Draft · not in forceVersion 0.3Last changed 2026-09-20

Acceptable Use Policy

The marketing Troy will not do, and the marketing you may not ask it for. It covers this website today, and the platform and the agents from the day either exists.

Who this applies to
  • Anyone using this website
  • Clients of Troy’s team, and everyone they name to approve work
  • Anyone given access to the Troy platform or its agents, once those exist
  • Troy itself: its strategists, and every agent workflow running on a client’s accounts

In plain EnglishThis policy says what marketing Troy will and will not do. It binds you, and it binds Troy.

This is the Acceptable Use Policy for Troy. It applies to this website today. It applies to the Troy platform, the approval queue and Troy’s agents from the day any of them is available to you. It applies to every piece of marketing Troy’s strategists produce for a client, and to every piece of marketing you ask Troy to work on.

Troy
Troy Agency Inc., trading as Troy. The incorporation is in progress — federally, under the Canada Business Corporations Act, with its registered office in Ontario, at Unit 6, 10651 Keele Street, Maple, Ontario L6A 3Y9, Canada — and it has not completed, so there is no corporation number yet: To be completed: There is no corporation number yet, which means the federal incorporation has not completed. Until it has, Troy Agency Inc. is an intended name rather than a company: it cannot sign a contract, and calling itself “Inc.” in one would be wrong. This is the first thing to finish.. Until it does, “Troy” here means the people doing the work: its staff, its strategists, and any agent workflow running on a client’s accounts.
You, the Client
The person or company using this website, buying Troy’s work, or given access to the platform. Where the client is a company, this policy binds every person that company gives access to.
Connected account
An advertising, commerce, email or analytics account you own and give Troy access to. In the first version these are Meta, Google Ads, Shopify and Klaviyo.
Content
Anything written, made or published as part of your marketing: ad copy, creative, landing pages, emails, text messages, organic posts, and the claims inside them.
Campaign
Any marketing activity, paid or unpaid, run through a connected account or produced by Troy.
Agent
An AI workflow that drafts, builds or proposes work. An agent never approves its own work, and never publishes or spends without an approval.
Approval
A named person on your side agreeing, in the queue or in writing, to a specific thing being published or a specific amount being spent.

Terms defined here carry the same meaning wherever they appear below.

In plain EnglishMost of what this policy governs has not been built. It is written now so that it is not written under pressure later.

Troy is pre-launch. What you can buy today is a free Troy Score prepared by a strategist, a Fix Sprint, and a retainer where Troy’s team runs your marketing. The platform, the approval queue and the agents are being built. Agents open by invitation from 2027. The self-serve tier is a waitlist. The company itself is still being incorporated, so the party that would sign an agreement does not exist yet.

So this policy covers two things at once: the conduct Troy holds itself and its clients to on work happening by hand today, and the conduct that will be enforced in the product when the product exists. Nothing here describes a control that is already running in software. Where a rule depends on a feature that has not shipped, the rule still binds the people doing the work.

In plain EnglishThis policy sits under the contract you sign, and it is not legal advice.

Where you have a signed agreement with Troy, that agreement governs. This policy describes conduct. It does not change what you pay, how notice is given, or who is liable for what. Those are in the service agreement.

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in it, and a dispute about it belongs to the courts of the Province of Ontario, which is where the agreement you sign puts it too. That choice does not reach past itself: where the law where you or your audience are gives someone a protection that cannot be contracted away, this policy does not try to take it away. Consumer protection, advertising and contract rules differ by province and by state, and the stricter rule applies to the work.

Troy’s clients are in Canada and the United States. Troy does not offer its services to people in the European Union or the United Kingdom yet. It intends to work to whichever of the rules reaching a piece of work is the strictest. That is a statement of how Troy means to work, not a claim that Troy meets a standard, holds a certification, or has been audited against anything.

Working from Canada changes which rules reach Troy itself. Personal information handled in the course of commercial activity in Canada falls under PIPEDA, the federal Personal Information Protection and Electronic Documents Act, although a province with its own substantially similar law can displace it for activity inside that province — which of them applies to a given piece of work depends on the facts. The regulator is the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority. None of that is a claim that Troy meets PIPEDA today. It is where the questions get asked.

Neither of the representative requirements that come with selling into Europe has been met, because neither is a market Troy sells into. In the European Union: none appointed. Troy does not offer its services to people in the European Union, and will appoint a representative there before it does. In the United Kingdom: none appointed. Troy does not offer its services to people in the United Kingdom, and will appoint a representative there before it does. That is about who Troy sells to, not about who your audience is — where a campaign reaches people in the European Union or the United Kingdom, the GDPR and the UK GDPR reach that work, and the obligations land on you as the advertiser. Say so at the start if that is where your audience is, because it changes what Troy will agree to do.

Troy is Canadian. Its systems are not. This website runs on Vercel Inc., in Vercel's Washington, D.C. region (iad1), in the United States, so anything sent through it — the brief form included — leaves Canada and is held there, within reach of American law. That is worth knowing before you type anything into a form here. What is collected, where else it goes, and on what basis, is set out in Troy’s privacy policy rather than here.

In plain EnglishDo not use Troy to do something unlawful, deceptive or harmful. That is the whole policy. The rest is detail.

Do not use Troy, and do not ask Troy to do work, that is unlawful, deceptive or harmful to the people who will see it. This holds whoever the audience is, wherever they are, and whatever a platform would let you get away with.

  • Unlawful means unlawful where the audience is, not only where you are. A campaign that is fine at home and unlawful in the country you are advertising into is not acceptable here.
  • Deceptive means it would leave a reasonable person with a false impression. It does not have to be a literal lie. True sentences arranged to mislead are still deceptive.
  • Harmful means it works on someone’s situation — their health, their debt, their grief, their age — to make a sale.
  • Where two rules both apply, the stricter one applies to the work. Platform policy is a floor, not a ceiling.

In plain EnglishThe detailed list. If your campaign is on it, Troy will not run it.

The following is not acceptable, whether Troy produces it, an agent drafts it, or you produce it and ask Troy to run it. The list is detailed rather than exhaustive: something not named here is still caught by clause 2.

In plain EnglishSell what you are allowed to sell, where you are allowed to sell it.

You may not advertise through Troy anything you are not lawfully entitled to sell to the audience you are advertising to.

  • Goods or services that are unlawful where the ad will be seen.
  • Counterfeit goods, and anything that infringes someone else’s trade mark, copyright or design right.
  • Stolen, leaked or scraped personal data, and any list, tool or service built from it.
  • Weapons, explosives, controlled drugs, and unapproved medicines or medical devices, where advertising them is prohibited.
  • Regulated categories — alcohol, tobacco and vaping, gambling, credit and other financial promotions, health and supplements, crypto-assets, adult content, immigration and legal services — where you do not hold the licence, authorisation or platform certification the category requires. These categories are not banned. They need the paperwork, and Troy will ask to see it before work starts.
  • Multi-level marketing, lead generation for a product that does not exist, and any offer whose real product is recruiting more sellers.
  • Anything needing a permit, registration or professional qualification that you do not hold.

In plain EnglishNo invented results, no urgency that is not real, no reviews nobody wrote.

Deception is the failure mode Troy cares most about, because marketing makes it easy and profitable. None of the following is acceptable, in any channel.

Patterns Troy will not build or run
PatternWhat it looks likeWhy it is out
Unsubstantiated resultsRevenue, earnings, weight-loss, health or performance figures with nothing behind them.A claim you cannot evidence at the moment you make it is deceptive, even if it later turns out to be true.
Fake scarcityTimers that reset, stock counters that do not count stock, “closing tonight” on an offer that reopens weekly.It manufactures a pressure to buy that does not exist.
Invented reference pricesA “was” price the product was never sold at, or a sale that never ends.The discount is fictional, and in several markets — Canada’s ordinary selling price rules among them — that is separately unlawful.
Fake or incentivised reviewsReviews written by you, by an agency, by a generator, or bought. Reviews given in exchange for a positive rating.Fake reviews and testimonials are the subject of active enforcement in the United States, and reviews that do not come from real, independent users are reachable as false or misleading representations in Canada.
Testimonials nobody gaveQuotes attributed to a person who did not say them, or who was never a customer.It is a fabricated endorsement, and it is put in a real person’s mouth.
Hidden connectionsAn endorser who is paid, employed by you or related to you, without that being disclosed.The audience cannot weigh an endorsement it does not know is bought.
Hidden terms“Free” that needs a subscription, a trial that bills without clear notice, a cancellation route harder than the signup.The material condition is exactly the part being hidden.
Misleading deliverySender names, subject lines or headers that misrepresent who is writing or what is inside.It deceives before the message is opened, and accurate sender and subject information is a rule in every market summarised in clause 4.1.

Canadian law reaches this list as well, and from Ontario it reaches Troy. The Competition Act prohibits representations to promote a product or a business interest that are false or misleading in a material respect. It also sets rules on the ordinary selling price a “was” price has to be measured against, on prices advertised without the mandatory charges that will be added at the end, and on environmental claims, which have to rest on adequate and proper testing or substantiation carried out before the claim is made rather than assembled afterwards. The Competition Bureau enforces it and the monetary penalties are large. Whether a particular claim crosses a line depends on the claim and on who sees it, and that is a question for counsel — the patterns above are out either way.

Troy will not write, design or run any of these. Where an agent drafts something that falls into one of them, it is not approved, and the pattern goes into your brand rules so that it does not come back.

In plain EnglishBe who you say you are. Do not borrow someone else’s name.

  • Using a person’s name, face, voice, signature or likeness without their permission.
  • Using another company’s name, logo or marks beyond what comparative or descriptive use lawfully allows.
  • The name, livery or tone of a government department, regulator, public health body, court or emergency service.
  • Claiming a partnership, certification, membership, award or endorsement that does not exist — including “official partner”, “certified by”, “as seen on”, and badges nobody awarded.
  • Domains, sender addresses, social handles or app names chosen to be mistaken for someone else’s.
  • Presenting Troy as the client, or the client as Troy, to a platform, a supplier or an audience. Where Troy runs work on your behalf, the advertiser is you.

In plain EnglishSome audiences may not be built, and some ads may not be aimed.

Targeting is where marketing most often turns into discrimination. The advertising platforms already restrict it and so does the law. Troy applies both.

  • Targeting, excluding or segmenting people by racial or ethnic origin, religion or belief, health or medical condition, sexual orientation, sex life, trade union membership, political opinion, immigration status, genetic or biometric data, or criminal record — whether the person stated it or you inferred it.
  • Housing, employment, credit and financial-services advertising outside the restricted targeting those categories require.
  • Excluding a protected group from an audience, including by proxy: a postcode list, an interest or a lookalike seed chosen for what it stands for rather than what it says.
  • Targeting people by a sensitive inferred state — bereavement, addiction, debt, illness, pregnancy — in a way that reveals it to them or works on it.
  • Uploading a customer list that carries sensitive attributes, or building a custom audience out of data the person did not give you for that purpose.
  • Advertising into a country, state or category where you are not licensed or permitted to operate.

Where your audience includes California residents, sharing a customer list with an advertising platform for targeting can be a sale or a share under California law, and anyone who has opted out has to be excluded. Keeping that suppression accurate is your job. Troy will ask how you do it before an audience is uploaded.

Where your audience includes people in Quebec, the provincial private-sector privacy law as amended by Law 25 may apply as well, and it speaks to exactly this: consent for the use of personal information, and telling someone when technology is being used to identify, locate or profile them. Troy has not assessed whether it applies to you or to your customers, and this sentence is not that assessment. If Quebec is in the audience, put the question to your counsel before the audience is built rather than after.

In plain EnglishDo not aim marketing at children, and do not collect their data.

  • Marketing aimed at children where the law or the platform prohibits it, and age-restricted products advertised with creative built to appeal to children.
  • Collecting personal data from a child through a form, quiz or landing page Troy builds. In the United States this engages the rules on children under 13. In the European Union the age of consent for online services sits between 13 and 16 depending on the country. The United Kingdom applies its Age Appropriate Design Code to services likely to be accessed by children.
  • Running age-restricted campaigns without the age gate and the targeting floor the platform and the law require.
  • Using a child’s image or voice in creative without the verified permission of a parent or guardian.

If adults buy your product for children, that is fine. The line is who the marketing speaks to, and whose data it collects.

In plain EnglishHold the evidence before the claim runs, not after someone complains.

Every factual claim in your marketing needs evidence you hold at the time the claim is made. Troy keeps evidence on file for every claim it makes about its own work, and asks you to do the same for claims about yours.

  • A performance, health, safety, environmental or comparative claim needs the study, the test or the data behind it — and needs to say what was actually measured.
  • A claim about cause needs an experiment. Troy will report what changed without one. It will not say why.
  • Environmental claims, and “best”, “number one” and “fastest”, need a stated basis and a date.
  • If you cannot produce the evidence when it is asked for, the claim comes out. Troy does not run a claim on the understanding that the evidence will follow.

Keep that evidence for longer than the campaign runs. A complaint about an ad usually arrives once it has stopped, and a dispute about work done under the agreement belongs to the courts of the Province of Ontario, where the basic limitation period is two years from the day a claim is discovered and the ultimate one is fifteen years. Where your audience is elsewhere, the period is different again, and a regulator’s own window is not the same thing as a limitation period. Troy is not telling you how long to keep your records. It is saying that evidence which exists only while the campaign is live is evidence you will not have on the day it is asked for.

In plain EnglishYour list is your responsibility. Troy drafts email and text, never sends, and never imports a list.

Email and text are where marketing most often creates personal liability, so the division of labour here is deliberate and it is not negotiable.

In plain EnglishYou need the lawful basis, the consent and the record that proves it.

You are the controller of your marketing lists. You are responsible for having a lawful basis and, where it is required, consent, for every address and number on them, and for holding the record that proves it.

  • Consent has to have been given for marketing of the kind you are about to send, by the person you are about to send it to.
  • Consent bought, rented, scraped, swapped, inferred from a purchase on somebody else’s site, or collected for a different purpose is not consent.
  • The record is the point. Under CASL the person relying on consent has to be able to prove it, so a consent you believe you have but cannot evidence is, in practice, a consent you do not have.
  • Unsubscribes, opt-outs and do-not-contact records are honoured across every list and every tool, not only in the tool that received them.
  • Suppression lists are part of the list. A campaign that goes around one is not acceptable, whatever the reason.
  • A list that has not been mailed in a long time is not the same as a list that consented. Re-permission it first.
What the rules turn on, by where your audience is
Where your audience isWhat it turns on
European Union and United KingdomPrior consent for electronic marketing to individuals under the ePrivacy rules as each country implements them, and PECR in the United Kingdom, with a narrow existing-customer exception for similar products. A lawful basis under the GDPR or UK GDPR as well. A working unsubscribe in every message.
United States, emailUnder the CAN-SPAM Act, opt-out rather than prior consent, with strict rules on accurate headers and sender identity, a valid postal address in the message, and opt-outs honoured promptly.
United States, texts and callsPrior express written consent for marketing messages under the TCPA. Statutory damages run from $500 to $1,500 per unlawful message, which is why Troy writes no text messages at all in the first version of the product.
CaliforniaAll of the above, plus the right to opt out of the sale or sharing of personal information — which reaches custom audiences and advertising identifiers, not just web forms.
CanadaCASL: consent, express or implied, before a commercial electronic message goes out; identification of the sender, with contact details that stay live afterwards; and an unsubscribe that works and is acted on quickly. The burden of proving the consent sits with whoever is relying on it.
AustraliaUnder the Spam Act, consent, accurate sender identification, and a functional unsubscribe.

That table is a summary written to help you ask the right question, not an answer, and it is not a complete list of the regimes a single send can fall under. Where your own counsel disagrees with it, follow your counsel and tell Troy.

CASL, Canada’s anti-spam legislation, is set out at more length here for three reasons. It applies wherever you are, because what matters is that a commercial electronic message is opened on a computer in Canada. Troy works from Canada, so it is the regime Troy is nearest to. And Canada is one of the two markets Troy sells into, so it will reach a good share of the work. Three things have to be true of a commercial electronic message: somebody consented to it, it says who is sending it, and it carries an unsubscribe that works.

  • Consent is express or implied. Express consent is asked for in its own right and given, and it does not lapse on its own. Implied consent is narrower than it sounds: it comes from an existing business relationship — a purchase or a contract inside the last two years, an enquiry inside the last six months — or, in limited circumstances, from an address the person published or gave out conspicuously without saying they did not want to be contacted, where the message relates to their role. Implied consent runs out. A list worth having is built on express consent.
  • Identification means the message says who is sending it, and on whose behalf where that is somebody else, with a mailing address and a way to reach a person that still works for at least sixty days after the message goes out.
  • The unsubscribe has to be set out clearly in the message, able to be used without difficulty, and acted on promptly — the Act allows ten business days. It may not require the person to log in, reply to a human, or explain themselves.
  • The consent has to be provable by whoever relies on it, which means a record of who consented, when, how, and to what.

The penalties are the reason this is not a footnote. The administrative monetary penalties in CASL run to a maximum of $1 million for an individual and $10 million for an organisation, in Canadian dollars, per violation, and the Act also catches a person who aids, induces or procures a contravention — which is the position an agency that drafts a send can find itself in. That is why the questions in clause 4.2 get asked before Troy will write for a list, and why the answer sometimes ends the conversation.

Sending into other countries brings the equivalent obligations in the table above, and others this policy does not list. The shape is usually the same — a basis for contacting the person, an honest identification of who is writing, and a way out that works — but the detail, the exceptions and who is liable differ, and the strictest rule reaching a given message is the one that governs the work.

In plain EnglishTroy will not load a list, and will not work on one it has reason to doubt.

Troy never imports a marketing list on your behalf. Lists live in your own email tool, under your own account, and you load them.

Where Troy is asked to work on a list, Troy will ask where it came from, when consent was given, and what record you hold. If the answer is missing, vague, or describes a purchase, a scrape or a swap, Troy will decline to work on that list. This is not a judgement about you. Troy cannot verify a consent it never saw, and the liability for a bad send lands on the sender.

In plain EnglishNothing is sent without a named person approving the message and the audience.

Agents and strategists draft email and text. They do not send. Every send needs a named person on your side to approve the message and the audience, and to confirm that the audience has consented to receive it.

That confirmation is part of the approval and is recorded in the change log with who gave it. A draft written into your own email tool stays a draft until you send it. In the first version Troy writes no text messages at all, whoever asks.

The division is a legal one, not only a practical one. Under CASL the person who sends a message, or causes or permits it to be sent, is the one answerable for it, and the consent has to be held by them; the American, British and Australian rules put the obligation on the sender too, and several of them reach the people who helped as well. You are the sender, you hold the consent, and the decision to send is yours. Troy writes the draft and stops there — which is also why Troy is strict about what it will draft, since drafting is not a place to hide.

clause 7.3 applies to sends exactly as it applies to spend.

In plain EnglishThe platforms’ policies apply to your work and to Troy’s, and neither of us games the review.

Troy does not own the channels it works in. Meta, Google, TikTok and the rest set their own advertising rules, grant access at their discretion, and can withdraw it. That is a fact about the work, so it is written into this policy rather than discovered later.

In plain EnglishWhichever rule is stricter is the one that applies.

You and Troy both follow the advertising policies of every platform the work runs on: Meta, Google, TikTok, and any other platform a campaign touches. Where a platform’s policy is stricter than this document, the platform’s policy governs work on that platform. Where this document is stricter, this document governs.

Platform policies change without notice, and platform reviews are discretionary and have no deadline. Troy will tell you when a change affects your work. Troy cannot promise that a given ad will be approved, that an account will stay in good standing, or that any review will be decided within any period.

In plain EnglishNo tricks to get work past a reviewer that it would not pass on its merits.

Troy will not use, build or advise on any technique whose purpose is to get work past a platform review that it would not otherwise pass.

  • Cloaking: showing the reviewer one page and the audience another.
  • Bridge, doorway or gateway pages that hide the real offer behind an innocuous one.
  • Changing a landing page, an offer or a creative after approval into something the platform would not have approved.
  • Opening further accounts, pages, business managers or payment methods to get around a restriction, a ban or a spend limit.
  • Misrepresenting the business, the beneficiary or the payer during verification.
  • Hiding claims from review inside images, video frames, comments, link previews, or text rendered after the page loads.
  • Circumventing an age gate, a geographic restriction or a category certification.

When an ad is rejected, the answer is to fix the ad or to challenge the decision on the record. Troy will help with both.

In plain EnglishAI writes and builds. It does not pretend to be a person, and it never quietly becomes the endorsement.

Troy uses AI to draft copy, build creative variants and propose changes. That work is acceptable only inside the limits below, which apply to Troy’s agents and to anything made with AI that you bring to Troy.

  • No photoreal synthetic people presented as real. No AI-generated person shown as a customer, a member of staff, a doctor, an expert or a witness.
  • No synthetic voice presented as a real person’s voice, and no cloned voice of a real person without that person’s written permission.
  • No synthetic endorsements. A testimonial, review or customer story generated by a model is fabricated, whichever tool made it and however true it feels.
  • No consumer-facing chat agent talking to your customers as though it were a person.
  • AI-generated and AI-manipulated content is labelled where the law requires it. The label is shown in the approval queue before you approve, so you are approving the disclosure as well as the content.
  • No promise that AI output is owned outright or free of third-party risk. Purely AI-generated output is not straightforwardly protected by copyright in the United States, and vendor indemnities carry exclusions. The human approval step is part of what makes the work yours.
  • Troy will not agree to terms that let an AI vendor train on client content. The models it drafts with today come from OpenAI and Anthropic, and which plan each of them is used under has not been confirmed in writing — so this policy states the position Troy takes, not a guarantee about a vendor’s terms. Any benchmark across clients uses aggregate metrics under a separate opt-in, and that opt-in is never tied to a discount.

The European Union’s transparency rules on AI content reach companies outside the European Union, so “we are not based there” does not answer the labelling question. Where your audience is matters more than where you are.

How Troy discloses AI involvement, in its own marketing and in yours, is set out in Troy’s AI Disclosure document. Where that document and this one overlap, both apply, and the stricter reading wins.

Troy makes no commitment to any content-provenance or watermarking standard today. It labels AI-made work in the approval queue and tells the client what was AI-made. The label in the queue is the whole of it: there is nothing machine-readable behind it, and this policy does not claim otherwise. If a provenance standard matters to your brand, ask before the work starts rather than assuming it is there.

In plain EnglishConnect accounts you control, and let a real person approve what ships.

Troy works inside accounts that belong to you. Two things follow from that: you have to have the right to let Troy in, and the decision to publish or to spend stays with a named person on your side.

In plain EnglishYour accounts and your tokens stay yours, and you can cut Troy’s access yourself, whenever you want.

You may only connect, or add Troy to, an account you own or are authorised to administer. If you are an agency, a consultant or a group company acting for someone else, you need their instruction, and Troy may ask to see it.

  • Do not add Troy to an account belonging to a client, a partner or a former employer without their agreement.
  • Do not give Troy a shared password, a personal login, or any credential you are not permitted to share. Troy asks for named access, not passwords.
  • Do not use a Troy workspace to work on a business that has not agreed to it.

Your accounts, the data in them and the tokens that reach them are yours. You can revoke Troy’s access from your own accounts whenever you choose, without asking Troy first and without giving notice. Revoking access ends the work it supported. It does not erase the change log, which is permanent for both our sakes.

One thing about the group belongs here rather than only in a privacy policy. Troy, Louin and Lunari Group share systems and data. Client data is held on systems Lunari Group runs, and the companies in the group can see each other's data. So if you are also a customer of Louin, the fact that Troy and Louin are different companies does not keep your data on one side of a wall.

Under PIPEDA, using someone’s personal information for a purpose they were not told about when it was collected needs their meaningful consent. Reading a Louin customer’s orders, stock or margin data to market to them is that kind of new purpose. What would make the sharing lawful — an agreement inside the group, notice to the people whose data moves, a way for them to say no, and a record of what they agreed to — is not in place: To be completed: What makes the sharing lawful, and how is it disclosed? Under PIPEDA, using someone's personal information for a purpose they were not told about needs meaningful consent, and a Louin customer has not agreed to their data being used for Troy's marketing. This needs, at minimum: a written agreement inside Lunari Group, notice to the customers whose data moves, a way for them to say no, and a record of consent. This is the most serious open item on this page — the site now discloses the sharing, but disclosure alone is not a lawful basis.. This policy is telling you what happens. It is not telling you the sharing is consented to, covered by an agreement, or lawful.

Lunari Group is therefore a processor of client personal data, and it is named as one on Troy’s sub-processor list. If that is not an arrangement you want your data inside, say so before you connect an account.

In plain EnglishRead first, then draft, then act under a cap.

Access Troy asks for at each stage
StageWhat Troy asks forWhat Troy may write
ScoreRead-only access as a viewer on the accounts you want included, plus your public website.Nothing. A Score changes nothing in your accounts.
DraftPermission to write paused and draft objects.Paused ads and drafts only. Nothing goes live, and nothing spends.
ActPermission to make live changes, each one approved, under a hard spend cap.Live changes you approved, inside the cap, each written to a permanent change log and revertible.

Troy does not hold your media money. You pay the advertising platforms directly, and Troy takes no percentage of your spend.

Caps are hard. Work above the cap is refused, not queued for later. A revert restores a setting; it cannot return money that has already been spent, which is why anything that changes spend asks first.

In plain EnglishThe approval is the control. Do not automate it away.

Nothing reaches an audience and nothing spends money without a named human approving it. That rule is the product, not a setting inside it, and working around it is a breach of this policy however it is done.

  • Do not script, bulk-apply or otherwise automate approvals, and do not connect an automation that clicks approve on your behalf.
  • Do not share an approver login, so that an approval cannot be attributed to the person who gave it.
  • Do not set an approval policy on behalf of someone who has not agreed to carry that authority.
  • Do not approve work you have not read. An approval is a statement that a person looked.

An approval can wait for days without losing its state. Waiting is always an acceptable answer.

In plain EnglishKeep your login to yourself, and tell Troy if you think someone else has used it.

Keep your Troy login to yourself, use a password you do not use elsewhere, and tell Troy if you think an account has been used by someone else. Where to report that is in clause 11.

In plain EnglishRead the site, link to it, quote it. Do not hammer it or poke at it.

You are welcome to read this website, troy-agency.com, link to it, and quote it with attribution. The following is not.

  • Scraping the site, or copying it in bulk, by any method.
  • Automated access beyond a well-behaved crawler that identifies itself, respects robots.txt and keeps to a reasonable rate.
  • Probing, scanning or testing the site or any Troy system for weaknesses without written permission. Reporting something you came across is welcome. Going looking is not.
  • Circumventing a rate limit, an access control or an authentication step, or attempting to.
  • Uploading or transmitting malware, or anything built to interfere with the site or with another user.
  • Using the site’s forms to send anything to someone who did not ask for it, or to load data about a third party.

Troy holds itself to the same line in the other direction. Nothing Troy builds is based on scraping another company’s site, and Troy’s own research uses public data and the platforms’ own interfaces.

In plain EnglishThe Score formula is published on purpose. The product is not a starter kit for a copy of it.

Troy publishes the Troy Score formula and versions it. You may read it, argue with it, disagree with it in public, and apply it to your own accounts by hand. The do-it-yourself instructions in a Score are complete and free, and they stay that way. The diagnosis is never a paywall for the cure.

What is not acceptable:

  • Taking access to the platform, or taking a Score, principally in order to build or improve a competing product.
  • Extracting Troy’s reports, scores or agent output at scale, whether by automation or by volume of requests.
  • Reverse engineering, decompiling or deriving the source of any non-public part of the platform, except where the law gives you that right and you have told Troy first.
  • Reselling a workspace, or presenting Troy’s work to a third party as your own, without a written arrangement with Troy. Agencies and consultants are welcome here. The arrangement simply has to exist.
  • Using Troy’s name, marks or output to imply a partnership, a certification or an endorsement that has not been agreed.

In plain EnglishTroy raises it, then refuses or pauses the work, then ends the engagement. In that order, unless the law says otherwise.

A breach of this policy is usually a misunderstanding, not a plan, so the response starts with a conversation. It does not stay there if the same thing keeps happening.

In plain EnglishTroy starts at the lowest step that actually addresses the problem.

How Troy responds to a breach
StepWhat Troy doesWhat it means for the rest of the work
Raise itTroy names the specific thing in writing, to the person who approves work, and says what would resolve it.Nothing stops. Most things end here.
Refuse the workTroy declines the specific campaign, creative, audience, list or agent run, and says why.Everything else carries on. A refusal is about a piece of work, not about you.
Pause the workTroy stops the affected campaign or workflow. Where something is live and unlawful, Troy pauses first and explains immediately afterwards.The rest of the engagement continues while it is resolved.
End the engagementTroy ends the work with the reason in writing, and disconnects its access.The change log stays. What is payable, and how notice runs, is set by the service agreement, not by this policy.

For the middle steps, repetition matters more than severity. One mistake, fixed, is a mistake. The same thing three times is a decision.

Troy may refuse or stop any specific piece of work it reasonably believes breaches this policy. That judgement does not wait for proof, and Troy does not have to establish a breach before declining to do something. It does have to tell you what it refused and why, and a refusal that turns out to be wrong is put right rather than defended.

Some things cannot be handled privately. Where the law requires Troy to report something to an authority or to a platform, Troy will report it, and will tell you unless it is prohibited from telling you.

In plain EnglishSome work is refused before it starts, whoever asks and whatever the fee.

  • Sending an email or a text message on your behalf. Agents and strategists draft. A named person on your side sends.
  • Changing live spend unattended, at any size, in the first version of the product.
  • Importing a marketing list.
  • Making photoreal AI people or voices, or putting a chat agent in front of your customers.
  • Holding your media money, or taking a percentage of your spend.
  • Saying that the Troy Score predicts results, or that AI output is owned outright.
  • Anything in clause 3, however it is framed and whoever is asking.

A refusal is specific. Troy names the piece of work it will not do and why, and the rest of the engagement carries on.

In plain EnglishThis is a standard Troy holds to. It is not a guarantee about anybody else.

  • It does not move your compliance decisions onto Troy. Your products, your claims, your lists and your licences stay yours.
  • It does not promise that Troy will detect every breach. Troy reviews what it sees, and it does not see everything.
  • It does not give a third party a right to enforce it.
  • It does not replace platform policy, advertising codes, or the law where you or your audience are.

Troy acting on a breach, or failing to notice one, does not change what either party owes under the agreement.

In plain EnglishTell us. Security problems to one address, everything else to the other.

If you believe Troy, a Troy client, or something on this website is breaching this policy, report it.

  • Security problems — a vulnerability, a suspected breach, an account you think has been taken over: troy@louin.io.
  • Privacy — what Troy holds about you, or the sharing of data inside Lunari Group described in clause 7.1. No individual is named on this site. Privacy questions reach the person accountable for privacy at Troy through the address below: privacy@louin.io. You can also complain to the Office of the Privacy Commissioner of Canada. People in the EU or the UK may also complain to their own national authority.
  • Everything else — deceptive marketing, impersonation, a message you believe came from work Troy did, a campaign you think should not be running: troy@louin.io.

Include what you saw, where, and when, plus anything that would help find it again: a link, a screenshot, an ad library entry, the sender address, the message headers. If you received a message you did not consent to, say which address or number it reached.

Troy will not treat a report made in good faith as a breach of this policy, and will not ask you to keep the existence of a problem secret.

Formal legal notices about this policy do not go to the addresses above. They go to troy@louin.io.

In plain EnglishThis will change. The version history at the foot of the page is the record.

Troy will change this policy as the product grows and as the law moves. Every change is published here with a new version number and a date, and the version history at the foot of this page says what changed.

While this document is a draft it is being written rather than amended, and it is not in force. When it does come into force, that will be stated at the top of the page rather than buried down here.

Where a change adds a restriction that affects work already under way, Troy will tell clients before it applies to their work. How that notice is given, and how much of it is required, is set by the service agreement.

A change applies from the date it is published here, and it does not apply backwards to work Troy has already done, refused or approved. Using the site or the platform after that date means the published version applies to your use from then on. If a change is one you cannot accept, say so — the addresses are in clause 11 — and if you are a client you can end the engagement on the terms in the service agreement rather than be held to a rule you did not agree to.

Changes to this document
VersionDateWhat changed
0.320 Sep 2026Corrected against the answers the founder gave the same day. The passage saying Troy never assumes access to a sister company’s data is gone: Troy, Louin and Lunari Group share systems and data, Lunari Group runs the systems client data sits on, and what makes that lawful is not in place yet — the clause on connected accounts now says so. Troy sells in Canada and the United States only, with no representative appointed in the European Union or the United Kingdom. The incorporation has not completed, so no clause calls Troy a company that exists. The website runs in the United States. The AI vendors are named and their terms marked as unconfirmed. Still a draft, still not reviewed by a lawyer.
0.220 Sep 2026Troy incorporating in Ontario settled the governing law, the courts, the privacy regulator and the reporting addresses, so the blanks and the “not settled yet” notes carrying them are gone. CASL is now set out in full in the consent clause, with the Competition Act in the deceptive-claims clause, Quebec’s Law 25 in the targeting clause, and Ontario’s limitation periods in the substantiation clause. Still a draft, still not reviewed by a lawyer.
0.119 Sep 2026First draft, written alongside the site. Not reviewed by a lawyer.