Acceptable Use Policy (AUP)

Version 1.1 · Effective: December 1, 2026 (for new registrations from the date of publication)

The Czech version is the controlling version. This Acceptable Use Policy (the "AUP") is an integral part of the Terms of Service of the SimplyForms service (simplyforms.app/en/legal/terms) operated by Adam Todt, IČO 19197438. In case of conflict between the AUP and the Terms of Service, the stricter provision prevails.

1. Purpose

The AUP defines the prohibited uses of the SimplyForms Service and provides the legal basis for the immediate suspension or termination of an Account in the event of a breach. Its aim is to protect:

other customers against abuse of the shared infrastructure,
the IP reputation of our SMTP servers,
compliance with applicable law (in particular the GDPR, Act No. 480/2004 Coll., anti-spam legislation, the DSA),
form Submitters (visitors to Customers' websites).

2. Prohibited uses

The Customer undertakes NOT to use the Service for:

2.1 Anti-spam / unsolicited communications

(a) Sending unsolicited commercial communications (spam) in breach of Section 7 of Act No. 480/2004 Coll., the CAN-SPAM Act (USA), PECR (UK), CASL (Canada) or analogous regulations.
(b) Sending commercial communications without the recipient's provable prior consent (opt-in).
(c) Use of the Service for an autoresponder that sends commercial communications (the autoresponder is intended only for confirmation emails, not for newsletters).
(d) Mass automated submission of forms without provable consent of the Submitters.
(e) Sending emails with false identification details, deceptive subject lines, or a forged From or Reply-To header.

2.2 Security threats

(a) Malware, ransomware, viruses, trojan horses in any form (attachments, links, form payload).
(b) Phishing pages or forms designed to steal login credentials, payment data or other sensitive information.
(c) Fraudulent forms (fake giveaways, fake support, fake job offers, fake invoices).
(d) Distribution of links to phishing or malware by means of form submissions.
(e) Attempts to exploit vulnerabilities of the Service, brute-force attacks, or fuzzing of API endpoints without the Operator's express permission.

2.3 Infrastructure abuse

(a) Scraping the Service or its endpoints.
(b) Automated overloading of the Service — sending more requests than the Customer's plan permits.
(c) Circumventing CAPTCHA, rate limits or other security measures of the Service.
(d) Sharing the Account / API key with unauthorized third parties contrary to the plan.
(e) Reverse engineering, decompilation or disassembly of the Service in breach of Section 66 of Act No. 121/2000 Coll.
(f) Use of the Service to create a competing product or for any form of replication of its functionality.
(g) Running multiple Accounts in order to circumvent the limits of the FREE plan.

2.4 Illegal and harmful content

(a) Content promoting terrorism, violence, or hatred on the grounds of race, ethnicity, religion, gender, sexual orientation, age or disability.
(b) Child sexual abuse material (CSAM) in any form — with immediate notification of law-enforcement authorities.
(c) Doxxing, blackmail, threats, or the publication of third parties' private data without consent.
(d) Unlawful discrimination in breach of anti-discrimination legislation.
(e) Content infringing copyright or other intellectual property rights.
(f) Covering criminal activity, money laundering, terrorist financing.
(g) Content promoting illegal goods or services (drugs, weapons, counterfeit goods, stolen data).

2.5 Protection of personal data

(a) Collection of special categories of personal data under Art. 9 GDPR (health, racial/ethnic origin, political opinions, religious beliefs, sexual orientation, biometric and genetic data) without explicit consent from the Submitter and a completed DPIA.
(b) Collection of criminal-offence data under Art. 10 GDPR without the Customer's own lawful basis.
(c) Collection of data from minors under 16 years of age without legal-guardian consent under Art. 8 GDPR.
(d) Processing personal data without a valid lawful basis under Art. 6 GDPR.
(e) Failure to inform Submitters that the data is transferred to SimplyForms as processor (a breach of the Customer's own Art. 13 GDPR duties as controller).

2.6 International sanctions and export controls

(a) Use of the Service by a person named on an EU, UN or US international sanctions list (OFAC, EU sanctions list).
(b) Use of the Service for activities subject to export controls on weapons of mass destruction or dual-use items.
(c) Use of the Service to circumvent international embargoes.

3. Consequences of a breach

3.1 Immediate suspension

On reasonable suspicion of a breach of the AUP, the Operator is entitled, without prior notice, to:

suspend the Account,
block the API key,
reject / drop the queues of pending emails,
retain the technical logs necessary to evidence the breach,
inform the competent authorities (in the case of suspected criminal activity, CSAM, terrorism, etc.).

3.2 Termination of the Agreement

On a proven breach of the AUP the Operator is entitled to terminate the Agreement immediately under clause 11.3 of the Terms of Service without any entitlement of the Customer to a refund of Fees.

3.3 Contractual penalty (Business Customer)

For a proven, manifestly serious breach of the AUP (in particular the sending of spam, distribution of malware, phishing, CSAM) the Business Customer must pay the Operator a contractual penalty of CZK 50,000 per such case. The contractual penalty does not exclude a claim for damages (Article 14 of the Terms of Service). No contractual penalty is agreed vis-à-vis a Consumer Customer; against such a Customer the Operator claims compensation for the actual damage.

3.4 Referral to the authorities

In the case of suspected criminal activity, terrorism, CSAM or a serious breach of the law, the Operator will cooperate with law-enforcement authorities and will provide the data available to it (Account, logs, IP addresses) on the basis of a lawful request.

4. Reporting illegal content (DSA)

The Operator is a provider of a mere conduit intermediary service within the meaning of Art. 4 of Regulation (EU) 2022/2065 (the Digital Services Act) and is under no obligation to monitor the content transmitted (Art. 8 DSA). The address abuse@simplyforms.app is at the same time the single point of contact under Articles 11 and 12 DSA.

A third party (an injured party, a regulator, a law-enforcement authority) may report illegal content transmitted by means of the Service at that address. A report should include:

a description of the illegal content,
the reasons why the content is considered illegal,
the specific location of the content (URL, email, identifier),
contact details of the reporting person (for confirmation of receipt).

Response time: the Operator will assess the report and respond without undue delay.

Bona fide notice: where the reporting person acts in good faith, the report constitutes grounds for a review by the Operator. On a confirmed breach the Operator will apply the measures under Article 3 of this AUP. The Operator is not obliged to disclose information about the Customer to the reporting person other than on the basis of a lawful request.

5. Customer's reporting of its own incidents

If the Customer discovers that its Account or API key has been compromised or abused by a third party, it must:

report this to security@simplyforms.app without undue delay,
rotate the API key in the dashboard,
where necessary, request a freeze of the Account until the matter is resolved.

The Operator will provide assistance in investigating the incident.

6. Interpretation and changes

6.1 In case of doubt as to whether a particular use of the Service falls under one of the prohibitions, the Customer must consult the Operator (legal@simplyforms.app) before commencing such use. The Operator will provide its position within a reasonable period; that position is not legal advice and does not relieve the Customer of its responsibility.

6.2 The Operator is entitled to extend the AUP unilaterally by adding new prohibitions where this is required by:

developments in the law,
protection against newly identified types of abuse,
protection of other customers or of third parties.

The Customer will be informed of changes to the AUP in accordance with Article 3 of the Terms of Service (30 days in advance for material changes).

7. Relationship to the Terms of Service and the DPA

7.1 This AUP is an integral part of the Terms of Service of the SimplyForms Service.

7.2 A breach of the AUP is always at the same time a breach of the Terms of Service, and the consequences under Articles 11 and 14 of the Terms of Service apply.

7.3 Some provisions of the AUP (in particular clause 2.5 on the protection of personal data) also correspond to the Customer's obligations as controller under the DPA.

Contacts:

Abuse reports (DSA notice): abuse@simplyforms.app
Security incidents: security@simplyforms.app
General AUP queries: legal@simplyforms.app

Version 1.1 · Effective: December 1, 2026

Document hash (SHA-256): 6819f54f6ab9db6f10e3270fd1af615d4331c82f7f56b2ebad2677b7437077e6