Acceptable Use Policy

LeagueBinder Acceptable Use Policy

DRAFT — NOT REVIEWED BY COUNSEL. NOT FOR PUBLICATION.

Version: 0.1 (draft) Effective Date: [DATE]

This Acceptable Use Policy ("AUP") is incorporated into the LeagueBinder Terms of Service. It applies to Customer and to every Authorized User. Capitalized terms have the meanings given in the Terms of Service.

This policy is kept separate from the Terms of Service so that it can be updated as new misuse patterns emerge without reopening the subscription agreement.

1. Restricted content

Customer and its Authorized Users must not upload, store, or transmit through the Service:

1.1 Prohibited data categories. Social Security numbers; driver's license, passport, or other government identification numbers; financial account, debit, or credit card numbers; protected health information subject to HIPAA; background check reports or the underlying screening documentation; or biometric identifiers.

1.2 Unlawful content. Content that is unlawful, infringing, defamatory, or that Customer does not have the right to store or share.

1.3 Child sexual abuse material. Any content that sexually exploits or endangers a child. Reports will be made to the National Center for Missing & Exploited Children and to law enforcement, and the account will be terminated immediately without notice.

1.4 Malicious code. Viruses, worms, ransomware, or any code designed to disrupt, damage, or gain unauthorized access to systems or data.

2. Prohibited conduct

Customer and its Authorized Users must not:

2.1 Attempt to access data belonging to another Customer, or probe, scan, or test the vulnerability of the Service without prior written authorization from LeagueBinder.

2.2 Circumvent or attempt to circumvent authentication, authorization, rate limiting, or any other security or access control mechanism.

2.3 Share account credentials, or permit access by anyone other than an Authorized User.

2.4 Use the Service to send unsolicited bulk messages, or for any marketing to families or individuals whose information is stored in the Service unless Customer has an independent lawful basis and consent to do so.

2.5 Reverse engineer, decompile, or disassemble the Service, or attempt to derive its source code, except to the extent this restriction is unenforceable under applicable law.

2.6 Resell, sublicense, rent, or provide the Service to third parties, or use it to operate a service bureau on behalf of organizations that are not the Customer.

2.7 Use automated means to access the Service in a manner that imposes an unreasonable load, or that exceeds any documented rate limits.

2.8 Use the Service to store records for an organization other than the Customer, except where the Customer is the parent or governing body of that organization.

2.9 Remove, obscure, or alter any proprietary notices in the Service.

3. Youth safety

The Service exists to support organizations responsible for children. Customer must:

3.1 Limit access to records containing information about minors to those Authorized Users with a legitimate need.

3.2 Remove access promptly for any individual who leaves the board, resigns, is removed, or is suspended from a role involving contact with children.

3.3 Not use the Service to communicate directly with minors.

3.4 Maintain and follow its own youth protection and safeguarding policies. LeagueBinder does not provide, review, or verify those policies.

4. Reporting

Report suspected violations, security vulnerabilities, or misuse to [SECURITY EMAIL]. Good-faith security research reports are welcome and will not be pursued legally, provided the researcher does not access, modify, or exfiltrate data belonging to any Customer and gives LeagueBinder reasonable time to remediate before disclosure.

5. Enforcement

LeagueBinder may investigate suspected violations and may suspend or terminate access in accordance with the Terms of Service. Where a violation presents an immediate risk to the security of the Service, to other Customers, or to the safety of a child, LeagueBinder may act immediately and give notice as soon as practicable.

LeagueBinder is not obligated to monitor Customer Data and does not routinely review its contents.

6. Changes

LeagueBinder may update this AUP. The current version is published at [URL] with a version number and effective date. Material changes will be notified to account administrators.