Acceptable Use Policy
Version: 1.0 Effective from: 2026-10-09 Provider: Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany
This Acceptable Use Policy forms part of the Terms of Service and specifies the obligations of the Customer under Section 5 of the Terms of Service. In the event of conflicts, the order of precedence set out in Section 1 of the Terms of Service applies.
1. Scope
(1) This Policy applies to all persons who use the Choicery platform: Customers, workspace owners, workspace members, employees of the Customer and third parties commissioned by the Customer to use the platform. The Customer ensures that all persons to whom it grants access know and comply with this Policy. Violations by these persons are attributed to the Customer.
(2) The Policy applies to all plans (Free Trial, Pro, Academic, Enterprise) and to all components of the platform, including the surveys delivered via the platform and the export functions.
(3) In relation to consumers, this Policy applies only within the limits of mandatory statutory provisions. The statutory rights of consumers, in particular under Section 18 of the Terms of Service, remain unaffected.
2. Prohibited Uses of the Platform
The following is prohibited:
(1) Reverse engineering. Decompiling, disassembling or otherwise reverse engineering the platform or individual components, unless Sections 69d and 69e of the German Copyright Act (UrhG) mandatorily permit otherwise.
(2) Circumvention of technical protection measures. Circumventing, disabling or manipulating authentication, session and CSRF protection, rate limits, concurrency limits, file size limits, IP restrictions, workspace isolation or checksums on response data.
(3) Systematic copying. Using the platform to create a competing product by systematically copying its functions, user interfaces or output formats. The use of the Customer's own data and results, switching to another provider in accordance with the Data Act Exit and Switching Policy, establishing interoperability to the extent permitted by law, comparative research and competition as such remain permitted.
(4) Scraping. Reading out content or data of the platform by automated means, except via the export and interface functions provided by the Provider or with the prior approval of the Provider in text form (for example e-mail).
(5) Unauthorised testing. Conducting load, penetration, vulnerability or stress tests against the platform or its infrastructure without the prior approval of the Provider in text form. Vulnerabilities noticed during intended use are to be reported in accordance with Section 10.
(6) Account sharing. Passing on access credentials to other persons or allowing an account to be used by several persons. Each person who requires access receives their own account (Section 4(3) of the Terms of Service). The Customer removes departing persons from its workspace without undue delay. If several persons use one account together, the Provider may ask the Customer to set up an account of their own for each person or to choose a suitable plan. If the Customer continues the shared use afterwards, the Provider may suspend the account or terminate the contract (Section 8).
3. Prohibited Content and Data
(1) It is prohibited to upload, distribute or process via the platform content that
a) violates applicable law, in particular criminal law, copyright, trademark or competition law, or whose distribution is unlawful (including content that incites hatred, glorifies violence, is pornographic or is harmful to minors);
b) infringes the personality rights of third parties, in particular real names, photographs, contact details or health information, collected without a legal basis, of persons who are not participants in the respective study, or that serves the impermissible surveillance of persons;
c) contains malware, executable code or scripts that could impair the platform, participants or other users;
d) requests access credentials, passwords, one-time codes or payment data (phishing) or feigns an official, governmental or third-party corporate or personal identity (identity deception).
(2) Data categories not approved. The platform is not approved for the following data categories. The Customer does not collect or process them via the platform. Enabling them is possible only by separate agreement in an Enterprise contract, to the extent that the service providers engaged by the Provider permit the processing:
a) special categories of personal data under Article 9 GDPR (including health data, genetic and biometric data, information on ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation) and data relating to criminal convictions and offences under Article 10 GDPR;
b) Protected Health Information (PHI) within the meaning of 45 C.F.R. § 160.103 (HIPAA). The Provider does not enter into Business Associate Agreements and does not act as a Business Associate;
c) data from education records and from surveys of students at US educational institutions, to the extent that FERPA (20 U.S.C. § 1232g) or PPRA (20 U.S.C. § 1232h) applies. If a Customer uses the platform in such a context, the Customer is responsible for compliance with FERPA and PPRA, in particular for the parental notification with an opportunity to opt out or the parental consent that is required, depending on the funding and the mandatory or voluntary nature of the survey, for questions on the topics protected by PPRA. The Provider acts as a "school official" only on the basis of a separate contract;
d) nonpublic personal financial information within the meaning of the Gramm-Leach-Bliley Act (GLBA);
e) payment card data, bank account and credit card numbers, social security numbers, official identity document and passport numbers and passwords of third parties.
The Customer designs its questionnaires so that these data categories are not requested. If participants nevertheless provide such data unprompted, for example in free-text fields, the Customer deletes them without undue delay.
(3) Data of minors. Accounts may only be created by persons of full age (Section 1 of the Terms of Service). Targeted studies with minors are not permitted via the platform. The Customer does not collect via the platform any personal data of persons under 16 years of age in the European Union and the European Economic Area or any personal data of persons under 13 years of age in the United States (COPPA, 16 C.F.R. Part 312). The Customer designs its surveys so that they are not directed at these age groups. If the Customer becomes aware that such data have been collected, the Customer deletes them without undue delay. If the Provider becomes aware of this, paragraph 4 applies.
(4) The Provider may block access to the affected content and data under paragraphs 1 to 3. Data are deleted on the Customer's instruction or where the law requires it. Section 8 applies accordingly.
4. AI-Supported Functions
(1) It is prohibited to use the platform's AI-supported estimation methods to profile or categorise individual natural persons on the basis of sensitive characteristics (in particular ethnic origin, political opinion, religious or philosophical belief, health, sex life or sexual orientation) or to make predictions about them. The analysis remains limited to the study purposes for which the Customer lawfully collected the data.
(2) Using the platform for automated individual decision-making that produces legal effects concerning a natural person or similarly significantly affects that person (Article 22 GDPR) is prohibited.
5. Invitations and Communication
(1) The Provider does not send survey invitations. The Customer distributes survey links itself (including by e-mail, via panels, social media or its own websites) and is solely responsible for the lawfulness of this communication.
(2) Before sending, the Customer ensures that
a) a legal basis exists for the use of the recipients' contact details;
b) for promotional or commercial invitations, the applicable anti-spam provisions are complied with, in particular Section 7 of the German Act against Unfair Competition (UWG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) in Germany, the CAN-SPAM Act for e-mails to recipients in the USA (including labelling, postal address and a functioning unsubscribe option) and, for SMS or telephone invitations to recipients in the USA, the prior express consent required under the TCPA;
c) a functioning option exists to decline further invitations;
d) no address lists from impermissible sources are used (purchased lists without consent, automatically harvested addresses);
e) participants are informed about the controller and the processing of their data before the survey begins (Section 5 of the Terms of Service).
(3) Research standards. The recognised codes of conduct of market, opinion and social research, in particular the ICC/ESOMAR International Code in its current version, constitute the agreed standard for surveys via the platform. Under these codes, participation is voluntary and may be discontinued at any time. Surveys may not serve as a cover for sales or fundraising solicitation (sugging, frugging) and may not be used as push polls that are intended to influence the opinion of respondents under the guise of a survey.
(4) In the event of complaints from recipients or participants, blocklist entries attributable to the Customer's survey links, or reasonable suspicion of a violation of this section, the Provider may temporarily block the affected surveys. Section 8 applies.
6. Incentives and Prize Competitions
(1) If the Customer uses remuneration, vouchers, raffles or prize competitions as an incentive for participation, the Customer is their sole organiser. The Provider is neither organiser nor sponsor and does not process incentives.
(2) The Customer is solely responsible for the conditions of participation and their announcement, the selection and notification of winners, the payout, all registration, bonding and disclosure obligations under the law of the states in which participants are approached, and for tax obligations arising from the incentives. The Customer ensures that incentives do not result in an unlawful lottery or unlawful gambling.
(3) Incentives may not impair the voluntary nature of participation or the data protection rights of participants. Contact details collected solely for the processing of an incentive may not be used for other purposes.
7. Platform Integrity
(1) The Customer does not use the platform in a manner that impairs security, stability or availability for other users. In particular, the following are prohibited:
a) a disproportionately high number of simultaneous estimation runs, exports, PDF generations or uploads outside the limits applicable to the respective plan;
b) attempts to access the workspaces, projects, response data or results of other Customers;
c) exploiting identified vulnerabilities or malfunctions instead of reporting them in accordance with Section 10;
d) creating multiple Free Trial accounts in order to circumvent plan limits.
(2) The Provider uses rate limits, concurrency limits, file size limits and plan limits to keep the platform stable for all users. Attempts to circumvent these limits constitute a material violation of this Policy.
8. Consequences of Violations
(1) If the Customer or a person attributable to the Customer violates this Policy, the Provider may, in a manner graduated according to severity, repetition and risk to third parties,
a) request the Customer to cease and remedy the violation and set a reasonable period for doing so;
b) block access to individual content, surveys or records (Section 3(4));
c) temporarily suspend the account or individual functions in accordance with Section 16 of the Terms of Service;
d) terminate the contractual relationship for cause in the event of serious or repeated violations (Section 8 of the Terms of Service).
(2) The Provider informs the Customer in text form about the measure, its reason and the possibility of submitting a counter-statement, in the case of blocking or suspension at the latest together with the measure. In cases of imminent danger, in particular ongoing attacks, malware or unlawful content, the measure may be taken immediately; the information is provided subsequently without undue delay.
(3) The Customer may comment on any measure (counter-statement). The Provider reviews the counter-statement and lifts the measure as soon as its reason no longer applies. For measures based on reported content, Section 11 of the Terms of Service additionally applies.
(4) During a suspension, the Provider makes an export of the Customer's data available on request, unless legal reasons preclude this.
(5) Further rights of the Provider, in particular to damages and indemnification under Section 5 of the Terms of Service, remain unaffected. In relation to consumers, the measures of this section apply only within the limits of statutory rights; mandatory consumer rights remain unaffected.
9. Notices
(1) Violations of this Policy, unlawful content in surveys and infringements of third-party rights may be reported via the notice form or by e-mail to abuse@choicery.ai. Participants may additionally report a survey via the link for reporting abuse displayed in the survey. The notice form also serves for notices under Regulation (EU) 2022/2065 (Digital Services Act, DSA) and for copyright notices under 17 U.S.C. § 512 (DMCA). Acknowledgement of receipt, review and statement of reasons for the decision are governed by Section 11 of the Terms of Service.
(2) DMCA. For copyright notices under 17 U.S.C. § 512, Paul Bengart, Keplerstraße 4A, 39104 Magdeburg, Germany, telephone: +49 160 92087997, abuse@choicery.ai, is designated as Designated Agent and registered with the U.S. Copyright Office. Notices contain the information required under 17 U.S.C. § 512(c)(3); counter-notifications by the affected user are governed by 17 U.S.C. § 512(g). Content blocked following a valid notice is made accessible again after an effective counter-notification within the framework of the statutory procedure, unless the notifying party provides evidence of court action within the statutory period.
(3) Repeat infringers. The Provider terminates, in appropriate circumstances, the accounts of users who repeatedly infringe copyrights or other rights of third parties (17 U.S.C. § 512(i)). For this purpose, the Provider consolidates valid notices and measures taken on a per-account basis. Users against whom repeated valid notices have been issued without an effective counter-notification are suspended or terminated in accordance with Section 8.
(4) Notices are processed in German and English.
10. Reporting Vulnerabilities (Responsible Disclosure)
(1) Vulnerabilities in the platform are to be reported to security@choicery.ai. The contact details are also available in our security.txt.
(2) Anyone reporting a vulnerability does not exploit it, does not retrieve third-party data, does not modify or delete any data and does not disclose it to third parties before the Provider has had an opportunity to remedy it. Tests under Section 2(5) remain prohibited without prior approval.
(3) There is no entitlement to a reward.