Udio Customer and Authorised User Acceptable Use Policy
Rules for lawful secure and responsible use of Udio
Udio WA Pty Ltd | ABN 38 166 661 945 | Version 1.0 | 27 October 2026
This Policy applies to each Customer and Authorised User. The Customer must make it available to its Authorised Users and take reasonable steps to require compliance, including through its own user terms where appropriate. An Authorised User does not become Udio's business customer merely because this Policy applies to their use.
1. Permitted use
1.1 A Customer and Authorised User may use Udio only for authorised business, program, booking, attendance, communication, payment, reporting and related purposes.
1.2 Each user must follow applicable law, the Customer's lawful instructions, this Policy and the permissions assigned to the account.
2. Accounts and access
2.1 Each Customer and Authorised User must:
- use their own account and not share passwords, passkeys or authentication factors;
- use strong authentication and multi-factor authentication where Udio requires or supports it;
- not bypass permissions, access another customer's information or probe security controls without written authorisation; and
- notify the Customer and security@udiosystems.com promptly of suspected compromise, unauthorised access or an exposed credential or API key.
2.2 Customer administrators must assign only the access reasonably required and remove or change access promptly when a user leaves or no longer requires it.
3. Prohibited activity
3.1 A Customer or Authorised User must not use the Services to:
- engage in unlawful, fraudulent, deceptive, defamatory, threatening, harassing or discriminatory activity;
- introduce malicious code, steal credentials, conduct denial-of-service activity, exploit a vulnerability or interfere with the Services;
- access, copy, scrape or extract information except through authorised functionality or documented APIs;
- send spam or communications without required consent or authority;
- upload or disclose content that infringes privacy, confidentiality, intellectual property or other rights;
- circumvent rate limits, usage controls, tenant separation or technical restrictions;
- remove or alter proprietary notices; or
- use preview or beta functionality for safety-critical or business-critical activity.
3.2 Except to the extent the law does not permit restriction, a Customer or Authorised User must not decompile, disassemble, reverse engineer, adapt, translate, create derivative works from or attempt to derive source code from the Services.
3.3 A Customer must not sell, sublicense, redistribute or provide the Services as a standalone hosted, rental, timesharing or outsourcing service for a third party. This does not prevent ordinary use by the Customer's staff, contractors, parents, participants, students, members or other Authorised Users for the Customer's own operations.
3.4 A Customer must not use non-public aspects of the Services to build a competing product without Udio's written permission. This does not restrict lawful evaluation, interoperability, statutory rights or use of the Customer's own data.
4. Data handling
4.1 A Customer and Authorised User must enter, access and disclose only information that the Customer is lawfully authorised to collect, use and disclose.
4.2 Sensitive Information may be entered or disclosed only where reasonably necessary, appropriately protected and supported by consent or another lawful basis. Users must apply available access restrictions and avoid unnecessary Sensitive Information in email, support tickets and AI prompts.
4.3 Users must not place passwords, full card numbers, card verification values, private cryptographic keys or authentication recovery codes in notes, messages, support tickets, AI prompts or attachments.
4.4 Udio support may request limited information to investigate an issue and may remove or mask Sensitive Information that is not needed.
5. Communications
5.1 The sender is responsible for recipients, content, timing, consent, sender identification, opt-out handling and compliance with applicable communications laws.
5.2 A sender must not represent that a message comes from Udio unless Udio has authorised that representation in writing.
6. API integrations and AI Functionality
6.1 A Customer and Authorised User must protect API credentials, grant only required permissions, store keys securely, monitor use and revoke access when no longer needed. Credentials must not be placed in public code, shared documents or client-side applications.
6.2 An integration must respect tenant and facility scope, documented pagination, rate limits, permissions and security requirements.
6.3 A user of AI Functionality must review material outputs, instructions and action summaries before relying on or confirming them. The user must not use AI Functionality to bypass permissions, retrieve information they are not entitled to access, or perform an unlawful action.
6.4 A user must not submit information to AI Functionality unless the Customer is authorised to have that information processed for the requested purpose. A user must not attempt to manipulate AI Functionality into revealing another customer's data, system instructions, credentials or security information.
6.5 Where AI Functionality proposes a payment, refund, deletion, access-control change, bulk communication or another Material AI Action, the user must check the affected account, scope, values and recipients before confirming the action.
7. Enforcement
7.1 Udio may investigate suspected misuse and, where reasonable, remove unlawful content or suspend affected access. Where practicable, Udio will give notice and an opportunity to remedy. Udio may act immediately where delay creates an active security, legal or material-harm risk.
7.2 Enforcement will be proportionate to the suspected misuse and is subject to the suspension provisions in the Master SaaS Terms.
8. Reporting
8.1 Report a suspected security issue to security@udiosystems.com and other misuse to hello@udiosystems.com as soon as practicable.
8.2 A person must not publicly disclose a suspected vulnerability before Udio has had a reasonable opportunity to investigate and address it, unless disclosure is required by law.