Acceptable Use Policy
| Field | Value |
|---|---|
| Version | 1.1 |
| Effective date | 17 October 2026 |
| Last revised | 17 October 2026 |
| Approved by | Substrate Artificial Inteligence, S.A. |
| Contracting entity | Substrate Artificial Inteligence, S.A. |
The full version history is available in the Legal document changelog.
This Acceptable Use Policy sets out what may not be done with Serenity Edge. It forms part of the Terms of Service and applies to every Customer, whichever access route it uses, and to every person that uses the Services through a Customer's API Keys or Customer Offerings. Capitalised terms have the meaning given to them in the Terms of Service.
Substrate AI does not read the Inputs or Outputs of its Customers and does not apply content filters to requests. This policy therefore relies on the Customer's own compliance, on reports from third parties and on the technical signals that the Services record.
1. Prohibited uses
You must not use the Services, and must not allow your End-Users to use them:
- For illegal purposes. To engage in, promote or facilitate any activity that is unlawful in Spain, in the European Union or in the jurisdiction where you or your End-Users are located, including fraud, the sale of illegal goods or services and the evasion of sanctions or export controls.
- To generate child sexual abuse material. To generate, describe, request or distribute any content that sexualises minors, in any form, or any other content that exploits or endangers children. Substrate AI reports such conduct to the competent authorities.
- To infringe the rights of others. To generate or distribute content that infringes intellectual property rights, privacy or personality rights, trade secrets or any other right of a third party, or to submit Inputs that you have no right to use.
- To harm people. To generate content that incites violence, hatred or discrimination against a person or a group on the basis of a protected characteristic, that harasses, threatens or defames an individual, or that provides instructions for causing serious physical harm, including the development of weapons capable of mass casualties.
- To conduct unlawful surveillance. To identify, track, profile or monitor individuals without a lawful basis, including biometric identification and the inference of protected characteristics, or to process Personal Data in your Inputs without the lawful basis, information and safeguards that the GDPR requires.
- To deceive. To impersonate a person or an organisation, to generate spam, phishing or disinformation, to manipulate elections or to present an Output as the work of a human where the law or the context requires disclosure that it was generated by a machine.
- To attack information systems. To generate or deploy malware, to discover or exploit vulnerabilities in systems you are not authorised to test, or to facilitate unauthorised access to systems, accounts or data.
- For practices prohibited by the AI Act. To build or operate an artificial intelligence system that engages in any of the practices prohibited by Article 5 of Regulation (EU) 2024/1689, such as manipulative or exploitative techniques that cause significant harm, social scoring by public authorities or untargeted scraping of facial images.
2. High-risk and regulated uses
The Services are general-purpose. Where you use Outputs in a context that the law treats as high risk, you are responsible for the safeguards that context requires:
- If your Customer Offering is a high-risk AI system under Annex III of the AI Act, you bear the obligations of a provider or a deployer of such a system, including risk management, human oversight, logging and conformity assessment. The Services do not provide those safeguards on your behalf.
- Outputs are not a substitute for professional medical, legal, financial, engineering or safety advice. Where your Customer Offering touches those domains, a qualified person must review the Output before it is relied upon.
- You must not use Outputs to take decisions that produce legal effects on individuals or similarly significantly affect them without the human involvement and the rights that Article 22 of the GDPR and the applicable sector law require.
3. Technical restrictions
You must not:
- Circumvent or attempt to circumvent rate limits, capacity controls, authentication or metering, including by distributing traffic across multiple API Keys or accounts to evade a limit;
- Share an API Key outside your organisation, embed it in client-side code or publish it;
- Attempt to extract, reconstruct or derive the weights, parameters, architecture, training data or serving configuration of any Model, whether through Outputs, through timing or error analysis or by any other means;
- Systematically harvest Outputs to train, distil or build a model or a service that competes with the Services, unless you hold a licence that expressly allows it;
- Send traffic designed to degrade or disrupt the Services, or perform vulnerability, penetration or load testing of the Services without Substrate AI's prior written authorisation;
- Resell raw access to the API without an agreement with Substrate AI. Building and operating Customer Offerings on top of the Services is permitted.
4. Open-weight model licences
The Documentation identifies, for each Open Model, the licence under which its author published it. Where that licence imposes conditions on the use of the model or of its outputs, such as attribution, use restrictions or notice requirements, you must comply with them in addition to this policy.
5. Transparency and your obligations as deployer
Where you make Outputs available to End-Users or to the public, you are responsible for the transparency obligations that apply to you under Article 50 of the AI Act and any other applicable law, including informing End-Users that they are interacting with an artificial intelligence system where that is not obvious, and marking artificially generated text, images, audio or video as such where the law requires it. You are also responsible for the other obligations that apply to you as a deployer, such as using the Services in accordance with the Documentation, ensuring appropriate human oversight and informing the persons affected where required.
6. Responsibility for End-Users and personal data
You are responsible for your End-Users and for the Customer Offerings through which they use the Services. You must ensure that your End-Users comply with this policy, and you must be able to suspend an End-User that does not. Where your Inputs contain Personal Data, you are the Data Controller of that data: you must have a lawful basis for processing it, provide the information that data subjects are entitled to receive and, where you are a Commercial Customer, accept the Data Processing Agreement.
7. Enforcement
Substrate AI may investigate a suspected breach of this policy on the basis of Request Metadata, of reports received and of any content that a reporter provides, and may:
- Warn you and ask you to remedy the breach;
- Suspend one or more of your API Keys, or decline your requests where you access the Services through a Platform, with prior notice where practicable and immediately where the breach is serious, endangers people or threatens the Services; and
- Terminate the Agreement in accordance with Section 13 of the Terms of Service.
Substrate AI may also report unlawful conduct to the competent authorities and cooperate with their investigations, as the law requires.
8. Reporting abuse
To report a use of the Services that you believe breaches this policy, write to [email protected]. Because Substrate AI does not retain Inputs or Outputs, a report should include the content concerned and the circumstances in which it was generated.
9. Changes to this policy
Substrate AI may update this policy to reflect changes in the law, in the Services or in the risks they present. Changes are published with an updated version number and revision date and recorded in the Legal document changelog. Substantial changes are notified in accordance with Section 16 of the Terms of Service.