Acceptable Use Policy

This policy applies to everyone who uses the Rhodes API, the portal, or credit issued by us, and to anything sent through the API — including by your own end users.

It forms part of the Terms of Service. Breaching it is a breach of those Terms.

You are responsible for your end users. If your application lets other people send prompts through your key, you have to enforce equivalent rules on them.

Do not use the Service for anything unlawful in any jurisdiction that applies to you or to us, or to help anyone else do so.

This includes, without limitation: fraud, theft, money laundering, sanctions evasion, unlawful weapons development, drug trafficking, human trafficking, unauthorized access to computer systems, distribution of malware, and the infringement of intellectual property rights.

Do not use the Service to violate anyone's privacy rights, or to process personal data you have no right to process.

Do not use the Service to generate, request, solicit, describe, refine, or distribute child sexual abuse material (CSAM), or any sexualized depiction of a minor. This includes text, including fictional text, and includes attempts to elicit such content indirectly.

Do not use the Service to groom, sexually exploit, or endanger a minor.

Do not send protected health information, payment card data, government identity numbers, biometric identifiers, precise geolocation of identifiable individuals, or children's personal data.

We are not SOC 2 audited, not ISO 27001 certified, and not HIPAA compliant. Prompts are transmitted to third-party model-hosting providers. There is no business associate agreement and no DPA on offer today.

The provider that serves a request is our implementation detail. Customer-facing model names are brand-neutral by design.

Do not:

• Attempt to determine which upstream provider or model serves a request — including by probing, fingerprinting, or prompt-injection
• Publish or share any such determination, or any inference about our routing or pricing
• Use the Service to benchmark it against competing providers
• Use information obtained through the Service to negotiate directly with providers to bypass us
• Attempt to extract our system prompts, routing rules, or configuration

• Do not share, resell, sublicense, rent, or publish an API key
• Do not resell access to the Service without our written agreement
• Do not use another person's account or credentials
• Do not misrepresent your identity or create accounts using someone else's email

Do not attempt to obtain inference you have not paid for. Specifically:

• Do not exceed or evade the prepaid credit cap
• Do not evade per-key rate limits by rotating keys or distributing traffic
• Do not evade control-plane rate limits
• Do not forge or manipulate request headers to appear from a different IP address
• Do not interfere with metering or attempt to cause unmetered requests

Trial Credit Abuse

Trial credit is one grant per account, ever, and is capped per signup IP address. Do not:

• Create multiple accounts to obtain more than one trial grant
• Use proxies, VPNs, or hosting-provider IPs to evade the per-IP cap
• Automate account creation in any form
• Attempt chargebacks for credit you have consumed

We may withhold, withdraw, or claw back trial credit obtained in breach of this section.

Do not use the Service for:

• Medical diagnosis, treatment decisions, or clinical advice without qualified human review
• Legal, financial, or tax advice presented as authoritative
• Automated decisions with legal or significant effect (credit, insurance, employment, housing) without meaningful human review
• Law-enforcement, criminal-justice, or immigration decision-making
• Biometric identification, emotion inference, or social scoring
• Safety-critical control of vehicles, aircraft, medical devices, weapons, or critical infrastructure
• Political campaigning or targeted political advertising at scale
• Generating deceptive content where deception is the point: disinformation, impersonation, fake reviews, academic fraud
• Non-consensual intimate imagery or sexual content involving real identifiable people
• Harassment, stalking, threats, doxxing, or incitement to violence or self-harm
• Spam, bulk unsolicited messaging, or evasion of platform content moderation

What we can do:

• Suspend the account: Blocks your key at the gateway first so inference stops immediately, then refuses portal requests. No grace period.
• Revoke keys: Blocks specific keys at the gateway
• Claw back credit: A negative ledger entry with a note
• Report to law enforcement: Where required or permitted by law

We may act without prior notice where the breach is severe, where there is a risk to others, or where the law requires it. For less severe breaches we will normally contact you first.

A suspension is reversible. Contact support to contest one.

We do not retain prompt or response content. We therefore cannot retrospectively audit what you sent, and we cannot produce prompt content in response to a legal request unless it happens to be in a provider's possession.

There is no content filtering or moderation layer in our gateway. Any content moderation applied is whatever the upstream provider applies.

What we can see: per-request metadata (timestamp, model, token counts, cost), rate-limit and budget events, signup IP addresses, and funnel analytics.

Consequence: We can detect volumetric and economic abuse well, and content abuse essentially not at all, unless someone reports it. Most of this policy is enforceable on report or legal process, not proactively.