SpinUI Acceptable Use Policy

Effective date: 12 November 2026

This Acceptable Use Policy ("AUP") is part of the SpinUI Terms of Service. It applies to everyone who uses SpinUI, including through the API, the CLI, the Recorder, private runners and AI agents. "Target" means any website, application or system that SpinUI tests, crawls or visits for you.

1. Test only what you are allowed to test

1. Run tests, crawls and recordings only against Targets that you own or that you have permission to test from the owner.
2. When you test for a client, for example as an agency, you must have the client's permission. That permission must cover the kind of testing you do.
3. Do not use SpinUI for security testing of third parties without permission. This includes vulnerability scanning, brute-forcing sign-ins, and probing for weaknesses.
4. Do not test production systems in ways that could cause harm the owner has not agreed to. Examples include placing real orders, sending real messages to real people, or changing real records.

2. No load testing or denial of service

1. SpinUI is a functional UI testing tool, not a load-testing tool. Do not use it to put stress on a Target or degrade its performance.
2. Stay within your Plan's concurrency, duration and page limits. Do not use several accounts, organizations or trigger URLs to multiply load on a Target.
3. Do not schedule or trigger runs at a rate whose purpose or effect is to overwhelm a Target.

3. No scraping of third parties

1. Crawls are for checking your own sites: links, coverage and errors. Do not use crawls or tests to harvest content or data from sites you do not own or are not authorized to test.
2. Do not try to get around a Target's robots.txt, access controls, paywalls or terms of use.

4. Test inboxes

1. Use SpinUI test inbox addresses only to test your own applications. Examples: sign-up, verification, password reset and one-time-code flows in apps you own or are authorized to test.
2. Do not use test inboxes:
   • to sign up for third-party services, especially at scale or to get trials, credits or promotions;
   • as disposable or throwaway mail addresses;
   • to receive mail unrelated to a test;
   • to relay, forward or send spam, or to hide the source of mail.
3. Test inboxes only receive mail during a run and for 30 minutes after it. Do not try to keep an address alive or reuse it outside a run.

5. Do not get around limits or controls

1. Do not try to get around:
   • Plan limits, usage metering or billing;
   • rate limits;
   • the cloud runner egress guard;
   • tenant isolation;
   • any other security control.
2. Do not use cloud runners to reach private, internal or cloud-metadata addresses. Use a private runner inside your own network for internal sites.
3. Do not create multiple accounts to get extra free allowances or extra trials.
4. Do not interfere with or disrupt the Service, other customers or our providers. Do not probe, scan or test SpinUI's own security without our written permission. Report suspected vulnerabilities to [email protected].

6. Credentials and personal data

1. Store only credentials (passwords, API keys, cookies, tokens) that you are authorized to use for testing. Do not store other people's credentials without their authority.
2. Prefer dedicated test accounts and test data. Do not record pages with real payment card data. The Recorder does not redact every sensitive field.
3. Do not use SpinUI to collect, store or process personal data unlawfully, or special category data without a lawful basis.

7. AI features and AI agents

1. Review AI suggestions, explanations and drafts before relying on them. You are responsible for tests you accept.
2. Use AI agent (MCP) tokens only with agents and tools you control and trust. Give each agent the narrowest role it needs, for example a Viewer token for read-only use.
3. Do not use agents to get around limits, roles, previews or confirmations. Do not automate actions this AUP forbids.
4. Website text and test emails returned to an agent are untrusted data. Configure your agent not to follow instructions found in them.
5. Do not use AI features to generate unlawful, harmful or infringing content, or to attack the AI provider's systems or safeguards.

8. Unlawful and harmful content and use

Do not use SpinUI to:

• break any law;
• infringe others' rights;
• distribute malware;
• host or send phishing pages or messages;
• impersonate others;
• harass people;
• take part in any activity the AI provider's or hosting provider's usage policies prohibit.

9. Enforcement

1. We may investigate suspected breaches. To do this we may review relevant data, including test definitions, run records and logs, while keeping access to the minimum needed.
2. If you breach this AUP, we may:
   • warn you;
   • remove or disable content;
   • pause runs, schedules, trigger URLs, inboxes or AI features;
   • revoke tokens or runners;
   • suspend or close accounts and organizations;
   • report illegal activity to the authorities. We will act in proportion to the breach and give notice where practical. Serious or repeated breaches may lead to immediate suspension. No refund is due for suspension or termination caused by an AUP breach, except where the law requires one.
3. Report abuse of SpinUI, including abuse of our mail receiver or IP addresses, to [email protected].

10. Changes

We may update this AUP. We will post the new version with its effective date and tell you about material changes in advance.