Acceptable Use Policy (International)

Service Domain: lexaris.ru
Operator: Lexaris (IE Kudryavtsev S.A.)

This document is dynamically generated based on settings configured by the Operator in the Platform Admin Panel. Placeholder values in brackets represent current settings populated at runtime.

---

1. Purpose

This Acceptable Use Policy ("AUP") defines the standards of acceptable and prohibited use of the Lexaris PII anonymization platform ("Platform", "Service"), operated by Lexaris (IE Kudryavtsev S.A.) ("Operator", "we").

This AUP is incorporated by reference into the Lexaris Terms of Service, available at lexaris.ru/user-agreement-en. By accessing or using the Service, you ("User") agree to comply with this AUP. Capitalised terms used but not defined here have the meanings given in the Terms of Service.

The purpose of this AUP is to:

• Protect data subjects whose personal data appears in documents processed through the Platform;
• Prevent the Platform from being used as a tool to facilitate harm, criminal activity, or discrimination;
• Maintain the integrity and availability of the Service for all Users;
• Ensure the Operator's ability to comply with applicable law and regulatory obligations.

---

2. Permitted Use

2.1. General Principle. The Service is designed for the lawful anonymization of documents containing personal data. Permitted use is use that:

(a) serves a legitimate purpose under applicable data protection law;
(b) does not harm data subjects, third parties, or the Operator;
(c) complies with this AUP, the Terms of Service, and applicable law.

2.2. Specific Permitted Use Cases. The following are examples of lawful, intended use of the Service:

2.2.1. GDPR Compliance and Data Minimization.
Anonymizing documents to fulfil obligations under GDPR Article 5(1)(c) (data minimization) and Article 25 (data protection by design and by default); preparing anonymized versions of documents for sharing with parties who do not require access to identifiable personal data; responding to data subject access requests by producing anonymized copies of third-party data in disclosure packages.

2.2.2. Legal Proceedings and Judicial Processes.
Anonymizing case materials, court filings, witness statements, and evidence for disclosure where applicable rules require or permit redaction of third-party PII; preparing court decisions and tribunal rulings for publication in anonymized form; producing anonymized document bundles for arbitration or regulatory proceedings.

2.2.3. Academic Research and Education.
Anonymizing datasets and source documents for use in academic research, dissertation work, peer-reviewed publication, and education, where the research purpose cannot reasonably be served using fully synthetic data; preparing anonymized case studies for training programmes.

2.2.4. Journalism and Source Protection.
Anonymizing documents to protect the identity of confidential journalistic sources; processing leaked or disclosed documents to remove incidental personal data of individuals not themselves the subject of public-interest reporting.

2.2.5. Whistleblowing and Regulatory Disclosure.
Anonymizing supporting documents when making protected disclosures to regulators, anti-corruption bodies, or law enforcement, to protect the identity of individuals not involved in the reported conduct; preparing submissions under whistleblower protection frameworks.

2.2.6. Corporate and Organisational Use.
Anonymizing internal documents for external audit, due diligence, and regulatory review; preparing test and development datasets from real documents without exposing live personal data; anonymizing HR records, customer data, and internal reports for lawful secondary use purposes.

2.2.7. Healthcare, Social Care, and Research.
Anonymizing medical records and clinical notes for research publication, clinical audit, and quality improvement, where required by applicable health data regulation; preparing anonymized patient data for inter-institutional research collaboration.

---

3. Prohibited Content

3.1. Absolutely Prohibited Content. The following categories of content must not be uploaded to or processed through the Platform under any circumstances:

3.1.1. Child Sexual Abuse Material (CSAM).
Any image, video, text, or document depicting, describing, or facilitating the sexual abuse or exploitation of individuals under 18 years of age, regardless of whether the content is real, AI-generated, or purportedly fictional. Discovery of CSAM will result in immediate account termination, preservation of evidence, and mandatory reporting to law enforcement and relevant NCMEC/IWF-equivalent bodies.

3.1.2. Evidence Concealment.
Documents uploaded for the purpose of altering, sanitizing, or obscuring evidence of violent crimes, financial crimes, corruption, or other criminal conduct, where the intent is to impede law enforcement investigation, corrupt judicial proceedings, or destroy evidence subject to a legal hold or preservation obligation.

3.1.3. Terrorist and Extremist Content.
Documents that promote, glorify, recruit for, or provide operational support to acts of terrorism, mass violence, genocide, or violent extremism; manifestos, attack plans, or training materials produced by or on behalf of designated terrorist organisations.

3.1.4. Content Designed to Facilitate Fraud.
Documents whose primary purpose is to facilitate identity theft, financial fraud, money laundering, scam operations, or social engineering attacks against individuals or organisations; fabricated or forged documents being processed to make them appear more credible for fraudulent use.

3.2. Conditionally Restricted Content. The following content may be uploaded only when the User holds an appropriate legal basis and complies with applicable law:

3.2.1. Special Categories of Personal Data (GDPR Art. 9).
Documents containing health data, genetic data, biometric data, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life, or sexual orientation. Processing is permitted only where the User holds an explicit lawful basis under GDPR Article 9(2) (or equivalent under applicable local law) and has implemented appropriate safeguards.

3.2.2. Data Relating to Criminal Convictions and Offences.
Documents containing personal data relating to criminal convictions, charges, or offences (GDPR Art. 10). Processing requires a specific legal basis and is subject to applicable restrictions.

3.2.3. Documents Covered by Legal Privilege.
Legal advice, attorney-client communications, and litigation-privileged materials. Users must ensure that uploading such documents to a third-party processor is consistent with applicable professional conduct rules and privilege obligations.

---

4. Prohibited Activities

4.1. Session and Data Integrity.

4.1.1. Cross-session data extraction. Users must not attempt to access, intercept, or extract documents, token mapping tables, or anonymization outputs belonging to another User's session or account. The Platform implements session isolation controls; any attempt to circumvent these controls is a material breach of this AUP.

4.1.2. Exploiting processing results to re-identify data. Where the User has received anonymized output from another party, using the Platform to reverse-engineer or reconstruct the identity of data subjects is prohibited unless the User holds the token mapping table for that specific document and has the lawful authority to de-anonymize.

4.2. Automated Scraping and Abuse.

4.2.1. Automated scraping. Using bots, scripts, or automated tools to extract data, responses, or processing patterns from the Platform's API or user interface in a manner not authorized by the Terms of Service or the Platform's API documentation.

4.2.2. Circumventing usage limits. Creating multiple accounts, cycling accounts, sharing API keys, or employing any other mechanism to aggregate free-tier allowances or bypass subscription-tier limits.

4.2.3. Denial-of-service. Deliberately submitting requests designed to overload, crash, or degrade the Platform's services, including but not limited to submission of extremely large files, extremely high request volumes, or recursive processing patterns.

4.3. Unauthorised Processing.

4.3.1. Processing data without legal authority. Uploading documents containing personal data that the User has no lawful authority to process, including personal data obtained through data breaches, hacking, social engineering, or other unlawful means; bulk personal data compilations obtained without data subject consent or a valid legal basis.

4.3.2. Circumventing data subject rights. Using the Platform to anonymize personal data for the purpose of preventing data subjects from exercising their rights under applicable data protection law (right of access, right to erasure, etc.) where no other lawful basis for continued retention exists.

4.4. Platform Integrity.

4.4.1. Reverse engineering. Attempting to decompile, disassemble, extract, replicate, or reverse-engineer any component of the Platform, including detection models, algorithms, token-mapping logic, or training data, through any technical means.

4.4.2. Security testing without authorisation. Conducting penetration testing, vulnerability scanning, or security research against the Platform's infrastructure without prior written authorisation from the Operator. Authorised security research may be coordinated via info@lexaris.ru.

4.4.3. Bypassing authentication. Attempting to access the Platform or any account without valid credentials; exploiting authentication vulnerabilities; using session hijacking, CSRF, or similar techniques.

---

5. Rate Limits and Fair Use

5.1. Rate Limits. The Service applies rate limits to protect the availability and performance of shared infrastructure for all Users. Current rate limits by tier are published at lexaris.ru/pricing. The Operator reserves the right to adjust rate limits with reasonable notice.

5.2. Fair Use Principle. Free-tier usage is subject to a fair use principle: usage that is excessive relative to the free tier's intended purpose, disproportionate in its consumption of shared resources, or designed to replicate the capabilities of a paid tier may be throttled or suspended.

5.3. Burst and Quota Enforcement. The Platform enforces both per-minute burst limits and monthly processing quotas. Exceeding quotas will result in request rejection with an HTTP 429 response. Repeatedly triggering rate limits through automated means, rather than purchasing an appropriate subscription tier, is a violation of this AUP.

5.4. Enterprise and High-Volume Use. Organisations with processing requirements exceeding standard subscription limits should contact info@lexaris.ru to arrange a custom enterprise agreement.

---

6. Reporting Violations

6.1. How to Report. If you become aware of content or behaviour on the Platform that violates this AUP — including discovery of CSAM, evidence of criminal activity, or abuse of the Service — please report it immediately to: info@lexaris.ru with the subject line "AUP Violation Report".

6.2. Information to Include. Where possible, include:

• A description of the observed violation;
• Any relevant account identifiers, timestamps, or session references (do not include personal data beyond what is necessary to describe the violation);
• Whether the matter is urgent (e.g., CSAM, ongoing criminal activity).

6.3. Operator Response. The Operator will acknowledge reports within 48 hours and take appropriate action, which may include investigation, account suspension, evidence preservation, and referral to law enforcement. The Operator is not obligated to disclose the outcome of investigations to the reporting party.

6.4. Good Faith Reporting. The Operator will not take adverse action against Users who make good-faith AUP violation reports, even if subsequent investigation concludes that no violation occurred.

---

7. Consequences of Violations

7.1. Graduated Enforcement. The Operator will apply enforcement measures proportionate to the severity, frequency, and intent of the violation:

7.1.1. Warning.
For minor or first-time violations that do not involve prohibited content under Section 3.1 or unauthorised processing under Section 4.3, the Operator will issue a written warning explaining the violation and the required corrective action. A warning does not affect the User's access to the Service.

7.1.2. Temporary Suspension.
For repeated minor violations, violations of rate limits or fair use provisions, or violations of Section 4 that do not involve immediate risk to third parties, the Operator may temporarily suspend the User's account for a period of 24 hours to 30 days. During suspension, access to the Service is restricted. The User will be notified of the suspension and its duration.

7.1.3. Permanent Termination.
The following violations will result in immediate permanent account termination without prior warning or refund of prepaid fees:

• Upload or attempted upload of CSAM (Section 3.1.1);
• Use of the Platform to conceal criminal evidence (Section 3.1.2);
• Upload of terrorist content (Section 3.1.3);
• Processing data for fraud facilitation (Section 3.1.4);
• Deliberate denial-of-service attacks on the Platform (Section 4.2.3);
• Any violation resulting in a court order, regulatory direction, or law enforcement demand requiring account termination.

7.2. Evidence Preservation. Where a violation involves potentially criminal content or activity, the Operator will preserve relevant evidence in accordance with applicable law and cooperate with law enforcement requests made through proper legal channels.

7.3. No Liability for Enforcement Actions. The Operator shall not be liable to the User or any third party for any losses arising from enforcement actions taken in good faith under this AUP.

7.4. Appeals. Users who believe an enforcement action was taken in error may appeal by contacting info@lexaris.ru within 14 days of the action. The Operator will review the appeal and respond within 30 days. Appeals against terminations for CSAM or terrorist content will not be accepted.

---

8. Amendments

This AUP may be amended by the Operator in accordance with the amendment procedure set out in the Terms of Service. Material changes will be communicated with at least 30 days' advance notice.

---

Contact

For AUP-related enquiries, violation reports, or appeals:

Lexaris (IE Kudryavtsev S.A.)
Email: info@lexaris.ru
Website: lexaris.ru

---

This Acceptable Use Policy takes effect on the date stated at the top of this document.