Effective date: October 22, 2026

Acceptable use policy

GoodTaco is for building apps that help businesses and organizations run their work. This policy lists what you can’t do with it. It’s part of our terms of service and applies to you, your workspace members, your apps, and the people who use them.

1. Illegal, harmful and deceptive use

Don’t use GoodTaco, or build apps with it, to:

  • break any law, or help someone else break one;
  • collect passwords, payment details or other credentials by deception (phishing), or build pages that copy the sign-in or payment pages of another company;
  • impersonate a person, company or government body, or mislead people about who runs an app;
  • run scams, fraud, pyramid schemes, fake reviews or fake giveaways;
  • sell or promote illegal goods or services, weapons, illegal drugs, or gambling where it isn’t licensed;
  • harass, threaten, bully or stalk anyone, or promote violence, terrorism, self-harm, or hatred against people based on protected characteristics;
  • share sexually explicit material or content that sexualizes minors (we report child sexual abuse material to the authorities);
  • publish people’s private information without permission (doxxing);
  • infringe anyone’s copyright, trademark, privacy or other rights.

2. Email and messaging

When your apps send email from a connected Gmail account:

  • send email only to people who expect it, such as your customers, staff, or people who filled in your form;
  • don’t send spam, unsolicited bulk email, or email to bought or scraped lists;
  • follow anti-spam laws such as the CAN-SPAM Act, including a working way to unsubscribe from marketing email and an accurate sender;
  • follow Google’s Gmail program policies and sending limits.

3. Data GoodTaco apps can’t hold

GoodTaco isn’t built for regulated or highly sensitive data. Don’t put these into GoodTaco, its databases, or apps built with it:

  • Health information covered by HIPAA (protected health information). We don’t sign business associate agreements.
  • Full payment card numbers, security codes or other card data covered by PCI DSS. Use a payment provider such as Stripe for payments.
  • Social Security numbers, government ID numbers (such as passport or driver’s license numbers) or scans of ID documents.
  • Biometric data, such as fingerprints or face scans.
  • Data from children under 13: don’t build apps that collect personal data from children under 13 or that are aimed at them. Schools and youth programs can use GoodTaco for staff work, such as rosters kept by staff, but not for apps children sign in to or submit data through.

If you put these into GoodTaco anyway, you’re responsible for that, and we may delete it.

4. Decisions about people

Don’t use GoodTaco apps to make decisions with legal or similarly significant effects on people (such as credit, employment, housing, insurance, education or medical decisions) without a person reviewing each decision, and follow the laws that apply to those decisions.

5. Protecting the Services

Don’t:

  • upload or spread malware, or use apps to attack, scan or break into other systems;
  • test the security of GoodTaco or other customers’ apps beyond good-faith vulnerability research you report to us without accessing others’ data;
  • overload, disrupt or interfere with GoodTaco, or use it for crypto mining or similar heavy computing unrelated to your apps;
  • scrape the Services, or access them by automated means other than our APIs and MCP server;
  • get around plan limits, credit metering or usage restrictions, or create multiple accounts or trials to get extra free credits;
  • use GoodTaco to build a competing product or to train AI models that compete with GoodTaco;
  • try to make the AI assistant produce anything this policy bans, or get around the assistant’s safeguards.

6. Reporting abuse

To report an app or account that breaks this policy, such as a phishing page or spam, email compliance@goodtaco.ai with the app’s link and what you saw. For copyright complaints, see section 20 of our terms of service.

7. What we do about violations

  • We may investigate reports and suspected violations, including by looking at the app or content involved.
  • We may remove content, unpublish an app, pause email sending, limit features, or suspend or close an account. When there’s a risk of harm, we act right away and tell you afterwards.
  • We may report illegal activity to the authorities and share information with them as the law allows.
  • If you think we made a mistake, email compliance@goodtaco.ai and we’ll review the decision.

8. Changes

We may update this policy as GoodTaco and the ways people misuse it change. The effective date at the top shows the current version.