Nightingale Software Group — Acceptable Use Policy

Effective date: 30 October 2026 · Version: 2026-10-30/v1.1

This policy forms part of your agreement with Luke Otto trading as Nightingale Software Group (and, from incorporation, Nightingale Software Group Limited) ("Nightingale"). It applies to every Nightingale app, the Admin Centre and our APIs. "You" means the customer business and everyone it lets use the service. You are responsible for your users' compliance.

1. Business use only

The services are for business use only. You must not use them as a consumer or for household or personal purposes. You confirmed this when you signed up.

2. You must not

1. Break any law or regulation, or help anyone else do so — including data protection law (UK GDPR, the Data Protection Act 2018), the Privacy and Electronic Communications Regulations 2003 (PECR), employment, immigration, health and safety, food safety and environmental law.
2. Upload or process personal data you have no lawful right to process, or special category or criminal-offence data without an appropriate legal condition.
3. Upload malware, or try to probe, scan or test the vulnerability of our systems, or get around security, rate limits, usage limits or tenant isolation (unless we have agreed a security test in writing).
4. Access another customer's data or try to identify the providers or infrastructure behind the service by reverse engineering, scraping or decompiling.
5. Resell, sublicense, frame or white-label the service unless you have a written partner agreement with us.
6. Use the service to build a competing product, or to train or benchmark AI models on our outputs.
7. Share log-ins between people. Each user needs their own account.
8. Upload content that is defamatory, discriminatory, harassing, obscene, or infringes someone else's rights.
9. Put excessive or abusive load on the platform (for example automated bulk requests outside our APIs).
10. Use AI features to make solely automated decisions about individuals that have legal or similarly significant effects (for example dismissal, refusal of work, or disciplinary action) without meaningful human review.

3. Extra rules for calling, messaging and outreach features

These apply to GaleCast, BirdCall, Songbird, Zevolo and any other app that lets you call, text or email people:

1. You are responsible for having a lawful basis and for PECR compliance for every contact you make. We provide tools; you decide who to contact.
2. Email/SMS marketing: you may send unsolicited marketing emails or texts only to corporate subscribers (limited companies, LLPs, public bodies, etc.). You must not send them to sole traders or partnerships without their prior consent. Every message must identify you and include a working opt-out.
3. Live calls: cold outreach calls must be made by a person. You must not make live marketing calls to anyone who has told you not to call, or to numbers registered with the Telephone Preference Service or Corporate TPS unless they have consented to your calls. The platform keeps a do-not-contact and suppression list for you, but it does not check numbers against those registers — that check is your responsibility.
4. Automated or AI-voiced calls: we treat calls that play a recorded or synthetic (AI-generated) voice without a live human in control as automated calls under PECR regulation 19, which need the recipient's prior consent — including to business numbers. This is the cautious reading of the law and the one we require on our platform. AI-voice calls may only be made to people who have consented to receive them or who have asked you to call them back. All cold outreach must be human-led. Any AI agent must say at the start that it is an AI and who it is calling for, and must never claim to be human.
5. Recording: if calls are recorded or transcribed you must tell the other party at the start of the call.
6. Add anyone who objects to your suppression list straight away. Do not delete suppression entries.
7. Do not use the services for debt collection, political campaigning, or contacting consumers at home.
8. Respect contact-frequency limits and reasonable calling hours (Monday to Saturday, 08:00–20:00 UK time unless you have consent otherwise).

4. Extra rules for workforce apps

For PunchLine, Shift Check, KoWurk, Onboardly, Formermize, Rekuver, Rampify, CleanNest and similar apps: you must tell your workers what data you collect (including location, phone-clocking and any monitoring) and why, before you start; only track location during working time; and carry out right-to-work checks in line with Home Office guidance (our tools help you record them, but you remain responsible for the check).

5. Food safety and compliance records

For Ekspedite, WasteVault, FacilityFlow Core, e-Kwip and Stok: the apps help you keep records, but they do not replace your own legal duties (for example your HACCP plan, allergen labelling, waste duty of care or equipment inspections). You must check that the information you record and display — especially allergen information — is accurate.

6. If you break this policy

We may suspend or restrict the affected accounts or features straight away where there is a risk to people, to the platform, or to our legal position, and we will tell you why. Serious or repeated breaches allow us to end your subscription under our Terms. You must indemnify us for claims and fines caused by your breach of this policy, as set out in our Terms.

7. Reporting

Report abuse, security issues or unlawful content to team@nightingalesoftware.co.uk.