Acceptable Use Policy

1. Who this applies to

This Acceptable Use Policy applies to everyone who uses Soomi: account holders, the people a business or family invites into its account, guests in a meeting or on a shared document, and anyone who opens a Soomi share link. It covers every part of the service: mail, files, documents, calendars, contacts, meetings, chat, the portal and our apps.

It forms part of the Soomi Terms of Service. If you hold the account (a business, or the owner of a family plan), you are responsible for making sure the people you bring in follow it.

2. The basic rule

Use Soomi for lawful purposes, in a way that does not harm other people, other customers or the service itself. You are responsible for what you store, send and share through your account, and for having the right to do so.

The sections below spell out what that means in practice. They are examples, not a complete list: something harmful that is not listed is still not allowed.

3. Illegal and harmful content

Do not use Soomi to create, store, send, share or give access to:

• child sexual abuse material, or anything that sexualizes, exploits or endangers children;
• intimate images of a person shared without their consent;
• content that promotes terrorism, or incites hatred or violence against a person or group;
• threats, harassment, stalking, or intimidation of anyone;
• material that is fraudulent, defamatory, or designed to deceive people into harm;
• anything else that is illegal in Canada or where you are, or that helps someone commit a crime, including dealings that breach sanctions, money-laundering or anti-corruption laws.

Child sexual abuse material is never handled privately. When we become aware of it, we remove access to it, preserve what the law requires, and report it to the Canadian Centre for Child Protection (Cybertip.ca) and to the police, as Canadian law requires of internet services. We close the account involved.

4. Other people's rights

• Copyright and other intellectual property. Do not store or share material you do not have the right to, such as pirated software, films, music or books, cracked licence keys, or tools for breaking copy protection. Under Canada's notice-and-notice rules, we forward copyright notices we receive to the account involved.
• Trademarks and identity. Do not use someone else's name, logo or brand in a way that makes people think you are them or speak for them.
• Personal information. If you use Soomi to hold personal information about other people (customers, employees, members, patients), you are responsible for having the right to collect and use it, and for following the privacy laws that apply to you. Do not use Soomi to track, profile or expose people without a lawful reason, or to publish someone's private information to harm or intimidate them.

5. Email

Soomi mail is for your own correspondence. Mail from every customer leaves through shared servers, so one account sending spam harms everyone's delivery. Do not:

• send commercial messages without the recipient's consent, or without identifying yourself and offering a working way to unsubscribe, as Canada's anti-spam law (CASL) requires;
• send bulk or mass mailings from a Soomi mailbox (newsletters, cold outreach, purchased or scraped lists). Use a service designed for bulk mail;
• send mail from an address or domain you do not control, or forge message headers. Soomi only sends mail from addresses and domains that belong to your account;
• use Soomi to send phishing, scams or malware, or to collect replies to them.

If you bring your own domain, you are responsible for its DNS records. Keep the records we give you in place, or mail from your domain may be refused by receiving servers.

We may limit how much mail an account sends, and pause sending from an account that is generating complaints or bounces, while we work it out with you.

6. Security

Do not use Soomi to attack, disrupt or break into anything, and do not attack Soomi itself. In particular, do not:

• store, send or share malware, ransomware or other malicious code, except inside a clearly labelled, password-protected archive for legitimate security work;
• run phishing, credential theft or fake sign-in pages;
• try to get into accounts, workspaces or data that are not yours, or get around sign-in, permissions, limits or other protections;
• scan, probe or load-test Soomi without our written permission, or flood it with traffic;
• use Soomi to attack other systems, or as part of a botnet.

Soomi is built largely on open-source software, and you are free to study that software under its own licences. This policy is about attacking our service, not about reading code.

Found a security problem? Tell us at privacy@soomi.ca with enough detail to reproduce it, and give us reasonable time to fix it before you make it public. If you act in good faith, stay within your own account or a test account, and do not access, keep or share other people's information, we will not take action against you for the research.

7. Sharing and storage

Soomi is for your own work and the people you work and live with. It is not a public file host, a streaming service, a download mirror or a content-delivery network. Do not:

• use public share links to distribute files to large audiences, or to distribute anything this policy prohibits;
• use your storage mainly as a dumping ground or backup service for others, or resell it;
• disguise what a file is, or who it belongs to, to get around this policy;
• create files, links, versions or automated operations in volumes that slow the service down for others.

If a share link or folder is being misused, we may disable the link, limit sharing on the account, or block access to the specific files involved, and we will tell the account holder.

8. Accounts

• One person, one account. Each Soomi account is for one person. Do not share your sign-in or device passwords; a business or family adds people through its own seats or places.
• No borrowing. Do not use someone else's account without their permission. Administrators of a business workspace and guardians on a family plan may manage accounts as Soomi allows; that is not borrowing.
• No dodging. Do not open extra accounts to get around a limit, a suspension, a refund decision or a payment you owe.
• Be who you say you are. Do not impersonate a person, company or authority, or misrepresent who you are or whom you represent.
• Leave the controls alone. Do not interfere with an administrator's settings, audit records or security features.

9. Uses Soomi is not designed for

Soomi is a general office suite. Unless we have agreed otherwise in writing, do not rely on it as the system that keeps someone safe or alive, such as emergency dispatch, medical devices, the control of aircraft, vehicles or industrial equipment, or other systems whose failure could cause death, injury or serious damage.

You may store professional, financial or health information in Soomi, but you are responsible for deciding whether Soomi meets any specific rules your profession or industry places on how that information is kept. Ask us if you need to know how we handle something; we will tell you plainly what we do and do not offer.

10. What happens if this policy is broken

We do not monitor your content. We act on what we learn from reports, from complaints, from automated security checks (such as spam and malware filtering) and when the law requires it.

When we have good reason to believe this policy has been broken, we respond in proportion to the problem:

• We ask you to fix it, explain what we found, and give you a chance to respond.
• If it continues or is serious, we may disable a share link, block specific files, pause outgoing mail, or limit a feature.
• For serious or repeated breaches, we may suspend or close the account under section 16 of the Terms of Service.

We act first and explain afterwards only when waiting would cause serious harm (for example, an active phishing campaign or malware spreading) or when the law requires it. Child sexual abuse material is handled as described in section 3.

If you think we got it wrong, write to us at privacy@soomi.ca and a person will review the decision.

11. Reporting abuse

If you see Soomi being used to break this policy, whether you are a Soomi user or not, tell us at privacy@soomi.ca. Include, where you can:

• the link, email address, message or file involved (for an email, the full message with its headers);
• what you believe is wrong, and when you saw it;
• how we can reach you if we need more information.

We read every report. We keep the reporter's identity confidential unless the law requires otherwise, and we do not tell the account holder who reported them, except that a copyright notice is forwarded as we received it, because Canadian law requires that.

Do not send us child sexual abuse material as evidence. Send the link or location only, and report it directly to Cybertip.ca as well.

12. Changes to this policy

This policy is dated, and we keep a record of which version applied when. If we change it in a way that restricts what you may do, we tell account holders by email and in the portal at least 30 days before the change takes effect, except where a change is needed sooner to comply with the law or to stop serious harm. Earlier versions are available at soomi.ca/legal.