Bureau Translations Inc., trading as wxrks Effective 18 August 2026 · Version 1.0

1. Scope

This policy applies to everyone who uses the wxrks platform: account holders, users invited by an Account Administrator, and anyone accessing it through an integration or API key. It forms part of our Terms of Use and of any Master Services Agreement or Software Order Form. Terms defined in the Terms of Use have the same meaning here.

We do not inspect Customer Content and we do not scan it for policy violations. This policy exists so that uses which would harm the platform, other customers or third parties are prohibited in writing, and so that we have a basis to act when we become aware of one.

2. Content you must not submit

You must not submit content that:

• you do not have the right to submit, or whose submission or translation would infringe copyright, trade marks, database rights, trade secrets or any other right;
• is unlawful, or promotes or facilitates unlawful activity;
• constitutes child sexual abuse material. We will report this to the relevant authority and terminate the account, without notice;
• you are prohibited from disclosing to us by contract, professional obligation or court order;
• contains personal data you have no lawful basis to have us process on your behalf.

3. Restricted data

The platform is not designed or certified for the following, and you must not submit them without a prior written agreement with us:

• payment card data subject to PCI DSS;
• protected health information subject to HIPAA;
• data subject to export control or any government classification scheme;
• biometric identifiers.

If your use case requires any of these, contact us first. Special category data under the UK or EU GDPR is not prohibited, but you must have a lawful basis for it and should tell us in advance so the arrangement is documented.

4. Prohibited uses

Interference with the platform or other customers. Do not circumvent authentication, authorisation, rate limits, quotas or billing. Do not access or attempt to access another customer's account, data or Customer Content. Do not introduce malware or use the platform to store or distribute it. Do not probe or test the security of the platform except under section 6. Do not place a load on the platform that degrades service for others, including automated requests beyond documented API limits. Do not reverse engineer, decompile or disassemble the platform, except to the extent that restriction is unenforceable by law.

Commercial misuse. Do not resell, sublicense or make the platform available to a third party as a service unless your agreement permits it. Do not use it to build a competing product, or benchmark it for publication without our written consent. Do not share credentials or an API key outside your organisation, or use one account to serve multiple unrelated organisations.

Misuse of AI capabilities. Do not attempt to extract, reconstruct or reverse engineer the models available through the platform, their weights or their training data. Do not generate content that is unlawful, that impersonates a real person or organisation deceptively, or that is designed to mislead as to its origin in a way that causes harm. Do not present machine-generated Output as human-produced where a law, regulator or contract requires that distinction to be disclosed.

Misuse of Output. Do not rely on unreviewed machine output where an error would cause harm to health, safety or legal rights without an appropriate human review step. Output is machine-generated and may contain errors.

5. Account holder responsibilities

Keep credentials confidential and enable multi-factor authentication where offered. Remove users who no longer need access. Ensure the people you invite understand this policy. Tell us promptly at the address in section 8 if you become aware of a compromise, a violation, or unauthorised access.

6. Security research

We welcome good-faith security research.

Test against your own account and data only. Do not degrade the service or affect other customers, do not access or exfiltrate another party's data, and stop as soon as a vulnerability is confirmed. Do not run automated scanners against production without contacting us first.

Report findings to security@wxrks.com. We will not pursue action against researchers who follow this section in good faith.

7. Enforcement

Where we become aware of a violation we may ask you to correct it, restrict or suspend a user, an API key or an account, remove or disable access to specific content, or terminate the account. Our response will be proportionate to what has happened. The child sexual abuse material provision in section 2 is always immediate.

Suspension or termination does not change our deletion obligations. Customer Content is deleted on the timeline in the Terms of Use and the Data Processing Agreement regardless of why the account ended.

We will notify the Account Administrator of action taken against a user in their organisation unless doing so would prejudice an investigation or breach a legal obligation.

To report a suspected violation, contact us at the address in section 8 with enough detail to identify what you are reporting. To report alleged copyright infringement, follow the notice procedure in the Terms of Use.

8. Changes and contact

We may update this policy. The version and date at the top identify the current text. Where a change materially expands what is prohibited we will give notice before it takes effect.

Bureau Translations Inc., trading as wxrks 3515 Mt. Diablo Blvd, Lafayette, CA 94549, United States

Abuse and policy violations: security@wxrks.com

Security: security@wxrks.com