Acceptable Use Policy

Effective Date: February 11, 2026 | Last Updated: October 8, 2026

This Acceptable Use Policy ("AUP" or "Policy") governs the use of the products and services of QuikForms, LLC ("QuikForms," "we," "us," or "our"), including the QuikForms managed package, QuikForms AI and the QuikForms AI gateway, the plugin framework, and the documentation (together, the "Service"). It applies to every individual and entity that installs, configures, accesses, or uses the Service ("Customer," "you," or "your"), and to the forms Customers publish to their visitors ("End-Users").

This AUP is incorporated into and forms part of the QuikForms Terms of Service. Capitalized terms not defined in this AUP have the meanings given in the Terms of Service. By installing, configuring, or using the Service, you agree to this AUP. If you accept it on behalf of an organization, you represent that you have authority to bind that organization.

1. Purpose and Scope

1.1 Purpose

This AUP promotes safe, lawful, and responsible use of the Service, protects QuikForms, its Customers, End-Users, and the Salesforce ecosystem from harmful or unlawful activity, and sets clear standards of acceptable conduct.

1.2 Scope

This AUP applies to:

every Customer that installs or uses the QuikForms managed package in any Salesforce org, whatever its edition, plan, or license, including during a free trial;
every form, survey, chat hand-off, and other public-facing page created with the Service;
all content published through the Service, including field text, translations, custom HTML, uploaded files, and plugin code;
every use of QuikForms AI, whether through the QuikForms AI gateway or with the Customer's own Anthropic API key;
every use of the plugin framework; and
the documentation, APIs, static resources, and settings provided as part of the Service.

1.3 Customer Responsibility

You are responsible for all use of the Service in your Salesforce org, including use by your administrators, other users, and anyone to whom you give access. You are responsible for all content your forms display to End-Users, for the data your forms collect, and for the content you generate with AI features and publish.

2. General Conduct Requirements

2.1 Lawful Use

You must use the Service only for lawful purposes and in compliance with all applicable laws and regulations, including those governing data protection and privacy, consumer protection, anti-spam, intellectual property, export controls, sanctions, and anti-discrimination.

2.2 Good Faith

You must use the Service in good faith and for its intended purpose as a form builder for the Salesforce Platform. You must not use it in a way that is deceptive, fraudulent, or misleading, or that could damage, disable, overburden, or impair the Service or any Salesforce org.

2.3 Accuracy

You must not use the Service to collect, transmit, or publish information you know, or reasonably should know, to be false or misleading in a way intended to deceive End-Users or third parties.

2.4 Cooperation

You agree to cooperate promptly with QuikForms in any investigation of a suspected violation of this AUP.

3. Prohibited Uses

The following uses of the Service are prohibited. The list is illustrative, not exhaustive. QuikForms decides, in its reasonable discretion, whether a use violates this AUP.

3.1 Fraud, Phishing, and Impersonation

Creating forms that impersonate, or misrepresent an affiliation with, any person, business, organization, or government body;
Phishing, including collecting credentials, passwords, one-time codes, or financial information under false pretenses;
Asking End-Users for the password or login credentials of any account or service, even for a stated legitimate purpose;
Using styling, custom HTML, or AI features to copy another organization's forms or websites for deceptive purposes;
Misrepresenting who operates a form, what it is for, or how submitted data will be used; and
Using forms for identity theft, financial fraud, social engineering, or any other fraudulent scheme.

3.2 Spam and Unsolicited Communications

Using the Service to send or facilitate unsolicited bulk communications in violation of applicable law, including CAN-SPAM, the TCPA, and the EU ePrivacy Directive;
Configuring forms mainly to harvest email addresses or contact details for unsolicited communications;
Sending automated, scripted, or bulk submissions to forms you do not operate; and
Operating or supporting any spam operation.

3.3 Malicious Software and Harmful Content

Distributing, hosting, or transmitting malware, viruses, trojans, ransomware, spyware, or other malicious software;
Using file uploads to collect or distribute malicious files;
Using custom HTML, Custom HTML fields, or plugins to attack or exploit End-Users;
Redirecting End-Users to malicious websites; and
Using the Service to launch or facilitate denial-of-service attacks.

3.4 Unlawful Data Collection

Collecting personal information from children under 13 without verifiable parental consent as required by COPPA, or in violation of equivalent laws elsewhere;
Collecting payment card data (see Section 10.4);
Collecting protected health information without meeting HIPAA requirements;
Collecting biometric, genetic, or other special category data without the consents and safeguards the law requires;
Collecting any personal data without a lawful basis, or otherwise in violation of applicable privacy law (such as the GDPR, the UK GDPR, the CCPA/CPRA, and other state privacy laws); and
Collecting data covertly, beyond what the form discloses to End-Users.

3.5 Harassment, Threats, and Illegal Activities

Harassing, bullying, threatening, stalking, intimidating, or abusing any person;
Creating forms that solicit or facilitate violence, terrorism, self-harm, or harm to others;
Publishing hate speech or content that incites discrimination based on protected characteristics;
Facilitating illegal activities, including trafficking of drugs, weapons, or people, money laundering, or the sale of counterfeit goods; and
Displaying, distributing, or collecting child sexual abuse material or any content that exploits minors.

3.6 Intellectual Property Infringement

Infringing, misappropriating, or violating any third party's intellectual property rights;
Using forms to distribute pirated software or copyrighted material without authorization; and
Using another party's logos or trademarks in forms without permission, other than in a nominative, non-misleading way.

4. Form Content and Design Standards

4.1 Transparency

Every form must clearly identify the organization operating it and the purpose for which data is collected.

4.2 Accurate Representation

Form titles, descriptions, field labels, and confirmation messages must not be misleading.

4.3 Privacy Disclosures

A form that collects personal information must give a clear, accessible privacy notice or a link to your privacy policy. The End-User Notice Templates can help.

4.4 Consent Mechanisms

Where the law requires consent, forms must obtain it before collecting personal data. Pre-checked consent boxes are prohibited where the law does not allow them.

4.5 Multiple Languages

A form offered in several languages must provide every legally required disclosure and consent mechanism in each language. You are responsible for the accuracy of translations, including translations generated with AI features (see Section 9).

4.6 Surveys

Surveys must comply with the laws that apply to them, and survey links sent by email must comply with anti-spam law.

5. Security Controls and Anti-Abuse Mechanisms

5.1 CAPTCHA and Bot Protection

You must not switch off CAPTCHA (Disable_Captcha__c) on a public form without equivalent alternative protection. Doing so may violate this AUP if the form is then used for spam or abuse.
You must not publish your Cloudflare Turnstile secret key or your credential configuration.
You must not bypass or defeat CAPTCHA verification on your own forms or anyone else's.

5.2 Honeypot Protection

You must not tell End-Users or third parties how to get around the honeypot spam check, or publish details of it that would help someone do so.

5.3 Rate Limiting

You must not circumvent rate limits, including by distributing requests across sources, rotating IP addresses, or manipulating client-side code.
You must set the rate limit (Rate_Limit_Per_Minute__c) at a level reasonably calculated to prevent abuse while allowing legitimate use.
You must not use rate limit settings to deny service to legitimate End-Users.

5.4 Referrer Verification

You are strongly encouraged to list the websites allowed to send submissions (Valid_Referrers__c) for production forms. Leaving the list blank is not a defense to abuse that results.

5.5 Security Testing and Circumvention

You must not, and must not help anyone else to:

probe, scan, or test the vulnerability of the Service, the QuikForms AI gateway, or the QuikForms website, except as permitted by the responsible disclosure terms on the Security & Trust page;
breach or circumvent any security or authentication measure of the Service;
access or use non-public areas of the Service, QuikForms' systems, or its providers' systems;
reverse engineer any security mechanism of the Service in order to circumvent it; or
publish exploits or bypass methods for the Service's security controls before QuikForms has had a reasonable opportunity to fix them.

Testing your own forms and your own org is permitted, provided it does not target QuikForms' systems or other Customers.

6. Custom HTML

6.1 Overview

You can add custom HTML to a form in four places: the custom head HTML (Custom_HTML_Head__c), the header (customHeaderHTML__c), the footer (customFooterHTML__c), and Custom HTML fields. Both renderers sanitize this HTML before showing it: scripts and event handlers are removed, so custom HTML cannot run JavaScript.

6.2 Permitted Uses

Custom HTML may be used for legitimate purposes, including:

CSS styles and fonts for branding;
meta tags;
informational content, images, and links; and
disclaimers, privacy notices, and other legal notices.

6.3 Prohibited Uses

Attempting to inject scripts, or to defeat the sanitizer, in order to run code in End-Users' browsers;
Content designed to steal or exfiltrate End-User data, or to trick End-Users into entering data somewhere other than the form;
Clickjacking, overlays, or styling that hides or disguises the form's real purpose or its notices;
Content that interferes with the Service's security controls;
Links that redirect End-Users to malicious websites; and
Content that interferes with the proper functioning of the form, the Salesforce Platform, or End-Users' devices.

6.4 Customer Responsibility

You are solely responsible for the custom HTML in your forms. QuikForms does not review or approve it.

7. File Upload Responsibilities

7.1 Your Obligations

File uploads are stored in your Salesforce org and are limited in size and file type, as the documentation describes. If you enable file uploads, you are responsible for:

reviewing uploaded files for malicious, illegal, or prohibited content;
malware scanning appropriate to your use;
telling End-Users which file types and sizes are accepted and why you collect the files;
retaining and deleting uploaded files as the law requires; and
promptly removing files found to contain malicious or illegal content.

7.2 Prohibited File Content

Files must not be uploaded through the Service that:

contain malware or other malicious code;
contain illegal content, including child sexual abuse material and material that violates export control laws;
infringe third-party intellectual property rights;
contain data the Customer is not authorized to collect; or
disguise a prohibited file type, for example by changing its file extension.

8. Plugin Framework Usage

8.1 Applicability

This section applies to Customers using the plugin framework, which is included in the Professional plan, including Apex plugins, validators, submission handlers, callout handlers, JavaScript plugins, custom field types, Flow hooks, and platform events. Developers who write plugins are also bound by the Plugin Developer Agreement.

8.2 Permitted Plugin Uses

Plugins may be used for legitimate purposes, including custom field types, authorized external integrations, custom validation, business logic, and Flow-based automation.

8.3 Prohibited Plugin Activities

Plugins that exfiltrate or misuse End-User data, or send it to destinations not disclosed to the Customer and End-Users;
Plugins containing malware, backdoors, or logic bombs;
Plugins that bypass or disable the Service's security controls, licensing, or AI metering;
Using plugin callouts to attack third-party systems;
Plugins that consume excessive Salesforce governor limits; and
Distributing plugins that violate this AUP or applicable law.

8.4 Plugin Security Requirements

Customers developing and deploying plugins must:

use HTTPS for every external callout, and Named Credentials wherever possible, and never store credentials, keys, tokens, or secrets in code, configuration, or client-side JavaScript;
escape or sanitize all user input before rendering it as HTML;
validate input on the server, not only in the browser;
limit the data a plugin reads or writes to what its purpose requires, because plugin Apex runs in the form's server-side context and is not restricted to the site guest user's permissions;
follow the security guidance in the plugin documentation; and
review and update plugin code to address vulnerabilities.

8.5 Plugin Liability

You are solely responsible for all plugins you develop, deploy, or install. QuikForms is not responsible for the functionality, security, performance, or legal compliance of plugins written by Customers or third parties, and disclaims liability for them as set out in the Terms of Service.

9. QuikForms AI

9.1 Anthropic's Usage Policy

QuikForms AI uses models provided by Anthropic PBC. When you use AI features through the QuikForms AI included in your plan, your requests are sent to Anthropic under QuikForms' account, and you must comply with Anthropic's Usage Policy as if you were Anthropic's customer. When you use your own Anthropic API key, your use is governed directly by your agreement with Anthropic, and this AUP also applies.

9.2 Prohibited AI Uses

Using AI features to create forms, text, translations, or validation patterns for any use this AUP prohibits, such as phishing, impersonation, or deceptive forms;
Using AI features to generate content that Anthropic's Usage Policy prohibits;
Entering personal data, special category data, credentials, or secrets into AI features beyond what the task requires;
Attempting to make AI features ignore their instructions or act outside the QuikForms administrator role, including to access data the signed-in user could not otherwise access; and
Using AI features, or their output, to develop a competing AI model or service.

9.3 Allowances and Metering

Each plan's AI allowance is for use by the Customer's own org. You must not:

extract, share, or reuse your org's QuikForms AI token, or use it outside the org it was issued to;
call the QuikForms AI gateway other than through the managed package's AI features;
circumvent, disable, or interfere with allowance metering, or with the refusal of requests once an allowance is used up;
create Salesforce orgs or trials to obtain additional AI allowances;
attempt to use another Customer's allowance, token, or tenant; or
send automated or scripted requests to the gateway, or use AI features at a volume intended to degrade the gateway.

9.4 Review of AI Output

AI output can be wrong. You are responsible for reviewing forms, fields, validation patterns, translations, and analysis generated with AI features before you publish or rely on them. Translations of legal or regulated text, such as privacy notices and consent wording, must be reviewed by a person who reads the language. Where the law requires you to tell End-Users that content was generated or translated by AI, you are responsible for doing so.

10. Data Collection and Privacy Compliance

10.1 Customer as Controller

When you use the Service to collect personal data from End-Users, you are the controller of that data. QuikForms acts as a processor only for the limited processing described in the Data Processing Agreement. You determine the purposes and means of processing, and you are responsible for giving legally required notices and obtaining required consents.

10.2 Privacy Law Compliance

You must comply with applicable privacy and data protection laws, including by:

giving End-Users a clear privacy notice before collecting personal data;
having a lawful basis for each use of personal data, and obtaining consents where required;
honoring End-User rights, such as access, correction, deletion, portability, and opt-out;
protecting personal data with appropriate technical and organizational measures;
notifying QuikForms promptly of any data breach that involves the Service; and
entering into the data processing agreements the law requires.

10.3 Browser Information Logging

If you turn on browser information logging for a form (Log_User_Browser_Info__c), the End-User's IP address and browser user agent are stored on the created record. If you do, you must disclose this collection in your privacy notice, have a lawful basis for it, apply appropriate retention and deletion, and respond to End-User requests about it.

10.4 Prohibited and Restricted Data

The Service is not designed or assessed for processing payment card data. You must not use forms to collect full payment card numbers, card verification codes, PINs, or magnetic stripe data. Unless you have independently confirmed that your use complies with all applicable requirements, you must also not use the Service to collect:

protected health information as defined by HIPAA;
government identification numbers, such as Social Security, passport, or driver's license numbers, except where the form's purpose requires them and the law permits it;
biometric identifiers;
financial account credentials; or
personal information of children in violation of COPPA or equivalent laws.

10.5 Cross-Border Transfers

If your forms collect data from End-Users in jurisdictions that restrict cross-border transfers, such as the European Economic Area, the United Kingdom, or Switzerland, you are responsible for making sure those transfers comply with the law, for example through Standard Contractual Clauses or an adequacy decision.

11. Intellectual Property Protections

11.1 Managed Package Protections

The QuikForms managed package is proprietary software owned by QuikForms, LLC. Except as applicable law expressly permits, or as the plugin framework documentation or the Plugin Developer Agreement allows, you must not decompile, disassemble, reverse engineer, modify, copy, distribute, or create derivative works of the Service; remove proprietary notices; or use automated means to access the Service in ways QuikForms has not authorized.

11.2 Competitive Use

You must not use the Service, the plugin framework, the documentation, or non-public information obtained from them to develop, market, or operate a product or service that competes with QuikForms.

11.3 Trademarks

"QuikForms" and the associated logos are trademarks of QuikForms, LLC. You must not use them without prior written consent, except to refer to the Service in a nominative, non-misleading way.

12. Resource Consumption and Platform Limits

The Service runs on the Salesforce Platform and is subject to Salesforce governor limits. You must not use the Service in a way that consumes excessive resources, degrades the performance of your org or the Service, generates excessive log data, or circumvents Salesforce governor limits.

QuikForms does not limit the number of forms or submissions, but your use must not adversely affect the stability of your Salesforce org or the Service. If it does, QuikForms may ask you to change your configuration.

13. Monitoring, Enforcement, and Remedies

13.1 What QuikForms Can See

Your forms and data are in your Salesforce org. QuikForms has no standing access to it, uses login access you grant for a support request only for that request, and receives no usage data from the package. QuikForms therefore does not monitor your forms. It acts on reports, on what it can see on publicly accessible form pages, and on the operational metadata of the QuikForms AI gateway, such as request counts and statuses. QuikForms may investigate any suspected violation but has no obligation to monitor.

13.2 Enforcement Actions

If QuikForms determines that this AUP has been violated, it may:

issue a written warning requiring remediation, such as removing or changing a form;
suspend or revoke your org's access to QuikForms AI through the gateway;
suspend or terminate your QuikForms license, which stops your public forms from rendering;
report the violation to Salesforce, Anthropic, law enforcement, or regulators where appropriate; and
pursue other legal remedies.

QuikForms cannot itself edit or delete content in your org. Removing a violating form or file is your responsibility.

13.3 Notice and Cure

Except where QuikForms reasonably determines that a violation poses an imminent threat to the security, integrity, or availability of the Service, any Salesforce org, End-Users, or third parties (for example phishing, malware, active data exfiltration, abuse of the AI gateway, or illegal content), QuikForms will give notice and a reasonable opportunity to cure before taking action beyond a written warning. The cure period is five (5) business days from the notice unless the nature of the violation requires a shorter one.

13.4 No Liability for Enforcement

QuikForms is not liable to any Customer or third party for enforcement action taken in good faith under this AUP. Your remedy for any dispute about enforcement is as set out in the Terms of Service.

13.5 Survival

Sections 3, 11, and 13 survive the termination or expiration of your subscription or of the Terms of Service.

14. Reporting Violations

If you become aware of any use of the Service that you believe violates this AUP, the law, or anyone's rights, report it to:

Email: info@sfquikforms.com
Subject Line: "AUP Violation Report"

Please include, where available, the URL of the form at issue, a description of the suspected violation, any evidence (such as screenshots and timestamps), and your contact information. Copyright complaints should follow the DMCA and Copyright Policy, and security vulnerabilities the responsible disclosure process. QuikForms will acknowledge reports within three (3) business days, investigate credible reports, and keep the reporter's identity confidential to the extent the law and its obligations to the reported party allow. Reports must be made in good faith, and QuikForms may disregard reports that are frivolous or made in bad faith.

Because a form is operated by the organization that published it, you may also contact that organization directly, and Salesforce, Inc., which hosts the site.

15. Modifications to This Policy

QuikForms may modify this AUP at any time by posting a revised version on this page. Material changes take effect thirty (30) days after notice is given; other changes, such as corrections and clarifications, take effect when posted. Your continued use of the Service after a change takes effect constitutes acceptance. If you object to a material change, you may stop using the Service under the Terms of Service.

16. Definitions

"Customer" means any individual or entity that installs, configures, accesses, or uses the QuikForms managed package in a Salesforce org.
"End-User" means any individual who views, fills in, or submits a form created with the Service.
"Form" means any web form, survey, chat hand-off page, or other data collection page created with the Service.
"Managed Package" means the QuikForms software distributed as a Salesforce AppExchange managed package.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Plugin" means any code, configuration, or extension developed with the QuikForms plugin framework.
"QuikForms AI" means the AI features of the Service, including the QuikForms AI gateway that carries requests made with the AI included in a plan.
"Service" has the meaning given at the start of this AUP.

17. Contact Information

For questions about this Acceptable Use Policy, contact:

QuikForms, LLC

Email: info@sfquikforms.com
Website: www.sfquikforms.com

Acknowledgment

By installing, configuring, or using the QuikForms Service, you acknowledge that you have read this Acceptable Use Policy, understand it, and agree to comply with it. This AUP is part of the Terms of Service between you and QuikForms, LLC.

QuikForms Legal