nvestiv
Talk to IRISOpen Terminal
Menu

Acceptable Use Policy

Last Updated: October 16, 2026

Contact: support@nvestiv.ai

This Acceptable Use Policy ("Policy") governs all use of the Services provided by Nvestiv Capital Corporation ("Nvestiv", "we", "us" or "our"). The "Services" are our website, the Nvestiv app, IRIS, our APIs (the REST API at /api/v1 and the MCP server), integrations, data rooms, shared documents, the newsroom and journals, and managed services. "IRIS" is Nvestiv's AI assistant, available through web chat, voice, email, WhatsApp, SMS, Slack and the API.

This Policy is incorporated into and forms part of the Terms of Service. Capitalised terms that this Policy does not define have the meaning given in the Terms of Service.

By accessing or using the Services, you agree to this Policy. We may change this Policy at any time. A change takes effect when we post it, and the "Last Updated" date shows the current version. If you use the Services after a change, you accept it.

1. Purpose and scope

This Policy exists to:

  • protect the security, integrity and performance of the Services;
  • make sure that data, communications and AI features are used lawfully;
  • prevent misuse that harms Nvestiv, our customers, other users, or people who are not users; and
  • set out what you may and may not do with the Services.

This Policy applies to:

  • every Customer and every user of a workspace, whatever their role (owner, admin or worker);
  • every access point: web, mobile, voice, messaging channels, API, MCP and integrations; and
  • every action that IRIS or an agent takes on your instructions.

You are responsible for the actions that IRIS takes on your instructions, and for the conduct of the users in your workspace.

2. Your responsibilities

You must:

  1. Use the Services in accordance with this Policy, the Terms of Service and applicable law.
  2. Keep your sign-in links, devices, API keys and tokens secure and confidential.
  3. Make sure that you have the rights and consents you need for the content you upload, connect or send through the Services.
  4. Give access only to people you authorise.
  5. Check AI output before you rely on it or send it to anyone. AI output can be wrong or incomplete.
  6. Tell us promptly at support@nvestiv.ai about suspected misuse, unauthorised access or a breach of this Policy.

3. Prohibited conduct

Sections 4 to 19 list the conduct that this Policy prohibits. You must not engage in that conduct, or help, cause or allow another person (including IRIS or an agent acting on your instructions) to engage in it.

4. Security violations and system abuse

You must not:

  • breach or circumvent authentication, access controls or other security protections;
  • probe, scan or test the vulnerability of the Services without our written permission;
  • interfere with, disrupt or degrade the Services;
  • launch or take part in a denial-of-service attack;
  • introduce malware, ransomware, viruses, spyware or other harmful code;
  • try to get unauthorised access to any data, account, workspace or system;
  • use robots, scrapers, crawlers or other automated tools on the Services, except through the APIs we provide; or
  • tamper with, disable or bypass rate limits, usage controls or metering.

5. Misuse of AI features

You must not:

  • try to reverse-engineer, extract or derive any model, embedding, weight, prompt or proprietary process behind the Services;
  • perform prompt injection, model manipulation or other adversarial attacks;
  • use the Services to generate harmful, misleading, fraudulent, defamatory or illegal content;
  • use the Services to give financial, investment, legal or tax advice that you are not licensed to give;
  • use the Services to create deceptive or manipulated investor communications or deal materials;
  • present AI output as the verified work or opinion of a human professional when it is not; or
  • try to re-identify de-identified data, or to infer private information about a person from AI output.

How we use and protect Customer Content. Our Privacy Policy describes how we use Customer Content and how our AI providers handle it.

6. Data, content and file restrictions

You must not upload, connect, transmit or process:

  • content that you do not have the lawful right to use;
  • confidential information in breach of a non-disclosure agreement or other obligation;
  • malicious, harmful or corrupted files;
  • fraudulent, deceptive or falsified deal materials or financial documents; or
  • sensitive personal information (for example health information or government identification numbers), except where the law and your agreement with us allow it.

7. Intellectual property

You must not:

  • infringe the copyright, trademark or other proprietary rights of others;
  • upload or distribute content without proper authorisation;
  • remove or obscure proprietary notices or branding; or
  • misuse Nvestiv's trademarks or other intellectual property.

8. Outbound messages and calls through IRIS

IRIS can send email, WhatsApp, SMS and Slack messages and take part in calls for you. Each message or call that IRIS sends on your instructions is your message or call, and you are its sender. You must:

  1. Have the consent or other lawful basis that the law requires before IRIS contacts a person. This includes Canada's Anti-Spam Legislation (CASL), the US CAN-SPAM Act and Telephone Consumer Protection Act (TCPA), and the WhatsApp Business policies.
  2. Identify yourself (or your organisation) as the sender in every commercial message, and include the contact details and unsubscribe mechanism that the law requires.
  3. Honour every opt-out promptly. When a person replies STOP, STOPALL or UNSUBSCRIBE, IRIS stops messages on that channel. You must not try to get around an opt-out by another channel, address or number.
  4. Not use purchased, rented, scraped or harvested contact lists for IRIS outreach.
  5. Not send spam, unauthorised bulk messages, or abusive, deceptive or misleading messages.
  6. Not misrepresent your identity, or impersonate another person or organisation.

9. Recording and transcription

The Services can record, transcribe and analyse meetings and calls. You must:

  1. Tell every participant that the meeting or call is recorded and transcribed, before recording starts.
  2. Get the consent of every participant where the law requires it, including in jurisdictions that require the consent of all parties (two-party consent).
  3. Not record a person in secret, or in a situation where the law prohibits recording.
  4. Not use meeting sentiment or credibility analysis as the sole basis for a decision about a person. It is not a lie detector.

10. Securities and fundraising

The Services provide information and workflow tools only. Nvestiv is not a registered dealer, adviser, broker or funding portal. You must not use raises, data rooms, shared documents, the IRIS Network, the newsroom or journals to:

  1. Make a general solicitation or general advertisement of securities, or an offering that is not registered or exempt under applicable securities law.
  2. Distribute an offering to investors who are not eligible under the exemption you rely on.
  3. Publish or send investor materials that are false, misleading or incomplete in a material way, including projections without a reasonable basis.
  4. Present an AI-generated report, score or verdict as independent advice or as an endorsement by Nvestiv.

You are responsible for complying with the securities laws that apply to your offering, including any filing, eligibility, disclosure and resale requirements.

11. Research on people

The Services can research people and companies through web search, data providers and public records. You must not:

  1. Use any report, profile or result as a factor in deciding a person's eligibility for credit, employment, housing or insurance, or for any other purpose covered by the US Fair Credit Reporting Act (FCRA) or similar laws. The Services are not a consumer reporting agency.
  2. Use the Services to stalk, harass, intimidate, threaten or dox any person.
  3. Research a person for a purpose that the law prohibits, or that the person would not reasonably expect in a business context.

12. Browser automation and saved logins

IRIS can browse websites, sign in with logins that you save in the vault, and fill in and submit forms. You must:

  1. Comply with the terms of use of every website that IRIS visits on your instructions, including limits on automated access.
  2. Save and use only your own credentials, or credentials that the account owner has authorised you to use.
  3. Not use browser automation to scrape, create accounts in bulk, bypass a CAPTCHA or other bot control, or get around a website's access restrictions.

13. API and MCP keys

You must:

  1. Keep API keys and MCP tokens secret. Do not put them in public code, shared documents or messages.
  2. Revoke a key or token at once if you think it has leaked. Keys without an expiry date and MCP tokens stay valid until you revoke them.
  3. Give each key only the access it needs (read or read/write, and domain scope).
  4. Respect the rate limits and usage limits that apply to your key and plan.

14. The IRIS Network

The IRIS Network is Nvestiv's network of people who contact IRIS, which IRIS uses to suggest introductions. You must not:

  1. Send spam or unsolicited promotions to Network members.
  2. Misrepresent who you are, your organisation, your track record or your intentions.
  3. Harvest, copy, export or compile information about Network members, or try to find out who a member is before that member agrees to an introduction.
  4. Try to get around the Network's contact limits, opt-in rules or opt-outs.

15. Newsroom and journals

When you submit a post to the newsroom or journals on nvestiv.com, you must not publish content that:

  1. is defamatory, or makes false or unsupported claims about a person, company or investment;
  2. solicits investment, or offers or advertises securities;
  3. is false or misleading, including undisclosed paid promotion;
  4. infringes another person's rights or discloses confidential information; or
  5. is otherwise unlawful, harassing or harmful.

Posts are screened, including by AI, before they are published, and daily publishing limits apply. Nvestiv may refuse, edit, unpublish or remove any post at its discretion. Nvestiv may also refuse posts that disparage Nvestiv or its Services.

16. Abuse, harassment and harmful conduct

You must not:

  • harass, threaten or abuse Nvestiv staff, partners, users or any other person;
  • impersonate Nvestiv personnel or any other person;
  • take part in phishing, social engineering or fraud; or
  • use the Services to harm any person, business or Nvestiv.

17. Illegal, fraudulent or deceptive activities

You must not use the Services for:

  • money laundering or terrorist financing;
  • insider trading or market manipulation;
  • fraudulent investment solicitation;
  • breaches of sanctions or export control laws;
  • creating or distributing fraudulent deal records, investor communications or financial statements; or
  • any other activity that applicable law prohibits.

18. Resource misuse

You must not:

  • generate excessive traffic intended to degrade the Services;
  • abuse compute resources, AI capacity or API limits;
  • falsify or conceal usage to avoid billing or metering; or
  • circumvent plan limits, message caps or other usage limits.

19. Prohibited high-risk uses

Unless a written agreement with Nvestiv expressly allows it, you must not use the Services for:

  • military or defence applications;
  • nuclear operations;
  • medical diagnosis or treatment;
  • critical infrastructure operations;
  • automated trading or execution systems; or
  • safety-critical systems where an error could cause harm.

20. Enforcement

If we reasonably believe that you have breached this Policy, we may, at our discretion:

  • warn you;
  • remove or disable content;
  • suspend specific users or keys;
  • limit or disable features, channels or integrations;
  • suspend or terminate the workspace or account;
  • block abusive traffic;
  • report unlawful activity to the authorities; and
  • take legal action, including for damages.

We decide what is a breach of this Policy. We may act without notice where we need to protect the Services, other users or other people.

21. Reporting violations

Report suspected violations to support@nvestiv.ai. We may ask for details that we need to investigate.

22. Contact

Nvestiv Capital Corporation
80 Atlantic Ave, 4th Floor
Toronto, Ontario, Canada M6K 1X9
Email: support@nvestiv.ai