Acceptable Use Policy

This Acceptable Use Policy is part of the Terms of Use of Siamang Studio and Siamang Cloud (the Services), operated by Siamang Labs LLC (Siamang, we, us). It applies to everyone who uses the Services, and to everything a survey shows its respondents.

Every survey we host is served from the same web address, and every invitation leaves from the same sending domain. One phishing page or one spam list can get that address blocked by browsers and that domain blocked by mail providers, for every customer. That is why we enforce these rules quickly.

1. What you may not do

Phishing, fraud and credential collection

• Ask respondents for passwords, PINs, one-time codes or security answers, for any account.
• Collect full payment card numbers, bank login details or similar financial credentials.
• Imitate another organization’s login page, brand or website, or pretend to be someone you are not.
• Run scams, fake prize draws or offers you do not intend to honor.

Malware and harmful code

• Distribute malware, or link to it.
• Use custom code to attack respondents’ devices, mine cryptocurrency, or redirect respondents to harmful sites.

Spam

• Upload contact lists that were bought, rented, scraped or harvested, or people who have not agreed to hear from you and have no existing relationship with you.
• Send invitations unrelated to a genuine survey, or remove, hide or work around the unsubscribe link.
• Create accounts or organizations to get around mailing limits or a paused mailing.

Illegal content

• Publish or collect content that is illegal where it is published or read, including child sexual abuse material, content that incites violence or terrorism, and content that infringes someone else’s intellectual-property rights.

Harassment and hate

• Use a survey or an invitation to threaten, harass, intimidate or dox anyone, or to promote hatred against people because of a protected characteristic.

Deceptive surveys

• Misrepresent who runs a survey, what it is for, or how answers will be used.
• Disguise sales or marketing as research.
• Collect data under a false promise of anonymity or confidentiality.

Abuse of respondents

• Collect more personal data than you tell respondents about, or without a lawful basis.
• Collect special categories of data (such as health, religion or sexual orientation), or data from children, without the legal basis and protections the law requires.
• Track respondents beyond your survey, fingerprint their devices, or load trackers without a lawful basis and a notice.
• Publish respondents’ personal data, for example through a public dashboard or share link, without a lawful basis.
• Use custom JavaScript to read, change or send data that belongs to another survey, or to hide a survey’s Report abuse link.

Abuse of the Services

• Probe, scan or test the security of the Services without our permission, except as allowed in section 5.
• Try to get around the analysis sandbox, rate limits, quotas, plan limits or access controls, or to reach another organization’s data.
• Scrape the Services, or put excessive or automated load on them.
• Use the Services to host files or pages unrelated to surveys and research, or to run an open redirect.
• Create accounts with fake details, by automated means, or to get repeated free trials.
• Resell the Services in a way that gets around these rules or your plan’s limits.

2. How to report a survey

At the bottom of every survey page there is a Report abuse link. It opens studio.siamang.org/report, which prepares an email to us with the survey’s address filled in. You do not need an account, and the page stores nothing.

You can also write to support@siamang-team.org. A good report includes:

• the survey’s address (its full link);
• what is wrong, for example phishing, a scam, harassment, someone else’s personal data or illegal content, and why;
• a screenshot, if you can take one safely;
• your name and email address, if you would like a reply.

We do not tell the survey’s owner who reported it, unless the law requires us to.

To report a security vulnerability in the Services themselves, write to the same address; it is also listed in our security.txt.

3. What we do with a report

1. We acknowledge it. If you gave a contact, we aim to confirm we received your report within 24 hours.
2. We review it. A member of our team opens the survey as any visitor would, records what they see, and finds the organization behind it. We do not use automated decision-making on reports.
3. We act.
   • Clear abuse, such as phishing, collecting passwords or payment details, malware or illegal content, is taken down as soon as we have checked it, usually within hours.
   • In other cases we usually decide within 2 business days. We may first ask the survey’s owner to explain or fix it, and pause the survey in the meantime.
   • Unfounded reports are closed.
4. Our actions, from the lightest to the most serious: closing the survey (its page is replaced by a “Survey closed” notice and it stops accepting responses), pausing the organization’s mailings, freezing the organization (all its live surveys are paused), and disabling an account. A takedown does not delete the organization’s data.
5. We tell the account owner. The organization’s owners receive an email that names the survey; says what we did and for how long; says whether we acted on a report or on our own review; names the rule of our Terms, or the law, it broke and why; confirms that no automated means were used; and explains how to appeal: by replying to the email, or before a competent court. In urgent cases we act first and send this email right after.
6. Appeals. The owner can appeal by replying to that email. Where our team’s size allows, someone who was not involved in the decision reviews the appeal. We reverse the action if it was wrong.
7. We tell the reporter what we decided, without details about the owner’s account, and that they can reply to ask us to look again or go to a competent court.

We keep a record of each report, our review, our decision and our messages for 2 years.

4. Notices under the EU Digital Services Act

For users and authorities in the European Union, the process above is our notice-and-action mechanism:

• Notices of illegal content can be sent through the report page or by email, as described in section 2. A notice should explain why the content is illegal, give its exact address, and include the sender’s name and email address (except for reports of child sexual abuse material), with a statement that the notice is made in good faith and is accurate.
• Statement of reasons: when we restrict a survey or an account, the owner receives the reasons described in section 3, step 5, and can appeal as in step 6.
• Point of contact for users, and for authorities of the Member States, the European Commission and the European Board for Digital Services: support@siamang-team.org, in English.
• Orders from a competent authority to act against illegal content or to provide information are carried out as the law requires, and we tell the authority what we did.
• If a report gives us reason to suspect a crime that threatens someone’s life or safety, we inform the competent law enforcement authorities.
• We may stop processing notices from someone who repeatedly sends notices that are clearly unfounded, after warning them.

5. Good-faith security research

You may look for security vulnerabilities in the Services if you:

• use only your own accounts and your own test data;
• do not access, change or delete other people’s data, and stop as soon as you reach any;
• do not degrade the Services for others (no denial-of-service or load testing, no spam, no social engineering of our staff or customers);
• report what you find to support@siamang-team.org and give us reasonable time to fix it before you publish.

We will not take action against research done within these limits.

6. Changes and contact

We update this policy together with the Terms of Use. Questions: support@siamang-team.org.

---

This policy is written in plain language. It is not legal advice.