ACCEPTABLE USE POLICY

This Acceptable Use Policy ("AUP") governs use of products, technology, data, applications, integrations, communications tools, and other services provided or made available by Civic Bridge LLC ("Civic Bridge").

This AUP forms part of Civic Bridge's Terms of Service and applicable client agreements.

Capitalized terms not defined here have the meanings provided in the applicable MSA, SOW, or Terms of Service.

1. General Requirement

Clients and Authorized Users may use Civic Bridge Services only for lawful purposes and in accordance with their applicable agreements with Civic Bridge.

Client is responsible for the conduct of individuals accessing the Services through Client's accounts.

Client may not use or permit use of the Services in a manner that violates this AUP.

2. Permitted Political and Civic Uses

Subject to applicable law, contractual restrictions, and third-party data licenses, Civic Bridge Services may be used for authorized political, electoral, campaign, advocacy, organizing, fundraising, voter-contact, field, communications, research, civic-engagement, and related organizational purposes.

Permitted use depends on the Client's organization type, jurisdiction, applicable law, applicable SOW, and the restrictions associated with particular data or third-party services.

Access to Civic Bridge does not independently authorize an activity that is otherwise prohibited by law or by a third-party data license.

3. Voter and Consumer Data

Client must use voter, consumer, contact, demographic, modeled, enriched, and other data obtained through Civic Bridge only for authorized purposes.

Unless expressly permitted under an applicable agreement, Client may not:

• sell, sublicense, rent, publish, distribute, or otherwise provide Civic Bridge-provided or third-party licensed data to another person or organization;
• make data publicly available;
• provide data to an unauthorized campaign, committee, organization, consultant, vendor, or other third party;
• circumvent geographic, organizational, Campaign Universe, licensing, or other access limitations;
• use data for a purpose prohibited by the applicable data provider;
• attempt to identify or obtain restricted data elements that Civic Bridge has intentionally withheld or limited; or
• retain or use licensed data after Client's rights to that data have expired where continued retention or use is prohibited.

Client may provide authorized access to employees, contractors, consultants, volunteers, or other personnel as permitted under Client's agreement with Civic Bridge, provided such individuals use the data solely for Client's authorized purposes and comply with applicable restrictions.

4. Prohibited Consumer-Reporting and Eligibility Uses

Client may not use the Services, data available through the Services, or information derived from the Services, in whole or in part, to determine or evaluate an individual's:

• eligibility for credit;
• eligibility for insurance;
• insurance underwriting;
• employment, promotion, reassignment, or retention;
• eligibility for a governmental license, benefit, or similar entitlement.

Client also may not use the Services for solicitation of survivors of deceased individuals or in support of jury consulting or potential-juror analysis.

These restrictions reflect prohibitions already contained in Civic Bridge's client MSA.

5. Messaging and Communications

Client is solely responsible for ensuring that communications sent through the Services comply with applicable law and provider requirements.

Client and Authorized Users must comply with all applicable requirements governing telephone calls, SMS, MMS, and other electronic communications, including applicable consent, registration, identification, opt-out, suppression, timing, and recordkeeping requirements.

Where applicable, this includes requirements under the Telephone Consumer Protection Act ("TCPA"), Telemarketing Sales Rule ("TSR"), Telemarketing and Consumer Fraud and Abuse Prevention Act, applicable state and local laws, carrier requirements, messaging-provider policies, and registration requirements such as 10DLC.

The MSA specifically assigns responsibility for required TCPA/TSR consent to the Client.

Client may not knowingly use the Services to:

• send communications to persons where required consent has not been obtained;
• continue messaging recipients after a legally effective opt-out;
• circumvent suppression lists or opt-out mechanisms;
• falsify sender identity or registration information;
• evade carrier, aggregator, or messaging-provider restrictions;
• artificially distribute traffic across accounts or numbers to evade enforcement;
• engage in unlawful spam or deceptive communications; or
• use Civic Bridge messaging infrastructure for an unauthorized organization or third party.

6. Prohibited Content

Client may not knowingly transmit, upload, publish, distribute, or communicate through the Services content that:

• is unlawful;
• is harassing;
• is libelous or defamatory;
• is obscene;
• infringes or misappropriates intellectual-property rights;
• violates privacy, publicity, or other legal rights;
• encourages criminal conduct; or
• otherwise violates applicable law.

These restrictions are intended to implement the content restrictions already contained in the MSA.

7. Security and System Integrity

Client and Authorized Users may not:

• attempt to gain unauthorized access to Civic Bridge systems, accounts, data, APIs, networks, or third-party systems;
• access another client's data without authorization;
• bypass authentication or authorization controls;
• disable or circumvent security features;
• probe, scan, or test vulnerabilities without Civic Bridge's prior written authorization;
• interfere with or disrupt the operation of the Services;
• knowingly upload or transmit viruses, worms, Trojan horses, malware, malicious scripts, destructive code, or other harmful technology;
• use automated processes in a manner that materially degrades the Services or violates applicable usage restrictions;
• attempt to extract source code except where expressly permitted by law and an applicable agreement; or
• assist another person in performing any prohibited activity.

These restrictions are consistent with the security and malicious-code provisions in the existing MSA.

8. Reverse Engineering and Unauthorized Exploitation

Except as expressly authorized in writing by Civic Bridge or permitted by applicable law notwithstanding contractual restriction, Client may not:

• reverse engineer;
• disassemble;
• decompile;
• translate;
• modify;
• create unauthorized derivative works from; or
• otherwise attempt to discover the source code or underlying proprietary technology of the Civic Bridge Services.

Client may not remove or obscure proprietary-rights notices or use Civic Bridge technology to create or support an unauthorized competing service.

9. Accounts and Credentials

Client must take reasonable measures to protect accounts and credentials.

Client may not knowingly:

• share individual credentials among multiple unauthorized users;
• sell or transfer access credentials;
• allow a person or organization that is not authorized under Client's agreement to access the Services;
• impersonate another user;
• provide false account or registration information; or
• continue using credentials belonging to a former employee, contractor, volunteer, or other user whose authorization has ended.

Suspected unauthorized access or credential compromise must be reported to Civic Bridge promptly.

9A. Election and Campaign Finance Compliance

Client is solely responsible for ensuring that every invitation and access permission it grants complies with applicable federal, state, and local election and campaign finance laws. This includes rules on coordinated communications and expenditures, in-kind contributions, contribution limits and prohibited sources, common vendors and former employees, and the sharing of non-public information with candidates, party committees, or independent-expenditure-only committees.

If Client is required to maintain a firewall or information barrier, Client is solely responsible for designing, implementing, and enforcing it, including through its permission settings in the Services. Civic Bridge does not establish, monitor, or enforce firewalls. Civic Bridge makes no representation that any feature of the Services satisfies a legal firewall requirement or safe harbor. Civic Bridge does not provide legal advice.

Client must promptly revoke access that is no longer appropriate, for example when an invited user changes roles or employers or becomes subject to a firewall. If Client becomes aware that an invited user may have obtained access in violation of law or a firewall, Client must revoke that access and notify Civic Bridge at [email protected].

10. Third-Party Services

Use of NationBuilder, Ecanvasser, Prompt.io, voter-data services, communications providers, and other third-party products made available through Civic Bridge remains subject to applicable provider terms and restrictions.

Client may not use Civic Bridge to circumvent limitations imposed by those providers.

Conduct that threatens Civic Bridge's access to or contractual relationship with a third-party provider may constitute a violation of this AUP.

11. Data Exports

Client is responsible for protecting information exported or downloaded from Civic Bridge-supported systems.

Exporting data does not eliminate restrictions applicable to that data.

Any applicable limitations concerning use, disclosure, redistribution, retention, security, or deletion continue to apply to exported copies.

12. Data Submitted by Client

Client may submit to Civic Bridge only data that Client is authorized to provide and permit Civic Bridge to process.

Client may not knowingly provide Civic Bridge with data obtained unlawfully or data whose transfer to Civic Bridge would violate Client's contractual or legal obligations.

Client acknowledges that data generated or contributed through the Services may be processed and used by Civic Bridge as authorized under the applicable MSA, SOW, DPA, and Terms of Service, including applicable rights concerning data enrichment, analytics, modeling, and platform improvement.

Nothing in this AUP restricts data-use or modeling rights otherwise granted to Civic Bridge under those agreements.

13. Circumvention

Client may not take actions intended primarily to circumvent Civic Bridge's pricing, Campaign Universe limitations, messaging allowances, account restrictions, access controls, usage limitations, or enforcement measures.

For example, Client may not create duplicate accounts or artificially divide a single authorized use across multiple accounts for the purpose of avoiding an applicable limit.

14. Investigations and Cooperation

Civic Bridge may reasonably investigate suspected violations of this AUP.

Client agrees to reasonably cooperate with Civic Bridge in investigating security incidents, unauthorized data use, messaging complaints, provider inquiries, or suspected violations involving Client's accounts.

Civic Bridge may take reasonable steps to protect its systems, data providers, technology partners, clients, and other users during an investigation.

15. Enforcement

Civic Bridge may take action where it reasonably believes Client or an Authorized User has violated this AUP.

Depending upon the nature and severity of the violation, Civic Bridge may:

• notify Client of the issue;
• request corrective action;
• restrict particular functionality;
• disable an Authorized User;
• suspend messaging or data access;
• suspend some or all Services; or
• revoke access or terminate Services where permitted under the applicable MSA.

Civic Bridge may act immediately where reasonably necessary to address suspected unlawful activity, unauthorized data disclosure, cybersecurity threats, messaging abuse, threats to third-party provider relationships, or other material risks. If Civic Bridge terminates services to Client because of Client’s violation of AUP, Client is not entitled to any refund or return of funds.

Civic Bridge's failure to enforce this AUP in one instance does not waive its right to enforce the AUP in another instance. Nor does Civic Bridge’s failure or choice not to enforce this AUP constitute agreement, approval, condoning, or acquiescence to conduct that violates this AUP.

16. Reporting Violations

Suspected security issues, unauthorized access, misuse of Civic Bridge data, or other violations of this AUP should be reported promptly to:

Civic Bridge LLC | [email protected] | 1701 Rhode Island Ave NW, Washington, DC 20036

17. Changes to This Policy

Civic Bridge may update this AUP as its Services, provider requirements, legal obligations, security practices, or business operations evolve.

Updates become effective as provided under the applicable MSA or Terms of Service.

An update to this AUP does not override expressly negotiated provisions of an executed MSA or SOW except as permitted by that agreement.