Infinithink Acceptable Use Policy

This Acceptable Use Policy (the "Policy") sets out what you may and may not do with Infinithink. It forms an integral part of the Terms of Service and should be read together with them, the Privacy Policy and the AI Transparency Notice. This version is published on infinithink.it and applies to contracts concluded from 18 October 2026. For contracts concluded earlier, it applies 30 days after the notice provided for in Section 20 of the Terms of Service. Rules that restate legal prohibitions apply in any case.

Capitalised terms such as Service, Account, Customer, Consumer, Business Customer, Plan, Pricing Page, Input, Output, Customer Content, AI Providers and Credits have the meaning given to them in the Terms of Service.

1. Who we are

In this Policy "Provider", "we", "us" and "our" refer to Lorenzo Locantore as identified above.

2. Scope

2.1 This Policy applies to everyone who uses the Service, on any Plan, including the Free plan. It covers Customers, members of their teams, integrations through API keys and every feature that operates on a Customer's behalf, such as chatbots and voice bots installed on websites and messaging channels, agents, automations and scheduled publications.

2.2 Each Customer is responsible for use made through its Account, by its team members and with the API keys it creates. This includes content that the Service generates or publishes automatically on the basis of the Customer's instructions and settings. You are not responsible for consequences caused by malfunctions of the Service, by security breaches attributable to us or by unauthorised use of your Account that does not result from a failure on your part to keep your credentials safe. For Consumers, Sections 13 and 14 of the Terms of Service remain unaffected.

2.3 The lists below are examples and are not exhaustive. Any use that breaches applicable law, the Terms of Service or the rights of others is also prohibited, even if it is not expressly mentioned in this Policy. If you are unsure whether a use is allowed, write to info@infinithink.it before going ahead.

2.4 This Policy does not replace the legal, professional or ethical obligations that apply to you. Where an applicable rule of law is stricter, that rule prevails.

3. Illegal and harmful content and activities

You must not use the Service to create, store, distribute or promote content, or to carry out activities, that

• are unlawful under the law applicable to you, to us or to the recipients;
• incite or glorify violence, terrorism or violent extremism, or support terrorist or criminal organisations;
• promote hatred of or discrimination against people on grounds such as ethnic origin, nationality, religion, gender, sexual orientation, disability or age;
• harass, threaten, intimidate, defame or bully people, or are cruel to people or animals;
• facilitate the design, manufacture, acquisition or use of weapons, explosives, or chemical, biological, radiological or nuclear agents;
• promote or facilitate self-harm, suicide or eating disorders;
• facilitate trade in illegal goods or services, such as drugs, weapons, counterfeit goods, forged documents or stolen data;
• facilitate human trafficking or the sexual or labour exploitation of people;
• are sexually explicit or pornographic, or are used to offer sexual services;
• compromise the operation of critical infrastructure, such as power, water, healthcare, transport or telecommunications networks.

4. Protection of minors

4.1 Any content that sexualises minors is strictly prohibited, including content generated or altered with AI or presented as fiction. When we become aware of such content, we remove it, close the account involved and report it to the competent authorities. We retain, in a segregated form with restricted access, only the information needed for the report, for the time needed to pass it to the authorities and in any case for no longer than 12 months, unless the authority requests otherwise. Even when we act immediately, we send the statement of reasons after acting, subject to the exceptions set out in Section 15.3.

4.2 You must not use the Service to contact, groom, exploit or endanger minors, or to expose them to sexual, violent or otherwise age-inappropriate content.

4.3 The Service is reserved for people aged 18 or over. Without our written agreement, you must not use chatbots, voice bots or other features of the Service on websites, apps or channels directed mainly at minors.

5. People, privacy and identity

5.1 You must not

• generate sexual, intimate or nude images, video or audio of real people;
• use the image, face, body or voice of a real person, including through avatars, voice clones or digital characters that reproduce them, without that person's explicit, demonstrable consent that can be withdrawn at any time, or in ways that could mislead others as to the authenticity of the content;
• create or distribute deepfakes of real people without their consent, or without disclosing that the content has been artificially generated or manipulated where the law requires it. Under Italian law, causing unjust harm to a person by distributing, without their consent, images, video or voices falsified or altered with AI and capable of misleading as to their authenticity is a criminal offence (art. 612-quater of the Italian Criminal Code);
• impersonate people, companies or public bodies, or misrepresent your identity or affiliation;
• collect, publish or infer personal data without a legal basis, including doxxing, covert surveillance, tracking or profiling of individuals and mass scraping of personal data from websites or social networks;
• infer or attribute to individuals special categories of data, such as health, ethnic origin, sexual orientation, political opinions, trade union membership or religious beliefs, unless you have both a legal basis under art. 6 and one of the conditions of art. 9(2) GDPR. Inferring such data from other information is itself processing of special categories of data;
• monitor employees or contractors remotely in breach of the applicable rules, which in Italy include art. 4 of Law 300/1970 (the Workers' Statute);
• record conversations or calls, including through voice bots, if you have not informed the people involved or do not have a legal basis;
• process personal data through the Service in breach of Regulation (EU) 2016/679 (GDPR) or other data protection laws.

5.2 Do not enter special categories of data into the Service unless you have a legal basis and one of the conditions of art. 9(2) GDPR applies. Do not enter data relating to criminal convictions and offences unless the processing is authorised by a rule of law under art. 10 GDPR and art. 2-octies of the Italian Personal Data Protection Code (Legislative Decree 196/2003, the "Italian Privacy Code"), and do not enter data of minors without appropriate safeguards. Business Customers who process third parties' personal data through the Service act as controllers or processors, must inform the data subjects and must have a legal basis. The Data Processing Agreement applies to the processing we carry out on their behalf.

6. Practices prohibited by the AI Act

You must not use the Service for any practice prohibited by art. 5 of Regulation (EU) 2024/1689 (the "AI Act"), including

• subliminal, manipulative or deceptive techniques that materially distort people's behaviour and cause, or are reasonably likely to cause, significant harm;
• exploiting vulnerabilities due to age, disability or a specific social or economic situation;
• social scoring of people leading to detrimental or unfavourable treatment;
• assessing or predicting the risk that a person will commit a criminal offence based solely on profiling or on personality traits;
• creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage;
• inferring emotions in the workplace or in educational institutions, except for medical or safety reasons;
• biometric categorisation to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;
• real-time remote biometric identification in publicly accessible spaces for law enforcement purposes.

The Service is not designed or intended for emotion recognition or biometric categorisation. You must not use it for these purposes even where art. 5 of the AI Act does not prohibit them, for example to analyse people's emotions in calls, chats or images.

7. High-risk uses and significant decisions

7.1 The Service is not designed or offered for high-risk uses under the AI Act. Without our prior written agreement, you must not use it to take, or to substantially support, decisions on

• recruitment, selection, evaluation, promotion, task allocation or dismissal of workers;
• creditworthiness, credit scoring, pricing of life and health insurance, or other financial decisions with significant effects on individuals;
• access to housing or to essential public or private services and benefits;
• admission, assessment, guidance or exam proctoring in education and vocational training;
• diagnosis, treatment or triage of patients, or the handling of emergency calls and requests;
• law enforcement, migration, asylum, border control or the administration of justice;
• biometric identification of people;
• the management or operation of critical infrastructure, or safety components of products;
• defence, national security or intelligence.

7.2 You must not present Outputs to others as medical, legal, tax, financial or professional advice given by a qualified professional, or use them to advise other people or to take decisions on their behalf in those areas without review by a qualified professional. If you use them for yourself, remember that they are not a substitute for the advice of a professional. Customers who are professionals remain responsible for their own professional and ethical duties, including informing their clients about the use of AI where required, for example by art. 13 of Italian Law 132/2025 for intellectual professions.

7.3 Decisions that produce legal or similarly significant effects on people must remain under the control of a competent person, who reviews the Outputs before relying on them. You must not use the Service to take decisions based solely on automated processing with such effects unless one of the exceptions in art. 22(2) GDPR applies. In that case, as controller, you must ensure at least the right to obtain human intervention, to express one's point of view and to contest the decision, and provide meaningful information about the logic involved.

7.4 Chatbots and voice bots are not a substitute for emergency services. You must not set them up as the only channel for urgent health or safety requests and, where the context requires it, you must direct users to emergency numbers.

8. Transparency, deception and integrity of information

You must not

• remove, hide or alter the notice that informs people they are interacting with an AI system in chatbots, voice bots or other conversational features of the Service, or lead people to believe that they are talking to a human;
• remove or tamper with watermarks, content credentials or metadata that identify content as generated or altered by AI, or use tools to do so;
• publish deepfakes without disclosing that they have been artificially generated or manipulated, including evidently artistic, creative, satirical or fictional works, for which the disclosure may be made in a way that does not hamper their enjoyment, or publish AI-generated or AI-altered text for the purpose of informing the public on matters of public interest without the same disclosure, unless the text has undergone human review or editorial control and a person holds editorial responsibility for it (art. 50(4) of the AI Act);
• create or spread disinformation, or content falsely attributed to real people, news outlets or public bodies;
• use the Service for political or electoral campaigning, political advertising, lobbying or content intended to influence the outcome of an election or referendum or voting behaviour, or to discourage people from voting, unless we have agreed in writing and the use complies with Regulation (EU) 2024/900 on the transparency and targeting of political advertising and with the policies of the AI Provider concerned;
• generate fake reviews, testimonials or endorsements, or present them as coming from real customers, in breach of art. 23 of the Italian Consumer Code (Legislative Decree 206/2005) and the corresponding EU rules;
• create fake accounts, bot networks or coordinated inauthentic activity to simulate popularity or artificially inflate likes, followers, views, comments or reviews;
• create phishing pages, scams, pyramid schemes, fraudulent offers, misleading or aggressive commercial practices, or content that imitates well-known brands in order to deceive;
• advertise regulated products or services, such as medicines, medical devices, healthcare services, food supplements, financial products, alcohol, tobacco and e-cigarettes, in breach of sector rules or of the rules of the channels used;
• promote or facilitate gambling or betting with real money;
• design chatbots, characters or messages that exploit people's trust or emotional dependence to obtain money, data or behaviour contrary to their interests;
• present AI-generated content as your own original work in exams, theses, competitions or other contexts where this is prohibited, or use the Service to evade AI-content detection in those contexts.

9. Rules for specific tools

The following rules apply in addition to the general rules, to the extent that the tool is included in your Plan. These rules concern your use of the Service and do not reduce the legal guarantee of conformity that Section 13 of the Terms of Service provides for Consumers.

9.1 Text, articles, blogs and SEO

This section covers writing, rewriting and translation tools, article generation, including from RSS feeds or videos, agents that write and schedule articles, and publishing to WordPress.

• Review texts before publishing them, especially data, quotations, prices, health claims and comparisons with competitors.
• Do not republish third-party articles, feeds or transcripts, even in rewritten form, unless you have the right to do so.
• Do not use automated publishing to mass-produce low-value pages or articles designed only to manipulate search engines, or in breach of search engines' spam policies.
• You are responsible for what agents publish on the websites you connect, including scheduled publications, except for malfunctions of the Service attributable to us.
• Articles published automatically without human review cannot benefit from the exemption for texts that have undergone editorial control. Where they deal with matters of public interest, they must carry the disclosure that they were generated with AI.

9.2 Images and product photography

This section covers image generation and editing, image analysis and virtual photo shoots, including product and fashion photography.

• Upload photos of people only if you have their consent or another legal basis, and do not alter them in ways that harm their dignity or reputation.
• Product images used for sales or advertising must not mislead as to the essential characteristics of the product, such as appearance, size, materials or results.
• Do not remove other people's watermarks, signatures or logos from images you do not hold the rights to.
• Do not generate images that reproduce protected works, characters or trademarks of others in a way that infringes their rights.

9.3 Video, avatars and digital characters

This section covers video generation from text, images or web pages, video-to-video transformation, avatars, virtual characters and influencers, and short clips.

• You may create an avatar or character that reproduces a real person only with that person's explicit, demonstrable consent that can be withdrawn at any time, and within the limits of that consent. If consent is withdrawn, stop using the avatar or character and delete it.
• If the person whose image or voice you reproduce is one of your employees or contractors, make sure that the consent is genuinely free, that refusing or withdrawing it has no consequences for the relationship and that the use is limited to what has been agreed in writing. Consent to the use of the person's image under art. 10 of the Italian Civil Code and art. 96 of the Italian Copyright Law (Law 633/1941) is also required.
• Virtual influencers and testimonials must be presented as AI-generated and not as real people, and promotional content must be recognisable as advertising.
• Do not use avatars or synthetic voices to make real people appear to say things they did not say.
• For videos made from third-party content, such as web pages, videos or podcasts, you must hold the necessary rights.

9.4 Voice, audio and music

This section covers text-to-speech, voice cloning where available, transcription, voice isolation, music generation and voice chat.

• You may clone only your own voice, or the voice of a person who has given explicit, demonstrable consent to that use that can be withdrawn at any time. You must be able to demonstrate that consent at our request. If consent is withdrawn, delete the cloned voice and the samples used to create it. For the voices of employees and contractors, the precautions in Section 9.3 apply.
• Do not use synthetic voices for scams or deceptive calls, or to imitate singers, voice actors or well-known people.
• Transcribe or process recordings only if the people recorded have been informed and you have a legal basis.
• Do not generate music that reproduces protected songs, lyrics or voices, and check the commercial use terms shown for each tool on the Pricing Page and in the Account before publishing generated tracks.

9.5 Chatbots and voice bots

This section covers chatbots and voice bots on websites, WhatsApp, Telegram, Messenger, Instagram and telephone lines, where available.

• The notice informing users that they are talking to an AI must remain active, clear, distinguishable and accessible, for example also in audio form for voice bots, and must be given at the latest at the time of the first interaction and, for voice bots, at the start of every inbound and outbound call.
• Publish on your website or channel a privacy notice that also covers the chatbot, and collect only the data you need.
• List the widget in your website's cookie policy. If you enable widget features that use cookies or identifiers not strictly necessary for the conversation requested by the visitor, load them only after consent has been collected through your banner, in line with art. 122 of the Italian Privacy Code and the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on 10 June 2021.
• Some channels, such as Telegram, and some telephony services are operated by companies established outside the European Economic Area. By connecting them, you choose to transfer your users' messages to them, and you must state this in your privacy notice, together with the relevant safeguard or derogation under Chapter V GDPR.
• Train the chatbot only on content you hold the rights to, and keep that content up to date, especially prices, opening hours, terms and health information.
• Limit the chatbot to the scope of your business and provide a handover to a person for complaints, complex requests and sensitive cases, where your Plan allows it.
• The chatbot's replies to your users are communications of your business. Do not set it up to make contractual commitments, grant discounts or give guarantees that you do not intend to honour.
• Outbound promotional calls made with voice bots are automated calls and always require the prior consent of the person called (art. 130(1) of the Italian Privacy Code). Checking the Registro pubblico delle opposizioni (the Italian public register of objections) is not enough. People called must know from the start of the call that they are talking to an AI system and must be able to ask to speak to a person or not to be contacted again.

9.6 Messaging, campaigns and social media

This section covers email, WhatsApp, Telegram, SMS, calls, the unified inbox, campaigns, social media management, the social media agent, the content calendar and automated publishing.

• Send promotional communications by email, SMS, WhatsApp, Telegram, Messenger or automated calls only to people who have given prior, specific, freely given and demonstrable consent for that channel. The only exception is email sent to your own customers about products or services similar to those already purchased, within the limits of art. 130(4) of the Italian Privacy Code, with the option to object to every message. Include in every message an easy, free way to opt out and comply with the equivalent rules of the recipients' countries.
• For calls made by a human operator, comply with the telemarketing rules, including the Italian public register of objections (Registro pubblico delle opposizioni) where applicable.
• Comply with the rules of the channels you use, such as the WhatsApp Business Messaging Policy, the Telegram Bot Platform terms and the Meta Platform Terms, and with each social network's rules on automation.
• Do not send spam, bulk unsolicited messages or automated calls without consent, and do not add people to groups or channels without their consent.
• Do not use the social media agent to follow, unfollow, comment or like in bulk or automatically where the platform prohibits it.
• Connect only accounts and pages you are entitled to manage.

9.7 Research, chat with documents, web pages and images

This section covers deep research, chat with PDFs and documents, analysis of web pages from a URL, image analysis and SEO tools.

• Upload only files you are entitled to use, and do not enter confidential information of others without authorisation.
• Do not use features that read web pages to circumvent paywalls, restricted areas, technical protection measures or websites' terms of use, or to scrape content or personal data on a large scale.
• Check sources before using research results. Summaries may be incomplete or wrong.

9.8 Code

• Review and test generated code before using it in production, including from a security standpoint.
• Comply with the licences of any third-party code included in Outputs.
• Do not generate malware, exploits or tools for unauthorised access.

9.9 Agents, automations and integrations

• Configure agents and automations with appropriate limits and monitor how they work on a regular basis.
• Actions with financial, contractual or legal effects, such as purchases, payments or sending offers, require approval by a person before they are carried out.
• You are responsible for the actions that automations carry out on the accounts and services you connect, such as WordPress sites, social media profiles, WhatsApp numbers and Telegram bots, except for malfunctions of the Service attributable to us.
• Promptly revoke access for integrations you no longer use or believe have been compromised.

9.10 AI Provider API keys

Where your Plan allows you to use your own API keys for an AI Provider, you also accept that provider's terms and bear the related costs. Do not use keys you do not own or are not authorised to use, do not publish API keys and do not allow unauthorised third parties to use them.

10. Security and integrity of the Service

You must not

• upload or distribute malware, or use the Service to plan, assist or carry out cyber attacks, intrusions or vulnerability scans on systems you are not authorised to test;
• attempt to access accounts, data or systems without authorisation, or probe or test the vulnerability of the Service without our written consent. If you discover a vulnerability, report it to info@infinithink.it without exploiting or disclosing it;
• circumvent limits, Credits, rate limits, safety filters or security measures, including through "jailbreak" or "prompt injection" techniques;
• create multiple accounts to obtain additional free plans, free Credits or trials, or share an account or credentials beyond the seats purchased;
• consume Credits or resources through automated requests repeated in a loop without human involvement, other than those of the agents, automations and API integrations provided by the Service, or beyond the technical limits shown in the Account;
• resell, sublicense or provide access to the Service to third parties without our written agreement;
• extract data from the Service by automated means other than the features and interfaces we make available, decompile it or attempt to extract its models, prompts or system instructions, except to the extent permitted by mandatory law. This prohibition does not limit the export of your Customer Content, the portability of your personal data or the switching of provider provided for in Section 16 of the Terms of Service;
• use the Service or its Outputs to develop models that compete with those of the AI Providers, where their terms prohibit it;
• overload the Service or interfere with its operation or with other users' use of it.

11. Intellectual property

You must not upload content you are not entitled to use, or use the Service to infringe copyright, related rights, trademarks, designs, trade secrets, image rights or other rights of third parties, for example by reproducing protected works, imitating trademarks or creating content likely to be confused with that of others. Outputs may resemble existing material, and it is your responsibility to check the rights before publishing them, without prejudice to our obligations under the Terms of Service.

12. Teams

The Account holder assigns seats, manages team members' permissions and is responsible for their use of the Service. Each person must use their own credentials.

13. Affiliate programme

Participants in the affiliate programme must not

• send spam, or promote the Service with false or misleading claims about features, prices or results;
• present themselves as Infinithink or as our representatives;
• sign up through their own affiliate link or create fake accounts to earn commissions;
• use the Infinithink brand in paid search advertising or in domain names without our written consent;
• set cookies or other identifiers by force or without the user having clicked the link, or use pixels and tracking tools without the consent required by art. 122 of the Italian Privacy Code.

Commissions relating to purchases obtained through conduct contrary to these rules are not payable. In serious or repeated cases we may exclude you from the programme in accordance with the affiliate programme terms.

14. Policies of AI Providers and third-party platforms

14.1 AI Providers apply their own usage rules, which you can consult at the links below.

• the Anthropic Usage Policy;
• the OpenAI Usage Policies;
• the Google Generative AI Prohibited Use Policy;
• for models made available through OpenRouter, the OpenRouter Terms of Service and the policies of the provider of the selected model.

The providers used by the Service that process personal data, and the related safeguards, are listed in the Privacy Policy.

14.2 AI Providers may refuse or block requests that breach their rules even where this Policy does not prohibit them, and in that case the block is not a sanction against you. For Consumers, the measures in Section 15 are based only on the rules of this Policy and on the law. If an AI Provider introduces significant restrictions, we incorporate them into this Policy through the procedure in Section 19. If you are a Business Customer, you must also comply with the AI Providers' usage policies referred to in Section 14.1, in the version in force on the update date shown at the top of this page or in any later version we notify to you.

14.3 The terms of the platforms you connect with your own account, such as WordPress, Meta (Facebook, Instagram, WhatsApp, Messenger), Telegram and other social networks, govern your relationship with those platforms, and you must comply with them when you use them through the Service.

15. Enforcement

15.1 We may use automated systems, including those of the AI Providers, to detect and block requests or content that appear to breach this Policy, and carry out targeted human checks when we receive a report or identify a concrete risk. Automated systems may block individual requests or Outputs. The suspension, closure or restriction of an Account is always decided or confirmed by a person. Human access to Customer Content is limited to what is necessary for these checks, for the support you request, for the security of the Service or to comply with legal obligations, and the people authorised to access it are bound by confidentiality.

For these security activities and for checking compliance with this Policy, we process data as an independent controller, on the basis of our legitimate interest in protecting the Service, its users and third parties (art. 6(1)(f) GDPR) and of the applicable legal obligations, as described in purpose 4 of the Privacy Policy. Security tools that use device identifiers, such as Google reCAPTCHA where it is active on the registration and login forms, are listed in the Privacy Policy.

AI Providers also apply their own safety checks. If a request is flagged by their systems, the AI Provider may retain it for longer periods and, where required by the law that applies to it, report it to the competent authorities, including outside the European Economic Area. You can ask us about the retention periods and the role of each AI Provider by writing to info@infinithink.it.

15.2 Measures are taken in proportion to the seriousness of the breach, its repetition and its consequences, at the following levels.

• precautionary measures, in the event of a possible breach. We may ask you for clarification or send you a warning, block an individual request or Output and suspend the individual content, chatbot, automation or scheduled publication concerned for the time needed to check it and in any case for no more than 15 days, unless the check depends on information we have asked you for and you have not yet provided. Precautionary measures do not result in the loss of Credits, which become available again when the measure is lifted;
• measures on individual content, where we establish that content, a chatbot, an automation or a scheduled publication is unlawful or breaches this Policy. We may remove or disable it;
• measures on the Account, only in the event of an established, serious or repeated breach. We may restrict features or integrations, suspend the entire Account or close it, in accordance with Section 15 of the Terms of Service, after sending you a warning and giving you a reasonable period to remedy the breach, except for the serious breaches listed in Section 15.5 and the cases in Section 15.4.

While the entire Account is suspended, we do not charge the automatic renewal. If the suspension lasts more than 30 days, you may cancel with immediate effect and obtain a refund for the unused period, without prejudice to our right to claim damages. In the event of closure, the refunds provided for in Section 15.2 of the Terms of Service apply.

15.3 When we restrict content or an account, we send you a clear and specific statement of reasons, setting out the measure taken and its duration, the facts and circumstances relied on, whether automated means were used to detect the content or to take the measure, the legal rule or provision of this Policy concerned and the remedies available to you, in line with art. 17 of Regulation (EU) 2022/2065 (Digital Services Act) to the extent that it applies. We do not send a statement of reasons only where this is prohibited by law or by an order of an authority, or where we do not have your electronic contact details.

15.4 In serious or urgent cases, such as child sexual abuse material, threats to life or safety, cyber attacks or ongoing fraud, we may act immediately and without prior notice. In these cases too, we send you the statement of reasons after acting, subject to the exceptions in Section 15.3. If we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of people has taken place, is taking place or is likely to take place, we inform the competent authorities.

15.5 Only the following are serious breaches that may justify the immediate suspension or closure of the Account without prior warning

• content that sexualises minors and the other conduct prohibited by Section 4;
• the practices prohibited by the AI Act listed in Section 6;
• generating sexual, intimate or nude images, video or audio of real people (Section 5.1, first point);
• terrorist or violent extremist content or activities, facilitating the use of weapons or of chemical, biological, radiological or nuclear agents, and human trafficking (Section 3, second, fifth and eighth points);
• phishing, scams, pyramid schemes and fraudulent offers (Section 8, eighth point);
• distributing malware, cyber attacks and attempts at unauthorised access (Section 10, first and second points);
• the serial creation of accounts to obtain free plans, Credits or trials (Section 10, fourth point).

15.6 The suspension or restriction of the Account does not prevent you from withdrawing using the "Withdraw from contract here" function ("Recedere dal contratto qui" in the Italian version), which is available in the website footer also while the Account is suspended, or by writing to info@infinithink.it, from cancelling your subscription or closing your Account (Sections 7.3, 8.2 and 15.3 of the Terms of Service) or from requesting a copy of your data (Section 16 of the Terms of Service), excluding unlawful content. Even in the event of closure, you can export your lawful Customer Content in accordance with Section 16 of the Terms of Service.

15.7 We may report unlawful conduct to the competent authorities. Communications to the authorities are based on art. 18 of the Digital Services Act, where it applies, or on other legal obligations (art. 6(1)(c) GDPR) and, in other cases, on our legitimate interest and on the right to file a criminal complaint under art. 333 of the Italian Code of Criminal Procedure, in compliance with art. 10 GDPR and art. 2-octies of the Italian Privacy Code. We disclose data to authorities of countries outside the European Economic Area only in the cases permitted by Chapter V GDPR, in particular art. 48.

15.8 We retain data relating to reports, measures taken, statements of reasons and reviews for 12 months from the closure of the case, plus any further time needed to handle a complaint or dispute, as stated in purpose 4 of the Privacy Policy. When we ask you to demonstrate consent, we examine it and keep only a record that the check took place, without copies of the documents, unless this is necessary to handle a pending report, complaint or investigation.

16. Review of decisions

16.1 You can ask us to review a decision by writing to info@infinithink.it within 6 months of becoming aware of it, explaining why you believe it is wrong and attaching any relevant information. The review is free of charge and is carried out by a person, not solely by automated means. We reply with a reasoned decision within 30 days.

16.2 If the review finds in your favour, we reverse the measure without undue delay and, where possible, restore the content or the account. If the measure prevented you from using a paid Plan or Credits, we extend the period and the validity of the Credits for a duration equal to the measure or, at your choice, refund the corresponding amount, without prejudice to the other remedies provided by law. Until the deadline for requesting a review expires and, if you request one, until the decision, we retain the Account data, unless you ask us to delete it earlier and except for unlawful content that we must remove or hand over to the authorities.

16.3 The review does not affect your rights under articles 15 to 22 GDPR, your right to lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) or with the supervisory authority of your country, your right to apply to the courts or your right to lodge a complaint with the Digital Services Coordinator, in Italy AGCOM, under art. 53 of the Digital Services Act. If you are a Consumer, you may also use the ADR procedures referred to in Section 24.4 of the Terms of Service.

17. Reporting illegal content and abuse

17.1 Anyone, including people without an account, can report content or uses of the Service that they consider illegal or contrary to this Policy, such as a chatbot installed on a website or content published through the Service, by writing to info@infinithink.it with "Report" or "Segnalazione" in the subject line. To help us assess the report, please include

• the reasons why you consider the content illegal or abusive;
• the exact location of the content, such as the URL, channel or chatbot concerned, and any screenshots;
• your name and email address, except for reports of child sexual abuse material, which you may also send anonymously;
• a statement that you believe in good faith that the information in the report is accurate and complete.

17.2 We confirm receipt, assess the report in a timely, diligent and objective manner and inform you of our decision, stating whether automated means were used and the remedies available.

17.3 We may decline to act on reports that are manifestly unfounded or submitted repeatedly and abusively.

17.4 Reports of copyright or trademark infringement follow the same procedure. Please also state the right you believe has been infringed and whether you are the right holder or are authorised to act on the right holder's behalf.

17.5 You can also report child sexual abuse material directly to the competent authorities, in Italy to the Polizia Postale.

17.6 We process the data you provide with your report, and the data of the people reported, only to handle the report. The legal basis is the obligation under art. 16 of the Digital Services Act, where it applies, or our legitimate interest in tackling abuse. We retain this data for 12 months from the closure of the report, plus any further time needed for a complaint. We disclose your identity to the person reported only where strictly necessary, for example for reports of infringement of intellectual property rights, and in that case we tell you beforehand. Your rights are described in the Privacy Policy.

17.7 If content generated or published with the Service contains your personal data, including your image or your voice, you can ask for it to be deleted or object to its processing by writing to info@infinithink.it, even if you do not have an account. If the content belongs to a Business Customer, we forward your request to the Customer, which is the controller, and assist it in responding.

18. Single point of contact

18.1 The address info@infinithink.it is our single point of contact for users of the Service and for the authorities of the EU Member States, the European Commission and the European Board for Digital Services, under articles 11 and 12 of the Digital Services Act.

18.2 We accept communications in Italian and English. Messages sent to this address are read and handled by a person. You can also write to us through the contact form on the website or by post to the business address shown in Section 1.

19. Changes

We may update this Policy to reflect changes in the law, in the Service or in the policies of AI Providers and third-party platforms, or to tackle abuse. Material changes are notified in the manner and within the time limits set out in Section 20 of the Terms of Service. The date of the latest update is shown at the top of this page. Changes do not have retroactive effect. If you do not accept a material change, you may withdraw before it takes effect, in accordance with Section 20.2 of the Terms of Service, without penalty and with a refund of any amount prepaid for the remaining period and of the price of Credits purchased as top-ups and not yet used.

20. Governing law and language

20.1 This Policy is governed by Italian law. If you are a Consumer, you keep the protection of the mandatory provisions of the law of the country where you habitually reside and, if you reside in Italy, the court of the place where you reside or are domiciled has jurisdiction (art. 66-bis of the Italian Consumer Code). In all other cases, the rules in Section 24 of the Terms of Service apply. People who use Sections 17 and 18 without having an Account do not, by doing so, accept this Policy.

20.2 This Policy is available in Italian and English. In case of conflict between the two versions, the Italian version prevails, except that for Consumers any doubt of interpretation is resolved in their favour (art. 35 of the Italian Consumer Code).

To report illegal content or abuse, write to info@infinithink.it with "Report" in the subject line.