Acceptable Use Policy
Version 1.0 · last updated 30 September 2026
§ 1 Scope
1.1 This Acceptable Use Policy (the "Policy") sets out how Strom, the decision API of Uprelic GmbH, Liebenwalder Straße 16, 13347 Berlin, Germany ("Uprelic", "we"), may and may not be used. "Strom" or the "Service" means the API at api.uprelic.com, the console at platform.uprelic.com (including the playground) and the models made available through them.
1.2 This Policy applies to you as our customer, to every person you let use the Service (your employees, contractors and other users), and to anyone who sends requests with one of your API keys. You are responsible for their compliance as for your own. Strom is offered to businesses only.
1.3 This Policy forms part of the Terms of Service. A breach of this Policy is a breach of the Terms. Where the Terms define a term, it has the same meaning here.
1.4 This Policy adds to applicable law; it does not replace it. Examples given in this Policy are illustrations, not a complete list.
§ 2 Lawful use and the rights of others
2.1 You may use Strom only for lawful purposes. You must not use it to commit, prepare, facilitate or conceal an unlawful act, in particular fraud, discrimination prohibited by law, or the evasion of sanctions.
2.2 Your inputs. You may send Strom only content you are entitled to have processed for your purpose. This covers the text or JSON you send as state, the questions you ask, and every image you send or link to. You must not send content that infringes the intellectual property rights, trade secrets or personality rights of others.
2.3 Personal data. If your inputs contain personal data, you are responsible for having a legal basis for that processing, for informing the people concerned where the law requires it, and for any other duty that data protection law places on you. You must not send personal data you have no right to process.
2.4 Special categories of data. You may send special categories of personal data within the meaning of Art. 9 GDPR (for example data concerning health, biometric data used to identify a person, or data revealing racial or ethnic origin, political opinions, religious beliefs or sexual orientation) only if you have a legal basis for it and have checked that using Strom for that purpose is appropriate.
§ 3 Prohibited content and child safety
3.1 You must not use Strom to create, classify, rank, filter or otherwise process content in order to produce, distribute or promote:
- child sexual abuse material or any content that sexualises minors, including content that is artificially generated or altered;
- content that supports or incites terrorism or violent extremism;
- content that incites hatred or violence against people or groups, where unlawful;
- intimate images of real people shared or created without their consent.
3.2 Detecting, filtering, moderating, reporting or removing such content — for example as part of a lawful trust-and-safety process — is permitted, provided you are entitled to handle the material and comply with the law that applies to it. For child sexual abuse material in particular, you must not send the material itself to Strom unless you are legally permitted to do so.
3.3 You must not use Strom to support the development, production or use of weapons, including chemical, biological, radiological or nuclear weapons.
§ 4 Security and abuse of the Service
4.1 No probing or attacks. You must not scan, probe or test the Service for vulnerabilities, carry out penetration tests or load tests against it, or attempt to bypass its authentication, without our prior consent in text form.
4.2 Limits and keys. You must not circumvent the limits that apply to your account (such as requests per minute, concurrent requests, questions and images per request, and the model's context limit), whether by technical means, by spreading traffic across several accounts, or by sharing API keys with other accounts or organisations in order to exceed those limits. You must keep your API keys secret. If you believe a key has been exposed, revoke it in the console without delay.
4.3 No interference. You must not use the Service in a way that impairs its operation or its availability for other customers, for example by deliberately triggering errors, sending inputs designed to crash or overload the model, or generating artificial load.
4.4 Image URLs. When you send an image as an http(s) URL, our servers download it. You must not use this to make our servers request addresses you are not entitled to access, to scan or attack third-party systems, or to probe our own network.
4.5 Other customers. You must not access, or attempt to access, the accounts, API keys, requests or responses of other customers.
4.6 Accurate requests. You must not falsify or disguise the origin of requests in order to evade our abuse prevention or billing.
4.7 Reporting vulnerabilities. If you find a vulnerability, report it to us at security@uprelic.com (§ 10). Do not exploit it beyond what is strictly necessary to demonstrate it, and do not access, change or keep data belonging to others. If you come across a vulnerability in the course of normal use and report it in line with this § 4.7, we will not treat that as a breach of this Policy. Active testing still requires our consent under § 4.1.
§ 5 Rules for the model and its outputs
5.1 No reverse engineering. You must not reverse engineer, decompile or disassemble the Service or the Strom model, or attempt to derive its architecture, parameters or non-public interfaces. Mandatory statutory rights, in particular under §§ 69d and 69e of the German Copyright Act (UrhG), remain unaffected.
5.2 No extraction. You must not attempt to extract the model's weights or its training data, including by sending large numbers of systematically varied requests intended to reconstruct the model or recover the data it was trained on.
5.3 No competing models. You must not use outputs of Strom, or data derived from them, to develop, train, fine-tune or distil a model or AI service that competes with Strom, or to build a dataset for that purpose.
5.4 Outputs are predictions. Strom returns model predictions with probabilities. They can be wrong. You decide how to act on them, for example which thresholds to apply and when a person reviews a result. You must not present Strom's outputs as decisions or assessments made by a human where that would mislead the people affected.
§ 6 Decisions about people
6.1 You must not use Strom as the sole basis for a decision about a natural person that produces legal effects concerning them or similarly significantly affects them (Art. 22 GDPR), unless the decision is subject to meaningful human review. Meaningful review means a person with the competence and authority to assess the output, and to disregard or change the result, actually looks at the case before the decision takes effect.
6.2 Where the law gives the people affected a right to human intervention, to express their point of view or to contest a decision, you are responsible for providing it.
6.3 § 2.4 applies to special categories of personal data.
§ 7 EU AI Act: prohibited practices and high-risk areas
7.1 Prohibited practices. You must never use Strom for a practice prohibited under Art. 5 of Regulation (EU) 2024/1689 (the "AI Act"), as amended. This includes in particular:
- manipulative or deceptive techniques, or the exploitation of vulnerabilities due to age, disability or social or economic situation, that materially distort a person's behaviour and cause or are likely to cause significant harm;
- social scoring, that is, evaluating or classifying people on the basis of their social behaviour or personal characteristics with unjustified or disproportionate detrimental treatment;
- assessing or predicting the risk that a person will commit a criminal offence based solely on profiling or personality traits;
- untargeted scraping of facial images from the internet or from CCTV footage to create or expand facial recognition databases;
- emotion recognition in the workplace or in educational institutions, except for medical or safety reasons;
- biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;
- real-time remote biometric identification in publicly accessible spaces for law enforcement purposes.
This prohibition applies as a contractual rule, whether or not the AI Act applies to you directly.
7.2 High-risk areas. You must not use Strom in any of the high-risk areas listed in Annex III of the AI Act. These are:
- biometrics: remote biometric identification, biometric categorisation according to sensitive or protected attributes, and emotion recognition, to the extent not already prohibited under § 7.1;
- critical infrastructure: safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity;
- education and vocational training: decisions on access, admission or assignment, the evaluation of learning outcomes, the assessment of the appropriate level of education, and the monitoring of students during tests;
- employment, workers management and access to self-employment: recruitment and selection, including placing targeted job advertisements and analysing, filtering or evaluating applications; decisions on the terms of work relationships, promotion or termination; the allocation of tasks based on individual behaviour or personal traits; and the monitoring or evaluation of the performance and behaviour of workers;
- access to essential private and public services and benefits: assessing eligibility for public assistance benefits and services, including healthcare services; evaluating the creditworthiness of natural persons or establishing their credit score; risk assessment and pricing in relation to natural persons for life and health insurance; and evaluating and classifying emergency calls, dispatching emergency first response services, and emergency healthcare patient triage;
- law enforcement;
- migration, asylum and border control management;
- administration of justice and democratic processes, including influencing the outcome of elections or referendums or the voting behaviour of natural persons.
7.3 Safety components and regulated products. You must not use Strom as a safety component of a product, or as a product in itself, that is covered by the Union harmonisation legislation listed in Annex I of the AI Act — for example medical devices and in vitro diagnostic medical devices, machinery, toys, lifts or vehicles. In particular, you must not use Strom for medical or clinical decisions.
7.4 You are the deployer; no change into high-risk. You are the deployer of any AI system you build with Strom. Strom is not intended for any high-risk use, and within the meaning of Art. 25 (2) of the AI Act we specify that it is not to be changed into a high-risk AI system. You must not modify Strom or a system built with it, or use either of them, in a way that would make the resulting system a high-risk AI system within the meaning of Art. 6 of the AI Act. The Service has not been developed, tested or assessed for conformity as a high-risk AI system.
§§ 7.2 to 7.4 apply as contractual rules, whether or not the AI Act applies to you directly.
7.5 Surveillance. You must not use Strom for the surveillance or tracking of individuals.
§ 8 Images
8.1 You may send images to Strom to have questions about them answered. You must not use Strom to:
- identify or verify a person by their face, body or other biometric features;
- recognise or infer the emotions of people at work or in education;
- monitor, track or profile individuals, including building profiles of people from images.
8.2 You must be entitled to use every image you send, including images of identifiable people (§ 2).
§ 9 Benchmarks
9.1 You may publish benchmarks or comparisons of Strom, provided you state the model and the date tested, describe your method and data in enough detail for others to understand the results, and do not present the results as ours. § 5 applies to the test data and outputs.
§ 10 Reporting violations
10.1 If you become aware of a use of Strom that breaches this Policy, including a suspected misuse of your own API keys, please tell us at abuse@uprelic.com. Describe what happened, when, and, where possible, the account or key concerned. Anyone may report, with or without an account.
10.2 You must tell us without undue delay if you know or suspect that one of your API keys is being used in breach of this Policy.
§ 11 Enforcement
11.1 If we have reasonable grounds to suspect a breach of this Policy, we may take the following measures, choosing the mildest one that is effective in the circumstances:
| Step | Measure |
|---|---|
| 1 | A warning asking you to stop or remedy the breach within a reasonable period |
| 2 | Suspension of individual API keys, of playground access, or of the whole account |
| 3 | Termination of the contract in accordance with the Terms |
11.2 We may skip the warning and suspend access immediately where the breach is serious, in particular under § 3, § 4 or § 7.1, where immediate action is needed to prevent harm to others or to the Service, or where the law, a court or an authority requires it.
11.3 We will tell you the reason for a measure, unless the law prevents us from doing so, and we will lift a suspension once the reason for it no longer applies. You can object to a measure at appeals@uprelic.com; a person will review your objection.
11.4 We cooperate with authorities and disclose information to them where we are legally required to do so.
11.5 Your other rights and obligations, including payment obligations and what happens to any unused balance, are governed by the Terms. Statutory rights and claims remain unaffected.
§ 12 Versions and changes
12.1 Each version of this Policy carries a version number and a date.
12.2 We may change this Policy in accordance with the change procedure in the Terms, for example to reflect changes in the law, new features or new risks. The version that applies to you is the one in effect for you under that procedure.