LeonAI LinksLegal

Acceptable Use Policy

Last updated July 10, 2026 · Version 1.0

Effective date: July 10, 2026

This Acceptable Use Policy ("AUP") governs all use of the LeonAI Links service operated by LeonAI LTD ("LeonAI," "we," "us"), including short links on our shared short-link domain and on customer custom domains, QR codes, link-in-bio pages, the dashboard, the REST API, and webhooks (collectively, the "Service"). This AUP is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

Because a URL shortener can be abused to disguise the destination of a link, we enforce this AUP strictly. Violations may result in immediate link deactivation, account suspension, or termination without refund.

1. Scope

This AUP applies to: (a) every Destination URL to which a Short Link, QR code, or link-in-bio entry points, including any page reached through subsequent redirects; (b) all content published on link-in-bio pages hosted by the Service; (c) all use of the API, SDKs, and webhooks; and (d) the manner in which Short Links are distributed. You are responsible for all Short Links created under your account, including by your team members and by applications using your API keys.

2. Prohibited Content and Destinations

You may not create, maintain, or distribute a Short Link that points to, or a link-in-bio page that contains, any of the following:

  1. Phishing and credential harvesting. Pages that impersonate a legitimate business, government body, or person to collect login credentials, payment details, one-time passcodes, or other personal information, including fake login portals, spoofed banking pages, and lookalike domains.
  2. Malware and harmful code. Viruses, ransomware, spyware, trojans, drive-by downloads, browser exploits, cryptomining scripts, or any software installed without informed consent.
  3. Spam. Content promoted through unsolicited bulk email, SMS, or messaging (see Section 4), or landing pages that exist primarily to deliver spam, including snowshoe spam and URL-rotation schemes.
  4. Deceptive redirects and cloaking. Using the Service to disguise a destination for the purpose of evading spam filters, security scanners, advertising network policies, or platform moderation; showing different content to scanners than to human visitors; or misrepresenting the destination in anchor text, QR context, or link metadata.
  5. Affiliate abuse. Cookie stuffing, forced clicks, typosquatting monetization, or use of Short Links in violation of an affiliate program's terms.
  6. Child sexual abuse material (CSAM). Zero tolerance. Links to CSAM are removed immediately, preserved as required by law, and reported to the National Center for Missing & Exploited Children (NCMEC) and relevant authorities.
  7. Terrorism and violent extremism. Content that promotes, incites, glorifies, or provides material support for terrorism or violent extremism.
  8. Illegal goods and services. Sale or facilitation of illegal drugs, illegal weapons, counterfeit goods, stolen data, forged documents, or human trafficking.
  9. Fraud and scams. Tech-support scams, fake giveaways and sweepstakes, advance-fee fraud, pyramid and Ponzi schemes, fraudulent investment or cryptocurrency offerings, fake shops, and payment fraud.
  10. Hate, harassment, and doxxing. Content whose primary purpose is to threaten, harass, or incite violence against individuals or groups, or to publish private personal information to enable harassment.
  11. Intellectual property infringement. Destinations distributing pirated software, media, or other infringing material. Copyright complaints are handled under our DMCA / Copyright Policy.
  12. Adult content on the shared domain. Lawful adult content is prohibited on the shared short-link domain. It is permitted only on a verified custom domain owned by the Customer, provided the content is lawful in all targeted jurisdictions, involves only consenting adults, and is placed behind an appropriate age gate. Non-consensual intimate imagery is prohibited everywhere without exception.
  13. Regulated content without compliance. Pharmaceuticals, gambling, alcohol, tobacco and vaping, and financial promotions may only be linked where the Customer holds all required licenses and the promotion complies with the laws of every jurisdiction it targets.

3. Prohibited Technical Behavior

You may not:

  1. Bypass, probe, or circumvent rate limits, tier quotas, authentication, or other technical controls, including by rotating accounts, API keys, or IP addresses.
  2. Enumerate short codes, scrape the Service, or systematically resolve Short Links you do not own for data-harvesting purposes.
  3. Chain redirectors — pointing a Short Link at another URL shortener or open redirect for the purpose of defeating our destination scanning.
  4. Interfere with or attack the Service's infrastructure, including denial-of-service attacks, resource exhaustion, or exploiting vulnerabilities (security research is governed by our Responsible Disclosure Policy).
  5. Commit click fraud or artificially inflate click counts, scan counts, or analytics, whether by bots, click farms, or automated refreshing.
  6. Use the API to operate a competing general-purpose URL shortening service that resells access to the shared short-link domain.
  7. Create Short Links designed to trigger downloads, purchases, subscriptions, or permission prompts without clear disclosure to the End User.

4. Anti-Spam Requirements

Short Links, and QR codes derived from them, may not be distributed through: (a) unsolicited bulk email or SMS/MMS; (b) messages sent to purchased, rented, or scraped contact lists; (c) messaging that lacks a functioning unsubscribe mechanism or accurate sender identification; or (d) any campaign that violates CAN-SPAM, the TCPA, CASL, the EU ePrivacy rules, or equivalent laws in the recipient's jurisdiction. Using shortening to hide a domain with a poor sending reputation is itself a violation. We monitor spam-trap hits, blocklist listings, and abuse-desk feeds relating to our shared short-link domain and will act on them to protect deliverability for all customers.

5. Detection and Moderation

To keep the shared domain trustworthy, LeonAI operates layered abuse detection:

  • Automated scanning. Destination URLs are checked at creation time and periodically thereafter against Google Safe Browsing and similar reputation services, plus our own heuristic and machine-learning classifiers (domain age, redirect chains, content signals, click-pattern anomalies).
  • Third-party intelligence. We consume phishing, malware, and spam feeds from industry abuse networks and blocklist operators.
  • Manual review. Flagged links and abuse reports are reviewed by our team.

Scanning is automated and content-neutral; we do not review the substance of lawful destinations except in response to flags and reports.

6. Enforcement Actions

Depending on severity, history, and confidence, we may take one or more of the following actions, without prior notice where the risk to End Users or the Service is severe (for example, active phishing or malware):

  1. Interstitial warning. The Short Link continues to resolve but End Users first see a warning page describing the suspected risk.
  2. Link deactivation. The Short Link stops redirecting and returns HTTP 410 Gone with a notice page. Deactivated links are retained for evidentiary purposes.
  3. Feature restriction. Suspension of API access, bulk creation, or custom-domain features.
  4. Account suspension or termination. For serious or repeated violations, the entire account may be suspended or terminated.
  5. Referral. CSAM, terrorism, and credible threats are referred to law enforcement and relevant hotlines; we cooperate with lawful investigations.

Re-creating a deactivated Short Link, or creating a materially equivalent link to the same abusive destination, is an independent violation and typically results in immediate account termination.

7. Reporting Abuse

Anyone may report an abusive Short Link by emailing care@leonai.io with the subject line "Abuse Report." Please include the full Short Link URL, the observed Destination URL, a description of the abuse, and any supporting evidence (screenshots, message headers). We aim to act on verified phishing and malware reports within 24 hours, and on other categories within 3 business days. Copyright complaints should follow the DMCA / Copyright Policy instead.

8. Appeals

If your link or account was actioned and you believe we made a mistake, reply to the enforcement notice or email care@leonai.io with the subject line "AUP Appeal," identifying the affected links and explaining why the action was incorrect. We will respond within 5 business days. During an appeal, deactivated links generally remain deactivated. Our decision following appeal is final, subject to your rights under applicable law.

9. Effect on Paid Subscriptions

Termination or suspension for an AUP violation does not entitle you to any refund of prepaid fees, as further described in our Refund and Cancellation Policy. You remain responsible for fees accrued through the date of termination.

10. Reservation of Rights; Changes

We may investigate suspected violations, preserve and disclose information as required by law or as necessary to protect End Users and the Service, and update this AUP as new abuse patterns emerge. Material changes will be announced with at least 14 days' notice via the dashboard or email, except where immediate change is needed to address a legal requirement or an active abuse vector. Continued use of the Service after a change takes effect constitutes acceptance.

Questions about this AUP: care@leonai.io.