Acceptable Use Policy
What you may not do with data.co, app.data.co, the Data.co Marketplace, and the Data.co API and MCP server. This policy forms part of our Terms of Service and applies to you, your Users, and any application or agent you connect to the Services.
Why this policy exists.
The Services give organizations access to data, APIs and AI tooling. Misuse can harm the people who appear in data, the providers who license it, other customers, and the Services themselves. This policy describes conduct that is not allowed. It is not exhaustive: we may treat conduct that is similar in nature or effect as a violation.
You are responsible for the conduct of your Users and of any application, script, AI agent or MCP client that accesses the Services with your credentials, including actions an agent takes autonomously.
This policy does not govern what you do with Data.co Control in your own infrastructure, which is covered by your license agreement, except that you may not use the Software for the unlawful purposes listed in section 2.
You may not use the Services to:
- Violate any applicable law or regulation, or anyone's rights, including privacy, publicity and intellectual property rights
- Infringe copyrights, trademarks or patents, or misappropriate trade secrets
- Collect, process or disclose personal data without a lawful basis, required notices, or required consents
- Harass, threaten, stalk, defame, dox or unlawfully surveil any person
- Discriminate unlawfully, including in employment, housing, credit, insurance, education or access to services
- Commit fraud, impersonate any person or organization, or misrepresent your identity or affiliation
- Develop, distribute or host malware, ransomware, spyware or other harmful code
- Gain or attempt to gain unauthorized access to any system, account or data
- Send spam or unsolicited bulk communications using data obtained through the Services
- Violate export control or sanctions laws
- Misrepresent the source, provenance or licensing of data
- Facilitate or promote violence, terrorism, child sexual exploitation, or human trafficking
When using AI features, Datasets with AI, or connecting AI agents, you may not:
- Make automated decisions with legal or similarly significant effects on individuals without the human review, notices and safeguards the law requires
- Present AI-generated summaries or output as official, certified or authoritative legal, medical or financial advice, or cite AI case summaries as legal authority
- Use Datasets or AI output to build profiles of private individuals for surveillance, stalking, harassment, or background checks that fall under consumer reporting laws, unless you comply with those laws
- Generate or distribute deceptive content, including deepfakes or fabricated court records, intended to mislead
- Attempt prompt injection, jailbreaks, or other attacks against the Services or other customers' agents through our API or MCP server
- Use the MCP server or API to give an autonomous agent access beyond the scope your organization authorized
- Train, fine-tune or ground models on a Dataset unless its Dataset License permits that use
- Use the Services to develop weapons capable of mass casualties or to facilitate critical infrastructure attacks
When using Marketplace Datasets, the API and the MCP server, you may not:
- Use a Dataset beyond the scope of its Dataset License
- Redistribute, resell, sublicense or republish Datasets unless the Dataset License permits it
- Share API keys or access outside your licensed organization, or embed keys in public client-side code or repositories
- Circumvent rate limits, quotas, metering, paywalls or access controls, including by creating multiple accounts or rotating keys
- Scrape, crawl or bulk-download the Marketplace, graphics or website by automated means, other than through the API within your license or by search engines following our robots.txt
- Attempt to re-identify individuals in de-identified or aggregated data
- Combine Datasets with other data to identify individuals in ways the Dataset License or applicable law prohibits
- Frame or re-host graphics other than with our published embed code
- Remove, alter or obscure provenance, attribution or license notices
- Interfere with or degrade the Services or other customers' use of them
Sharing capacity fairly.
Every plan has rate limits and usage allowances, documented on our rate limits page and in app.data.co. Requests above the limit receive an error response telling your client when to retry. Well-behaved clients respect those responses and back off.
Some plans describe usage as unlimited or as fair use. Fair use means usage consistent with the normal operation of a single organization's applications. Sustained traffic designed to mirror a Dataset, to resell access, or that materially degrades service for others is not fair use. If your usage exceeds fair use, we will contact you first to discuss options, such as a higher plan, before restricting it, unless the usage threatens the stability or security of the Services.
Safe harbor for good-faith research.
We welcome reports of security vulnerabilities. You may test Data.co software running in your own environment without asking us. For data.co, app.data.co, the API and the MCP server, we will not pursue legal action or ask law enforcement to investigate you for research that follows these rules, and we will treat it as authorized for the purposes of anti-hacking laws and our Terms.
Rules for good-faith research: test only against your own accounts and organizations; do not access, modify or delete data that belongs to others, and stop and report immediately if you encounter it; do not degrade service (no denial-of-service, load testing, or spam); do not use social engineering, phishing or physical attacks against our staff or providers; do not test third-party services such as our subprocessors; keep findings confidential until we have resolved the issue or 90 days have passed since your report, whichever comes first, unless we agree otherwise.
How to report: use the contact form at data.co/contact with the topic "Security" and include a description, the affected URL or endpoint, steps to reproduce, and your contact details. We will acknowledge your report within 7 days, keep you informed of our progress, and tell you when it is resolved. We do not currently offer monetary rewards.
This safe harbor does not cover activities that break the law, and if a third party brings legal action against you for research that followed these rules, we will make it known that your actions were authorized.
How to report misuse and what happens next.
- 1
Report
Report suspected misuse of the Services, Datasets or graphics through the contact form at data.co/contact with the topic "Security". Include what you observed, where, and when. Copyright claims follow our copyright policy.
- 2
Investigate
We review reports promptly and may investigate suspected violations, including by reviewing account, usage and log data. We may ask the account holder for information.
- 3
Act proportionately
Depending on severity, we may warn you, require you to fix the issue, throttle or revoke API keys, remove content, suspend access, or terminate your account. Where practical, we notify you first and give you an opportunity to fix the issue; for serious or urgent risks we may act immediately.
- 4
Notify
Where appropriate, we may notify affected Providers, affected individuals, or law enforcement, and cooperate with lawful investigations.
- 5
Appeal
If you believe we acted in error, reply to our notice or contact us. A person not involved in the original decision will review it.
Updates to this policy.
We may update this policy to address new risks or legal requirements. We post updates on this page, and for material changes we notify account holders as described in our Terms of Service.
Last updated: November 6, 2026.
Questions about these terms?
Contact us and we will route your question to the right person.