Acceptable Use Policy

About this policy

This policy expands on the “Acceptable use” section of the Terms of Service. Words such as customer, user and personal link mean the same as there. [TO CONFIRM: how this policy becomes part of the terms and the order form.]

Who it applies to

• The customer: the organization named in the order form. It is responsible for what its users do in DayOneFlow.
• Users: everyone the customer invites to its organization in DayOneFlow (admins, HR, managers and members).
• Candidates and new hires who use a personal link: [TO CONFIRM: whether and how this policy applies to them, as they do not accept the terms].

Use DayOneFlow lawfully and for its purpose

Do not use DayOneFlow to:

• break the law or anyone else's rights, for example data-protection, employment, anti-discrimination or intellectual-property law;
• store or send content that is unlawful, threatening, harassing or defamatory;
• upload files or text that you have no right to share;
• do anything other than manage new hires from offer to probation outcome, for example recruitment marketing, bulk email, or keeping unrelated records.

Personal data: only what you may use

• Enter only personal data that you have a lawful basis for, and give candidates and new hires the notices the law requires, including your own privacy notice.
• Collect only what you need. Turn on the date-of-birth question only when you need it, and ask for identity or right-to-work documents only when you have a reason.
• DayOneFlow does not ask for special-category or similarly sensitive data, such as health, ethnic origin, religion, political opinions, trade-union membership, sex life or sexual orientation, genetic or biometric data, or criminal records. Do not add it in free-text fields such as check-in notes. Uploaded documents can show some of it (a right-to-work document can show nationality, for example), so request them only where you have a lawful basis. [TO CONFIRM: counsel guidance to customers on special-category data.]
• Keep the data accurate. In particular, a candidate's personal email must be correct, because offers and personal links are sent there.

Security and other organizations' data

Do not:

• try to see or change data you have not been given access to, including another organization's data or another person's personal page;
• probe, scan or test DayOneFlow's security, including penetration tests and vulnerability scans, without our written permission;
• get around DayOneFlow's limits or protections, such as roles, limits on repeated attempts, file-type checks or upload limits;
• upload malware, or any file meant to harm DayOneFlow, its users or the people whose records it holds. DayOneFlow accepts only PDF, PNG and JPEG files and refuses PDFs with active content.

If you find a vulnerability, report it to security@dayoneflow.com and do not use it further. How DayOneFlow is protected is described on the Security page.

Load, scraping and automation

Do not:

• overload DayOneFlow, for example with denial-of-service traffic or large numbers of automated requests;
• scrape or crawl the application, or extract data from it by automated means. Use the CSV reports and downloads it provides;
• create accounts, or send sign-in, registration or password-reset requests, automatically or in bulk.

DayOneFlow limits repeated attempts at signing in, registering, resetting a password, sending invitations, opening personal links, uploading and exporting. Requests above those limits are refused for a while.

Accounts and personal links

• Each user signs in with their own account. Do not share accounts or passwords, and keep your sign-in details to yourself.
• Admins remove or disable a user's access when it is no longer needed.
• A personal link is meant only for the candidate or new hire it was sent to: whoever holds it can act as them. Do not forward or publish it. If a link was shared by mistake, HR can revoke it and email a new one; only the newest link works.
• If you received a personal link that was not meant for you, do not use it. Tell the organization that sent it, or write to us.

If this policy is broken

• We may suspend the customer's organization to protect DayOneFlow or other customers, or for a serious breach [counsel: notice]. While it is suspended nobody can use it, but its data is kept.
• A breach can also be a material breach that allows the agreement to be ended, as the terms describe [notice and cure periods].
• [TO CONFIRM: whether we may instead disable a single user's account when that is enough to stop the problem.]
• Where the law requires it, we report unlawful activity to the authorities [counsel].

Reporting abuse

• Security vulnerabilities and incidents: security@dayoneflow.com.
• Any other misuse of DayOneFlow, including a personal link that reached the wrong person: hello@dayoneflow.com.
• Candidates and new hires with a question about their own data: please contact the hiring organization first, as the Privacy notice explains.

Changes

We change this policy in the same way as the terms, with [notice] days' notice [counsel]. The date above shows the current version.