Iris acceptable use policy

This policy applies to everyone who uses Iris and Iris Cloud, and to every website made with Iris. It is part of the Iris Cloud terms of service.

Iris is for building real websites for real businesses, people and causes. Use it honestly.

1. Anthropic's Usage Policy applies to Iris Cloud

Iris Cloud runs on AI models provided by Anthropic. When you use Iris Cloud, you must also follow Anthropic's Usage Policy, which we pass on to you as part of this policy. Anything that breaks Anthropic's Usage Policy breaks this policy too. Where the two differ, the stricter rule applies.

2. Never use Iris, or a website made with it, for

Fraud and deception

• Phishing: pages that imitate a real sign-in, bank, payment, delivery, government or support page, or that trick people into giving up passwords, codes or personal details.
• Credential or payment harvesting: fake checkouts, fake donation pages, card-testing pages, or forms that collect passwords, card numbers or bank details under false pretenses.
• Impersonation: pretending to be a real person, company, brand, charity or public body, or using their name, logo, branding, photos or a look-alike domain in a way that could mislead people, without their permission. Clearly labeled parody and fan sites that do not mislead anyone are allowed.
• Fake reviews and endorsements: made-up reviews, ratings, testimonials, client logos, awards, press mentions or endorsements, including ones written by AI, or reviews written by the business about itself as if by customers.
• Fake documents: fake receipts, invoices, order confirmations, tickets, certificates, licenses, IDs or official letters.
• Scams: fake shops that will not deliver, investment, crypto or giveaway scams, advance-fee fraud, fake jobs, fake charities, or prices and subscriptions designed to trap people.

Harm to computers and networks

• Malware, viruses, ransomware, spyware, cryptominers, exploit kits, drive-by downloads or hidden scripts.
• Attacking, scanning or overloading systems you are not authorized to test.

Harm to people

• Sexual content involving minors in any form. We report child sexual abuse material to the National Center for Missing & Exploited Children and to the authorities.
• Sexually explicit content.
• Intimate images shared without consent.
• Harassment, threats, stalking, or publishing someone's private information (doxxing).
• Content that promotes violence, terrorism or hatred against people for who they are.
• Selling or promoting illegal goods or services, including weapons and drugs where they are illegal. The payment and hosting services you connect have their own lists of what they refuse (Stripe's includes adult content, gambling and get-rich-quick schemes): check them, as they can close your account.
• Therapy or mental health treatment delivered by AI, unless the law where you offer it allows it and a licensed professional is responsible for it.
• False information about elections or voting, or impersonating candidates or officials.

Other people's rights

• Copying other people's websites, text, photos, designs, logos or trademarks without permission.
• Collecting personal data without telling people and getting the consent the law requires, or tracking visitors without consent where the law requires it.

Spam

• Spam, doorway pages, keyword-stuffed pages or link schemes meant to game search engines.
• Marketing email or text messages to people who did not agree to get them where the law needs that, or marketing email without a working unsubscribe and your postal address.

3. Rules for AI features

• Tell visitors about AI chat. If your website has an AI assistant that talks to visitors, it must say clearly that it is an AI, at least at the start of each conversation or in the chat window, and it must never claim to be a person. Iris's visitor assistant does this; keep it that way.
• Review high-stakes advice. If your website gives legal, medical, mental health, financial, tax, insurance, credit, housing, employment or education advice, a qualified person must review the AI-written content before it goes live, and you must tell visitors AI was used. Do not set an AI assistant to give that kind of personal advice.
• Children. Do not use the AI assistant, or collect personal information, on a site directed at children under 13 unless you meet the children's privacy law, including parents' consent. Anthropic has extra rules for products that serve anyone under 18.
• Check facts. Do not publish AI-written claims (prices, results, qualifications, health or safety claims) that you have not checked.
• Do not get around safety systems. Do not try to make the AI produce content it refuses, or hide what you are asking for.
• Do not bend agents to harm. You are responsible for what Agent Iris does on your approval, including through the services it connects to.
• Iris Cloud is for Iris. Do not resell it, use it as a general AI service, or use its output to build or train a competing AI model.

4. Rules for the service

• Do not share your Iris Cloud account, or get around credits, limits or metering.
• Do not probe, attack or overload Iris Cloud, or use it in a way that harms other users.

5. What we do about breaches

Depending on how serious the breach is, we may:

• warn you and ask you to fix it;
• stop jobs, limit or suspend Iris Cloud, or close your account;
• end your license to use Iris;
• tell the host, registrar or payment provider of a harmful website;
• report it to the police or other authorities, and keep the information the law requires.

Websites published from Iris are hosted by Iris, on Cloudflare's network under Iris's own account, so we can take one offline. A copy someone downloaded or published elsewhere we cannot see or take down ourselves, but we pass on credible reports to the company that hosts it, and we can stop Iris Cloud and the website assistant on an account.

6. How to report abuse

If you see a website made with Iris used for phishing, scams, impersonation, malware or anything else this policy bans, email [email protected] with:

• the address of the website or page;
• what is wrong, and any screenshots or other evidence;
• how we can reach you (optional, but it helps us follow up).

What happens next:

1. We confirm we received your report within 2 business days.
2. We review it. Reports of child sexual abuse material, active phishing and malware are handled first.
3. If the site uses Iris Cloud or breaks our terms, we act as in section 5. If it is hosted elsewhere, we send the report to its host and registrar, and we tell you where else you can report it.
4. We tell the account holder about the report where we lawfully can, without your name unless you agree or the law requires it.
5. We let you know the outcome where we can.

If someone is in immediate danger, contact the police first. Copyright complaints follow our Copyright and DMCA policy.

7. If we act on your account

We tell you what we did and why, where we lawfully can. If you think we made a mistake, reply to our message or email [email protected] within 30 days, and a person who was not involved in the first decision will review it.

8. Changes

We may update this policy. The version and date are at the top.

All policies