Technical abuse policy

Lockii runs bookings, payments, and physical access to rental gear for businesses around the world. When someone abuses the platform, the harm can reach a real trailer, storage unit, or customer. This policy explains what we don't allow and how to report it.

Technical Abuse Policy

Last updated 5 November 2026

1. Who this policy applies to

This policy applies to anyone who uses or interacts with Lockii. That includes merchants and their team members, renters and other end customers, visitors to Lockii-powered websites and booking pages, developers using our API or MCP server, and anyone sending traffic to our systems. It covers the dashboard, booking pages, merchant websites on Lockii or custom domains, the native and App Clip apps, email sent from lockii.email, SMS, AI agents, and connected smart locks and trackers.

This policy forms part of our Terms and Conditions. If the two conflict, the Terms apply.

2. Prohibited activities

You must not do, or try to do, any of the following.

Unauthorised access

  • Access an account, company, booking, customer record, or file you aren't authorised to access, including by changing IDs in URLs or API requests.
  • Use leaked, guessed, or shared credentials, run credential stuffing, or bypass two-factor authentication.
  • Hijack sessions, forge tokens, or get around role permissions given to you by a merchant.

Smart locks, trackers, and devices

  • Guess, brute-force, or reuse lock codes, or use a code outside the booking it was issued for.
  • Tamper with, spoof, or interfere with the firmware, connectivity, or messages of a Lockii-connected lock, GPS tracker, or other device.
  • Disable, remove, or hide a tracker or lock to avoid return, billing, or recovery of rented equipment.

Service disruption and excessive load

  • Run denial of service (DoS or DDoS) attacks, or flood booking, checkout, form, chat, or login endpoints.
  • Place load on our systems that degrades the service for other merchants or their customers.
  • Use Lockii file storage or websites to host files or content that has nothing to do with running a rental business.

Bots, scraping, and booking abuse

  • Scrape product, pricing, availability, or customer data from Lockii stores or websites, except through tools we provide for that purpose or with written permission.
  • Create bookings, holds, or carts in bulk to block availability or test pricing.
  • Send automated or spam submissions through booking, contact, or website forms.

Payments and identity verification

  • Card testing, using stolen payment details, or any other form of payment fraud.
  • Get around identity checks, for example with fake or altered documents, someone else's identity, or AI-generated images.
  • Get around deposit, payout, refund, or chargeback controls.

AI agents

  • Use prompt injection or jailbreaks to make a Lockii AI agent reveal other people's data, ignore a merchant's policies, take actions you aren't allowed to take, or produce harmful content.
  • Hide instructions aimed at AI agents in bookings, messages, uploads, or website content.
  • Send automated volume to AI features in a way that exceeds normal use.

API, MCP, and integrations

  • Exceed or get around rate limits, or share, sell, or publish API keys and access tokens.
  • Use the API, MCP server, or webhooks to access data outside the accounts you are authorised for, or to attack third parties.
  • Build integrations that collect merchant or customer data for purposes the merchant hasn't agreed to.

Email and SMS

  • Send spam, phishing, or unsolicited bulk messages through Lockii email or SMS, or send to purchased or scraped lists.
  • Send messages from lockii.email that aren't about a genuine rental, booking, or customer relationship.
  • Spoof senders or forge headers to make a message look like it came from Lockii or a merchant.

Websites and domains

  • Host phishing pages, fake checkouts, deceptive redirects, SEO spam, or cryptocurrency mining scripts on a Lockii-powered website.
  • Impersonate another business, brand, or Lockii itself.
  • Connect a domain you don't own or control.

Malicious code and account misuse

  • Upload or distribute viruses, worms, trojans, ransomware, or any other malicious code.
  • Create fake or duplicate accounts, repeat free trials, or open a new account to get around a suspension.
  • Run security testing against Lockii outside the rules in section 3.

3. Good-faith security research

We welcome reports from security researchers. If you think you've found a vulnerability, email abuse@lockii.app with the subject “Security report”. While you research:

  • Only test against accounts and data you own, such as a trial account you created.
  • Don't access, change, or keep other people's data. If you reach it by accident, stop, tell us, and delete it.
  • Don't run denial of service tests, social engineering, or spam, and don't physically test locks or equipment belonging to merchants.
  • Give us reasonable time to fix the issue before you disclose it publicly.

If you follow these rules, we won't treat your research as a breach of this policy or take legal action against you for it. We don't run a paid bug bounty program at this time.

4. Reporting technical abuse

Email abuse@lockii.app with as much of the following as you can:

  • What happened and when, with timestamps and time zone;
  • URLs, domains, email headers, or phone numbers involved;
  • IP addresses, request logs, or screenshots;
  • The Lockii merchant or booking involved, if you know it.

For a problem with a booking, such as a lock code, a deposit, or a return, contact the business you rented from first. If someone is in danger or property is being stolen, contact your local police.

5. How we respond

We review every report and investigate where there is enough information to act. We may contact the account holder, ask for more details, or work with payment providers, device partners, hosting providers, or law enforcement. Where there is an immediate risk to people, property, data, or the platform, we may act first and contact the account holder afterwards.

6. Consequences

Depending on the severity, breaking this policy may lead to:

  • Removal of content, websites, domains, or integrations;
  • Revoked API keys, disabled lock codes, or restricted features;
  • Blocked IP addresses, devices, or traffic sources;
  • Suspension or termination of the accounts involved;
  • Held or reversed payouts where fraud is involved;
  • Referral to law enforcement and legal action.

7. Changes to this policy

We may update this policy as Lockii and the ways it is abused change. The date at the top shows when it last changed.

Related: Terms, Privacy Policy, DMCA Abuse Policy.

Hazey Creative Pty Ltd (trading as Lockii), 55 Collins Street, Melbourne, Victoria 3000, Australia.