1.Purpose and binding effect
Donna Technologies Pty Ltd (ACN 691 287 457) operates the Donna Platform at bydonna.ai (the “Platform”). The Platform is an AI-assisted legal collaboration environment built for admitted legal practitioners and the staff who support them. This Acceptable Use Policy (the “AUP”) sets the rules of engagement that apply to every use of the Platform, regardless of the contract under which a Customer accesses it.
The AUP is incorporated by reference into the Platform Agreement, the Service Terms and the Evaluation Terms. Defined terms used in those documents have the same meaning here. Where the AUP and another Donna agreement address the same subject matter, the stricter rule applies.
The Customer is responsible for ensuring that each Authorised User and each End Client invited into a Space complies with the AUP. The acts and omissions of those users are treated, for the purposes of enforcement under this AUP, as if they were the acts and omissions of the Customer itself.
2.Prohibited content
The Customer must not upload, store, transmit, generate, request or otherwise process through the Platform any content that falls into the categories below. These categories are illustrative and not exhaustive.
2.1 Unlawful, infringing or defamatory content
Content that is unlawful under Australian law or the law of a jurisdiction relevant to the Customer or the End Client. This includes content that infringes copyright, trade marks, designs, patents, confidential information, trade secrets, moral rights or any other intellectual property right, and content that is defamatory, misleading, deceptive or that constitutes a serious invasion of privacy.
2.2 Child sexual exploitation material
Any material that depicts, describes or solicits child sexual abuse, child exploitation or the sexualisation of a person under 18 years of age, including material captured by the offences in Divisions 272, 273 and 474 of the Criminal Code Act 1995 (Cth) and equivalent offences in other jurisdictions. There is no permitted use of the Platform for this material in any form, including for purposes described as research or analysis.
2.3 Terrorism and abhorrent violent material
Content that promotes, incites, instructs or provides material support for a terrorist act within the meaning of Part 5.3 of the Criminal Code Act 1995 (Cth), and abhorrent violent material within the meaning of the Criminal Code Amendment (Sharing of Abhorrent Violent Material) Act 2019 (Cth). Material that depicts terrorist acts, murder, attempted murder, torture, rape or kidnapping in a way that a reasonable person would regard as offensive falls within this category.
2.4 Non-consensual intimate imagery
Intimate images or recordings shared without the depicted person’s consent, content that is the subject of a removal notice under the Online Safety Act 2021 (Cth), and content created or modified using synthetic media techniques to depict a person in a sexual context without that person’s consent.
2.5 Content depicting unlawful acts of violence
Material that glorifies, incites or provides operational instruction for serious violence against a person, including content that breaches Division 80 (urging violence) of the Criminal Code Act 1995 (Cth).
2.6 Discriminatory content
Content that constitutes unlawful discrimination, vilification or harassment within the meaning of the Racial Discrimination Act 1975 (Cth), the Sex Discrimination Act 1984 (Cth), the Disability Discrimination Act 1992 (Cth), the Age Discrimination Act 2004 (Cth) and equivalent State and Territory legislation. This includes content reasonably likely to offend, insult, humiliate or intimidate a person or group on the basis of a protected attribute.
2.7 Personal Information processed without lawful basis
Personal Information, including sensitive information and health information, where the Customer does not have a lawful basis under the Privacy Act 1988 (Cth) or other applicable privacy law to collect, use or disclose that information by way of the Platform. The Customer remains the controller of Customer Data it places in a Space and warrants that each upload is supported by a lawful basis.
The presence of any of the content described in this section, even momentarily and even where that content was generated as Output, is a material breach of the Platform Agreement.
3.Prohibited conduct
The Customer and its Authorised Users must not engage in any of the following conduct in connection with the Platform.
3.1 Unauthorised access and impairment
Accessing, attempting to access, modifying or impairing any part of the Platform, any Donna system or any third party system, in a manner that is not expressly permitted by Donna. Conduct in this category may attract liability under Part 10.7 of the Crimes Act 1914 (Cth), the Computer Misuse Act 1990 (UK) or the Computer Fraud and Abuse Act in the United States.
3.2 Circumvention of access controls
Bypassing, disabling or interfering with authentication, authorisation, rate limiting, audit logging, content moderation or any other security or governance control implemented by Donna. Sharing access credentials between people, using a single Authorised User account for more than one natural person, or operating an account on behalf of a person who has been suspended.
3.3 Malware and harmful code
Uploading, transmitting or distributing through the Platform any virus, worm, trojan, ransomware, spyware, keylogger or other code intended to cause harm, disrupt operation, gain unauthorised access or exfiltrate data.
3.4 Security testing without prior written consent
Conducting penetration testing, vulnerability scanning, fuzzing, denial of service testing, prompt injection campaigns or red-team exercises against the Platform or any Donna system without Donna’s prior written consent. Section 8 sets out the responsible disclosure programme for good-faith research.
3.5 Rate limit and quota evasion
Generating volumes of requests that exceed the published or contractually agreed limits, distributing traffic across multiple accounts to defeat per-account limits, or using automation to circumvent throttling, queueing or fair-use protections.
3.6 Reverse engineering and scraping
Decompiling, disassembling or reverse engineering the Platform, or using crawlers, scrapers or harvesting tools to collect content, prompts, Outputs, telemetry or other material from the Platform other than as expressly permitted in writing.
3.7 Competitive benchmarking without authorisation
Using the Platform to develop, train, evaluate or benchmark a product that competes with the Platform, or publishing comparative performance data about the Platform without Donna’s prior written consent.
3.8 Resale
Reselling, sublicensing, time-sharing or otherwise making the Platform available to a third party as a hosted or managed service, except to the extent the Platform is provided to End Clients within Spaces in accordance with the Platform Agreement.
4.AI-specific prohibitions
The Platform is sold to admitted legal practitioners and the staff who support them for use in their practice. Outputs are intended to inform a legal practitioner’s professional judgement, not to replace it. The following AI-specific prohibitions apply in addition to the general rules above.
4.1 Outputs are not legal advice
The Customer must not rely on, or permit any Authorised User or End Client to rely on, an Output as a substitute for legal advice provided by an admitted legal practitioner. Outputs are working product. They must be reviewed, corrected and adopted by a qualified practitioner before they are issued, filed, lodged or relied upon for any legal purpose.
4.2 No public-facing legal-advice service to consumers
The Customer must not deploy the Platform, or any product built on the Platform, to render legal advice direct to members of the public outside an established lawyer-client relationship. This prohibition specifically extends to chat-bot or virtual-assistant front ends that surface Outputs to consumers without practitioner review of each response. Where the Customer offers any consumer-facing service powered by the Platform, an admitted legal practitioner must review each Output before it is communicated to the consumer.
4.3 No fully automated legal decisions affecting individuals
The Customer must not use the Platform to make a fully automated decision that produces legal effects concerning a natural person, or that significantly affects a natural person’s rights, opportunities or access to services, without meaningful human supervision by a qualified person. Where any element of an Output forms part of such a decision, a human reviewer must be capable of, and accountable for, accepting, rejecting or modifying the Output before it is acted upon.
4.4 No deceptive deepfakes or impersonation
The Customer must not use the Platform to generate or distribute synthetic media that impersonates a judicial officer, regulator, court, tribunal, government agency, counterparty, witness or any other identifiable person, where the synthetic character of the media is not clearly disclosed and the relevant person has not consented. Lawful and clearly disclosed uses of synthetic media for training, simulation or demonstration are permitted where the depicted persons have consented.
4.5 No extraction of model weights or training data
The Customer must not attempt to extract, reconstruct or otherwise obtain the weights, parameters, training data, system prompts or internal representations of any model used by or made available through the Platform, including by means of adversarial prompting, model inversion, membership inference or distillation techniques.
4.6 No use of Outputs to train competing AI models
The Customer must not use Outputs, prompts, telemetry or any other material obtained from the Platform to train, fine-tune, evaluate or align a machine learning model that competes with the Platform or with any service offered by Donna’s Subprocessors, including Microsoft Corp and Amazon Web Services, or with any model developer whose models are made available through the Platform.
4.7 No biometric categorisation or social scoring
The Customer must not use the Platform to perform biometric categorisation of natural persons, including the inference of race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. The Customer must not use the Platform to evaluate or classify natural persons over a period of time on the basis of social behaviour or known, inferred or predicted personal characteristics in a way that would constitute social scoring.
4.8 No high-risk profiling without human-in-the-loop
The Customer must not use the Platform to assess a natural person’s creditworthiness, employability, access to insurance, access to housing, access to education or access to other essential services, unless a qualified human reviewer is in the loop on every decision and the Customer has independently confirmed that its use complies with all law applicable to it. This is a blanket Donna policy. It applies whether or not the EU AI Act applies to the Customer.
Why this matters
5.Legal professional conduct
Authorised Users who are admitted legal practitioners must comply with the rules of professional conduct that apply to them in the jurisdictions in which they are admitted, including the Legal Profession Uniform Law in New South Wales and Victoria and equivalent legislation in other Australian jurisdictions and overseas. Use of the Platform does not displace those rules.
The Customer is responsible for supervising non-legal staff who use the Platform on its behalf, consistent with rule 31 of the Legal Profession Uniform General Rules 2015 or the equivalent supervision obligation in non-uniform jurisdictions. Configuration of Spaces, role assignments and the publication of Outputs to End Clients must be performed under the direction of an admitted legal practitioner.
The Customer must not use the Platform in a manner that would cause an Authorised User to engage in legal practice contrary to the unqualified-practice provisions of the Legal Profession Uniform Law or its equivalents. The Platform is not a substitute for admission, holding a current practising certificate or maintaining professional indemnity insurance.
6.Electronic communications and spam
The Customer must not use the Platform, or any feature of the Platform, to send unsolicited commercial electronic messages in breach of the Spam Act 2003 (Cth), the CAN-SPAM Act of 2003 (US), Canada’s Anti-Spam Legislation (CASL), the Privacy and Electronic Communications Regulations 2003 (UK) or any other law that regulates the sending of commercial electronic messages.
Where the Customer uses the Platform to send communications to its own clients or contacts, including Space invitations, document share notifications and matter updates, the Customer warrants that:
- It has obtained the requisite consent from each recipient, whether by way of express consent or inferred consent based on an existing professional relationship, and can produce evidence of that consent on request.
- Each commercial electronic message identifies the Customer as the sender and includes a functional unsubscribe facility that complies with the law of the recipient’s jurisdiction.
- The Customer maintains its own suppression list and honours unsubscribe requests within the time required by applicable law.
Donna may suspend any sending feature where it has reasonable grounds to believe that the Customer is using the Platform to send messages in breach of this section, and Donna may cooperate with the Australian Communications and Media Authority and equivalent overseas regulators in the investigation of any such breach.
7.Security obligations of Authorised Users
Each Authorised User must:
- Keep the credentials used to access the Platform confidential, and not share those credentials with any other person.
- Use the multi-factor authentication mechanism offered by the Platform where one is available for the relevant role, and not disable or downgrade that mechanism.
- Use the Platform only from devices that are managed in accordance with the Customer’s information security policies and that are kept current with applicable security patches.
- Treat session tokens, API keys and webhook secrets issued by the Platform as confidential information and rotate them when an event reasonably suggests they may have been compromised.
The Customer must report any actual or suspected compromise of an Authorised User credential, an API key, a session, a Space or any Customer Data within 24 hours of becoming aware of the compromise. Reports must be sent to the addresses set out in section 8.
8.Reporting abuse and security issues
Donna welcomes reports of abuse, content concerns and security issues. Reports may be submitted by anyone, whether or not they are an Authorised User.
Where to write
Security issues, including suspected vulnerabilities and credential compromise: security@bydonna.ai.
Abuse, prohibited content and AUP breaches: abuse@bydonna.ai.
8.1 Responsible disclosure programme
Donna operates a responsible disclosure programme. The published scope, the permitted testing techniques and the safe harbour terms are set out at /security. Researchers acting in good faith and within the published scope must:
- Test only against accounts and resources that they own or that have been specifically authorised by Donna for testing.
- Avoid degradation of service for any other customer, avoid privacy violations, and refrain from accessing, modifying or exfiltrating Customer Data beyond the minimum needed to demonstrate the issue.
- Provide Donna with a reasonable opportunity to investigate and remediate before publishing any details of the finding.
Donna will not pursue civil or criminal action under the Crimes Act 1914 (Cth) or equivalent overseas laws against a researcher who acts in good faith and within the published scope.
9.Enforcement
Donna may investigate any suspected breach of this AUP. In the course of an investigation Donna may:
- Issue a written notice requiring the Customer to remedy the breach within a stated period.
- Suspend access for an Authorised User, an End Client, a Space or the Customer as a whole.
- Quarantine specific items of Customer Data where Donna reasonably believes those items breach this AUP, while preserving them for legal or regulatory process.
- Terminate the Platform Agreement in accordance with its terms.
Donna will provide notice and an opportunity to remedy where time permits. Donna may act without prior notice where the breach is of section 2.2 (child sexual exploitation material), section 2.3 (terrorism and abhorrent violent material) or where Donna reasonably believes that immediate action is required to prevent serious harm, to comply with a legal obligation or to preserve the integrity of the Platform.
A decision by Donna not to suspend or terminate in respect of a particular breach does not waive Donna’s right to take enforcement action in respect of any subsequent or continuing breach.
10.Cooperation with regulators
Donna will cooperate with regulators, courts and law enforcement to the extent required by law. This includes the eSafety Commissioner under the Online Safety Act 2021 (Cth), the Office of the Australian Information Commissioner (the “OAIC”) under the Privacy Act 1988 (Cth), the Australian Federal Police and equivalent regulators and authorities in the United Kingdom, the European Economic Area, the United States, Canada and other jurisdictions in which Donna or its customers operate.
Where Donna receives a removal notice, takedown notice, preservation notice or compelled-disclosure notice that affects Customer Data, Donna will, where lawfully able to do so, notify the affected Customer before taking action and will limit any disclosure to what the notice requires.
11.Indemnity for breach
The Customer indemnifies Donna and Donna’s personnel, contractors and Subprocessors against any loss, damage, cost, expense (including reasonable legal costs on a solicitor-and-own-client basis), fine, penalty or claim arising out of or in connection with a breach of this AUP by the Customer, an Authorised User or an End Client invited into a Space by the Customer. This indemnity is in addition to any other right or remedy Donna has under the Platform Agreement, the Service Terms or the Evaluation Terms.
This indemnity does not extend to loss to the extent it is caused by Donna’s own breach of the Platform Agreement or by Donna’s wilful misconduct.
12.Changes to this AUP
Donna may amend this AUP from time to time. Donna will publish the current version at /legal/acceptable-use-policy and will update the “Last updated” date at the top of the page.
Where a change is non-material, for example a clarification, a typographical correction or a structural improvement, the change takes effect on publication and continued use of the Platform constitutes acceptance.
Where a change is material, for example the introduction of a new prohibition that materially restricts the Customer’s use of the Platform, Donna will give the Customer at least 30 days notice by email to the Customer’s nominated billing contact, or by an in-product notice that requires positive opt-in by an Authorised User with administrative privileges. If the Customer does not accept a material change, the Customer’s sole remedy is to terminate the Platform Agreement under its termination-for-convenience provisions.
13.Contact
Questions about this AUP, including requests for written consent under sections 3.4, 3.7 or 4.4, should be addressed to abuse@bydonna.ai. Security issues should be addressed to security@bydonna.ai.