Acceptable Use Policy

This Acceptable Use Policy ("AUP") governs use of the services offered by Workforce Technologies Inc., doing business as OnTask.AI ("OnTask.AI"). It forms part of the Master Subscription Agreement and the Terms of Use when validly incorporated into the applicable agreement.

Last updated: November 4, 2026

1. Scope

This AUP addresses use of OnTask.AI's hosted workforce-monitoring platform and applications (the "Service") and public website (the "Site") by Customers, their authorized Users, authorized reseller or managed-service partners ("Partners"), and other persons accessing them. References to the Service in this AUP also cover Site activities to which the relevant restriction applies, but do not extend subscription obligations to Site visitors. Restrictions apply to the activities relevant to each person's access. Contractual obligations arise through the applicable agreement and valid acceptance or incorporation, not merely because a link appears on a website. Capitalized terms not defined here have the meanings in the applicable agreement.

The applicable agreement's order-of-precedence provisions govern conflicts. This AUP does not override negotiated terms, any applicable data processing agreement ("DPA"), or rights and obligations that cannot lawfully be excluded.

OnTask.AI may revise this AUP prospectively only in accordance with the amendment and notice requirements of the applicable agreement. For Service subscriptions under the Master Subscription Agreement, material changes require agreement or prospective application at renewal with advance notice and a lawful nonrenewal opportunity; for Site use, the Terms of Use govern notice and acceptance. Changes required by law may take effect sooner only to the extent permitted by law and the applicable agreement, with notice as soon as reasonably practicable. Urgent security or abuse measures remain subject to existing enforcement rights and do not themselves amend the agreement. Posting alone does not establish assent where additional acceptance is required, and revisions do not retroactively expand liability or alter existing commercial commitments except through a valid amendment.

2. Lawful Use

You must comply with applicable laws governing privacy, data protection, employment, discrimination, communications and recording, intellectual property, export controls, sanctions, and use of automated systems.

The Service records screen video and periodic screenshots from browser or desktop activity, including multiple monitors where configured, and uses OCR and AI analysis to produce classifications, summaries or "stories," timesheets, violation outputs, and searchable information. Depending on the subscription and Customer settings, it also provides optional webcam recording and one-to-one face verification, marketed as "facial recognition." Face verification is off by default and enabled by the Customer per worker; it compares a Customer-approved reference photo with periodic webcam snapshots using face embeddings processed in memory and not persisted. Monitoring is configured by the Customer. Customers are responsible for establishing lawful purposes and instructions, determining the permitted scope of monitoring, and providing all required employer-side notices and policies, acknowledgments, consents, and labor consultation or collective bargaining before monitoring begins. This allocation does not limit OnTask.AI's independent obligations under applicable law or the applicable agreement or DPA.

Webcam recording and face verification are subject to Section 2.8 of the Master Subscription Agreement. Do not enable face verification for workers in jurisdictions where it cannot lawfully be used, or for workers in the EEA or UK unless a separate written agreement with OnTask.AI addresses a lawful Article 6 basis, an applicable Article 9 condition, and other required safeguards. OnTask.AI provides the worker's in-app biometric notice and written-release flow and the public Biometric Data Retention and Destruction Policy; those safeguards do not replace Customer's employer-side obligations. No reference-photo capture or face comparison is permitted without the worker's separate release. Do not bypass that flow, override a worker's decline or withdrawal, or retain or reuse biometric data contrary to the applicable destruction requirements. Workers may withdraw consent at any time in-app, stopping further comparison and immediately destroying the reference photo. Face-verification results may be inaccurate and must not be used as the sole basis for adverse employment decisions. Any Customer requirement to use a webcam must itself be lawful; the biometric release is not blanket consent to webcam recording.

Requirements vary by jurisdiction. Applicable employee-monitoring laws include, for example, New York Civil Rights Law Section 52-c, Connecticut General Statutes Section 31-48d, and 19 Delaware Code Section 705. Notice, acknowledgment, and consent requirements are not interchangeable. Under GDPR and UK GDPR, Customers must establish an appropriate lawful basis, assess necessity and proportionality, and complete a data protection impact assessment where required. Employee consent may not be freely given and is not a universal solution. Neither an employer's authorization nor access to an employer-owned device automatically authorizes recording every communication or overrides the rights of other participants under applicable interception or communications laws.

Do not deploy monitoring covertly or deceptively, defeat legally required notices or indicators, access personal accounts or devices without lawful authority, or capture activity outside the disclosed and lawfully authorized monitoring scope. Configure and supervise monitoring to minimize unnecessary capture of personal, privileged, sensitive, or unrelated activity, including activity outside authorized working periods. Where a managed desktop installation starts automatically or records in the background, account for that in your notices, schedules, and internal controls; the application running does not extend your lawful monitoring scope. Use available controls and appropriate workplace procedures; do not deploy monitoring where the required safeguards cannot be met. Availability of the Service is not confirmation that a particular deployment is lawful.

AI outputs are informational and intended for human review; the Service is not designed to make automated employment decisions. Outputs may be inaccurate, incomplete, or lack context. Before relying on them for discipline, compensation, promotion, termination, or another consequential employment decision, conduct meaningful human assessment, verify relevant facts independently, and allow correction or challenge where required. Do not use the Service to make solely automated decisions prohibited by law. Comply with applicable automated-decision and AI requirements, including required notices, assessments, explanations, human oversight, and contest mechanisms under GDPR/UK GDPR, applicable state privacy laws, the EU AI Act, and the Colorado AI Act, according to their scope and applicable compliance dates. Human review alone does not determine whether a system or use is subject to high-risk or other regulated-system requirements, and this AUP does not transfer OnTask.AI's independent provider obligations to Customers.

Do not direct the Service to children under 13 or knowingly deploy it to monitor them. Do not enable or use webcam recording or face verification for workers under 18. Any otherwise permitted deployment involving minor workers must satisfy applicable employment, privacy, and other protections for minors. Employer authorization alone is not sufficient to satisfy applicable child-privacy requirements. Incidental references to children in an adult worker's captured content are distinct from child-directed deployment.

3. Prohibited Conduct

You may not, and may not permit any User, Partner, or third party to:

  1. copy, rent, lease, distribute, pledge, assign, sell, sublicense, or otherwise transfer the Service except as expressly permitted by the applicable agreement, including a written agreement authorizing Partner resale or administration;
  2. violate applicable law, a court order, or third-party rights, including privacy, publicity, confidentiality, and intellectual property rights;
  3. use the Service to create or disseminate unlawful, infringing, fraudulent, defamatory, harassing, hateful, or obscene material. This does not prohibit necessary, lawful capture or retention of evidence for investigation, security, or compliance, but does not authorize unlawful possession, harmful dissemination, or other unlawful use;
  4. introduce, execute, or distribute viruses, worms, Trojan horses, spyware, ransomware, or other malicious code through the Service. Lawful capture of an image or record of a security incident is not, by itself, introduction or execution of malicious code;
  5. gain unauthorized access to, probe, scan, or test the vulnerability of a system associated with the Service, or breach security or authentication measures, except for testing expressly authorized in writing by OnTask.AI;
  6. interfere with, disrupt, overload, or impair the integrity or performance of the Service or its data, including through denial-of-service attacks;
  7. circumvent access controls, rate limits, usage restrictions, or account or workspace boundaries;
  8. reverse engineer, decompile, disassemble, or attempt to derive the source code, underlying algorithms, file formats, or non-public APIs of the Service;
  9. modify, translate, or create derivative works of the Service without authorization;
  10. access or use the Service to build, train, or improve a competing product or service, or copy its features, functions, or user interface;
  11. engage in unlawful surveillance or collect, use, or disclose personal information without lawful authority or required notices, acknowledgments, or consents;
  12. use captured content or outputs to create biometric identifiers or templates for identification except through the optional face-verification feature in accordance with Section 2.8 of the Master Subscription Agreement and this AUP; extract or reuse biometric data outside that permitted feature; infer emotions from biometric data; conduct prohibited sensitive biometric categorization; or engage in prohibited social scoring. The face-verification exception does not authorize emotion recognition or other prohibited biometric uses;
  13. engage in unlawful discrimination or retaliation, interfere with legally protected organizing or concerted activity, obstruct protected reporting, or prevent the lawful exercise of privacy or employment rights;
  14. send spam, unsolicited bulk communications, or chain letters, or conduct phishing or other deceptive activity;
  15. impersonate another person or entity, conceal the identity of a person exercising delegated administrative access, or misrepresent an affiliation;
  16. use Partner or other delegated access beyond the Customer's authorization, access unrelated workspaces, or use Customer Data for unrelated purposes;
  17. materially violate this AUP or the applicable agreement, or knowingly use the Service to create a demonstrable security or operational risk.

These restrictions do not prohibit activity that cannot lawfully be restricted by contract, including applicable nonwaivable interoperability rights. They also do not prohibit lawful complaints, protected disclosures, regulatory cooperation, or exercise of nonwaivable rights.

4. Security Obligations

Customers and Partners must use reasonable safeguards for credentials and access under their control and manage the access they authorize consistently with the applicable agreement. These obligations do not shift responsibility for OnTask.AI's own breach or independent legal duties. You must:

  • use strong, unique passwords, protect authentication credentials, and enable multi-factor authentication where available;
  • limit access to authorized persons and appropriate roles, and promptly revoke access when authorization ends;
  • not share credentials or permit unauthorized account transfers or access;
  • use authorized delegated-access mechanisms for Partner administration or "log in as" activity, and act only within the Customer's authorization and applicable Partner agreement; review delegated access regularly and revoke it promptly when authorization ends;
  • promptly report actual or suspected unauthorized access or security incidents to abuse@ontask.ai; and
  • reasonably cooperate with lawful investigation and remediation, subject to applicable confidentiality, privilege, and legal restrictions.

5. Content and Customer Data

"Customer Data" has the meaning set out in the applicable agreement. You must have the lawful authority, rights, legal bases, and required permissions for the collection, submission, disclosure, and processing you direct through the Service. You are responsible for the legality and appropriateness of your instructions and use of Customer Data, without limiting OnTask.AI's independent obligations. These requirements do not make you a guarantor of the accuracy of passively captured third-party statements or AI-generated inferences.

The optional face-verification feature is permitted only subject to Section 2.8 of the Master Subscription Agreement, this AUP, the worker's separate written release, and all applicable legal conditions. This narrow permission does not authorize other intentional sensitive-data collection. For other processing, do not intentionally target or collect sensitive personal data through the Service unless expressly agreed in writing in the applicable Order Form or other agreement and all applicable legal conditions are satisfied. This includes GDPR/UK GDPR special-category data, criminal-offense information, and sensitive personal information under applicable U.S. state laws, as well as passwords, authentication secrets, government identifiers, and financial-account credentials. Written permission is not itself a legal basis. GDPR/UK GDPR special-category processing requires both an Article 6 basis and an applicable Article 9 condition; criminal-offense information requires the applicable Article 10 safeguards.

Minimize incidental sensitive capture, including sensitive information inferred by AI. If unintended sensitive data is captured, promptly restrict further use and take appropriate steps to remediate or delete it, subject to lawful preservation requirements and the applicable agreement or DPA. Use available controls and seek assistance where needed rather than assuming all captured data may be freely used.

Customers and Partners must respect applicable access, correction, deletion, objection, and automated-decision rights, subject to lawful exceptions and their assigned roles. Employee information is not categorically exempt from the CCPA/CPRA. Processing roles, permitted uses, assistance obligations, and any required DPA are governed by the applicable agreements and law; this AUP does not supply a missing data-processing or transfer agreement.

Do not instruct or carry out restricted international transfers unless applicable requirements are satisfied. U.S. hosting, employer authorization, and general consent language do not by themselves establish a valid GDPR/UK GDPR transfer mechanism. Before relevant EEA or UK processing or transfers begin, confirm that required agreements, transfer mechanisms, assessments, and supplementary safeguards are in place. Consult the Privacy Policy and contact OnTask.AI if clarification is needed.

6. Enforcement

OnTask.AI may, but does not undertake a general obligation to, investigate suspected violations, except where action is required by law or the applicable agreement. Subject to the governing agreement's limits on suspension, termination, notice, cure, and data handling, and based on a reasonable determination of a violation or credible legal, security, or operational risk, we may:

  • remove or disable access to offending content;
  • restrict or suspend an affected User's, Partner's, or Customer's access;
  • terminate access or the applicable Service as permitted by the governing agreement;
  • preserve relevant evidence and cooperate with authorities where lawful; or
  • pursue available legal or equitable remedies.

Where reasonably practicable, action will be proportionate and targeted to the affected content, User, Partner, or workspace. We may act without prior notice to address urgent security threats, ongoing unlawful activity, legal requirements, or material harm only as permitted by the governing agreement or required by law. When acting without prior notice, we will give notice promptly afterward unless legally prohibited. Otherwise, we will provide notice and a reasonable opportunity to cure consistent with the applicable agreement. Suspension will be reasonably limited in scope and duration and lifted when its basis is resolved. Termination rights, payment consequences, data access, return, deletion, and required retention remain subject to that agreement, any applicable DPA, and law.

Investigation-related access to and use of Customer Data must be reasonably necessary, contractually authorized, and lawful. Disclosure to authorities is subject to applicable law, valid legal process where required, and contractual notice commitments unless notice is legally prohibited. Lawful emergency disclosures and necessary evidence preservation remain permitted. This AUP is not a general waiver of confidentiality or authorization for unrelated processing or indefinite retention.

7. Reporting Violations and Contact

Report suspected AUP violations or security incidents to abuse@ontask.ai. Provide only the information reasonably necessary to identify the concern, such as the affected account, relevant time, and nature of the incident. Do not email passwords, authentication secrets, unnecessary sensitive recordings, or privileged material. Contact us before transmitting sensitive evidence to arrange an appropriate submission method.

For privacy requests, contact privacy@ontask.ai and see the Privacy Policy. For other assistance, visit Support or call +1 (800) 460-4631.

Contractual legal notices must be sent by email to hello@ontask.ai, with a copy addressed to Workforce Technologies Inc. (dba OnTask.AI), Attn: Legal, 2810 N Church St PMB 28466, Wilmington, Delaware 19802, USA, subject to any controlling notice provisions in the applicable agreement.

8. Survival

Accrued rights and remedies, lawful investigation and preservation obligations, and restrictions that properly apply to retained data or software survive termination to the extent required by law or the applicable agreement. This AUP does not authorize continued collection, new access, or indefinite retention after access ends. Other continuing obligations, including confidentiality and data return or deletion, are governed by the applicable agreement, any applicable DPA, and law.