Hybrid Comply Acceptable Use Policy

Effective date: 16 August 2026 · Last updated: 16 August 2026 · Version: 1.0

1. About this Policy

This Acceptable Use Policy (“Policy”) sets out the rules for accessing and using:

the Hybrid Comply mobile application;
the Hybrid Comply web portal and administrative dashboard;
Hybrid Comply property inspection and compliance-reporting features;
Hybrid Comply application programming interfaces and integrations;
Hybrid Comply websites, support tools and related services; and
any other service supplied by HYBRID HQ LTD, trading as Hybrid Comply, together referred to as the “Service”.

This Policy applies to:

customers;
account administrators;
property owners;
landlords and managing agents;
inspectors;
employees and contractors;
schools and education providers;
businesses;
hotel and recreation-facility operators;
tenants and occupiers;
report recipients;
integration partners; and
any other person who accesses or uses the Service.

This Policy forms part of the Hybrid Comply Terms of Service and any applicable customer agreement.

By using the Service, you agree to comply with this Policy.

2. Purpose of Hybrid Comply

Hybrid Comply is intended to support legitimate property health and safety activities, including:

conducting property inspections;
recording hazards and defects;
collecting relevant inspection evidence;
creating compliance reports;
assigning remedial actions;
monitoring corrective work;
maintaining inspection audit trails;
sharing reports with authorised recipients; and
supporting lawful property-management and compliance activities.

Hybrid Comply must not be used for purposes unrelated to legitimate property inspection, safety, maintenance or compliance unless Hybrid Comply has expressly approved the use in writing.

3. General User Responsibilities

You must:

use Hybrid Comply lawfully and responsibly;
comply with the Terms of Service and applicable customer agreement;
provide accurate account information;
follow your organisation’s policies and instructions;
use only the access permissions granted to you;
protect your account and device;
collect only information necessary for the inspection purpose;
respect the privacy, dignity and rights of other individuals;
ensure inspection evidence is accurate and not misleading;
promptly report security, privacy or safety concerns;
comply with relevant property, tenancy, employment, safeguarding and health and safety requirements; and
cooperate with reasonable investigations into suspected misuse.

You are responsible for activity conducted through your account unless it results from a security failure for which Hybrid Comply is legally responsible.

4. Authorised Property Access

Hybrid Comply does not grant authority to enter, inspect, photograph, record or monitor a property.

Before using Hybrid Comply at a property, you must ensure that:

you are legally entitled or properly authorised to enter;
any required notice has been given;
the inspection occurs at an authorised time;
applicable tenancy or occupancy rights are respected;
any required consent or permission has been obtained;
the scope of the inspection is understood;
restricted or private areas are not accessed without authority; and
any relevant safeguarding or workplace procedure is followed.

You must not use Hybrid Comply to:

enter a property unlawfully;
bypass access restrictions;
misrepresent your identity or authority;
pressure an occupant into granting access;
interfere with a tenant’s right to quiet enjoyment;
enter a private room or area outside the authorised inspection scope; or
collect information from a property where you have no legitimate inspection purpose.

5. Lawful and Proportionate Data Collection

You must collect only information that is:

necessary for a legitimate inspection or compliance purpose;
relevant to the issue being inspected;
proportionate to the risk or obligation;
accurate to the best of your knowledge;
collected fairly and lawfully; and
retained only for an appropriate period.

You must not use Hybrid Comply to collect personal information merely because it may be useful later.

You must avoid collecting excessive information about:

tenants;
occupants;
employees;
pupils;
visitors;
customers;
hotel guests;
contractors;
neighbouring properties; or
other identifiable individuals.

Where unnecessary personal information is captured, you should promptly:

delete it;
crop the relevant image;
redact the information;
reduce its level of detail;
restrict access; or
report it to the relevant administrator.

6. Photographs, Video and Audio

Hybrid Comply may allow users to capture photographs, video and audio as inspection evidence.

You must:

focus media on the relevant defect, hazard or property condition;
avoid including identifiable individuals where possible;
avoid capturing private documents, screens or correspondence;
avoid recording conversations without lawful authority;
use redaction or cropping tools where available;
consider whether written notes would be less intrusive;
ensure recording is permitted at the property;
follow safeguarding rules in schools and similar settings; and
share media only with authorised recipients.

You must not deliberately capture:

people in bedrooms, bathrooms, changing rooms or similarly private spaces;
children, unless strictly necessary, lawful and appropriately safeguarded;
identity documents;
medical records;
bank statements;
personal messages;
passwords or access credentials;
computer screens containing private information;
intimate images;
unrelated personal possessions;
neighbouring properties beyond what is necessary; or
private activity unrelated to the inspection.

Hybrid Comply must not be used as a covert camera, recording device or surveillance platform.

7. Location Information

Where location features are enabled, you must use them only for legitimate purposes such as:

confirming the location of an inspection;
matching evidence to a property;
locating an assigned property;
maintaining an accurate inspection audit trail; or
preventing fraudulent inspection records.

You must not use Hybrid Comply location information to:

track an individual’s movements without lawful authority;
monitor employees, tenants or contractors excessively;
follow or stalk another person;
infer private activity unrelated to an inspection;
create an unnecessary movement history;
monitor an individual when they are off duty; or
disclose a person’s location to an unauthorised recipient.

Background location access must not be enabled or required unless it is necessary for an approved Hybrid Comply feature and has been properly communicated to affected users.

8. Children and Vulnerable Individuals

Hybrid Comply accounts are intended for authorised adults.

When using Hybrid Comply in schools, nurseries, leisure facilities, residential settings or other locations involving children or vulnerable individuals, you must:

follow applicable safeguarding procedures;
avoid photographing or recording children;
arrange inspections to reduce the likelihood that children are present;
avoid capturing names, pupil work, timetables or safeguarding notices;
avoid entering occupied private areas without appropriate supervision;
restrict access to relevant inspection records;
report accidental capture of sensitive information; and
escalate safeguarding concerns through the appropriate official process.

Hybrid Comply is not a safeguarding case-management or emergency-reporting system.

Do not use Hybrid Comply as the sole means of reporting an immediate safeguarding concern.

9. Accurate Inspection Records

You must ensure that inspection records are complete, accurate and honest.

You must not:

record an inspection that did not take place;
claim to have inspected an area you did not inspect;
use another person’s identity or account;
alter a date, time or location to misrepresent an inspection;
upload evidence from a different property;
recycle old photographs as current evidence;
falsely state that remedial work was completed;
deliberately omit a serious hazard;
manipulate a risk score to achieve a desired outcome;
forge a signature;
falsely identify the person who attended;
issue a report containing information you know is false; or
delete or conceal evidence to mislead another person.

Where an error is discovered, you must correct it using the available correction, annotation or amendment process.

You must not overwrite or alter records in a manner that hides the original error where an audit trail is required.

10. Professional Competence

You must not use Hybrid Comply to undertake work for which you are not competent, trained, accredited or legally authorised.

Where an inspection requires a qualified or registered professional, you must not represent a Hybrid Comply checklist or report as a substitute for that professional assessment.

This may include work involving:

gas safety;
electrical safety;
fire-risk assessment;
asbestos;
structural engineering;
lifts or lifting equipment;
water hygiene;
building control;
energy certification;
specialist environmental hazards; or
another regulated or technical field.

You must not:

misrepresent your qualifications;
use another person’s accreditation;
issue a statutory certificate without authority;
sign a document reserved for a qualified professional; or
describe a Hybrid Comply-generated report as a professional certification where it is not one.

11. No Emergency Use

Hybrid Comply is not an emergency response service.

You must not rely on Hybrid Comply as the sole method of reporting:

fire;
gas leaks;
suspected carbon monoxide;
serious electrical hazards;
structural collapse;
flooding that creates an immediate danger;
violence or criminal activity;
a threat to life;
an urgent safeguarding concern; or
another immediate health and safety emergency.

Where there is an immediate risk, contact the relevant emergency service, responsible person, property manager or qualified professional directly.

Submitting an inspection or support request through Hybrid Comply does not guarantee immediate review.

12. Respectful Conduct

You must not use Hybrid Comply to:

harass;
stalk;
threaten;
intimidate;
shame;
abuse;
discriminate against;
defame; or
unlawfully monitor another person.

You must not include abusive, humiliating or discriminatory content in:

inspection notes;
photographs;
captions;
reports;
task assignments;
user profiles;
support requests; or
communications sent through Hybrid Comply.

You must not use property-condition information to retaliate against a tenant, employee, inspector, contractor or other person who raises a legitimate concern.

13. Discrimination and Unfair Decisions

Hybrid Comply must not be used to make unlawful or unfair decisions based on protected or sensitive characteristics.

You must not use Hybrid Comply data to discriminate unlawfully on grounds including:

age;
disability;
gender reassignment;
marriage or civil partnership;
pregnancy or maternity;
race;
religion or belief;
sex; or
sexual orientation.

You must not use an inspection report, automated score or recommendation as the sole basis for a significant decision about an individual without:

checking the underlying information;
considering relevant context;
applying meaningful human judgement;
giving the individual an appropriate opportunity to respond where required; and
complying with applicable law.

14. Account and Credential Security

You must:

use your own account;
keep credentials confidential;
use a strong and unique password;
use multi-factor authentication where available;
protect authentication codes;
secure devices used to access Hybrid Comply;
log out of shared devices;
notify Hybrid Comply or your administrator of suspicious activity;
remove access promptly when no longer required; and
comply with organisational access procedures.

You must not:

share a personal account;
allow an unauthorised person to use your account;
request another user’s password;
disclose a one-time code;
impersonate another user;
create an account using false information;
attempt to avoid an account suspension;
create multiple accounts to evade controls;
transfer an account without authorisation; or
leave an authenticated device available to an unauthorised person.

15. Unauthorised Access and Security Testing

You must not attempt to gain unauthorised access to:

another user’s account;
another customer’s property records;
administrative functions;
source code;
databases;
servers;
cloud infrastructure;
internal systems;
logs;
backups;
application programming interfaces; or
any data or function outside your authorised access.

You must not:

guess or obtain another person’s password;
bypass authentication;
bypass role or permission controls;
intercept network traffic;
exploit a vulnerability;
scan or probe Hybrid Comply systems without written approval;
conduct penetration testing without authorisation;
alter or delete another person’s data;
introduce malicious code;
access a disabled or suspended account;
use an undocumented access method; or
assist another person to do any of these things.

Unauthorised access to computer systems and data may constitute a criminal offence under UK law.

16. Malware and Harmful Content

You must not upload, transmit, introduce or distribute:

malware;
ransomware;
spyware;
viruses;
worms;
trojans;
malicious scripts;
corrupted files;
destructive code;
credential-stealing tools;
harmful links; or
content designed to interfere with a system or device.

You must not use Hybrid Comply to test, host, distribute or control malicious software.

Files uploaded to Hybrid Comply must be relevant to the permitted inspection or compliance purpose.

17. Service Interference

You must not:

overload the Service;
conduct a denial-of-service attack;
generate unreasonable automated traffic;
interfere with system performance;
evade rate limits;
disrupt another user’s access;
consume excessive resources deliberately;
exploit defects to obtain additional storage or features;
interfere with synchronisation or reporting;
disable security controls;
manipulate logs;
interfere with monitoring; or
take any action likely to damage or impair the Service.

Hybrid Comply may apply reasonable technical limits to protect availability and other customers.

18. Automated Access, Scraping and APIs

You must not use bots, scripts, crawlers, scraping tools or other automated systems to access Hybrid Comply unless:

the access uses an approved Hybrid Comply integration or API;
the Customer is authorised to access the data;
the activity complies with documented limits;
the activity does not impair the Service; and
Hybrid Comply has approved the use where approval is required.

You must not:

scrape user or customer information;
collect data from another customer;
harvest contact details;
reproduce Hybrid Comply databases;
avoid API restrictions;
rotate accounts or addresses to evade rate limits;
use undocumented interfaces;
extract standard templates in bulk for competing use; or
use Hybrid Comply data to build an unauthorised commercial database.

19. Intellectual Property

You must respect the intellectual-property rights of Hybrid Comply and third parties.

You must not:

upload content you have no right to use;
remove copyright or ownership notices;
copy or redistribute Hybrid Comply software;
reverse engineer the Service except where a legal right cannot be excluded;
reproduce Hybrid Comply templates for unauthorised resale;
use Hybrid Comply branding without permission;
copy another customer’s templates;
upload pirated documents or software;
use Hybrid Comply content to create a competing service; or
infringe another person’s copyright, trademark, database right or confidential information.

20. Confidential Information

You must not use Hybrid Comply to disclose confidential information without authority.

Confidential information may include:

customer records;
property access details;
unpublished inspection findings;
security procedures;
commercial terms;
employee information;
school information;
source code;
vulnerability details;
legal advice; and
information belonging to another person or organisation.

You must verify recipients before sharing or exporting inspection information.

Public sharing links must not be used for Restricted or Confidential information unless expressly designed and approved for that purpose.

21. Prohibited Content

You must not upload, create, store or distribute content that:

is unlawful;
is fraudulent;
is deliberately false;
is defamatory;
infringes privacy;
infringes intellectual property;
promotes violence;
contains threats;
constitutes harassment;
is discriminatory;
contains unlawful sexual content;
exploits or endangers children;
facilitates crime;
reveals credentials;
contains malicious code;
is unrelated to the legitimate Service purpose; or
exposes another person to an unreasonable risk of harm.

Hybrid Comply may restrict access to or remove content that reasonably appears to violate this Policy.

22. Special Category and Highly Sensitive Information

Hybrid Comply is not designed for routine storage of:

medical records;
criminal-offence records;
safeguarding case files;
biometric templates;
immigration records;
employee disciplinary files;
pupil records;
banking credentials;
complete payment-card details; or
intimate personal information.

You must not upload such information unless:

it is strictly necessary;
it is lawful;
the Customer has approved the processing;
an appropriate lawful basis and additional condition apply;
appropriate privacy information has been provided;
access is restricted; and
an appropriate retention period is applied.

Where sensitive information is accidentally captured, report it promptly and remove or restrict it where appropriate.

23. Payment and Subscription Misuse

You must not:

use stolen payment information;
submit false billing information;
evade subscription charges;
abuse trials;
reverse or dispute legitimate payments fraudulently;
manipulate usage records;
resell access without permission;
share a plan beyond its user limit;
falsify eligibility for a discount; or
interfere with payment-provider systems.

Billing disputes must be raised through the proper support or complaint process.

24. Integrations and Third-Party Services

You may connect Hybrid Comply only to authorised third-party services.

You are responsible for:

selecting the integration;
confirming that it is appropriate;
reviewing the data shared;
obtaining necessary authority;
configuring permissions;
protecting integration credentials;
monitoring continued access; and
disconnecting it when no longer required.

You must not use an integration to:

export data to an unauthorised service;
bypass Hybrid Comply controls;
copy another customer’s information;
create an unlawful surveillance system;
transfer information internationally without appropriate authority; or
expose Customer Data through insecure configuration.

Hybrid Comply may suspend an integration that creates a security, privacy, legal or operational risk.

25. Analytics, Artificial Intelligence and Model Training

You must not use Customer Data obtained through Hybrid Comply to train, test or improve an artificial intelligence or machine-learning system unless:

the Customer has authorised the use;
affected information is lawfully available for that purpose;
appropriate privacy information has been provided;
relevant contractual restrictions permit it;
sensitive and unnecessary information has been removed;
security measures are appropriate; and
any required impact assessment has been completed.

You must not submit Hybrid Comply inspection photographs, tenant information, school information, access codes or confidential reports to public generative artificial-intelligence services without express authority.

You must not use automated tools to produce misleading or fabricated inspection records.

26. Customer Administrators

Customer administrators must:

authorise users appropriately;
grant the minimum necessary permissions;
remove users promptly;
review access regularly;
investigate suspicious activity;
protect report-sharing settings;
configure retention appropriately;
manage connected integrations;
respond to user concerns; and
ensure users understand this Policy.

Administrators must not access user information for curiosity, personal purposes or purposes unrelated to legitimate account administration.

27. Reporting Suspected Misuse

Suspected misuse should be reported promptly to:

Support email: hello@hybrid-hq.co.uk

A report should include, where available:

the nature of the suspected misuse;
the date and time;
the affected account or property;
relevant screenshots or evidence;
the potential impact;
immediate safety concerns; and
contact details for follow-up.

Do not access additional information or conduct your own intrusive investigation merely to obtain evidence.

Where there is an immediate danger, contact the appropriate emergency service or responsible authority.

28. Security Vulnerability Reporting

Security researchers must not test Hybrid Comply systems without written authorisation unless Hybrid Comply has published a vulnerability disclosure programme expressly permitting the activity.

Vulnerability reports should be sent to: hello@hybrid-hq.co.uk

A report should include:

the affected service;
a clear description;
reproduction steps;
potential impact;
relevant evidence; and
the reporter’s contact details.

Researchers must not:

access unnecessary personal data;
alter or delete data;
disrupt the Service;
use social engineering;
access another customer’s account;
publicly disclose the issue before remediation and agreed disclosure;
demand payment through threats; or
retain information obtained during testing.

Hybrid Comply may publish a separate Vulnerability Disclosure Policy defining authorised testing.

29. Monitoring and Investigation

Hybrid Comply may monitor use of the Service where reasonably necessary to:

protect security;
prevent fraud;
investigate suspected misuse;
maintain availability;
enforce this Policy;
comply with law;
support customers; or
protect the rights and safety of users and others.

Monitoring may include review of:

account activity;
authentication events;
administrative changes;
exports;
uploads;
security logs;
system events;
complaint information; and
content relevant to a reported violation.

Monitoring will be conducted lawfully, proportionately and with appropriate access restrictions.

Hybrid Comply does not undertake to monitor every user action or inspect every item of Customer Data.

30. Enforcement

Where Hybrid Comply reasonably believes this Policy has been breached, it may take proportionate action, including:

issuing a warning;
requesting corrective action;
requiring content to be removed;
removing or restricting content;
disabling a feature;
reducing permissions;
suspending an integration;
resetting credentials;
temporarily suspending an account;
permanently terminating access;
preserving relevant evidence;
notifying the customer administrator;
notifying an affected customer;
reporting conduct to a regulator or law-enforcement authority where appropriate; or
taking legal action.

Hybrid Comply may act immediately where delay may:

create a safety risk;
expose personal data;
compromise another customer;
damage the Service;
enable fraud;
interfere with an investigation; or
breach a legal requirement.

Where appropriate and lawful, Hybrid Comply will provide:

the reason for action;
an opportunity to respond;
a reasonable opportunity to remedy the breach; and
information about any available review process.

31. Content Removal and Preservation

Hybrid Comply may remove, quarantine or restrict content where it reasonably appears to:

be unlawful;
violate this Policy;
contain malware;
expose credentials;
create an immediate privacy or safety risk;
infringe third-party rights; or
threaten the Service.

Hybrid Comply may preserve content or logs where reasonably necessary for:

an investigation;
a complaint;
a legal claim;
a regulator;
law enforcement;
a personal data breach assessment;
an insurance claim; or
another lawful preservation requirement.

Removal from ordinary user access does not always mean immediate deletion from protected evidence stores or backups.

32. Cooperation with Investigations

You must cooperate reasonably with an authorised investigation into suspected misuse.

You must not:

destroy relevant evidence;
manipulate logs;
delete content subject to a preservation request;
influence witnesses improperly;
retaliate against a reporter;
provide false information; or
obstruct a lawful investigation.

Hybrid Comply may restrict information about an investigation where disclosure would:

prejudice the investigation;
expose another person;
compromise security;
breach confidentiality;
interfere with legal proceedings; or
violate law.

33. Appeals and Reviews

Where an account or feature is suspended or terminated for an alleged violation, the affected Customer may request a review by contacting: hello@hybrid-hq.co.uk

The request should state:

the affected account;
the action taken;
why the Customer believes it was incorrect;
relevant evidence; and
any corrective steps completed.

A review does not automatically restore access.

Hybrid Comply may decline repeated requests that provide no new information.

34. Customer Responsibility for Users

An organisational Customer is responsible for:

informing its users about this Policy;
ensuring users are appropriately trained;
supervising authorised use;
configuring permissions;
responding to internal misconduct;
removing access promptly; and
maintaining its own acceptable-use and disciplinary procedures where appropriate.

A Customer’s failure to control its users may be treated as a breach of the Main Agreement where the Customer knew or reasonably should have known of the misuse and failed to act.

35. Relationship with Other Agreements

This Policy supplements:

the Hybrid Comply Terms of Service;
the Privacy and Data Protection Policy;
the Customer Data Processing Agreement;
the Information Security Policy;
the Data Retention and Deletion Schedule;
applicable order forms; and
customer-specific agreements.

If this Policy conflicts with a signed customer agreement, the signed agreement takes priority to the extent of the conflict, unless applying it would permit unlawful or harmful conduct.

36. Changes to this Policy

Hybrid Comply may update this Policy to reflect:

new features;
changes in risk;
changes in law;
new security threats;
regulatory guidance;
customer requirements;
changes to enforcement processes; or
lessons from incidents.

Hybrid Comply will provide reasonable notice of material changes.

The “Last updated” date identifies the current version.

Continued use after the effective date of an updated Policy constitutes acceptance where permitted by the applicable agreement and law.

37. Contact

Questions about this Policy should be sent to:

Hybrid HQ Ltd
Trading as: Hybrid Comply
Address: 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY
Email: hello@hybrid-hq.co.uk