Acceptable Use Policy

1. The Consent Requirement — Non-Negotiable

Every GigVerify™ API query must be accompanied by a valid consent token issued by the worker being queried. There are no exceptions.

• Consent must be obtained through the GigVerify™ consent widget or Hosted Flow — you may not claim consent via other mechanisms
• Consent tokens are non-transferable — a token for worker A cannot be used to query worker B
• Storing and reusing consent tokens beyond the permitted scope is prohibited
• You must honor consent revocations immediately — a consent_revoked response means you must not attempt to re-query or circumvent the revocation

2. Prohibited Uses

3. Required Disclosures to Workers

If you use GigVerify™ data as part of an adverse action decision (e.g., loan denial), you must notify the worker of the data source. We recommend including in your adverse action notice: "This decision was made in part based on income verification data obtained from GigVerify™ (Mavvrixx.ai Inc.) with your prior consent."

You must provide workers with the ability to dispute the data by directing them to disputes@gigid.ai or gigid.ai/vault.

4. Rate Limits and Technical Use

• Starter plan: 60 requests/minute, 1,000 queries/month
• Growth plan: 120 requests/minute, 10,000 queries/month
• Scale plan: Custom limits per agreement

Exceeding rate limits will result in 429 rate_limit_exceeded responses. Sustained abuse of rate limits, or attempting to circumvent them, will result in key suspension.

5. Security Requirements

• Your API keys must be stored server-side only — never in client-side code, mobile apps, or version control
• All API calls must be made over TLS 1.2 or higher
• You must notify us within 48 hours of any suspected compromise of your API keys at security@gigid.ai
• You must implement appropriate access controls limiting who within your organization can access GigVerify™ responses

6. Enforcement

Mavvrixx.ai reserves the right to:

• Suspend or revoke API access for violations of this AUP, with or without prior notice
• Audit API usage logs to detect violations
• Require remediation of violations as a condition of reinstatement
• Pursue legal remedies for material violations

7. Reporting Violations

If you believe another verifier is misusing GigVerify™ data, or if a worker reports unauthorized use of their GigID data, please contact us at compliance@gigid.ai.

8. Updates

We may update this AUP at any time. Material changes will be communicated via email to the technical contact registered on your Verifier account with 14 days' notice. Continued API use after the effective date constitutes acceptance.