Acceptable Use Policy

Effective date: 6 November 2026

1. Purpose and scope This policy applies to users, business administrators, suppliers, professionals and authorised integrations using Lighthouse. It protects legitimate discovery, portfolios, quotation activity and transactions. It supplements the Terms of Service and applies to public content, private workspaces and enabled AI/API features. Users must comply with applicable law, respect others’ rights and use only accounts and systems they are authorised to access.

2. Identity and professional integrity Do not impersonate a person, firm, brand or Lighthouse representative; fabricate registration, licences, awards, testimonials or brand authorisations; borrow another professional’s credentials; or imply that payment buys independent verification. Do not misrepresent your role in a project, claim another firm’s work or present conceptual, incomplete or synthetic work as a real completed project. Do not create false dealer branches, service areas or contact records. Protect credentials and OTPs. Do not use a restricted person’s account or create accounts to evade enforcement.

3. Listings and procurement integrity Do not list counterfeit, stolen, recalled, unsafe or unlawfully sold goods. Do not falsify certification, origin, MRP, discounts, stock, delivery dates, warranty coverage, SKU, dimensions, units or manufacturer affiliation. Submit genuine RFQs. Prohibited conduct includes fabricated demand, bid rigging, collusive price fixing, fake competing quotes, coercive quotation tactics, unauthorised substitutions, concealed charges, forged invoices, false delivery evidence and deceptive payment instructions. Independent dealings are not automatically prohibited. However, do not falsify transaction records or conceal an attributable order to evade a specifically agreed fee. No undisclosed blanket non-circumvention restriction applies to all future business.

4. Leads, reviews and promotion Use contact information only for the inquiry or other permitted purpose. Do not harvest prospects, resell leads, spam users, import contact lists without authority, ignore opt-outs or contact unrelated household members. Do not buy or exchange favourable reviews, impersonate customers, review your own business as a customer, suppress honest criticism by threats, or condition a refund on a positive review. Disclose sponsored content, commissions and material conflicts.

Advertisements must be truthful, substantiated and clearly identified. Do not fabricate “verified”, “best”, “government approved” or environmental claims. Creators must not conceal paid relationships.

5. Content, safety and privacy Do not post unlawful threats, targeted harassment, discriminatory abuse, sexual exploitation, non-consensual intimate material, doxxing or unlawful impersonation. Do not expose private addresses, access codes, identity documents, financial information or sensitive site layouts without authority. Do not upload malware, stolen files, confidential tenders, trade secrets or copyrighted material without the necessary rights. Keep lawful criticism factual and relevant. Genuine complaints, whistleblowing, lawful reporting and consumer remedies are not prohibited merely because they criticise Lighthouse.

6. AI and automated systems Do not use AI to fabricate completed projects, credentials, legal approvals, test reports, invoices, endorsements or delivery evidence. Do not create unlawful synthetic media or remove required provenance labels. Do not rely solely on AI for structural safety, fire safety, engineering certification, regulatory compliance, medical decisions, or autonomous purchase approval. Do not use private customer material to train an external model without lawful authority. Automation must remain within authorised APIs, permissions and rate limits. Do not circumvent safeguards, perform credential stuffing, harvest personal data, exfiltrate models or secrets, manipulate ranking or overwhelm infrastructure.

7. Security research and intellectual property Do not probe production systems or conduct load testing without an expressly authorised scope. A responsible report of an accidentally discovered issue is welcome through the Security Policy; stop testing before accessing other users’ information. Do not remove rights notices, bypass access controls, clone protected software, infringe patents or misuse confidential know-how. Restrictions do not override mandatory legal exceptions for interoperability, research or other protected activities.

8. Regulated and unlawful dealings Do not use Lighthouse for bribery, kickbacks, money laundering, unlawful sanctions evasion, prohibited exports, illegal procurement or restricted materials without required licences. A professional category listing is not permission to supply a regulated product or practise a regulated profession. A government or institutional tender may impose separate integrity, confidentiality and procurement requirements. Do not upload restricted tender data or bypass mandatory procurement procedures.

9. Reporting and enforcement Report a profile, project, product, review, RFQ or security issue through the designated report/support route, identifying the relevant URL or record and concise supporting facts. Do not circulate harmful material more widely or submit malicious reports. Lighthouse may ask for corrections, limit visibility or access, remove content, suspend a feature or terminate an account proportionately. Serious fraud, imminent harm or a lawful direction may require immediate action. We preserve required evidence and apply the Content Moderation & Takedown Policy, including notice, human appeal and applicable deadlines.

10. Changes Material changes are notified under the Terms. Periodic reminders required by applicable intermediary rules must be delivered through an effective user notice. This policy does not override statutory rights or a lawful exception.

11. Data extraction, automation and competitive misuse Do not harvest personal contacts, private quotations or protected portfolios; circumvent access restrictions; evade rate limits; or use rotating accounts to bypass an enforcement decision. Public browsing does not authorise bulk republication, resale of a directory or training a model on material for which you lack rights. Authorised API or integration use must remain within the approved scopes, limits and retention terms. Do not repurpose credentials, expose them in client applications, cache restricted material indefinitely or infer that API access transfers ownership of source content. Mandatory legal exceptions remain unaffected.

12. Technical attacks and AI manipulation Prohibited conduct includes malware, credential stuffing, denial-of-service, unauthorised vulnerability exploitation, payment interception and attempts to access another tenant’s data. A security-reporting route does not authorise disruptive testing. Do not insert hidden instructions into PDFs, images or catalogue text to cause an AI system to reveal secrets, ignore user permissions, favour a vendor or initiate an unauthorised action. Do not use the service to generate fraudulent approvals, certification marks, invoices, reviews or identity documents.

13. Marketplace and financial integrity Do not list counterfeit, stolen, recalled or unlawfully regulated products; falsify origin or certification; arrange sham quotations; conceal product condition; or charge an amount not authorised by the buyer. A legitimate commercial disagreement must not be presented as proven criminal conduct without basis. Do not use another person’s payment instrument without authority, divert refunds, manufacture transactions to obtain benefits, or provide false evidence in a chargeback. An

accepted business fee must not be evaded through deliberate falsification, but this rule does not create an undisclosed perpetual commission on unrelated transactions.

14. Content importing and communications Do not copy a competitor’s portfolio or import old stories on the assumption that a takedown-on-request statement is sufficient. Use rights-cleared assets and accurate credits. Do not re-upload removed material under a new name to evade a valid restriction. Do not send spam, impersonate support, add enquiry contacts to unrelated marketing, or sell lead data. Communications through telephone, email, WhatsApp or an external system remain subject to the relevant data-use obligation when the contact was obtained through Lighthouse.

15. International restrictions and lawful use Use in another country remains subject to applicable sanctions, export controls, product restrictions, professional rules and privacy requirements. Do not obscure the real destination or end user to bypass a lawful restriction. A blanket reference to US restrictions does not mean every US rule automatically governs every Indian transaction; applicability must be assessed. The service must not be used for unlawful surveillance, discriminatory profiling, exploitation of children or other prohibited harmful purposes. Where additional regulated-sector requirements apply, obtain a written approved scope before sending that data or using the feature.

16. Enforcement and preservation of legitimate activity We may investigate, request information and take proportionate protective action. Serious security threats or unlawful conduct may justify immediate restriction. Where appropriate, provide notice, the relevant reason and an appeal path. This policy does not prohibit lawful criticism, complaints to regulators, protected whistleblowing, permitted accessibility use or rights that cannot lawfully be waived. A policy breach does not give Lighthouse unrestricted authority to seize funds, expose personal data or erase evidence.

17. Access, identity and delegated users Use only accounts and permissions you are authorised to control. Do not buy, rent, sell or transfer access to evade verification, limits or a restriction. An organisation must remove access for personnel who no longer need it and must not instruct staff to use another person's identity. Do not obtain access through social engineering, forged support requests, intercepted OTPs or misleading account-recovery claims. A supplier's public contact details do not authorise you to act as its administrator.

18. Data collection and automated interaction Do not harvest personal contacts, private quotations, project plans or other restricted records. Automated access must comply with the permissions and limits applicable to the approved integration. Do not bypass controls by rotating accounts, keys or identifiers. This restriction does not prohibit a non-waivable lawful right, ordinary approved export or authorised accessibility function. Where a legitimate integration requires more capacity or a different data scope, obtain the relevant permission rather than disguising the activity.

19. Security, files and system interference Do not upload malware, executable payloads disguised as documents, credential-stealing links or files designed to exhaust processing resources. Do not probe other tenants, manipulate signed URLs or exploit preview and conversion tools to access unauthorised data. Security testing requires the authority described in the Security Policy. Discovery of a vulnerability does not authorise downloading more records to prove impact. Preserve minimal safe evidence and report it through the appropriate route.

20. AI and transaction manipulation Do not insert instructions into catalogues, drawings or source pages intended to cause an AI feature to reveal private data, ignore access restrictions or change an order. Do not use generated documents as fabricated proof of approval, delivery, certification or payment. Automated agents may not accept quotations, award orders or release payments without the specific authorised workflow. Repeated requests must not be used to create duplicate benefits, exploit credits or overwhelm another participant.

21. Commercial integrity and communications Do not create sham enquiries, collusive quotations, false invoices, counterfeit listings, fabricated stock or misleading delivery evidence. Do not conceal an agreed attributable transaction to evade a lawful fee, or invent attribution to charge for unrelated business. Do not use the service to offer bribes, launder funds, impersonate payment staff, resell leads without authority or pressure users into unrelated purchases. Communications must relate to the authorised purpose and respect applicable marketing choices.

22. Content, rights and safety Do not import portfolios without the necessary rights, impersonate a rights holder or misuse takedown procedures to suppress lawful competition. Do not expose confidential client information or create deceptive synthetic representations of completed work. Prohibited activity includes unlawful sexual exploitation, non-consensual intimate imagery, threats and other illegal or dangerous content. A “research,” “parody” or “AI-generated” label does not automatically make the activity lawful; legitimate context will be considered where relevant.

23. Enforcement and cooperation Lighthouse may preserve relevant evidence, limit affected access, seek clarification and take proportionate action under the applicable policies. Where feasible, a remedy will target the risk rather than unrelated lawful activity. Serious or legally urgent harm may require immediate action. Users must not destroy records subject to a lawful preservation requirement. Cooperation requests must remain relevant and proportionate and do not create unrestricted access to a user's systems. Statutory rights and valid appeals remain available.