Acceptable Use and Anti-Abuse Policy

1. Purpose and scope

1.1 This policy sets out what must not be done with reactive.chat (the "Service"), which limits and protective measures the Operator applies, which tools Customers have against abuse, how the Operator handles reports of abuse and of illegal content, how it cooperates with authorities, and which measures it may take against Customers. It is part of the Terms of Service; capitalised terms have the meaning given there.

1.2 The Operator is LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, VAT ID PL7252266190. Single point of contact for users, authorities and reports under this policy (Articles 11 and 12 of Regulation (EU) 2022/2065, the "Digital Services Act"): contact@lukaswojcik.com, in English, German or Polish.

1.3 The policy binds the Customer and its Team Members directly. The Customer must make sure that Visitors on its websites and channels do not use the Service in breach of section 2, as far as the Customer can influence this, and may pass the relevant rules on to them.

1.4 Role of the Operator. For content that Customers, Team Members and Visitors put into the Service (messages, attachments, knowledge bases, widget texts), the Operator provides a hosting service within the meaning of Article 3(g)(iii) of the Digital Services Act. Chat conversations are not made available to the public; the Operator is therefore not an online platform within the meaning of that Act. The Operator is not a party to the conversations between Customers and Visitors and does not monitor them for content (Article 8 of the Digital Services Act); it acts on reports and on its own knowledge.

2. Prohibited uses

2.1 Illegal content and activities. The Service must not be used to store, transmit or make accessible content that is illegal under the law of the European Union or of a Member State, in particular child sexual abuse material, terrorist content, incitement to violence or hatred, content infringing intellectual-property rights, unlawful trade, and content infringing personality rights or data-protection law.

2.2 Fraud and deception. In particular:

• phishing: using the Widget, the chat or the channels on websites that imitate banks, shops, authorities or log-in pages, or asking Visitors for passwords, one-time codes, full card numbers or other access data;
• impersonating another person, company or authority, or misrepresenting the identity of the sender;
• fake shops, advance-fee fraud, fake support for third-party products, or other schemes to obtain money or data by deception;
• using bot actions, forms or cards to collect data under false pretences.

2.3 Spam and unsolicited communication. In particular:

• sending unsolicited commercial communication by WhatsApp, SMS, e-mail or other channels without the prior consent required by law (Article 13 of Directive 2002/58/EC and its national implementations, in Poland in particular the Electronic Communications Law);
• uploading contact lists to WhatsApp campaigns whose numbers did not give their consent to the Customer;
• proactive messages and on-site campaigns that are deceptive, cannot be closed, or imitate system messages of the browser or operating system;
• using the Widget or the channels for bulk messages unrelated to the Customer's own business.

2.4 Attacks and malware. Distributing malware, malicious links or files; attacking, probing or overloading the Service, its AI nodes or third-party systems; bypassing access controls; testing stolen card or access data.

2.5 Harassment. Harassing, threatening, insulting or defaming persons, including Team Members and Visitors, or sending discriminatory content.

2.6 Data harvesting. Collecting or extracting personal data of other persons without a legal basis; directing the knowledge-base crawler at websites the Customer does not control or is not authorised to copy; using the Service to build profiles of Visitors for purposes other than the Customer's own customer communication.

2.7 Embedding without authority. Embedding the Widget on websites, or connecting channels and accounts, that the Customer does not operate or is not authorised to use; using another Customer's site key.

2.8 Misuse of the AI functions. In particular:

• removing, hiding or changing the notice, the AI label or the AI subtitle so that Visitors no longer recognise that they are talking to an AI, or presenting the Assistant as a human (see the AI Act page, section 7);
• using the Assistant as a free general-purpose AI, for example to have code written, texts composed or homework solved, contrary to the settings of the project;
• attempting to make the Assistant ignore its instructions, reveal its system instructions or the content of other projects, or carry out actions not intended ("prompt injection" and "jailbreaking"), whether in messages, in the knowledge base, in documents or in web pages that the crawler reads;
• placing content in the knowledge base that is illegal, deceptive or designed to manipulate Visitors;
• using AI ratings to monitor or evaluate individual Team Members contrary to the conditions of the AI Act page, section 6.3;
• using the Service for the purposes of Annex III point 4 of the AI Act (employment and workers' management, in particular accepting, screening or assessing job applications or evaluating employees with AI output), which are excluded, or for purposes in the other high-risk areas of Annex III without informing the Operator in advance (see the AI Act page, sections 6.3 to 6.5).

2.9 Circumvention. Evading blocks, limits, suspensions or other measures, for example by new accounts or workspaces, changing addresses, manipulating identifiers or using several Free accounts to exceed the limits of the Free plan.

2.10 Payment fraud and account misuse. Using stolen or unauthorised payment methods; giving false billing data or a VAT ID of another business; initiating chargebacks for fees that were properly invoiced instead of raising the matter under the complaints procedure; passing on log-in data, sharing a personal log-in between several persons, or reselling access outside the purpose of the contract.

3. Phishing through the chat: rules and protection

3.1 A chat window on a website enjoys the trust of the website. The Customer and its Team Members must therefore never ask Visitors in the chat for passwords, one-time codes, PINs, full card numbers with security code, or online-banking access. Where payment is needed, the Customer must use a payment page of its payment provider.

3.2 The Service supports this as follows:

• before storage, the server masks in Visitor and agent messages: card numbers (checked with the Luhn algorithm), IBANs, e-mail addresses, telephone numbers written with a leading "+" or "0", German tax numbers, tax identification numbers and identity-card numbers, and strings that look like secrets; the stored message contains a placeholder and a count of the masked items. Masking does not apply to messages written through the REST API and to the values of forms sent in the chat;
• the Assistant does not ask for access data and cannot carry out an action that changes something without the Visitor's explicit confirmation;
• attachments are accepted only in allowed formats, their content is checked against the declared type, and they are delivered in a way that prevents scripts from running. There is no virus scan; Team Members should open attachments from unknown Visitors with care.

3.3 Anyone who notices that the Service is used for phishing should report it immediately (section 6). The Operator treats such reports with priority and may block a project before the Customer has been heard (section 7.6).

4. Limits and throttling

4.1 To keep the Service available for everyone, the following limits apply. The values are the defaults at the time of this version; the Operator may change them to protect the Service. Some protective guards can be operated either in a measuring mode, in which they only count, or in a blocking mode; the Operator decides per guard.

4.2 Real-time connection (Widget and agent dashboard):

• at most 64 KiB per frame;
• at most 120 frames and 20 messages per 10 seconds per connection; whoever exceeds this repeatedly is disconnected;
• at most 3 simultaneous connections per session and at most 1,000 connections in total per server;
• the first message after connecting must arrive within 5 seconds;
• message length: Visitors 1,000 characters on the Free plan and 4,000 characters on paid plans; agents 4,000 characters;
• automatic temporary blocks of addresses that exceed limits, by default for 24 hours.

4.3 AI functions:

• AI jobs per conversation and minute: Free 8, Professional 15, Agency 30;
• AI jobs per website and minute for all Visitors together: Free 30, Professional 60, Agency and individual contracts 120;
• AI jobs per website and address: 30 per minute;
• above these limits, the Visitor receives a fixed sentence instead of a model answer;
• answers from general knowledge: at most 3 per conversation by default (see the AI Act page, section 8.2).

4.4 Accounts and forms:

• log-in: after 5 failed attempts the account is locked for 15 minutes; at most 30 attempts per address in 15 minutes;
• second factor: at most 30 attempts per address and 10 per account in 15 minutes;
• registration: at most 10 per address and hour;
• password reset: at most 10 requests per address in 15 minutes;
• support form: at most 20 attempts in 10 minutes and 10 submissions per hour per address;
• Google reCAPTCHA v3 on the log-in, registration, password-reset and support forms; never in the Widget.

4.5 Interfaces and files:

• REST API: 120 requests per 60 seconds per key; at most 60 failed key attempts per address in 15 minutes; request body at most 64 KiB, message text at most 4,000 characters;
• requests to the web application: body at most 2 MiB;
• attachments: Free up to 2 MB per file, paid plans up to 15 MB, within the storage quota of the plan.

4.6 A note on addresses. Many people can share one IP address, for example in a company network, at a mobile operator or behind a VPN. Automatic measures therefore prefer short, temporary blocks. A block by address can affect people who did nothing wrong. Whoever is affected can ask for a review (section 9).

5. Tools for the Customer's agents: /ban and /spam

5.1 Team Members with the right to close conversations (by default owner, admin and member (agent), unless the workspace has restricted members) can type the following commands in the reply field of the agent dashboard:

• /ban [duration] [reason] blocks the Visitor of the current conversation. The duration is given as for example 30m, 12h or 7d; it is at least 1 minute, by default 24 hours and at most 365 days. The reason is optional (at most 160 characters). The conversation is closed.
• /spam does the same as /ban for 24 hours with the reason "spam" and marks the conversation as spam.

5.2 What a block covers. A block applies to two things at once:

• the Visitor identifier on the website (project) concerned, so that the same browser cannot continue on that website; and
• the IP addresses of the Visitor's current connections in that session; for IPv6 addresses, the whole /64 network to which the address belongs.

5.3 Important: an address block applies across the Service. If the Visitor is connected directly to the Service, the block of the address applies for its whole duration to the Widget on the websites of all Customers of the Service, not only to the Customer who set it. Only if the Visitor is connected through the Customer's own domain (proxy), the address block applies to that Customer's project only. Because an address can be shared by many people (section 4.6), the Customer must use /ban carefully:

• only against actual abuse (for example spam, insults, attacks, fraud attempts), not to refuse service or for convenience;
• with the shortest duration that is sufficient; long blocks only in serious or repeated cases;
• never on grounds protected by anti-discrimination law, and not in a way that breaches the Customer's own legal obligations towards its Visitors.

5.4 The Operator can view and lift blocks at any time, in particular on a justified request of a person affected (section 9), and may restrict or withdraw the use of /ban for a Customer who uses it in breach of this section. There is currently no list in the dashboard in which Customers can view or lift their own blocks; Customers who want a block lifted early write to contact@lukaswojcik.com.

5.5 Other tools: closing a conversation, transferring it to a colleague, and internal notes. The Operator itself maintains manual block lists for the real-time server and can suspend user accounts and workspaces (section 10).

6. How to report

6.1 Reports of abuse, of illegal content and of security problems go to contact@lukaswojcik.com. Customers can also use the support form in the dashboard.

6.2 A report of illegal content (notice under Article 16 of the Digital Services Act) should contain:

• a sufficiently substantiated explanation of why the content is considered illegal;
• a clear indication of where it is: website address or project, the conversation if known, date and time, and if possible a screenshot or the wording;
• the name and e-mail address of the reporting person, except for reports concerning child sexual abuse material and certain related offences, which may be made anonymously;
• a statement that the reporting person believes in good faith that the information is accurate and complete.

For intellectual-property claims: in addition, the right concerned and a statement that the reporting person is the rights holder or acts on the rights holder's behalf.

6.3 Reports of security vulnerabilities should describe the problem so that it can be reproduced, and should not include personal data of other people. Please do not test vulnerabilities on data of other Customers or Visitors, and do not disrupt the Service.

7. How the Operator handles reports

7.1 Confirmation. Where the report contains contact details, the Operator confirms receipt by e-mail.

7.2 Review. The Operator reviews reports in a timely, diligent, non-arbitrary and objective manner. Decisions are taken by a person; automated means are not used to decide on reports. If the report is incomplete, the Operator may ask for more information.

7.3 Content of the Customer's conversations. Where a report concerns messages in conversations between a Customer and its Visitors, the Customer is the first point of contact as controller and as party to the conversation. The Operator forwards such reports to the Customer and sets a period for a response, unless the content is manifestly illegal or a matter is urgent.

7.4 Decision. The Operator informs the reporting person of its decision without undue delay and of the possibility of redress (section 9).

7.5 Measures, in ascending order and according to severity: a request for information or a warning to the Customer; removal of or blocking access to specific content; restriction of specific functions (for example campaigns, AI, actions, uploads) or of the Widget on a website; temporary suspension of a project, workspace or account; termination for cause under the Terms of Service.

7.6 Urgent cases. Where the security of the Service or of third parties, life or health, or the rights of others are seriously endangered (for example phishing, malware, attacks), the Operator may act first and inform afterwards.

7.7 Statement of reasons. If the Operator removes or restricts content of a Customer or suspends a Customer, it informs the Customer at the latest when the measure takes effect, with a statement of reasons (Article 17 of the Digital Services Act): what was done and for how long, the facts and circumstances, whether the measure was based on a report, the legal or contractual ground, and the possibilities of redress. This does not apply where an authority has ordered otherwise or where informing would endanger an investigation or other persons.

7.8 Criminal offences threatening life or safety. If the Operator becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, it informs the competent law-enforcement or judicial authorities (Article 18 of the Digital Services Act).

7.9 Evidence. The Operator keeps what is needed to handle a report (the content concerned, times, technical identifiers, log entries) for as long as necessary for the report, for the defence of claims or because of legal obligations, and deletes it afterwards.

7.10 Abusive reports. The Operator may, after a warning, suspend for a reasonable period the processing of reports from persons who frequently submit manifestly unfounded reports.

7.11 Transparency reports. As a micro-enterprise, the Operator is exempt from the transparency reports under Article 15 of the Digital Services Act.

8. Cooperation with authorities

8.1 The Operator cooperates with courts, law-enforcement and other competent authorities within the framework of the law. Orders to act against illegal content (Article 9 of the Digital Services Act) and orders to provide information (Article 10) are carried out after checking their formal requirements; the Operator informs the authority of the effect given to the order.

8.2 Data is disclosed only on a legal basis and only to the extent required. The Operator informs the Customer or person concerned of the order and its effect, unless the authority or the law prohibits this.

8.3 The Operator has access to data of conversations only to the extent described in the Data Processing Agreement; for data in conversations, the Customer as controller is the first addressee of requests from authorities. Where an authority contacts the Operator directly, the Operator informs the Customer as far as permitted.

9. Objection and redress

9.1 Anyone affected by a measure, a Customer whose content was removed or whose account was restricted, a Visitor blocked by an address block, and a reporting person who disagrees with a decision, can object through the complaints procedure or by e-mail to contact@lukaswojcik.com. The objection is reviewed by a person; the Operator answers within 14 days.

9.2 An objection does not suspend a measure that protects the security of the Service or the rights of others.

9.3 The right to go to court remains unaffected.

10. Payment fraud

10.1 Payments are processed by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). Card data is entered only on Stripe's payment page and is not seen by the Operator. Stripe applies its own fraud checks; the Operator may refuse or reverse orders that Stripe flags as fraudulent.

10.2 The VAT ID entered at checkout is checked by Stripe against the EU VIES database. Whoever enters the VAT ID of another business or false billing data commits a serious breach of contract.

10.3 If a Customer initiates a chargeback for a properly invoiced fee, the Operator may suspend paid functions until the matter is settled and may terminate for cause if it happens again. Disputes about invoices should first be raised through the complaints procedure.

10.4 Accounts created with false billing data or unauthorised payment methods may be suspended or closed without notice.

10.5 If a payment fails, the Service continues for the time being; the Operator reserves the right to restrict or suspend paid functions in case of default of payment, as set out in the Terms of Service.

11. Sanctions against Customers

11.1 In the event of a breach of this policy, the Operator may take the measures listed in section 7.5. When choosing, it takes into account the severity, the number and the duration of the breaches, whether the Customer acted intentionally or negligently, the harm to third parties, and how the Customer responded.

11.2 To this end the Operator may, among other things, switch off individual functions per project (function switches), stop the AI for a project or globally (emergency stop), block the Widget of a project, and suspend user accounts and workspaces.

11.3 A suspension does not delete data. What happens to the data after a termination is governed by the Terms of Service and Access and deletion.

11.4 Claims of the Operator for damages and the Customer's obligation to indemnify the Operator against claims of third parties under the Terms of Service remain unaffected.

12. Changes

The Operator may amend this policy, in particular when the Service, the limits or the law change. Material changes are announced to Customers by e-mail or in the dashboard before they take effect; the Terms of Service apply to changes.

This document is drawn up in English. Translations into German (/de/p/missbrauchs-und-betrugsbekaempfung) and Polish (/pl/p/przeciwdzialanie-naduzyciom-i-oszustwom) are provided for convenience; the English version prevails.

Version 2.2 replaces version 2.1 of 11 October 2026. Corrected: scope of masking before storage (3.2); for IPv6, an address block covers the whole /64 network (5.2).

Version 2.1 replaces version 2.0 of 11 October 2026. Changed: use for the purposes of Annex III point 4 of the AI Act (employment, job applications) excluded (section 2).

Version 2.2 – effective 12 October 2026.