Acceptable Use Policy of the MuninCloud Flexible API

This policy forms part of the Terms of Service of the MuninCloud Flexible API (clause 6.4). It applies to every request made with a key of the Customer's account, whether made by the Customer or by a third party to whom it gives access to its application.

1. What the API may not be used for

1.1. Nothing unlawful. Using the API for any purpose contrary to Spanish law, European Union law or the law applicable to the Customer, or to help commit an offence.

1.2. Prohibited AI practices. Using the API in any of the AI practices prohibited by art. 5 of Regulation (EU) 2024/1689 on artificial intelligence.

1.3. Child sexual abuse. Generating, requesting or processing any content that sexualises minors.

1.4. Harm to people. Harassing, threatening or impersonating a person, or deceiving people into believing they are talking to a person when they are talking to an AI system (art. 50 of the AI Act), as well as processing third parties' personal data without a legal basis that allows it.

1.5. Malicious code and attacks. Creating or improving malware, or preparing or carrying out attacks against other people's systems.

1.6. Third-party rights. Infringing intellectual or industrial property rights, trade secrets or image rights of third parties.

2. What may not be done against the API

2.1. Evading charges or limits. Tampering with calls to avoid paying for usage, to bypass the rate limit, the spending cap or the balance cap, or spreading usage across several accounts for that purpose.

2.2. Attacking the service. Probing, scanning or overloading the API or MuninCloud's infrastructure, or trying to access its systems, other accounts or the engines behind the API.

2.3. Sharing keys and resale. Publishing keys or sharing them outside the Customer's organisation. The Customer may offer the service to third parties within its own product (an application that uses the API underneath), but may never resell, assign or give third parties keys or direct access to the API.

2.4. Extracting the models. Trying to extract the weights or the configuration of the models or of the engine through the API.

3. Caps against abuse

3.1. Each account has a maximum number of requests per minute and may have a daily spending cap; both are shown in GET /v1/cuenta. They also limit the damage of a stolen key.

3.2. Bursts of malformed requests or of requests to routes that do not exist may cause the source IP to be blocked automatically by the perimeter defence systems (Terms, clause 9.4).

4. How usage is monitored without reading content

MuninCloud neither stores nor reads the content of requests or responses (Privacy Policy). It monitors usage through the metadata of each request (account, key, model, tokens, duration, response code and source IP address; Privacy Policy, 3.1, 3.2 and 3.5) and through the reports it receives from third parties or authorities.

5. What happens in case of breach

5.1. MuninCloud may immediately suspend the affected key or account, and close it if the breach is serious or repeated (Terms, clause 9).

5.2. The balance of a closed account is governed by clause 2.6 of the Terms.

5.3. MuninCloud will cooperate with the authorities when the law requires it.

6. Reports

To report misuse of the API: soporte@munincloud.com.

Updates

23 October 2026 — publication of the acceptable use policy of the MuninCloud Flexible API.