Acceptable Use and AI Policy

1. What you may never do

Don’t use Sovaria, or let your app’s users use it, to:

• create, store or share sexual content involving minors. We remove it, close the accounts involved and report it to the authorities where the law requires;
• run phishing: pages or apps that pretend to be another company, bank, government body or person to trick people, including look-alike sign-in pages;
• collect passwords, card numbers, one-time codes or other credentials for a service that isn’t yours;
• build, host or spread malware, spyware, ransomware or tools whose main purpose is to break into systems you don’t own;
• send spam, run credential stuffing or password spraying, scrape sites against their terms, or run open proxies, crypto-mining or denial-of-service traffic;
• host content that is illegal in India or where your users are, that harasses or threatens people, promotes violence, or infringes someone’s rights;
• get around sign-in, access rules, rate limits, plan limits, Sovariq credits or billing, including by opening several accounts or organizations to collect more free usage. Sign-ups with throwaway email addresses are refused, sign-ups from one network are limited, and Sovariq uses Sovaria’s credits only after you confirm your email address.

2. Using Sovariq

Sovariq is for designing, building, debugging and running your Sovaria projects. It isn’t a general-purpose chatbot: requests unrelated to your project get a one-line answer, and obvious ones (jokes, essays, homework) are answered without using the AI model.

Don’t try to make Sovariq or an agent ignore its rules, reveal its instructions, reach data you can’t reach yourself, or act against another customer. Planting instructions in data, pages or files to steer someone else’s AI (prompt injection) counts as abuse of the service.

Sovariq declines to build the things listed above, such as look-alike sign-in pages of another brand or forms that collect another site’s passwords. If you are testing your own security (for example a phishing-awareness exercise for your own staff), do it on your own domain, label it clearly, and tell your users.

Sovariq’s answers and actions come from AI models and can be wrong. Review what it proposes. You are responsible for the changes you approve and for what your published apps show and do.

3. How Sovariq protects your project

These protections are built in and apply on every plan:

• Sovariq acts with your own permissions and your organization’s AI policy. It can never do more than you could do yourself in the console, and every step it takes is recorded.
• Changes ask for your approval unless you choose otherwise in Sovariq’s approval settings. Under “Ask first” and “Auto-run safe changes”, steps that delete data, run code, send something outside the project or change who can access what always ask. “Sovariq decides” runs only what your message plainly asked for, and never on its own a step that leaves the project or changes access. “Run everything” runs every step, but still asks before those steps once Sovariq has read a web page, an outside tool’s result or a page in your browser in the same message.
• Secrets (API keys, tokens, private keys, passwords in connection strings) are hidden before the AI model reads anything, and Sovariq refuses to write a secret into code, SQL or settings or send one out of the project.
• Text in rows, files, logs, web pages and outside tools is treated as data, never as instructions. Text that looks like instructions aimed at the AI is removed before the model reads it (also when it is disguised: other languages, encoded text, spaced-out letters), and nothing runs on its own for the rest of that message.
• Sovariq’s rules can’t be talked away. Asking it to ignore its instructions, to role-play another assistant, or to reveal its instructions (in any language or encoding) is declined, and its rules are repeated to it throughout long conversations. After such an attempt, steps that send something outside the project, change access or delete data ask first even under “Run everything”. You decide design and style; the safety rules aren’t yours or ours to switch off mid-conversation.
• Before any step runs, Sovaria checks what it would write: look-alike sign-in pages of other brands, code that sends passwords to a chat bot, and crypto-miners are refused under every approval setting. Project rules, memory and preferences can’t hold instructions that weaken these protections.
• Sovariq reads only public web addresses (never private networks or cloud metadata), and opens only pages from its own search results or links you gave it, so a page can’t make it send your data elsewhere in a link.
• Code that Sovariq runs to build your app runs in an isolated sandbox with no network, no credentials and no access to your data.
• Sovariq usage is limited by your plan’s Sovariq credits and daily allowances, so a runaway conversation can’t spend without limit.

4. AI agents in your apps

You can put AI agents in front of your own users. You are responsible for what those agents are told to do, for the model account they use, and for telling your users how their data is used, as your own privacy notice requires.

Sovaria limits what an agent that serves your app’s users can do: it never gets tools that delete data, it can’t use your outside (MCP) connections or call outside services with your credentials, it acts with that user’s own access, and each user has a daily run allowance you set.

Don’t use agents to do anything this policy forbids, to deceive people about whether they are talking to a person, or to make decisions with legal or similarly serious effects on people without human review.

5. Apps and sites hosted on Sovaria

Apps and sites published on Sovaria addresses (including preview addresses) and on custom domains pointed at Sovaria must follow this policy. We may take down a site, or stop an organization’s sites from being served or deployed, if it hosts phishing, malware or other abuse; it then shows “Site unavailable”. Only Sovaria can lift such a takedown.

Every release of a hosted site is checked automatically before it goes live, and live sites are checked again from time to time, for look-alike sign-in pages, forms that send passwords or card numbers elsewhere, phishing kits, crypto-miners, redirects that hide where visitors end up, and malware. A release that clearly breaks this policy isn’t published and the organization’s owners are emailed the reason; anything less certain goes to our staff for review. Your own sign-in page and buttons such as “Sign in with Google” are fine. If we got it wrong, contact support with the site name and we review it.

6. Reporting abuse

To report a site, app or account that breaks this policy, use the form at sovaria.in/report-abuse, or email outreach@sovaria.in with the subject “Abuse”. Include the web address, what you saw and when. We acknowledge complaints within 24 hours and resolve them within 15 days, as the IT Rules, 2021 require. Sovariq names the same address when it declines a request this policy forbids.

To report a security vulnerability in Sovaria itself, follow sovaria.in/.well-known/security.txt.

7. What we do when the rules are broken

Depending on how serious it is, we may remove or disable content, take a site down, suspend an account or organization, or end the agreement, as the Terms of Service describe. Where practical and lawful we tell you first and give you a chance to fix it. We may keep records and share them with the authorities when the law requires.

8. Changes to this policy

We update this policy as Sovaria and the law change, and post the new version here with its date. Material changes are announced as the Terms of Service describe.

Our Grievance Officer, Sovaria Technologies Private Limited, Nadi Ki Dhani, Akeda Choud, Via Jahota, Bhato Ki Gali, Jaipur, Rajasthan 303701, India. Email outreach@sovaria.in with the subject “Privacy” or “Grievance”.