Acceptable use policy

Who this policy is for

This policy applies to every business that uses Bona, and to everyone the business lets use it, such as its agents, admins and developers. In this policy, “you” means the business and its people, and “your customers” means the people who visit your website and ask for help.

It forms part of our terms of service. If you or your team break it, we may suspend or close your account, as the terms explain.

Be open with your customers

Bona only works because your customers can trust it. So:

• Tell them about it. Say in your privacy notice that you use Bona for chat and screen sharing, what your agents can see and why. You can start from the sample wording below.
• Use Bona’s own prompt. Start every screen share through Bona’s consent prompt: the customer clicks “Share screen with support”, then “Allow”. If you use your own button, it must open the same prompt, as Cobrowse.start() does. Never click it for them, hide it, or describe it as something else.
• Ask before you take control. Remote control needs a second, separate “Allow”. Only ask for it when you need it, and say first what you’re going to do.
• Respect their choices. When a customer says “Not now”, presses Pause or stops sharing, accept it. Don’t pressure them to start again.

Don’t try to get around, switch off or weaken any of Bona’s protections: masking, the consent prompts, the separate permission for remote control, the pages you’ve set as never shared, or the customer’s Pause button. That includes changing or wrapping Bona’s code on your pages to do any of these.

Bona doesn’t record sessions. If you record your agents’ screens with other tools, you’re responsible for telling your customers and for following the law that applies to recording.

Keep private fields private

Bona masks passwords, card numbers and one-time codes on the customer’s device by default. It finds them from each field’s type, its autocomplete setting and its name. Everything else on the page is visible to your agent unless you mark it private, so before you go live:

• Mark sensitive elements private. Add the data-cobrowse-redact attribute, or the class cobrowse-redact, to anything your customers wouldn’t expect an agent to see, such as account balances, ID numbers, health details or account numbers. Your agent sees a blank box of the same size, and its content never leaves the customer’s device.
• Use private mode for sensitive pages. With data-bona-privacy="private" on the Bona script tag, everything on the page is hidden except what you allow with data-cobrowse-unredact.
• Keep some pages out completely. List them under “Pages never shared” in the dashboard, and Bona won’t share them, even during a session.
• Check again when your site changes. After you add a form or a page, look at it from the agent console to make sure nothing sensitive shows.
• Pass only what you need. If your site passes visitor details to Bona, such as a name or email address, pass only what your agents need to help.

Rules for agents

• Use Bona only to help the customer in front of you, with what they asked for help with.
• Never ask a customer to type a password, card number, one-time code or other secret while they’re sharing their screen, and never ask for one in chat.
• Ask for remote control only when you need it, and give it back as soon as you’re done.
• End the session when you’ve finished helping. Don’t leave it running.
• Keep your login to yourself, and sign out on shared computers.

Take extra care with sensitive information

• Children. Take extra care if children use your website. Don’t use Bona to view a child’s screen unless the law allows it and you have any consent it requires, such as a parent’s or guardian’s.
• Health, financial and other sensitive information. Information such as health details, ID numbers, biometric data, religious beliefs or criminal records is protected more strictly by POPIA, UK GDPR, the EU GDPR and the other laws Bona is built for. Mark fields that hold it as private, or keep those pages out of sessions with “Pages never shared”.
• Regulated industries. If you work in banking, insurance, healthcare, telecoms or another regulated industry, check that the way you use Bona fits your industry’s rules, for example on outsourcing and record keeping, before you go live.
• No covert monitoring. Never use Bona to watch anyone without their knowledge, including your own staff. Bona is for helping customers who ask for it, not for monitoring or surveillance.

Your AI assistant

• You’re responsible for what it says. You decide what your AI assistant knows and how it behaves, through the instructions and pages you give it. Treat its replies as if one of your agents had written them.
• It always says it’s an AI. Bona labels every AI reply with the assistant’s name and “AI”, and tells the customer they’re chatting with an AI assistant that your team can see. Don’t try to hide this, don’t give the assistant a name or instructions meant to make customers think it’s a person, and follow any law where you operate that requires you to disclose the use of AI.
• Don’t use it to mislead. Don’t instruct it to deceive or pressure people, or to give advice you aren’t allowed to give, such as regulated financial, legal or medical advice.
• Choose your provider with care. The assistant sees the page only when the customer allows it, and never sees masked fields. If you connect your own AI provider with your own API key, your agreement with that provider applies too, and it’s up to you to make sure you may send it your customers’ information.

Things you must never do with Bona

• Break the law, or help anyone else break it, including data protection, consumer protection and electronic communications laws.
• Harm, harass, threaten, deceive or defraud anyone, for example by pretending to be another business’s support team.
• Send spam or unwanted marketing through chat or proactive nudges.
• Send malware, or anything meant to damage someone’s device or get into their accounts.
• Attack or overload the service, try to get into parts of it you aren’t allowed to use, or get around its limits.
• Scrape, copy or reverse engineer Bona, except where the law allows it whatever these rules say.
• Resell Bona, or give another business access to it, without our written agreement.
• Install Bona on a website you don’t own or aren’t allowed to change.
• Test Bona’s security, for example by scanning or penetration testing, without our written permission. If you think you’ve found a security problem, please tell us at [email protected]. While you check it, don’t access other customers’ information or disrupt the service.

If you make or sell cobrowsing, screen-sharing or live-support software, or work for a company that does, you need our written permission before you open a trial, as our terms say.

Reporting misuse

If you think someone is misusing Bona, for example a website using it to watch people without their consent, or someone pretending to be a support team, email [email protected]. Tell us the website, what happened and when.

We look into every report. If an account has broken this policy, we may warn the account holder where we can, ask them to put it right, remove a user’s access, or suspend or close the account. If the law requires it, we report it to the authorities.

Changes to this policy

We may update this policy as Bona grows. We’ll post the new version on this page, update the date at the top, and tell account holders about important changes before they take effect.