cost or risk.

Prohibited conduct includes:

• excessive automated calls, messages, API requests, retries, crawling, or exports outside approved limits
• circumventing quotas, concurrency, rate, model, number, geography, storage, or retention limits
• creating duplicate accounts, tenants, Programs, numbers, or identities to evade enforcement or fees
• using the service as general-purpose hosting, call center, bulk marketing platform, data broker, model-training corpus, or payment processor outside the activated use
• deliberately generating abusive Provider charges or operational load

Dohos should provide documented limits and reasonable warnings where practicable. Emergency protection may require immediate throttling.

17Accessibility and nondiscrimination

You must not configure or use the service to unlawfully discriminate, deny a reasonable alternative, or obstruct a person because of disability or another protected characteristic.

Required notices, consent, order review, correction, payment, cancellation, privacy, support, and dispute functions must not be intentionally hidden from or made unusable for people using an approved assistive method.

An accessibility report is not abuse merely because it involves repeated attempts to demonstrate a barrier. Dohos and the Restaurant should route it through the approved remediation process described at the Accessibility Statement.

18Compliance requests and investigations

Dohos may request information reasonably necessary to evaluate compliance, such as:

• authority, identity, business, Restaurant, location, and license evidence
• menu/content provenance
• communications Program and consent records
• payment, refund, dispute, and transaction records
• data-source, purpose, privacy, retention, and deletion records
• security controls, users, integrations, and incident facts
• remediation plans and completion evidence

Requests must be proportionate, limited to the relevant issue, protected under the agreement, and consistent with privacy, privilege, confidentiality, and law. Dohos may not demand irrelevant Restaurant trade secrets or Personal Data merely because this policy exists.

You must provide accurate information and must not destroy, fabricate, or conceal relevant evidence. Nothing requires waiver of privilege or a protected legal right.

19Enforcement

Dohos may take proportionate action when it reasonably determines that use violates this policy, creates a credible risk, or may expose a person or system to harm. Depending on severity and urgency, action may include:

• guidance, warning, or a corrective deadline
• blocking content, a user, integration, number, Program, location, product, or capability
• rate limiting or requiring additional verification
• temporarily suspending affected access
• preserving evidence and investigating
• notifying or cooperating with a Provider, Restaurant, affected person, insurer, regulator, or law enforcement when authorized or required
• terminating the affected service under the governing agreement

Dohos should limit action to the affected scope when reasonably possible. Immediate action may be necessary for fraud, unlawful communications, credential compromise, payment harm, dangerous products, privacy breach, imminent safety risk, or Provider/network threat.

Enforcement does not authorize Dohos to retain data indefinitely, disclose it without authority, decide a Restaurant dispute unfairly, or block non-waivable privacy, accessibility, refund, charge-dispute, regulator, whistleblower, or emergency routes.

20Notice, correction, and appeal

Where appropriate and lawful, Dohos should provide:

• the policy section and facts supporting the action
• the affected account, capability, Program, location, or content
• whether the action is temporary or final
• available correction steps and deadline
• an accessible appeal route to a reviewer not responsible for the initial decision
• expected timing and restoration conditions

Dohos may delay details that would compromise security, safety, an investigation, legal duty, or another person's rights, but should provide the maximum useful explanation permitted.

An appeal does not automatically stay urgent protective action. Dohos must record the decision, evidence, reviewer, reasoning, and outcome.

21Monitoring and privacy boundary

Dohos may use proportionate metadata, automated controls, reports, and human review to prevent, detect, investigate, and remediate violations only as permitted by the agreement, privacy notice, law, and approved security program.

This policy is not consent to:

• routine human listening to calls
• retention of raw call recordings beyond the disclosed retention schedule
• biometric identification or emotion inference
• general model training
• sale or targeted advertising use of data
• unrestricted employee access
• surveillance unrelated to service integrity and legal duties

Monitoring must be purpose-limited, access-controlled, logged, tested, and retained only under the approved schedule. High-impact automated enforcement requires appropriate human review and appeal.

22Reporting a concern

The activated policy will provide monitored routes for:

• abuse and safety
• security vulnerabilities and incidents
• privacy concerns and rights
• communications consent and spam
• payment fraud and disputes
• intellectual-property notices
• accessibility barriers
• general support

23Changes to this policy

Dohos may change this policy prospectively only through the approved document-control and contract-amendment process. A change must not silently expand monitoring, data use, prohibited categories, suspension rights, fees, liability, or incorporated obligations.

The activated process must preserve versions at the version archive, provide required notice, obtain renewed assent when required, make a durable copy available, and link the applicable version to the customer, Order Form, capability, release, and enforcement event.

No change retroactively makes earlier conduct prohibited or cures prior Dohos conduct.

24Relationship to other agreements

This policy supplements the activated Restaurant Services Agreement and Order Form — see the Master Services Agreement for the commercial contract this policy attaches to. It cannot:

• add a capability not selected in the Order Form
• override a negotiated amendment or mandatory law
• expand data rights beyond the Data Processing Addendum or Privacy Notice
• create a fee, warranty disclaimer, indemnity, or liability limit absent the governing agreement
• make a Restaurant responsible for Dohos's own nondelegable duties
• make public website users subject to Restaurant commercial obligations without valid assent

If a conflict exists, the approved hierarchy and narrower customer-specific term govern.

Related documents

• Master Services Agreement — The commercial agreement this policy attaches to and cannot expand beyond, per Section 24.
• Data Processing Addendum — The data-rights ceiling referenced in Section 24 — this policy cannot grant broader data rights than the DPA allows.
• AI and Voice Transparency Notice — The disclosure obligations behind Section 8's AI-assisted-use rules.
• Privacy Notice — The data-handling rules behind Section 10 — this policy sets conduct boundaries; the Privacy Notice sets the underlying practice.
• Vulnerability disclosure — The reporting route named in Section 14.
• Accessibility Statement — The remediation process named in Section 17.