Acceptable Use Policy

Status: Draft v0.9 — 11 August 2026 — legal and operational review required before publication. Current provider: Heritage Timepieces AB, org. no. 559491-1157, VAT SE559491115701, Kungsgatan 2C, 223 50 Lund, Sweden. Entity notice: Klocktech AB is under registration and is not the current contracting party. Registration alone does not transfer an agreement. Contacts: legal@heritagetp.com (legal/privacy) · info@heritagetp.com (general).

1. Purpose and application

This policy protects Klocktech customers, other dealers, individuals, marketplaces and the Service. It applies to every user, account, API client, integration, beta feature and Professional Services request. The Customer is responsible for its Authorised Users and anyone acting through its credentials.

2. Authorised inventory only

Klocktech may be used only for watches and related content that the Customer owns, physically holds, or is expressly authorised to market on consignment or agency terms and supplies through its own upload, system or authenticated account. Permission from another dealer does not authorise Klocktech to connect to or import that dealer's feed, account, database or catalogue. The Customer must not use Klocktech, directly or indirectly, to:

• scrape, crawl, search, monitor, download, index or copy a dealer or marketplace website;

• import another dealer's watches, stock feed, listing, photograph, title, description, attribute, serial number, price, seller identity or availability;

• submit a third-party listing URL for automatic extraction or enrichment;

• use browser automation, unauthorised feeds, shared credentials, proxy accounts or a generic URL fetcher;

• create a competitor database or monitor identifiable competitor listings;

• perform external image, serial or duplicate matching, provided that exact or risk-based duplicate checks confined to the same Customer tenant and its own authenticated records are permitted;

• expose or infer inventory belonging to another Klocktech tenant;

• publish or syndicate inventory the Customer is not authorised to market; or

• circumvent this boundary through an API, connector, export, AI prompt, beta feature, employee, contractor or support request.

Permitted sources are limited to the Customer's own uploads and systems, its authenticated Connected Accounts and known own listings or orders, Permitted Reference Data, and licensed aggregate market data that contains no identifiable or singlable dealer, listing or watch information. Reference sources are model-level only. A licence or consent alone does not permit another dealer's feed or item-level data.

3. Watch, image and listing integrity

Users must not use Klocktech to:

• alter or generate the physical watch, dial text, hands, bezel, case, bracelet, engravings, patina, scratches, damage or other condition evidence;

• conceal a defect, create an accessory or component that was not photographed, or misrepresent the contents of a set;

• make unsupported claims about authenticity, ownership, provenance, service, rarity, warranty, condition or price;

• list counterfeit, stolen, pledged, embargoed, sanctioned or otherwise unlawful goods;

• remove a mandatory AI, provenance or editing disclosure; or

• use another person's photograph, logo, description or trademark without permission.

Generative background replacement and realistic shadow are permitted only outside the watch segmentation mask. Restrained, non-generative tonal correction may touch watch pixels only if it cannot invent, erase, repair, beautify or obscure condition evidence. Cropping must not omit relevant damage or included components. The immutable original and a processing record must be retained, and the Customer must compare and approve the derivative before publication.

A dedicated serial-privacy tool may mask the serial region in a public derivative without changing the immutable original, synthesising replacement characters or concealing other condition evidence. Public output must be backend-only or show no more than three original serial characters; full serials must not appear in public media, metadata, filenames or text.

4. Security and system abuse

Users must not attempt unauthorised access, cross-tenant access, credential attacks, malware delivery, phishing, rate-limit evasion, denial of service, destructive testing, security-control bypass or interference with a connector. Reverse engineering is prohibited except to the extent a mandatory legal right cannot be excluded. Good-faith security research is permitted only within the Vulnerability Disclosure Policy.

5. Privacy and communications

Customer Data must be collected and used lawfully. Users must not upload special-category personal data, criminal-offence data, identity documents or payment-card data unless the Service expressly supports that data and the parties have documented a lawful purpose and safeguards. Klocktech must not be used for spam, harassment, discrimination, unlawful surveillance or deceptive communications.

6. Enforcement

The Provider does not undertake a general duty to monitor Customer Data. It may investigate credible reports, require provenance evidence, quarantine or remove content, limit a feature, suspend access or terminate for a material or repeated breach. It will not fetch a submitted third-party URL or retrieve more prohibited data to investigate. It will block the operation, keep only minimal evidence necessary for security, rights or legal handling, and delete any accidentally received prohibited payload under the short incident-retention rule. Where safe and lawful, it will give notice and a reasonable opportunity to respond. Immediate action may be taken for security threats, illegal content, cross-tenant access, stolen or counterfeit goods, or collection of Prohibited Third-Party Dealer Data.

The Provider may preserve information where legally required and may cooperate with competent authorities under a valid legal process. A Customer may appeal an enforcement decision to legal@heritagetp.com with relevant evidence.