Acceptable Use Policy

1. Scope and How This Policy Applies

This Acceptable Use Policy (“Policy”) governs all use of the Service by the Customer and its Authorized Users. It forms part of the agreement between Apollo Hedge Advisors, LLC (“Apollo”) and the Customer (the “Agreement”). If this Policy conflicts with the Agreement, the Agreement controls.

• Service: the Apollo hosted platform and every portal, application, API, integration, report and document Apollo provides under the Agreement, including Aegis, Aperture, Accord, Argus, Atlas and Attest.
• Customer: the organization that signed the Agreement.
• Authorized User: an employee or contractor of the Customer to whom Apollo or the Customer has issued credentials.
• Customer Data: loan, borrower, trade, pricing and other data the Customer or its agents submit to the Service.
• Outputs: reports, prices, analytics, extractions, recommendations and other results the Service generates.

Capitalized terms not defined here have the meanings in the Agreement.

2. Accounts and Credentials

Every account belongs to one named person, and the Customer is responsible for everything done under its accounts.

1. Credentials are personal. Authorized Users must not share passwords, multi-factor devices or sessions, or let anyone else use their account.
2. The Customer must not create shared, generic or role-based logins unless Apollo approves it in writing.
3. The Customer must keep its list of Authorized Users current. It must tell Apollo, or remove access itself where the Service allows, within one business day after a user leaves or no longer needs access.
4. Authorized Users must keep multi-factor authentication enabled wherever the Service offers it.
5. Credentials the Customer gives Apollo to reach third-party systems on its behalf (investor portals, agency APIs, mailboxes) must be ones the Customer is authorized to provide. The Customer must tell Apollo promptly when they change or are revoked.
6. The Customer is responsible for all activity under its accounts and API keys, and for its Authorized Users’ compliance with this Policy.

3. Customer Data

The Customer may submit only data it has the right to submit, and only for the purposes in the Agreement.

1. The Customer represents that it has every right, consent and notice needed to submit Customer Data, including borrower nonpublic personal information under the Gramm-Leach-Bliley Act and applicable state privacy laws.
2. The Customer must not submit data unrelated to the Service’s purpose. Examples: full payment card numbers, health records, or personal data of people with no connection to a loan or transaction the Customer handles.
3. The Customer must not use the Service to process data in breach of law, a court order, or a duty of confidentiality the Customer owes a third party.
4. The Customer is responsible for the accuracy and completeness of the Customer Data it submits. Outputs depend on that data (see Section 7).

4. Security: Prohibited Activities

The Customer and its Authorized Users must not test, probe or work around the Service’s security without Apollo’s prior written permission. In particular, they must not:

1. Scan, penetration-test, fuzz or load-test the Service, or probe it for vulnerabilities. Customers who need a security assessment can ask Apollo to arrange one under agreed scope and rules of engagement.
2. Bypass or disable authentication, authorization, rate limits, network controls or any other security measure.
3. Access, or try to access, another customer’s data, accounts or environment, or any part of the Service they are not authorized to use.
4. Upload or transmit malware, malicious macros or any code designed to disrupt, damage or gain unauthorized access.
5. Interfere with the Service’s operation, or place an unreasonable load on it.
6. Use the Service to send unsolicited email or messages, or to impersonate Apollo or anyone else.

If an Authorized User finds a vulnerability by accident, they must stop, must not exploit it further, and must report it under Section 8.

5. Automated Access and APIs

The only automated access to the Service allowed is through APIs Apollo documents and issues credentials for.

1. No scraping, crawling, bots, browser automation or bulk download of the web portals, except as the Service’s own export features allow.
2. API use must follow Apollo’s published documentation, including rate limits, payload limits and webhook requirements. Apollo may throttle or block traffic that exceeds them.
3. API keys and webhook secrets are confidential credentials. The Customer must store them securely, must not embed them in client-side code or public repositories, and must tell Apollo immediately if one is exposed so it can be rotated.
4. The Customer must not resell, sublicense or expose Service APIs to third parties unless the Agreement allows it.

6. Intellectual Property and Competitive Use

The Service, its methods and its underlying models remain Apollo’s property, and the Customer may use them only to run its own business. The Customer and its Authorized Users must not:

1. Reverse engineer, decompile or disassemble the Service, or try to derive its source code, pricing logic, models, prompts or algorithms, except where law expressly permits it despite this restriction.
2. Use the Service or its Outputs to build, train or improve a competing product or service, including any machine-learning model.
3. Copy, frame or mirror any part of the Service, or remove proprietary notices from it.
4. Publish benchmarks, comparisons or performance tests of the Service without Apollo’s written consent.
5. Give access to the Service, or share Outputs in bulk, with a competitor of Apollo.

Apollo’s patent-pending methods (including those in Argus) are covered by this Section whether or not a patent has issued.

7. Outputs Are Decision Support

Outputs support the Customer’s own decisions. They are not investment, legal, tax, accounting or regulatory advice, and the Customer stays responsible for every action it takes.

1. The Customer is solely responsible for its hedging, trading, pricing, commitment, pair-off, loan sale and delivery decisions, including any instruction it sends to an investor or counterparty through the Service.
2. The Customer must review Outputs before relying on them for regulatory filings, borrower disclosures, accounting entries or investor deliverables. This includes fee and appraisal-review results and purchase advice extractions.
3. Some Outputs are produced with machine-learning or AI models and may contain errors. The Customer must not represent AI-assisted Outputs to a borrower, regulator or counterparty as independently verified unless the Customer has verified them.
4. The Customer must not use the Service or Outputs to make a decision that requires a licensed professional unless one reviews it.

8. Reporting Misuse and Compromise

The Customer must tell Apollo within 24 hours after it learns of or reasonably suspects any of the following:

• a compromised account, password, multi-factor device, API key or webhook secret;
• unauthorized access to the Service or to Customer Data;
• a security vulnerability in the Service;
• a breach of this Policy by any of its Authorized Users.

Report to security@apolloha.com or the Customer’s Apollo account contact. The Customer must cooperate reasonably with Apollo’s investigation and must not publicly disclose a vulnerability until Apollo has had a reasonable chance to fix it.

9. Enforcement, Changes and Contact

Apollo may suspend access to stop a violation or a security threat, and will restore it once the issue is resolved.

1. Suspension. Apollo may suspend an Authorized User, an API key or the Customer’s access, in whole or in part, if it reasonably believes this Policy has been violated or that continued access threatens the Service, other customers or Customer Data. Apollo may suspend without advance notice, and will notify the Customer promptly afterwards.
2. Remedies. A material or repeated violation is a breach of the Agreement, and the Agreement’s termination and other remedies apply. Suspension does not relieve the Customer of its payment obligations.
3. Investigation. Apollo may review use of the Service, including logs and metadata, to check compliance with this Policy, consistent with its confidentiality obligations under the Agreement.
4. Changes. Apollo may update this Policy at any time, in its sole discretion, by posting a new version at this URL. Updates take effect when posted, and Apollo will notify the Customer of material changes. Changes do not apply retroactively.
5. Contact. Questions about this Policy: info@apolloha.com.