Acceptable Use Policy

1. About this policy

This Acceptable Use Policy sets out the rules for using MCPForm.io (the “Service”). MCPForm.io is a product of Talitu Ltd (“we”, “us”). The Service includes the website at www.mcpform.io, the dashboard at app.mcpform.io, the MCP server at mcp.mcpform.io, the API at api.mcpform.io, the CLI, the public forms and short links we serve on mcpforms.io and the emails the Service sends for you.

“You” means the customer: the organisation that signs up and everyone it lets into its workspaces, including its team and any agency acting for it. A “lead” is a person who fills in one of your forms.

This policy forms part of, and should be read with, our Terms of Service. Our Privacy Policy explains how we handle personal data. By using the Service you agree to this policy.

2. General rules

You must use the Service lawfully, honestly and in good faith. You must not use the Service in any way that breaks the law, infringes the rights of others, harms people or could damage, disable, overload or impair the Service or anyone’s use of it.

3. Prohibited conduct

You must not:

• Give false or misleading information when you sign up, or pretend to be someone else.
• Publish or send content that is unlawful, defamatory, fraudulent, harassing, hateful, obscene or that exploits, sexualises or endangers children.
• Make false or unsupported claims about products, results, prices or qualifications in a form, its results page or an email, or break advertising, consumer-protection or platform rules.
• Upload or send viruses, malware or other harmful code.
• Try to get into the Service, another customer’s workspace or our systems without permission.
• Probe, scan, test, reverse-engineer or get around our security controls, bot checks, rate limits or plan limits, except as section 7 allows.
• Interfere with, overload or disrupt the Service or the systems it runs on.
• Copy, resell, sublicense or commercially exploit the Service without our written permission. An agency may run workspaces for its own clients.
• Use the Service to infringe intellectual property or other rights of any person.

4. What your forms may not collect or do

Your forms are public pages that anyone can open. You decide what each form asks and who it is for, so you are responsible for what it collects. Your forms must not ask for or collect:

• Payment card numbers, card security codes or bank login details.
• Passwords, PINs, security answers or one-time codes for any service.
• Government identity numbers, such as passport, National Insurance or social security numbers.
• Special category data (health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation) or criminal records data, unless you have a lawful basis and a legal condition that allows it, and the form tells people clearly why you are asking.
• Data from children. Forms must be aimed at adults acting for themselves or their work.

Your forms must not:

• Pretend to be, or copy the name, logo or look of, another organisation or person without their permission.
• Be used for phishing: tricking people into giving sign-in details, payment details or other data they would not knowingly give you.
• Look like a sign-in page, a payment page or a message from a bank, a public body or a well-known service.
• Hide what the form is for, who is asking or what will happen to the answers. Hidden URL parameters must not be used to attach personal data the visitor has not been told about.
• Promise a prize, result or reward you do not intend to give in order to collect details.
• Spread malware, link to harmful sites or send visitors somewhere other than where the form says.
• Use our name in a way that suggests we made, checked or endorse the form or its content.

Each form must tell visitors who you are and link to your own privacy notice that explains how you will use their answers.

5. Email follow-up

The Service can email leads on your behalf. These rules apply to every email sent through it. You must:

• Email only leads who opted in through your own form. The Service sends follow-up only to leads who opted in, and you must not try to get around that.
• Not load, import or email bought, rented, borrowed, shared or scraped lists.
• Not use the Service for cold outbound email of any kind, including to people whose details came from enrichment data rather than from your form.
• Honour every stop. Every email carries a one-click unsubscribe and a stop always wins. Do not remove or hide the unsubscribe link, re-add a lead who has stopped or use the data you collected to keep emailing them another way.
• Treat a reply that asks you to stop as a stop, even if the lead did not click the link.
• Name your business clearly as the sender and not hide or fake the sender, the subject or the purpose of an email.
• Keep each email about what the lead asked for, at a frequency and volume that does not amount to harassment or break your email provider’s rules.
• Follow the email and marketing laws that apply to you and your leads, including UK PECR, UK GDPR, the EU ePrivacy rules, CAN-SPAM and CASL.

You are responsible for keeping your own stop and suppression records in the other tools you send leads to, such as your CRM, and for honouring them there too.

6. Lead data, enrichment and scoring

When you ask, the Service fills in company, job, website and LinkedIn details for a lead from data enrichment providers, and scores the lead by your own rules with the reasons shown. That data is for you to follow up the leads who filled in your forms. You must not:

• Sell, rent, license, share or give enrichment data to anyone else, or publish it.
• Use the Service to build a lead list or database for resale, or for anyone other than your own business. An agency may use it for the client whose workspace the lead came in through, and only for that client.
• Use the Service to look up or enrich people who did not fill in your form, or feed in lists of names or emails to get data back.
• Export lead or enrichment data in bulk to build or top up a separate database.
• Use the Service as a way to get data from our data providers outside normal use of your forms.
• Write scoring rules that use special category data or that treat people unfairly because of a protected characteristic.
• Use a score on its own to make a decision about a person’s credit, employment, housing, insurance or access to an essential service.

7. API, MCP server and CLI

You can use the Service from your AI tool through the MCP server, from your own code through the API and from the command line through the CLI. You must:

• Use only your own API keys and sign-ins. Keep them secret and share them only with people in your team who need them.
• Stay within the rate limits and usage limits for your plan and not spread work across extra keys, workspaces or sign-ups to get around them.
• Not scrape or crawl the Service, other customers’ public forms or short links, or try to list workspaces, forms or short links you do not own.
• Not use the API or MCP server to send spam, flood forms with fake responses or run load tests.
• Not connect an AI tool or automation to the Service that you have not checked, or let one act in a workspace beyond what you have allowed it to do. What an AI tool does in your workspace with your access is your responsibility.
• Not try to get around a bot check on a public form.
• Not run security tests against the Service without our written permission. If you find a security problem, report it to abuse@mcpform.io and give us a fair chance to fix it before you tell anyone else.

8. Regulated and professional advice

Calculators, quizzes and assessments give people an answer, so they need care. You must not present a form’s result as legal, financial, tax, insurance, medical or other regulated advice unless you are allowed to give that advice and the result says who is giving it.

Where a result touches on a regulated subject, it must say plainly that it is general information and not personal advice, and point people to a qualified professional. You are responsible for the figures, logic and wording in your forms and their results, even where an AI tool helped you write them.

You are responsible for any notices, consents or disclosures the law requires about your forms, your emails and any use of AI in them, in each place where your leads are.

9. Your responsibilities as a customer

For the personal data your forms collect, you are the controller and we act as your processor on your instructions. You must:

• Have a lawful basis for every piece of personal data your forms collect and for every use you make of it, including enrichment, scoring and email follow-up.
• Give leads the notices the law requires and get any consents it requires, and keep a record of them.
• Make sure the content, offers, prices and claims in your forms, results and emails are accurate, current and lawful.
• Hold any licences, registrations and qualifications you need to offer your services where you trade.
• Answer requests from leads who want to see, correct or delete their data. We will help where the Service makes that possible.
• Make sure everyone you let into a workspace, including clients and contractors, follows this policy. If you are an agency, you are responsible for every workspace you run.
• Tell us promptly at privacy@mcpform.io about any complaint, regulator contact or security incident that relates to your use of the Service.

Your workspace data is held in the United States. If you collect data from people in the UK or the EU, you are responsible for telling them that in your privacy notice.

10. Content you submit

You are responsible for the content, prompts, instructions, settings and files you put into the Service, whether you do it in the dashboard, through your AI tool, the API or the CLI. You confirm that you have the rights to use them and that they do not break this policy or any law. We may review, restrict or remove content that we believe breaks this policy, but we do not have to.

11. Reporting misuse

If you see a form, short link or email that you think breaks this policy, please report it to abuse@mcpform.io. Include the link or a copy of the email if you can. We read every report.

If you filled in a form on mcpforms.io and want to see or delete your answers, contact the business that ran the form first, since they control that data. If you cannot reach them, write to privacy@mcpform.io.

12. What happens when we act

If we believe this policy has been broken, we may do any of these, in proportion to the risk:

• Ask you to fix the problem by a set time.
• Remove content, or unpublish a form or short link so its public page stops working.
• Pause email follow-up from a workspace.
• Revoke API keys, MCP connections or a team member’s access.
• Suspend a workspace, or every workspace in your organisation.
• Close your organisation’s use of the Service, as our Terms of Service allow.
• Report the matter to the police, regulators, the organisation being impersonated or the people affected.

We may act at once. Where a form or email looks like phishing or fraud, puts people’s data at risk or harms the Service or other customers, we may unpublish it or suspend the workspace straight away, before we contact you. We will tell the workspace owner what we did and why, unless the law or the risk stops us, and work with you on putting things right where that is reasonable.

The “Built with MCPForm.io” line. Forms on the Free plan carry a “Built with MCPForm.io” line that links to www.mcpform.io. You must not hide, cover, remove or change it on the Free plan, by code, styling or any other means. Paid plans remove it. If the line is hidden on a Free plan form, we may put it back or unpublish the form.

Suspending a workspace does not delete its data straight away. Our Terms of Service explain what happens to your data if your use of the Service ends.

If you think we got it wrong, reply to our notice or write to abuse@mcpform.io and we will look again.

13. Changes to this policy

We may update this policy from time to time. The “last updated” date shows when the latest version took effect. Continuing to use the Service after changes take effect means you accept the updated policy.

14. Contact

Questions about this policy can be sent to hello@mcpform.io. Reports of misuse should go to abuse@mcpform.io. Privacy questions and data requests should go to privacy@mcpform.io.

MCPForm.io is a product of Talitu Ltd, registered in England and Wales, company no. 10295016. Registered office: 483 Green Lanes, London N13 4BS.