Watchpost Acceptable Use Policy

Key points

This summary is for convenience; the numbered clauses are binding.

1. About this Policy

1.1 This Acceptable Use Policy ("Policy") is issued by XYZ Sdn Bhd (Company Registration No. 202601000000) of Malaysia ("Watchpost", "we", "us"), identified as the Companies Act 2016 (s.30) requires. It forms part of the Watchpost Terms of Service ("Terms") (Terms clauses 3.3 and 14).

1.2 It applies to every Account, Member and Workspace, all Customer Content (including Agencies' Client content) and all use of the Service, with or without a Subscription. The Workspace Owner, and the organisation it acts for, must ensure that its Members comply and is responsible for their breaches (Terms clause 6.4). Each Member is also personally bound.

1.3 Capitalised terms not defined here have the meanings given in the Terms.

1.4 Precedence. If this Policy conflicts with the Terms, the Terms prevail (Terms clause 3.4). Where a Platform's own rules are stricter than this Policy, they apply (Terms clause 15.3). Our Security and Vulnerability Disclosure Policy governs security research (Terms clause 3.3; clause 12).

2. Definitions

3. Illegal and harmful content

3.1 You must not create, upload, schedule or publish content within the harmful content categories of the First Schedule to the Online Safety Act 2025 (Act 866). We adopt these categories as contractual rules, although the Act's duties bind licensed platforms rather than us. That is, content:

(a) that is child sexual abuse material (Sexual Offences against Children Act 2017 s.4), or that otherwise sexualises a person under 18; (b) that is financial fraud content; (c) that is obscene; (d) that is indecent; (e) that may cause harassment, distress, fear or alarm by threatening, abusive or insulting words, communication or acts; (f) that may incite violence or terrorism; (g) that may induce a child to harm himself or herself; (h) that may promote feelings of ill-will or hostility amongst the public at large, or may disturb public tranquillity; or (i) that promotes the use or sale of dangerous drugs.

3.2 Genuine news, awareness-raising, education, and scientific, medical or artistic content about these subjects (for example, a bank's scam-awareness post, an anti-drug campaign or medical information about the body) does not breach items (b), (c), (d) or (i), provided that it does not itself promote the harm and complies with the law and the Platform Terms.

3.3 You must not use the Service to make, create, solicit or initiate the transmission of content that is indecent, obscene, false, menacing or grossly offensive with intent to annoy, abuse, threaten or harass any person or to commit an offence involving fraud or dishonesty against any person (Communications and Multimedia Act 1998 s.233, as amended by Act A1743).

3.4 Hate and harassment. You must not publish content that attacks, dehumanises or threatens people because of a characteristic protected by law or by the Platform's community guidelines (such as race, religion, descent, nationality, gender, disability or age), or that bullies, stalks or exposes a private individual.

3.5 Other unlawful activity. You must not publish or promote anything unlawful in Malaysia or where the content is targeted, including:

(a) seditious content, or content that insults any religion or causes disharmony on grounds of religion (Sedition Act 1948; Penal Code ss.298 and 298A); (b) unlicensed gambling, or pyramid schemes (Direct Sales and Anti-Pyramid Scheme Act 1993); (c) counterfeit goods; (d) unlicensed financial, investment or money-lending services (Financial Services Act 2013; Capital Markets and Services Act 2007; Moneylenders Act 1951); (e) advertising of tobacco or smoking products, including vape products, where the law forbids it (Control of Tobacco Product and Smoking for Public Health Act 2024); and (f) advertising of medicines, treatments or health products without the approvals the law requires (Medicines (Advertisement and Sale) Act 1956).

3.6 Businesses our payment processor prohibits. You must not use the Service to promote, sell or facilitate any business or product that our payment processor prohibits, which includes the sale of online traffic or engagement. We will send you the current list on request at [email protected]. Whether a business that our payment processor restricts may use the Service is governed by Terms clause 4.3.

4. Scams and misleading content

4.1 You must not use the Service for scams, phishing, fake giveaways or investment fraud, or to obtain passwords, one-time codes or payment details under false pretences (Communications and Multimedia Act 1998 s.233).

4.2 You must not publish false or misleading statements about goods, services, prices or endorsements, including fake reviews or testimonials (Consumer Protection Act 1999 ss.9–10; Trade Descriptions Act 2011 ss.5, 17 and 18).

4.3 Labels and declarations. You must truthfully disclose paid partnerships, branded content and realistic AI-generated or materially altered content wherever the law or a Platform requires (Consumer Protection Act 1999 s.10). Use the Platform's controls in the Service, such as TikTok's commercial content disclosure and AI-generated label, YouTube's altered or synthetic content setting and Facebook's branded content tag. Where the Service does not offer the control you need, disclose on the Platform itself or in the caption, or do not publish through the Service. You must also set YouTube's "made for kids" setting accurately. The TikTok declarations made when you choose Schedule or Post are yours (Platform Disclosures clause 10.4).

5. Spam and platform manipulation

5.1 You must not:

(a) buy, sell or exchange likes, follows, views, comments, shares or reviews, or use the Service to run a business selling engagement, traffic or followers (Meta Developer Policies 2.7; clause 3.6); (b) use fake accounts, engagement pods or coordinated activity to mislead people about the popularity or origin of content; (c) publish identical or substantially similar content across several X accounts, repeat identical content on X through recurring posts, send bulk or unsolicited @mentions, or automate likes, replies, reposts or follows (X Automation Rules); (d) publish repetitive or unwanted content, misleading hashtags, or deceptive links; (e) market to anyone who has asked you to stop (PDPA s.43) or, once Communications and Multimedia Act 1998 s.233A is in force, send unsolicited commercial electronic messages it prohibits; or (f) republish through the Service content a Platform has removed, or operate through the Service an account a Platform has suspended or banned.

5.2 A person decides what is published. Every post must be composed and scheduled, or approved, by an authorised Member (Terms clause 14.2; Meta Developer Policies 1.7; YouTube API Services Developer Policies III.C). Recurring posts, queue slots and Sets must be set up by a Member and must comply with each Platform's rules on repetitive content. You must not configure the Service to publish or engage on a Platform without a person's decision.

6. Intellectual property

6.1 You must not publish content that infringes copyright, trade marks or other rights (Copyright Act 1987; Trade Marks Act 2019), such as unlicensed music, footage, images or fonts.

6.2 Notices from rights holders. Rights holders may notify us under clause 13. We handle notices in line with Part VIB of the Copyright Act 1987. On a complete notice (clause 13.2), we aim within 48 hours to hold the material so that it is not published and to disable access to it in the Service, including through preview links (s.43H). We then send the notice, including the rights holder's name and contact details, to the Workspace Owner, which may respond with evidence of its rights. If it does, we may restore the material after 10 Business Days unless the rights holder tells us that it has started court proceedings. We may suspend or terminate, under clause 14, a Workspace or Account that repeatedly infringes.

7. Privacy and personal data

You must not:

(a) collect, disclose or sell personal data without the consent or other legal basis the law requires (PDPA s.6; GDPR Art. 6 and SG PDPA s.13 where they apply), or scrape Platform data (PDPA s.130; Platform Terms); (b) publish anyone's identity card number, home address or other private information without lawful authority; (c) publish sensitive personal data, such as data on health, religious beliefs, political opinions or alleged offences, or biometric data, without explicit consent or another ground PDPA s.40 allows; or publish identifiable images of a child under 18 without a parent's or guardian's consent where the law requires consent (Personal Data Protection Regulations 2013 reg. 3(3)); (d) use Platform Data to profile, surveil or discriminate against people (Meta Platform Terms s.3(a)); or (e) sell, license or transfer Platform Data obtained through the Service (including exports and reports), or use it for advertising targeted outside the Platform, eligibility decisions (such as employment, housing, insurance or credit), re-identification, inferring sensitive characteristics, or training artificial-intelligence models, where the Platform Terms forbid it (Meta Platform Terms s.3; X Developer Agreement and Developer Policy; TikTok Developer Terms of Service s.III.3).

8. Impersonation and account integrity

8.1 You must not impersonate any person, business, Platform or Watchpost; publish synthetic or altered media that realistically shows a real person saying or doing something they did not, without their consent and a clear label; falsely claim that Watchpost or a Platform approves or endorses you (Trade Descriptions Act 2011 s.16); or make misleading statements about the Service or a Platform (Terms clause 14.1(k)). You may connect only accounts you own or are authorised to manage (Terms clause 15.2).

8.2 No selling of accounts. You must not buy, sell, rent or share Accounts or login credentials (invite Members instead); buy, sell or rent Workspace or Subscription access, or let people use a Workspace other than as invited Members (except under a written reseller agreement with us); or use the Service to trade in social media accounts or to operate accounts bought or rented in breach of the Platform Terms. Transferring Workspace ownership for a genuine business reason, such as an Agency returning a Workspace to its Client, is allowed.

8.3 You must not create extra Accounts or Workspaces to obtain Subscription features without paying for them, to obtain the Free Trial again (Terms clause 7.4), or to evade Plan Limits, a suspension or a termination. Using several Workspaces, each with its own Subscription, for different businesses or Clients is allowed.

9. Malware and attacks

You must not: (a) upload or link to malware or files designed to exploit software; (b) access or try to access another Account, Workspace or our systems without authority, or bypass security controls (Computer Crimes Act 1997 ss.3–5), except as clause 12 permits; (c) overload or disrupt the Service (including by denial-of-service attacks), or use it to attack a Platform or other system; or (d) misuse access tokens, post preview links or data returned by the Service.

10. Platform rules

10.1 The Platform Terms apply to everything you publish through the Service and prevail where stricter than this Policy (Terms clause 15.3). They include:

10.2 You must follow the Platform rules in force when you publish. We may change the Service to enforce them.

10.3 If your conduct leads a Platform to remove content or restrict a Connected Account or our application, we may take Enforcement Action and Terms clauses 15.4 and 24.1 apply.

11. Rate and abuse limits

11.1 We apply request rate limits per user and per IP address, limits on sign-up, login and password-reset attempts, and Plan Limits on Connected Accounts, Member seats and media storage. There is no limit on the number of posts (clause 11A). Platforms impose their own publishing limits and quotas.

11.2 A request over a rate limit is refused with a "rate limited" message saying when to try again. An action over a Plan Limit is refused with an explanation; nothing already stored is deleted (Terms clause 7.4). When a Platform Limit is reached, the post waits and is published automatically when the Platform allows it, and the Service shows it as waiting with the expected time. A post that still cannot be published 72 hours after its scheduled time (or after another maximum wait shown in the Service) is marked failed with the reason, so that you can reschedule it. We tell you in the Service when a post waits, and by email at most once a day for each kind of limit.

11.3 You must not circumvent our limits or a Platform's rate limits and quotas by scripts, bots, scrapers or automated browsers (unless using an interface we publish for that purpose, under its terms), by rotating IP addresses or Accounts, or by splitting activity across Accounts or Workspaces for the purpose of evading a limit.

11.4 We may temporarily lower limits for an Account, Workspace or IP address causing abuse or risk, telling you where practicable.

11A. Fair use

11A.1 Unlimited, with fair use. There is no limit on the number of posts. Our fair use page (/fair-use) explains in plain words what normal use is, what is not allowed, what we review and how to ask for more.

11A.2 Why. All customers publish through the same Platform applications. Use that a Platform treats as spam or abuse can lead it to restrict those applications for every customer.

11A.3 Monitoring. Our systems count publishing volume; identical content sent to several accounts on the same Platform, or repeated on one account; how quickly posts are created; how often publishing fails; how much of a limit shared by all customers one Workspace uses; and Platform spam, block and limit responses. They use thresholds we may change, and keep only counts and one-way codes (hashes) of post text, never the text itself. Once X is switched on, the same text sent to two or more X accounts within 24 hours is also flagged (clause 5.1(c)). These checks only flag activity for a person to review (clause 14.7); they never read or judge the meaning of your content, and a flag on its own changes nothing for you.

11A.4 What we do. For fair-use concerns that are not Serious Breaches, we follow these steps in order and tell the Workspace Owner at each step what we saw, what to change, what we did and how to appeal:

(a) a heads-up by email and in the Service, with no restriction;

(b) if the activity continues, a temporary slow-down, for example a maximum number of posts per hour or a minimum gap between posts on an account, for up to 14 days; posts still publish, later, and each affected post shows its new time;

(c) a suspension of publishing under clause 14.2(c) and Terms clause 25, only as a last resort. Scheduled posts are held, not deleted, and you can still compose, schedule, see analytics and export your data. Posts that fall due during the suspension are never published late: when it ends, or once a held post is 24 hours overdue, we mark it as not published, with the reason, so that you can reschedule it (Terms clause 25.3).

When the last restriction ends, we tell you that publishing is back to normal.

11A.5 Asking for more. If your business needs more than normal use, email [email protected] with what you plan to post. We can raise our review thresholds for a Workspace where the Platforms allow it.

11A.6 Records. We keep a record of each fair-use review and step (what we saw, what we told you, and who decided and why) for 3 years after the matter closes, then delete it (Privacy Policy clause 10).

12. Security testing

12.1 We welcome good-faith security research under the VDP, which governs security research and prevails over this clause if they differ (Terms clause 3.3). In summary, you must:

(a) test only Test Accounts (VDP clause 2): Accounts and Workspaces you created for research, or whose owner has given you written permission; (b) not access, change, delete or keep anyone else's data; if you encounter it, stop, keep only what is needed to prove the issue, report it and delete your copy; (c) not carry out denial-of-service or load testing, spam, phishing, social engineering or physical attacks, or search for or brute-force our admin tools; (d) keep automated scanning within clause 11; (e) not test the Platforms, our payment processor or our Sub-processors through the Service, or publish harmful content while testing; and (f) report promptly to [email protected] with reproduction details, and keep the issue confidential during the Disclosure Period in VDP clause 10.4 (until we confirm a fix or 90 days after your report, whichever is sooner, unless we agree otherwise).

12.2 Research that makes a good-faith effort to follow clause 12.1 and the VDP is authorised, and we give it the safe harbour in VDP clause 11, including our promise not to bring a claim or complain to the authorities about it. That safe harbour has the limits in VDP clause 11.2: for example, we cannot authorise testing of Platforms, our payment processor or Sub-processors, or bind the Public Prosecutor, the police or other authorities. Other testing is Prohibited Conduct and may be an offence under the Computer Crimes Act 1997.

13. Reporting abuse

13.1 Anyone may report content scheduled or published through the Service, a post preview link or other misuse by emailing [email protected] (subject "Abuse report") or through the Contact page on our website. Use the subject "Security" for security issues, and "Privacy" for personal data concerns, which go to our Data Protection Officer.

13.2 Include the content's link or a screenshot, the Platform, why it breaches this Policy or the law and your contact details. For an intellectual property notice, also identify the work and the infringing material, show that you own the right or are authorised to act for its owner, and state that the notice is accurate and made in good faith. An incomplete report may take longer to handle. We do not give your identity to the person you report, except for an intellectual property notice (clause 6.2) or where you agree or the law requires; clause 13.6 explains our other disclosures.

13.3 Only the Platform can remove a published post from its service, so please report it there too. We can hold scheduled posts, disable preview links and act against the Account or Workspace.

13.4 We acknowledge Abuse Reports within 2 Business Days. We give priority to reports of child sexual abuse material, financial fraud or threats to safety, and aim to act on them within 24 hours of receipt. For a complete intellectual property notice, we aim to act within 48 hours (clause 6.2).

13.5 Never send us child sexual abuse material, even as evidence: send only the link and a description, and report it to the police where you are (in Malaysia, the Royal Malaysia Police) and to the Platform.

13.6 We handle reporters' personal data as Support and Request Data under our Privacy Policy (category H; purpose 6) and keep it for 3 years after the matter closes (Privacy Policy clause 10). We may share: (a) the substance of a report with the Workspace Owner concerned, so that it can respond; (b) a report, without your identity unless you agree, with the Platform concerned, where its terms require it or it is investigating the misuse; and (c) a report, including your identity where necessary, with the Malaysian Communications and Multimedia Commission, the police or another authority, where the law requires or permits (PDPA s.39). Recipients may be in other countries, under the safeguards the law requires (Privacy Policy Section 9). Knowingly false reports or appeals by a Customer or Member are Prohibited Conduct.

14. Enforcement

14.1 We do not pre-review content, but may investigate suspected Prohibited Conduct, including by reviewing relevant Customer Content and logs (Terms clause 16.4). Staff access for this purpose is read-only and limited to it (Terms clause 5.4), and our staff read Google User Data only as Terms clause 5.4 allows, for example where needed to investigate abuse. For personal data in Customer Content, we carry out this limited processing for abuse prevention, security, Platform compliance and legal obligations, as Privacy Policy clause 2.3 describes.

14.2 Enforcement ladder. We normally escalate in this order, in proportion to the seriousness, harm, intent, past breaches and how quickly you fix the problem:

(a) Warning: a notice to the Workspace Owner (and the Member involved) saying what to fix and by when; (b) Restriction: holding or cancelling posts, disabling preview links, disabling a Connected Account (pausing its publishing without deleting its data), lowering limits or requiring post approval. Where needed to stop serious or continuing harm, we may disconnect a Connected Account, which deletes its tokens and, under Terms clause 15.6, its Platform Data; (c) Suspension of publishing, analytics syncing or access for a Member, Account, Connected Account or Workspace (Terms clause 25); and (d) Termination of the Account or Workspace under Terms clause 26.3: after notice and 14 days to remedy a material breach (Terms clause 26.3(a)), or immediately for a Serious Breach (Terms clause 26.3(b)).

14.3 We may skip steps for serious or repeated conduct, where a Platform, regulator or court requires it, and for these Serious Breaches, which may lead to immediate suspension or termination: (a) child sexual abuse material or sexualisation of minors; (b) financial fraud, scams or phishing; (c) incitement to violence or terrorism, or credible threats; (d) malware, unauthorised access or attacks; (e) unlawful collection or sale of personal data; (f) trading in engagement or accounts; (g) evading an earlier suspension or termination; and (h) conduct that has caused a Platform to restrict, or to threaten in writing to restrict, our application's access.

14.4 We tell the Workspace Owner the action, the reason, the clause breached and how to appeal (Terms clause 25.2). We do so before or when we act, except where the law, a Platform or an authority prevents us, or where, for a Serious Breach, telling you first would risk further harm; we then tell you as soon as that reason no longer applies.

14.5 During a suspension, scheduled posts are held and are not published late (clause 11A.4(c)), and you may still export your data unless the law prevents it or the data is itself unlawful content. On termination, Terms clauses 26.4 to 26.6 apply, including the 14-day Export Window; no refund is due for termination for your breach unless the law requires one.

14.6 We may preserve records for as long as the investigation, a legal claim or an authority's request reasonably needs (Privacy Policy clause 10.2), and report conduct to Platforms and authorities where the law requires or permits. We will report child sexual abuse material to the police. For personal data in Customer Content, DPA clause 12.8 also applies to requests from authorities. Platform-required deletion (Terms clause 15.6) still applies unless the law requires us to keep the data, in which case we keep only that data and record why.

14.7 Enforcement decisions are made by people, not by automated tools. Automated rate limits (clause 11) and the Service's checks against Platform limits are not decisions about your content.

15. Appeals

15.1 The Workspace Owner or an affected Member may appeal within 30 days by emailing [email protected] (subject "Appeal") with our reference, why the decision is wrong and anything already fixed. A person who made an Abuse Report may ask us once, in the same way, to reconsider our decision on it.

15.2 Where practicable, someone other than the original decision-maker reviews the appeal.

15.3 We aim to decide within 14 days and tell you in writing whether we uphold, change or reverse the action. If we reverse it, we restore access; overdue posts are not published late without your instruction, and data that a Platform's rules required us to delete cannot be restored, although you can reconnect the account. Terms clause 25.2 applies to a suspension you did not cause.

15.4 Where a Platform, regulator or court required an action, we will name that body unless the law forbids it, and you must challenge the requirement with that body. You may still appeal to us on whether we applied it correctly. Appeal a Platform's own decisions about your Connected Account to that Platform.

15.5 An appeal does not pause the action unless we say so. It does not affect your rights under the law or Terms clauses 28 and 29. If you live outside Malaysia, you also keep the rights your local law gives you, and you may contact us at [email protected] to use them.

16. Changes, contact and language

16.1 We give notice of material changes to this Policy under Terms clause 27, including your right to terminate under Terms clause 27.2; changes required by law or a Platform may take effect sooner, with as much notice as is practicable.

16.2 Contact: [email protected] for abuse reports, appeals, security issues, legal notices and our Data Protection Officer (use the subjects in clauses 13.1 and 15.1, or "Legal notice"); post, Malaysia; online, through our Contact page (/contact).

16.3 This Policy is written in English, which is the operative version. Where we publish a Bahasa Malaysia translation and the versions differ, the English version prevails unless Malaysian law requires otherwise (Terms clause 32.1).

17. Change log