Acceptable use

This policy sets out what you may not do with zdr.sh. It is part of the terms of service: breaching it is a breach of contract and may lead to the suspension or the ending of the contract. It applies to you and to anyone who uses the service through your account or your keys.

1. General principles#

Use the service lawfully, respecting the rights of others and the usage policies of the model providers. Do not use it to harm people, the service or third parties. If you are unsure about a use, ask us before you build.

2. Unlawful content and activities#

You may not use the service to:

• carry out or facilitate illegal activity, or help others break the law;
• generate, seek or distribute child sexual abuse material or material that sexualizes minors, in any form;
• glorify or promote terrorism, incite violence or hatred, or harass, threaten or defame people;
• generate intimate or realistic fake images, audio or video of real people without their consent;
• commit fraud, phishing, identity theft or scams, or impersonate other people or organizations;
• infringe copyright, trademarks, trade secrets or other third-party rights;
• process personal data without a legal basis, surveil people, collect their data indiscriminately or re-identify people from pseudonymized data;
• run disinformation or manipulation campaigns, including those about elections and referendums.

3. Prohibited and high-risk AI uses#

You may not use the service for AI practices that are prohibited outright, such as: subliminal or manipulative techniques that distort people's behaviour; exploiting vulnerabilities due to age, disability or social or economic situation; social scoring; predicting the risk that a person commits crimes based solely on profiling or personality traits; building facial recognition databases through untargeted scraping of images; emotion recognition in the workplace or in educational institutions, except for medical or safety reasons; biometric categorization to infer sensitive data; real-time remote biometric identification in public spaces for law enforcement.

You may not use the service in a high-risk AI system without our written consent, nor as the sole basis of decisions with legal or similarly significant effects on people, for example on employment, credit, insurance, health, education or access to essential services, without effective human oversight. Do not use it for life-critical systems or emergency services.

If people interact with a system of yours built on the service, or you distribute generated or manipulated content that may appear authentic, carry the transparency duties of Article 50 of the AI Act yourself, as section 8 of the terms states: the system tells people they are interacting with an AI, the synthetic content it generates is marked as artificially generated, and what you publish discloses that origin. Disclose it plainly in any case.

4. Security and integrity of the service#

You may not:

• create, distribute or improve malware, ransomware, exploits or attack tools, except lawful and authorized security research;
• probe, scan or test the vulnerability of the service or of other systems without authorization, bypass authentication or exploit a flaw instead of reporting it to us;
• overload the service or interfere with its operation;
• circumvent or try to circumvent rate limits, spending caps or security measures;
• decompile or reverse engineer the service, except within the mandatory limits of the law.

5. Keys, accounts and resale#

You may not:

• share, lend, sell or publish your keys or credentials; keep them out of client-side code and public repositories, and rotate at once any that leak;
• resell, sublicense or offer third parties access to the service or its APIs, including by embedding it in your product as a model access service, without a written agreement with us;
• scrape the website or the dashboard, or create accounts in an automated way;
• create several accounts or use false identities to obtain bonuses, promotions or referral rewards more than once, or refer yourself;
• use the service on behalf of people whose account we have closed.

6. Models and outputs#

Comply with the usage policies of the providers of the models you use. Do not use outputs to develop, train or improve competing models where the model provider forbids it, and do not try to systematically extract the model, its weights or its system instructions. Do not present generated content as written by a person where the law or the context requires its origin to be disclosed, and do not remove or alter the marking the service puts on an answer (the ai_generated field of its envelope and the x-ai-generated header) to pass it off as a person's. Article 50(4) of the AI Act requires that disclosure for content published to inform the public on matters of public interest; the rest of the time the context decides.

7. Spam#

Do not use the service to send or generate spam, unsolicited commercial messages, content to manipulate search engines, fake reviews or automated interactions posing as real people.

8. Enforcement#

We do not monitor content in general, but we check usage metadata and the reports we receive, including with automated checks. In case of a breach we may warn you, limit or revoke the keys involved, suspend the account or end the contract, in proportion to the seriousness of the breach. As a rule we warn you first; we act at once when people, the service or third parties are at risk, or when the breach is serious. We may report illegal content or activities to the authorities and cooperate with them, keeping the data needed within the limits of the law. You can contest a measure by replying to the notice: we review it and answer you.

When we suspend the account or end the contract, the notice we send you is the statement of reasons article 17 of Regulation (EU) 2022/2065 (the Digital Services Act) requires. It says the facts and the evidence the decision relied on, the ground in these terms or in the law, the measure and how long it lasts, and how to contest it. Our automated checks flag accounts for review; the decisions are taken by a person.

9. Reporting#

Report abuse, illegal content or vulnerabilities to support@rackduck.sh. If you find a vulnerability, report it to us instead of exploiting it and give us reasonable time to fix it before making it public. That address is also the contact point of the service, for the recipients of the service and for the authorities and the Commission, under articles 11 and 12 of the Digital Services Act: it is monitored every day.

10. Changes#

The version and date at the top identify the text in force; material changes are announced by email before they apply.