Acceptable Use Policy

Version 4.1 | Last updated 30 October 2026

1. About this Policy

1.1 This Acceptable Use Policy (the "Policy") is issued by Earnly Limited (company number 16183799), registered office 41 New Cross Street, Swinton, Manchester, England, M27 4TU ("Earnly", "we", "us", "our"). It sets out what you must and must not do when you use the Platform, and what we may do if you do not comply.

1.2 This Policy forms part of the Agreement, as set out in the "Documents forming part of the Agreement and order of precedence" clause of the Terms and Conditions. Capitalised terms used in this Policy have the meanings given in the "Definitions and interpretation" clause of the Terms and Conditions, including "Consumer", "Business User", "Individual", "Organisation", "Platform", "Account", "Connected Account", "Open Banking Data", "Outputs", "Provider" (meaning Finexer Ltd) and "Business Day" (Monday to Friday, excluding bank holidays in England and Wales). In this Policy, "you" means anyone who accesses or uses the Platform, whether or not they hold an Account, and includes anyone using your Account.

1.3 If there is a conflict between this Policy and another document forming part of the Agreement, the order of precedence in the Terms and Conditions applies.

1.4 This Policy applies to every Account, whether the Platform is provided free of charge or on a paid plan, and to any person acting on your behalf. You must ensure that anyone acting on your behalf complies with it.

1.5 Every rule in this Policy is an obligation. Where it says you "must" or "must not" do something, a failure to comply is a breach of the Agreement.

2. Who this applies to

2.1 Consumers (individuals using the Platform wholly or mainly for personal or household finances) must comply with this Policy. Enforcement against Consumers is subject to their statutory rights, and Consumers do not give any indemnity (see clause 14).

2.2 Business Users (sole traders, contractors, freelancers, partnerships, LLPs, limited companies and other organisations, and individuals acting for them) must comply with this Policy. A Business User's serious breach of this Policy is covered by the "Indemnity (Business Users only)" clause of the Terms and Conditions.

2.3 Organisations and the individuals acting for them. An Organisation is responsible for every person who uses the Platform for it. The Registrant and every other individual acting for the Organisation must comply with this Policy personally.

2.4 Visitors without an Account must comply with clauses 6 and 9 to 11 when using the public parts of the Platform and the website at earnly.co.uk.

2.5 Individuals have rights under UK data protection law in every case, including in relation to any monitoring or investigation under clause 11. The Privacy Policy explains them.

3. Regulatory status

3.1 Earnly Limited (FRN 1058277) is registered on the Financial Services Register as an agent of Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 925695) for the provision of account information services. You can check this on the Financial Services Register at register.fca.org.uk. Earnly is not itself authorised by the Financial Conduct Authority. Earnly does not provide payment initiation services, cannot initiate payments or move money, and never receives, sees or stores your online banking credentials.

3.2 Because Earnly provides the AIS on behalf of the Provider, misuse of Connected Accounts or Open Banking Data can expose the Provider to regulatory risk. That is why breaches of clause 7 are treated as serious breaches.

4. Account security and credentials

4.1 You must comply with the "Your Account and account security" clause of the Terms and Conditions. In addition, you must not:

(a) share your Account login credentials or one-time sign-in codes with any person, including an accountant, bookkeeper, family member or colleague, or with any third-party service, tool or password-sharing platform, other than a password manager under your sole control;

(b) allow any other person to sign in to your Account or use it as you. Earnly does not offer team or accountant access, so each person who uses the Platform, including for an Organisation, must use their own Account;

(d) sign in to, or attempt to sign in to, any Account other than your own.

4.2 You must tell us at support@earnly.co.uk without undue delay, and in any event within 24 hours, if you know or suspect that your credentials have been disclosed, lost or compromised, or that your Account has been accessed without your authority.

4.3 Earnly will never ask for your Account password, your one-time sign-in code or your online banking credentials. You must never give your online banking credentials to Earnly or to anyone claiming to act for Earnly. Please report any such request to security@earnly.co.uk.

5. One Account per person; no resale

5.1 Each person may hold only one Account. A single Account may hold a personal profile and one or more companies, so you do not need a separate Account for your personal and business affairs. You must not open another Account, including to get around a suspension, restriction or closure. The only exception is test Accounts opened under, and in accordance with, the Vulnerability Disclosure Policy.

5.2 You must add a company to your Account only if you are a director, owner or otherwise authorised to act for it, and you must remove it within 2 Business Days of that authority ending.

5.3 You must not sell, rent, lease, sublicense, assign, transfer or otherwise make available your Account or your right to access the Platform to any other person.

5.4 You must not provide the Services, any part of them, or any Output to third parties as a service of your own, whether for a charge or free of charge, and must not use the Platform to provide bookkeeping, accountancy or tax services to clients, including by adding a client's company to your Account.

6. Protecting the Platform

6.1 You must not use the Platform in any way that breaches any applicable law or regulation, or that infringes the rights of any other person.

6.2 You must not, and must not permit or help any other person to:

(a) access or attempt to access any part of the Platform, any Account or any data that you are not authorised to access;

(b) probe, scan, penetration test, vulnerability test or otherwise test the security of the Platform or its infrastructure, except in accordance with the Vulnerability Disclosure Policy;

(c) scrape, crawl, spider, harvest, index or otherwise extract data or content from the Platform by any automated or manual bulk means;

(d) access or use the Platform by automated means, including without limitation bots, scripts, headless browsers, browser automation tools, robotic process automation and AI agents. Earnly does not offer a public application programming interface. The only exceptions are assistive technology (for example screen readers, screen magnifiers, voice control and switch access) used by an individual to make the Platform accessible to them, and a password manager under your sole control used to fill in your own sign-in details;

(e) circumvent, disable or interfere with any rate limit, access control, authentication measure, security feature or technical restriction;

(f) reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, rules, algorithms or underlying structure of the Platform, except to the extent that sections 50B, 50BA or 296A of the Copyright, Designs and Patents Act 1988 or other law permits it and does not allow that permission to be excluded;

(g) upload, introduce or transmit any virus, worm, trojan, ransomware, spyware, logic bomb or other malicious or harmful code, file or link;

(h) carry out or facilitate a denial of service attack, or otherwise impair, overload or disrupt the operation, availability or integrity of the Platform or any system or network connected to it;

(i) frame, mirror or copy any part of the Platform on any other website or service; or

(j) use the Platform, the Outputs or any data derived from either to develop, train, fine-tune, benchmark or improve any product, service or model that competes with the Platform.

7. Connected Accounts and Open Banking Data

7.1 You must connect only an account that you hold in your own name, or that you are authorised by the account holder to connect and to share Open Banking Data from. You must not connect any account without that authority, including an account belonging to a family member, a former business partner, an employer or a client.

7.2 If you connect an account held by an Organisation or another person, you must be able to show your authority to do so, and you must provide evidence of it within 14 days of our request.

7.3 You must disconnect a Connected Account in Settings → Integrations without undue delay, and in any event within 2 Business Days, when your authority to connect it ends, is suspended or is withdrawn. This includes where you stop holding the account, cease to be a director, officer, partner or authorised signatory, or the account holder withdraws consent.

7.4 You must not attempt to bypass, weaken, automate or interfere with any consent, authentication or authorisation mechanism operated by the Provider or by your bank.

7.5 You must not use Open Banking Data for any purpose other than your own use of the Services in accordance with the Agreement, or in breach of any duty of confidence or data protection obligation you owe to any person.

7.6 Earnly relies on your authority under this clause 7. Any breach of this clause 7 is a serious breach for the purposes of clause 12.

8. Financial crime and misuse of Outputs

8.1 You must not use the Platform to commit, facilitate, conceal or attempt any of the following:

(a) fraud, including without limitation creating, altering or presenting false financial information;

(b) money laundering or terrorist financing;

(d) tax evasion, or the facilitation of tax evasion by any person; or

(e) any other offence involving dishonesty or financial crime.

8.2 You must not use any Output to mislead HM Revenue & Customs, Companies House, a lender, a landlord, an investor, an insurer, a court, a regulator or any other person. In particular, you must not:

(a) present an Output to any person as a verified, audited or professionally prepared figure, or as a tax return or statutory accounts;

(b) alter an Output, or a screenshot or export of an Output, and present it as having been produced by Earnly;

(c) manipulate, distort, omit or deliberately misclassify data, upload false receipts, or connect or disconnect accounts selectively, in order to produce an Output that does not reflect your actual financial position; or

(d) submit any figure to HM Revenue & Customs or Companies House in reliance on an Output without first verifying it as required by the "Your data, Outputs and your duty to verify" clause of the Terms and Conditions.

8.3 You must not use the Outputs to prepare, review, submit or support the tax return or other statutory filing of any other person.

8.4 You must not present, describe or hold out the Outputs, the Platform or the Services as regulated advice, as a regulated service, or as provided, approved or endorsed by the Financial Conduct Authority, HM Revenue & Customs or any other regulator or authority. You must not describe Earnly as authorised by the Financial Conduct Authority. If you refer to Earnly's regulatory status, you must do so consistently with clause 3.1.

9. Ask Earnly and AI Features

9.1 The only AI Feature is AI-assisted categorisation: where Earnly's rules cannot categorise a transaction, Earnly sends only a cleaned merchant name and the transaction amount to Anthropic's Claude Haiku 4.5 model to suggest a category, as described in the AI Policy. "Ask Earnly" is a preview that shows pre-written help content and is not an AI chat feature. The rules in this clause 9 apply to Ask Earnly, to AI-assisted categorisation and to any AI Feature we introduce in the future, in accordance with the AI Policy.

9.2 You must not:

(a) submit prompts or content designed to make Ask Earnly or an AI Feature ignore, override or reveal its instructions, safeguards or restrictions, including without limitation by prompt injection, jailbreaking, role-play instructions or instructions hidden in uploaded receipts, file metadata or transaction references;

(b) attempt to obtain, infer or reconstruct the data, Outputs, prompts or Account information of any other user;

(c) attempt to obtain, infer or reconstruct Earnly's system instructions, configuration or other confidential technical material;

(d) use Ask Earnly or an AI Feature to generate content that is unlawful, defamatory, discriminatory, harassing or otherwise in breach of clause 10;

(e) use Ask Earnly or an AI Feature to obtain guidance on committing any of the conduct described in clause 8;

(f) query Ask Earnly or an AI Feature by automated means or at a volume that exceeds normal use by one individual; or

(g) use Ask Earnly, an AI Feature or their outputs to train, fine-tune, benchmark or evaluate any competing model, product or service.

9.3 Outputs from Ask Earnly and any AI Feature may be inaccurate. They are subject to clause 8 and to the duty to verify in the Terms and Conditions in the same way as all other Outputs.

10. Content standards

10.1 You are responsible for all content you upload, submit or transmit to the Platform, including without limitation receipt images, company details, categories, notes, messages and other free-text entries.

10.2 Your content must be accurate where it states facts, must comply with all applicable law (including data protection law and the law of confidence), and must be content that you own or are entitled to upload and to let Earnly process for the purposes of the Services.

10.3 Your content must not:

(a) be unlawful, defamatory, obscene, offensive, discriminatory, threatening or harassing;

(b) infringe any intellectual property right, right of confidence or right of privacy of any person;

(d) contain special category personal data or criminal offence data about any person, except where it appears incidentally in a genuine receipt or transaction record.

10.4 Earnly does not routinely review the content of Accounts. We look at content in your Account only:

(a) when you ask us to help you, as described in the "Support" clause of the Terms of Service;

(b) when we are investigating a specific suspected breach of this Policy under clause 11; or

10.5 We may remove or disable access to content where we reasonably consider that this Policy has been breached, or where the law requires it.

11. Monitoring and investigation

11.1 Earnly keeps security and abuse logs only. These record sign-in and two-step verification events, failed sign-in attempts, request volumes, IP addresses, browser and device information, and errors and security events. We use them to keep the Platform secure and available and to detect breaches of this Policy. We do not use them to review the content of your Account, and we do not monitor your Account for any other purpose. We rely on our legitimate interests in keeping the Platform secure, as described in the Privacy Policy, and we keep security and audit logs for 12 months (longer only while an incident is under investigation), as set out in the Data Retention Policy.

11.2 We may investigate any suspected breach of this Policy. You must cooperate with an investigation, and must provide the information and evidence we reasonably request within 14 days of our request, or sooner where we reasonably require it for security reasons.

11.3 We may preserve records relating to your use of the Platform, including after the Agreement ends, for as long as needed for an investigation, a legal claim or a request from a competent authority, in accordance with the Data Retention Policy.

12. Enforcement

12.1 Serious breach. Each of the following is a serious breach of this Policy:

(a) any breach of clause 4.1 (credential sharing and account access);

(b) any breach of clause 5.1 or 5.4 (multiple Accounts and resale);

(d) any breach of clause 7 (Connected Accounts and Open Banking Data);

(e) any breach of clause 8 (financial crime and misuse of Outputs);

(f) any breach of clause 9.2(a), (b), (c) or (e) (Ask Earnly and AI Features);

(g) any breach of clause 10.3 (content standards);

(h) failure to remedy any other breach within the period stated in a warning under clause 12.2(a), or repeating a breach after a warning; and

(i) any breach that exposes Earnly, the Provider, another user or any other person to material legal, regulatory, financial, security or reputational risk.

12.2 Enforcement steps. Where we reasonably suspect or establish a breach of this Policy, we may take one or more of the following steps. We normally take them in this order, but we may start at any step that is proportionate to the breach, and we may go straight to step (c), (d) or (e) for a serious breach:

(a) Warning. We tell you in writing what the breach is and require you to remedy it within the period we state, which will be at least 7 days unless the breach requires faster action for security, legal or regulatory reasons.

(b) Restriction. We restrict or withdraw access to particular features, including exports or receipt upload, or remove or disable access to content.

(c) Suspension. We suspend your Account or particular Connected Accounts under the "Suspension" clause of the Terms and Conditions.

(d) Termination. We end the Agreement under the "Termination" clause of the Terms and Conditions.

(e) Reporting and legal action. We report the matter under clause 13 and take legal action, including seeking an injunction and damages.

12.3 Human review. Every decision to suspend or close an Account is made or reviewed by a person. We do not suspend or close Accounts by solely automated means.

12.4 Proportionality and notice. We will act proportionately in choosing the steps we take. Where it is lawful and practicable, we will tell you what action we have taken, why, and what you need to do. We will not tell you where doing so would be unlawful (including under the Proceeds of Crime Act 2002 or the Terrorism Act 2000), would compromise security or an investigation, or is prohibited by the Provider, a regulator or a law enforcement agency.

12.5 Review. If you think we have acted wrongly under this clause 12, you may ask us to review our decision through the Complaints Procedure. Asking for a review does not suspend the action we have taken.

12.6 Our rights under this clause 12 are in addition to our other rights under the Agreement and at law.

13. Reporting to the Provider and to authorities

13.1 We may report any actual or suspected breach of this Policy, and disclose information about you and your use of the Platform, to:

(a) the Provider, where the matter concerns the AIS, a Connected Account or Open Banking Data;

(b) the National Crime Agency, including by making a suspicious activity report, where we know or suspect money laundering or terrorist financing;

(d) HM Revenue & Customs, the Financial Conduct Authority, the Information Commission (ICO), the Office of Financial Sanctions Implementation or another competent authority; and

(e) your bank, where we reasonably suspect fraud or unauthorised access affecting a Connected Account.

13.2 Earnly is not a "relevant person" under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, because it does not provide accountancy or tax advice services to clients by way of business. This Policy still prohibits financial crime, and we will report suspicions to the National Crime Agency where the law requires us to, and may do so where the law permits.

13.3 We will make disclosures under clause 13.1 only where the law requires or permits it, in accordance with the Privacy Policy and data protection law.

13.4 Requests from law enforcement agencies, regulators and courts are handled by Earnly's Director. Before disclosing any personal data, the Director verifies the identity of the requesting body and the legal basis for the request (for example a court order, a statutory power or an exemption under the Data Protection Act 2018). We disclose only the minimum information needed to meet the request, and we keep a record of each request and our response.

13.5 We may be prohibited by law from telling you that we have made a report or disclosure.

14. Responsibility for breach

14.1 If you are a Business User, your responsibility for losses arising from a serious breach of this Policy is governed by the "Indemnity (Business Users only)" clause of the Terms and Conditions. This Policy does not create any separate or additional indemnity.

14.2 If you are a Consumer, you do not give any indemnity. You are responsible under the general law for loss that we suffer as a foreseeable result of your breach of this Policy.

14.3 The "Limitation of liability" clause of the Terms and Conditions applies to this Policy.

15. Reporting misuse and security vulnerabilities

15.1 If you become aware of any actual or suspected breach of this Policy, or any unauthorised access to the Platform or an Account, please report it to support@earnly.co.uk.

15.2 If you find a security vulnerability in the Platform, you must report it to security@earnly.co.uk in accordance with the Vulnerability Disclosure Policy. That policy sets out what is in scope, the rules you must follow when testing, how we respond, and when you may disclose a vulnerability publicly.

15.3 We will not take action under clause 12 against a person who reports a vulnerability in good faith and in accordance with the Vulnerability Disclosure Policy. That protection does not extend to any conduct outside the rules in that policy.

16. Changes to this Policy

16.1 We may change this Policy only for the reasons, and in the way, set out in the "Changes to the Agreement" clause of the Terms and Conditions. Material Changes are notified at least 30 days in advance, you may end the Agreement free of charge before a Material Change takes effect, and a Material Adverse Change takes effect for you only if you positively accept it.

16.2 We may make a change at shorter notice where it is needed to address an urgent security risk or to comply with law, a regulator or the Provider. We will give as much notice as we reasonably can, and your rights under the "Changes to the Agreement" clause of the Terms and Conditions still apply.

17. Governing law and jurisdiction

17.1 This Policy is governed by the law of England and Wales. The "Governing law and jurisdiction" clause of the Terms and Conditions sets out which courts have jurisdiction, including the right of Consumers to bring proceedings in the part of the United Kingdom where they live.

18. Contact

Questions about this Policy, and reports of misuse, should be sent to support@earnly.co.uk or by post to Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU. Security vulnerabilities should be reported to security@earnly.co.uk.