Acceptable Use Policy

Who this policy applies to

This policy covers every use of METAQUANTICS: the web interface, user accounts, public API keys, the MCP server and read-only share links. It describes what you may not do with the platform, with the data it displays and with its OSINT (open-source intelligence) tools.

It complements the Terms of Use and the Privacy Policy. Whoever uses an API key or a share link is responsible for what is done with it, including by third parties they passed it on to.

Prohibited uses

You may not use METAQUANTICS, directly or indirectly, to:

• Circumvent authentication or access control. Sign in with someone else's account, share credentials, bypass the account approval done by the administrator, the limits of your plan or the Store's source blocking, forge session cookies or exploit flaws to obtain access you were not granted.
• Abusive collection and overload. Mass-scrape the application's pages or internal routes, exceed or bypass request limits (for example, by rotating IP addresses, keys or accounts), or generate traffic that degrades the service for other users.
• Extract keys and secrets. Reverse-engineer, inspect traffic or use any other technique to obtain the third-party service keys configured on the server, other users' API keys or session secrets, or use the platform's routes as an intermediary to reach data sources while circumventing their terms.
• Unlawfully surveil people. Monitor, profile, track or locate an individual without a legal basis, including stalking, exposing personal data (doxxing) or compiling dossiers on individuals without a legitimate purpose.
• Harass, intimidate or discriminate. Use the data or the tools to threaten, embarrass, discriminate against or incite violence against people or groups.
• Breach the terms of data sources. Use third-party data in ways the source's license or terms do not allow, such as commercial use of data released for non-commercial use only, removing required attribution or automated collection the source forbids.
• Resell or redistribute restricted data. Resell, sublicense or mass-republish data whose license is non-commercial or forbids resale and redistribution, including through responses from the public API or the MCP server.
• Attack systems. Use the vulnerability, open port, certificate, DNS or threat information displayed to break into, scan or attack systems and networks without authorization from whoever controls them.
• Engage in unlawful acts. Commit fraud, evade sanctions, infringe third parties' rights or break applicable law, including Brazil's LGPD (Law 13,709/2018).

Usage limits

To protect the service and the data sources, the platform limits the number of requests. The values below are the ones currently set in the code. The public API and the MCP server only work when they are enabled on this instance, and keys are issued and revoked by the administrator.

When you hit a limit, the response has status 429 and, when possible, says how long to wait (Retry-After header). Automated clients must honor that wait, use progressive backoff between retries and cache whatever does not change often.

Responsible use of OSINT

METAQUANTICS brings together open-source data and offers OSINT tools, some of which can look up information linked to people, such as usernames on public sites, phone numbers and whether an e-mail address or domain appears in data breach and infostealer databases.

Public data is not free data: the LGPD still applies to publicly accessible personal data, and processing it must respect the purpose, good faith and public interest that justified making it available (art. 7, §§ 3 and 4). When you use these tools, follow these principles:

• Legitimate purpose. Use the tools for purposes such as information security, fact-checking, journalism, academic research or due diligence, and have a legal basis to process personal data when it shows up.
• Only what is necessary. Look up and keep only the data essential to your purpose, for as long as needed, as the LGPD's necessity and adequacy principles require (art. 6).
• Prefer what is yours. Checking breaches and exposure is most appropriate for your own e-mail addresses, accounts and domains, or those of the organization you represent and are authorized by.
• Confirm before acting. OSINT results can be wrong, incomplete or outdated. A matching username, for example, does not prove that two accounts belong to the same person. Do not make decisions that affect someone based on these results alone.
• Extra care with sensitive data. Do not use the platform to infer or expose sensitive personal data, such as racial or ethnic origin, religious belief, political opinion, health or sex life, nor data about children and adolescents.

Third-party data and terms

Much of what the platform displays comes from third-party sources, each with its own license. Accessing data through METAQUANTICS does not extend the rights the source grants. Some examples of restrictions recorded in the connector registry:

The full list of sources, licenses and required attribution is in Data licences and attribution. When you reuse any data outside the platform, you are responsible for complying with the source's license, including keeping the attribution and respecting restrictions on commercial use.

Consequences

In response to use that breaches this policy, depending on its severity and without prejudice to the Terms of Use, the METAQUANTICS administration may:

• limit or block requests, automatically or manually;
• revoke public API and MCP server keys, which cuts off access immediately;
• revoke share links, which stop opening right away;
• suspend or close the account involved;
• preserve the relevant records and report them to the competent authorities when the law requires it or when there is evidence of a crime.

How to report abuse

If you become aware of a use of METAQUANTICS that breaches this policy, such as surveillance of people, harassment, data resale or API abuse, report it. It helps to include:

• where it happened: the page address, share link or API route involved;
• when it happened, with date, time and time zone;
• what happened and why you believe it breaches this policy;
• evidence, such as screenshots or response excerpts.

Send only the personal data essential to understand the case and do not include passwords, API keys or full tokens.

The public contact channel has not been published on this page yet. In the meantime, account holders should forward the report to the administrator who approved their access.

To report a technical vulnerability in the platform, follow Security and responsible disclosure.

Changes to this policy

This policy may be updated to reflect changes to the platform, the data sources or the law. The date of the last update appears at the top of the page. Continued use after a change indicates agreement with the version in force.