Guild & Marketplace Ethics Statement

Applies to: Everyone who contributes to, sells through, or runs anything from the DataPublisher Marketplace: Guild members, pack authors, maintainers, mentors, apprentices, and partners.

1. Why this exists

DataPublisher exists to help people build honest consulting businesses out of document automation. Our tools generate documents, send email, place phone calls, collect signatures, and manage records. Those are trusted acts. A letter, a signature, or a retention schedule matters because people rely on it.

So the Guild's standard is simple: what you build or run on DataPublisher must be something you would be comfortable explaining, in plain words, to the person who receives the document.

2. Core principles

1. Truthful. Documents, records, and messages say what is real. We automate the production of true things, not the manufacture of false ones.
2. Consented. People are contacted, tracked, and have their data used only in ways they have agreed to or can reasonably expect.
3. Protective of the vulnerable. Seniors, people experiencing homelessness, patients, students, and people in financial trouble get extra care, not extra targeting.
4. Accountable. Every pack, campaign, and payout has a named human responsible for it.
5. Fair. Credit, revenue, and recognition go to the people who did the work, and no one games the system to take more.
6. Earned trust. Guild members bring their own clients. Their clients' data and reputation are in your hands. Treat both as you would want yours treated.

3. What is permitted

The Marketplace welcomes lawful, honest work in any vertical, including regulated ones, provided the safeguards in Section 5 are met. This includes:

• Vertical Domain Apps, Capability Packs, Flows, and templates for real businesses and organizations.
• Automation of routine correspondence, contracts, notices, statements, and reports.
• Outreach to people who are your customers, members, clients, or who opted in, or a B2B contact reached lawfully with a clear way to opt out.
• Records management packs, including retention schedules, holds, and disposition workflows.
• Packs serving nonprofits, shelters, community groups, and public agencies.
• AI-assisted drafting, with the disclosure rules in Section 6.
• Forking, remixing, and improving other authors' packs under their stated license, with credit.

4. What is prohibited (no exceptions)

Deception and fraud

• Generating fake or backdated records, invoices, receipts, credentials, certificates, licenses, medical or legal documents, or official-looking notices presented as genuine.
• Forging, pre-filling, or applying anyone's signature or consent without their action.
• Impersonating a government agency, court, bank, employer, or any organization or person you are not authorized to represent.
• Fake reviews, testimonials, endorsements, or case studies written in invented voices.
• Phishing, credential harvesting, or "look-alike" pages and messages.

Harmful contact

• Spam, or bulk email that violates CAN-SPAM, GDPR/PECR, or the recipient's stated opt-out.
• Robocalls, prerecorded or synthetic-voice calls, or texts without the consent the law requires (in the U.S., TCPA rules apply; Brazil and the EU have their own).
• Harassment, threats, or debt collection practices that intimidate or mislead.
• Caller-ID spoofing or hiding who is really calling.

Data abuse

• Collecting or enriching personal data through deception, or by scraping in violation of a site's terms or the law.
• Selling, sharing, or repurposing a client's or recipient's data outside what they agreed to.
• Building dossiers on private individuals.
• Using data to discriminate unlawfully (hiring, housing, credit, insurance, tenant screening) or to target people because of a protected characteristic.

Records integrity

• Packs designed to destroy, alter, or hide records that are under legal hold, audit, litigation, or a mandatory retention period.
• Disabling audit trails or changelogs in a way that lets someone conceal what happened.

Exploitation

• Targeting people in crisis (eviction, medical debt, homelessness, grief, cognitive decline) with deceptive offers or pressure.
• Pay-per-lead or call-tracking schemes that mislead the consumer about who they are talking to, or lead-farming from vulnerable populations.
• Anything that facilitates weapons, illegal drugs, human trafficking, child exploitation, or violence.

Marketplace abuse

• Uploading code or templates you do not have the right to distribute, or stripping another author's license or credit.
• Malware, hidden telemetry, undisclosed data exfiltration, or backdoors in a pack.
• Manipulating usage numbers, fake accounts, self-dealing, or synthetic document generation to inflate your share of the contributor pool.

5. Allowed with safeguards (high-risk domains)

These are legitimate and valuable, and they require more from the author:

Domain	Required safeguards
Clinical / health data	Declare what regulated data the pack touches (e.g., HIPAA). Author must state whether a BAA is needed. No PHI in sample data. Retention rules documented.
Legal, tax, accounting templates	Labeled as templates, not professional advice. Name a qualified reviewer or state that none was used. Jurisdiction clearly stated.
Voice, SMS, and broadcast	Consent capture built in, opt-out honored automatically, quiet hours, truthful caller identification, call logs retained.
Lead enrichment / prospecting	Lawful public sources only, source recorded per record, suppression list honored, deletion on request.
Vulnerable-population packs (seniors, shelters, homeless services, minors)	Data minimization by default. No resale or advertising use of client data. Plain-language consent. Staff-access logging.
Hiring and screening	No automated reject decisions. Criteria documented and job-related. Human review of every adverse outcome.
Financial / billing	Clear pricing and cancellation terms. No hidden fees. Records match the real transactions.
Cross-border data	Declare data residency. EU personal data handled per GDPR on the EU-region server.

6. AI-assisted content

• Documents drafted with AI are permitted. The human sender is responsible for accuracy and for anything sent in their name.
• Do not present AI-generated content as written by a named person who did not review and approve it.
• Do not present a synthetic voice as a live human when someone asks, or when the law requires disclosure.
• Do not use AI to fabricate facts, citations, quotes, or credentials.
• Packs that generate advice-like output (legal, medical, financial) must include a visible limitation notice.

7. Contributor conduct and credit

• Declare your sources, licenses, and any AI assistance in the pack's README.
• Credit prior authors. Forks keep upstream attribution.
• Do not claim endorsement by DataPublisher, Microsoft, or any client without written permission.
• Disclose known defects and security issues in your pack promptly. Maintainers fix or withdraw abandoned packs that handle sensitive data.
• Be decent to each other. Mentors and apprentices especially: no harassment, no gatekeeping, no using apprentices as unpaid labor outside the program's terms.

8. Revenue pool integrity

The contributor pool rewards real usage, support, and new features. It does not reward volume for its own sake.

• Usage that is generated by the contributor, or by accounts they control, does not count.
• Test, demo, and duplicated document generation is excluded from pool metrics.
• Support credit requires resolved cases, verified by the customer or an admin.
• Attempts to game the pool result in forfeiture of that period's share and may result in removal.
• The formula and its changes are published to the Guild in advance.

9. Review, enforcement, and appeal

At submission: structural checks are automated. Human approval is required before a pack is published, with extra review for anything in Section 5.

If a concern is raised:

1. Notice. The author is told what the concern is and given a reasonable time to respond, except where there is imminent harm.
2. Interim action. A pack may be unlisted or paused while it is reviewed. Packs are deprecated, never silently deleted, so client records stay intact and traceable.
3. Outcomes. Correction, warning, suspension of payouts, removal of the pack, or removal from the Guild.
4. Appeal. The author can appeal to someone who was not involved in the first decision.

Immediate removal applies to fraud, malware, illegal content, and anything that puts people at active risk.

10. Reporting

Anyone, including recipients of documents, calls, and email sent through DataPublisher, can report a concern to: legal@datapublisher.io. Reports can be confidential. Retaliation against a good-faith reporter is itself a violation.

11. Living document

This statement is reviewed at least once a year and after any serious incident. Changes are announced to Guild members before they take effect, with the revision date and a summary of what changed.