Acceptable Use Policy

1. Scope and Acceptance

This Acceptable Use Policy (the "Policy") is issued by EverXCloud Inc., a Delaware corporation, with its registered office at 8 The Green, Suite #19720, Dover, DE 19901, United States ("EverXCloud", "we", "us" or "our"). It applies to the website everxcloud.ai, the Portal, the API and all other Services, and to any Instance, container image, model, dataset, software or other content that you or your users run, store, process or transmit using the Services ("Customer Content").

By creating an account, accepting the Terms of Service or using the Services, you agree to this Policy. You are responsible for compliance with this Policy by every person who accesses the Services through your account, API keys or credentials, and by any end user of a service you build on the Services. A breach by any of them is treated as your breach.

Capitalised terms not defined in this Policy have the meaning given in the Terms of Service, available at everxcloud.ai/legal/terms. If this Policy conflicts with the Terms of Service on its subject matter, this Policy prevails, subject to the Additional Terms for Consumers.

2. Illegal Content and Activities

You must not use the Services to engage in, promote, facilitate or assist any activity that is unlawful in the United States or in any jurisdiction in which you, your users, the relevant Instance or the affected persons are located, including:

• fraud, phishing, identity theft, money laundering, terrorist financing or any scheme to deceive or defraud any person;
• the sale or promotion of illegal goods or services, including controlled substances, weapons or counterfeit goods;
• content or activities that promote, incite or facilitate terrorism or violent extremism, or that threaten violence against any person or group;
• harassment, stalking, intimidation or the incitement of hatred or violence against any person or group;
• gambling, lotteries or games of chance offered without all licences required by applicable law;
• any activity that would cause EverXCloud or a Provider to breach applicable law.

3. Child Sexual Abuse Material

You must not use the Services to create, generate, train models to generate, store, process, display, distribute or otherwise make available any child sexual abuse material or any content that sexualises, exploits or endangers minors, whether real, altered or synthetically generated. This prohibition is absolute and admits no exception, including for research, testing or model evaluation purposes, except as expressly authorised by law and agreed in advance in writing with EverXCloud.

Where we obtain actual knowledge of any facts or circumstances indicating apparent child sexual exploitation on the Services, we will report it to the CyberTipline of the National Center for Missing and Exploited Children (NCMEC), as required by 18 U.S.C. § 2258A, and to any other competent authority. We will preserve the relevant content and account information for the period required by law, will immediately suspend the account and the affected Instances, and will terminate the account. We will not notify you before making such a report where doing so is prohibited by law or could impede an investigation.

4. Intimate Imagery and Deceptive Synthetic Media

You must not use the Services to:

• create, generate, store or distribute intimate or sexually explicit images, video or audio of a real, identifiable person without that person's verifiable consent, including synthetic or altered depictions;
• create or distribute deceptive synthetic media ("deepfakes") that depicts a real, identifiable person saying or doing something that person did not say or do, where the content is intended or likely to deceive, defame, defraud, harass or manipulate, or to interfere with an election or a democratic process;
• impersonate any person or organisation, or misrepresent the origin of content, in order to deceive.

5. Security and Network Abuse

You must not use the Services to compromise the security or integrity of any system, network or data, whether operated by EverXCloud, a Provider, another customer or any third party. In particular, you must not:

• create, store, distribute or operate malware, ransomware, viruses, worms, trojan horses, spyware, botnets or command-and-control infrastructure;
• carry out or facilitate denial-of-service attacks, traffic flooding, amplification or any activity intended to degrade the availability of a system or network;
• scan, probe, test or attempt to access any system, network, port or account without the express authorisation of its owner, including vulnerability scanning, password cracking against third-party systems or credential stuffing; authorised security testing of your own systems or of systems for which you hold a written authorisation is permitted;
• intercept, monitor or tamper with network traffic or data that is not addressed to you;
• operate open proxies, open mail relays or anonymisation services that are used to conceal abusive activity;
• send unsolicited bulk or commercial messages (spam) by e-mail, messaging or any other channel, or host content promoted by spam, or otherwise breach applicable anti-spam laws;
• forge packet, e-mail or protocol headers, or otherwise conceal the origin of traffic in order to deceive.

6. Cryptocurrency Mining

Mining, validating or farming cryptocurrencies or other digital assets (including proof-of-work mining, mining pools and plotting) is prohibited on all Instances, unless EverXCloud has expressly agreed otherwise in writing for a dedicated offer.

The Services include automated technical controls that detect known mining software and block network connections commonly used for mining. When mining is detected, the affected Instance is stopped promptly, its data is preserved and no usage is charged for the period of the stop while the matter is reviewed. If our review confirms the prohibited use, the Instance is destroyed and the account may be suspended or terminated under Section 19, without refund of the charges incurred. If our review finds no prohibited use, the Instance is released and you may restart it. You may contest a decision by replying to the notification you receive or by writing to [email protected].

7. Export Controls, Sanctions and Prohibited End Uses

The Services provide access to advanced computing resources that are subject to the export control and economic sanctions laws of the United States and of other countries, including the Export Administration Regulations and the regulations administered by the Office of Foreign Assets Control. You must comply with those laws and you must not:

• access or use the Services from, or for the benefit of any person located in, ordinarily resident in or organised under the laws of a country or region subject to comprehensive United States sanctions;
• permit access to or use of the Services by, or for the benefit of, any person or entity listed on, or owned 50 percent or more, directly or indirectly, by one or more persons listed on, a United States restricted-party list (including the Specially Designated Nationals and Blocked Persons List, the Entity List, the Military End-User List, the Denied Persons List and the Unverified List) or an equivalent list maintained by the United Nations, the European Union or the United Kingdom;
• use the Services, directly or indirectly, for the design, development, production, stockpiling or use of nuclear, chemical or biological weapons or their means of delivery, including missiles and unmanned aerial vehicles;
• use the Services for any military end use or for any military end user where that use or user is restricted under applicable export control law, or for the development or production of advanced semiconductors or supercomputers where that activity requires a licence that has not been obtained;
• provide access to the Services to any entity headquartered in, or whose ultimate parent is headquartered in, a country or territory for which a licence would be required, unless that licence has been obtained and EverXCloud has agreed in writing;
• use VPNs, proxies, false information, intermediaries or any other means to evade our geographic restrictions, sanctions screening or identity verification.

8. Export Responsibility for Customer Content

You are the exporter of record of your own Customer Content, including models, model weights, software and technical data that you upload to, generate on or download from the Services. You are responsible for obtaining any licence required for their export, re-export or transfer and for not making them available in breach of export control laws. You must provide, on request, accurate information about your identity, ownership, location and intended end use, and promptly update it if it changes. We may suspend or refuse any Order, without liability, where we reasonably believe that providing the Services would breach export control or sanctions laws or where you do not provide the information requested.

9. Intellectual Property

You must not use the Services to infringe, misappropriate or violate the intellectual property or proprietary rights of any person, including copyright, trademark, patent, trade secret and database rights, or to circumvent any technical protection measure. You are responsible for holding all rights and licences required for the software, container images, models, datasets and other content that you use on the Services, and for complying with the licence terms of any open-source or third-party model or dataset that you use. Repeated infringement leads to termination under Section 18.

10. Privacy and Personal Data

You must not use the Services to collect, process, disclose or monitor personal data in breach of applicable data protection or privacy law, including by collecting personal data without a lawful basis or required notice, processing sensitive data without the safeguards the law requires, conducting covert surveillance of individuals, or building tools whose purpose is to track, profile or identify individuals unlawfully. Where you process personal data on the Services, you act as controller (or as processor for your own customers) and EverXCloud acts as your processor under the Data Processing Addendum, available at everxcloud.ai/legal/dpa.

11. Regulated Data

Unless EverXCloud has expressly agreed in a written agreement signed by an authorised officer of EverXCloud, you must not use the Services to store or process:

• protected health information within the meaning of the United States Health Insurance Portability and Accountability Act (HIPAA); EverXCloud does not enter into business associate agreements through the Portal and the Services are not designed for HIPAA-regulated workloads;
• payment card account data, including full card numbers, card verification codes or magnetic stripe or chip data; the Services are not certified under the Payment Card Industry Data Security Standard for Customer Content;
• classified information, or technical data controlled under the International Traffic in Arms Regulations;
• any other category of data whose processing requires a certification, accreditation, data-location commitment or contractual undertaking that EverXCloud has not expressly given in writing.

12. High-Risk Uses

The Services are not designed, tested or intended for use in situations where their failure, interruption or inaccuracy could lead to death, personal injury, or severe physical or environmental damage. You must not use the Services to operate, control or make real-time decisions for life-support or medical devices, the operation of nuclear facilities, air traffic control, aircraft or vehicle navigation, mass transit, critical infrastructure safety systems, or weapons systems, including autonomous or semi-autonomous weapons capable of selecting and engaging targets. Instances, and in particular interruptible offers, may be stopped or interrupted, and you must design your workloads accordingly.

13. Artificial Intelligence Workloads

In addition to the restrictions above, you must not use the Services to:

• train, fine-tune, evaluate or run a model on data that you obtained unlawfully, including data obtained in breach of a website's technical access restrictions, of a contract or of applicable data protection or intellectual property law;
• develop, train or run models whose intended purpose is to provide material assistance in the creation of biological, chemical, nuclear or radiological weapons, or to create or deploy cyberattacks against systems you are not authorised to test;
• generate content that is prohibited by Sections 2 to 4 of this Policy;
• deploy a model or application that makes legally significant decisions about individuals (such as employment, credit, housing, insurance or access to essential services) in breach of the anti-discrimination, consumer protection or artificial intelligence laws applicable to you or to the individuals concerned;
• present AI-generated output as human-created where applicable law requires disclosure of its artificial origin.

You remain solely responsible for the models you run, their outputs and the uses made of them, and for compliance with any artificial intelligence law applicable to your activities.

14. Platform Integrity and Resource Abuse

You must not:

• attempt to break out of, bypass or weaken the isolation between your Instance and the host machine, the Provider's network or other customers' workloads, including by exploiting vulnerabilities in a kernel, hypervisor, container runtime or GPU driver;
• access, or attempt to access, data, memory, storage or network traffic belonging to another customer, a Provider or EverXCloud, or attack, damage or interfere with any host machine, GPU or other hardware, including by deliberately overheating, overclocking, flashing firmware or otherwise altering hardware settings;
• interfere with, disable or circumvent the metering, billing, spend caps, balance controls, monitoring agents, usage limits, rate limits or security controls of the Services;
• create multiple accounts, use false identities or collude with others to obtain Promotional Credits, referral rewards, new-account benefits or prices to which you are not entitled, or to evade a suspension;
• manipulate the spot market, including by placing orders you do not intend to honour, trading with yourself or with related accounts to create artificial prices or volumes, or any other form of wash trading or spoofing;
• resell, sublicense, lease or otherwise make the Services or any Instance available to third parties as a stand-alone compute offering without our prior written agreement; you may use the Services to provide your own value-added applications to your end users, provided that you remain responsible for them under this Policy; Individual Customers may not resell the Services in any form;
• run benchmarks, tests or probes against the Services or the Providers for the purpose of manipulating our pricing, rankings or availability signals, of mapping our infrastructure or of identifying Providers, or publish benchmark results in a misleading way;
• use the Services in a manner that imposes an unreasonable or disproportionate load on our infrastructure, the Providers' networks or shared resources, including sustained high-volume outbound traffic that is not reasonably necessary for your workload;
• scrape or harvest data from the Portal or the website, or access the Services by automated means other than the API and documented tools.

15. Customer Responsibilities

You must keep your account credentials, API keys and SSH keys secure, and notify us without delay at [email protected] if you suspect that they have been compromised. You are responsible for configuring and securing your Instances, including firewalls, software updates, access control and the protection of any service that you expose to the internet. You must maintain appropriate backups of Customer Content. You must cooperate in good faith with any reasonable request for information that we make in order to investigate a suspected breach of this Policy.

16. Monitoring and Investigation

We have no obligation to monitor Customer Content, and we do not routinely access the content of your Instances. To protect the Services, the Providers and other customers, we and our systems collect and analyse technical and operational information, such as process names running on GPUs, resource consumption, network connection metadata and rejected network connections, health signals and account activity.

We may investigate any suspected breach of this Policy, including on the basis of a complaint, a report from a Provider, an alert from our systems or a request from a competent authority. During an investigation we may restrict access to the affected Instances or account, preserve information, and request information from you. Where required by law or where we believe in good faith that disclosure is necessary to prevent harm or to respond to valid legal process, we may disclose information to law enforcement, regulators or other competent authorities, in accordance with the Privacy Policy.

17. Reporting Abuse

Anyone may report suspected abuse of the Services, including illegal content, security incidents originating from our IP addresses, spam or a breach of this Policy, by writing to [email protected] with the subject line "Abuse report". Please include the IP address, date, time and time zone of the activity, a description of the issue and any supporting evidence such as logs or message headers. Do not send child sexual abuse material to us: describe its location instead and report it directly to NCMEC or to your national hotline.

We review abuse reports promptly and prioritise reports concerning child safety, ongoing attacks and threats to life. We may share the identity of the reporting person with the Customer concerned only where necessary to address the report or where required by law, unless the reporting person asks us not to and the law allows it.

18. Copyright Infringement Notices

EverXCloud responds to notices of alleged copyright infringement in accordance with the United States Digital Millennium Copyright Act (17 U.S.C. § 512). EverXCloud's designated agent to receive notifications of claimed infringement can be reached at [email protected], subject line "Copyright notice", or by post at 8 The Green, Suite #19720, Dover, DE 19901, United States, to the attention of the Designated Copyright Agent.

To be effective, a notice must be in writing and include substantially the following:

• a physical or electronic signature of a person authorised to act on behalf of the owner of the exclusive right allegedly infringed;
• identification of the copyrighted work claimed to have been infringed or, for multiple works, a representative list;
• identification of the material claimed to be infringing and information reasonably sufficient to permit us to locate it, such as the IP address, URL or Instance identifier;
• your name, address, telephone number and e-mail address;
• a statement that you have a good faith belief that use of the material in the manner complained of is not authorised by the copyright owner, its agent or the law;
• a statement that the information in the notice is accurate and, under penalty of perjury, that you are authorised to act on behalf of the owner of the exclusive right allegedly infringed.

Upon receipt of a valid notice, we will act expeditiously to remove or disable access to the material, which may require us to restrict the Instance concerned, and we will take reasonable steps to notify the Customer.

A Customer who believes that material was removed or disabled by mistake or misidentification may send a counter-notification to the same address, including: a physical or electronic signature; identification of the material and of its location before removal; a statement under penalty of perjury that the Customer has a good faith belief that the material was removed or disabled as a result of mistake or misidentification; and the Customer's name, address and telephone number and a statement that the Customer consents to the jurisdiction of the federal district court for the judicial district in which the Customer's address is located (or, if outside the United States, any judicial district in which EverXCloud may be found) and will accept service of process from the person who provided the original notice or its agent. Unless the complaining party informs us that it has filed an action seeking a court order, we may restore the material not less than 10 and not more than 14 business days after receiving the counter-notification.

Any person who knowingly materially misrepresents that material is infringing, or that it was removed or disabled by mistake, may be liable for damages under 17 U.S.C. § 512(f).

Repeat infringers. It is our policy to terminate, in appropriate circumstances, the accounts of Customers who are repeat infringers. We will generally treat an account as a repeat infringer account where it has been the subject of more than two valid infringement notices that were not successfully countered within any period of twelve months, and we may terminate an account after fewer notices where the infringement is flagrant.

19. Enforcement

If we reasonably believe that you, your users or your Customer Content breach this Policy, we may take any of the following measures, alone or in combination, in proportion to the seriousness of the breach:

• ask you to remove the offending content or stop the offending activity within a stated period;
• issue a written warning;
• stop, restrict or isolate the affected Instances, API keys or network access;
• cancel open Spot Orders and Reservations;
• suspend all or part of your account, including your ability to launch new Instances or top up your Prepaid Balance;
• terminate your account and the Terms of Service;
• report the matter to and cooperate with law enforcement, regulators, NCMEC, payment service providers and affected third parties, and preserve information as required by law.

We will normally notify you and give you an opportunity to remedy the breach before taking measures. We may act immediately and without prior notice where the breach involves child sexual abuse material, a sanctions or export control violation, a security threat, an attack on other customers or Providers, cryptocurrency mining, fraud, a risk of harm to any person, or where notice would be prohibited by law or would compromise an investigation.

Charges continue to apply in accordance with the Terms of Service for resources that you keep while your account is restricted, except that no usage is charged for an Instance while it is stopped by us pending review. Where we terminate your account for a serious or repeated breach of this Policy (including any breach referred to in the previous paragraph), we may, to the extent permitted by applicable law, retain from your Prepaid Balance an amount corresponding to the damage, costs, fines and third-party claims resulting from the breach, and refuse to refund the remaining Prepaid Balance where the funds are, or are reasonably suspected to be, the proceeds of fraud or other unlawful activity or are subject to a legal hold. Any remaining amount will otherwise be refunded in accordance with the Refund and Cancellation Policy. Nothing in this Section limits any statutory right of an Individual Customer that cannot be excluded by contract.

You may contest any enforcement measure by writing to [email protected] within 30 days. A person will review your request and inform you of the outcome. Our decision not to act on a breach does not waive our right to act on that or any other breach.

20. Changes to this Policy

We may update this Policy to reflect changes in the law, in the Services or in the risks we observe. We will publish the updated Policy at everxcloud.ai/legal/aup with its effective date and, for material changes, notify account holders by e-mail or in the Portal at least 15 days before they take effect, unless the change is required by law or is necessary to address an urgent security or legal risk, in which case it may take effect immediately. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

Effective date: 19 October 2026. Version 2026-10-19.