Acceptable Use

This Acceptable Use Policy (“AUP”) describes the prohibited and acceptable uses of the OneProvider gateway (the “Service”). This AUP is incorporated into the Terms of Service by reference. By using the Service you agree to comply with this AUP. We may modify this AUP from time to time; material changes are effective on posting with notice as described in the Terms of Service.

1. Prohibited Uses

You must not use the Service, and you must not permit others to use the Service through your key, for any of the following purposes:

1.1 Illegal activity

Facilitating, promoting or engaging in any activity that violates applicable local, national or international law — including fraud, extortion, identity theft, money laundering, the distribution of controlled substances, sanctions evasion or terrorism financing.

1.2 Child sexual abuse material (CSAM)

Generating, distributing, soliciting, retrieving or otherwise interacting with content that sexually exploits or endangers minors. This prohibition is absolute and applies regardless of whether the content is AI-generated or whether the depicted individuals are real or fictional. We report any detected CSAM to the relevant national authorities and, where applicable, to the National Center for Missing & Exploited Children (NCMEC) and the Internet Watch Foundation.

1.3 Spam, phishing and impersonation at scale

Generating unsolicited bulk messages, phishing payloads, romance-scam scripts, fake reviews, astro-turf campaigns or other content designed to deceive recipients about the sender’s identity or intent. Personal experimentation on your own consenting recipients is fine; outbound campaigns to non-consenting third parties are not.

1.4 Malware, exploits and cyberattacks

Generating, refining or distributing malware, ransomware, exploits, credential stuffers, DDoS-toolchain components, or code designed to gain unauthorized access to systems or to evade security controls. Legitimate security research, capture-the-flag training and authorized penetration testing are permitted; if your use case is borderline, message us at @Oneproviderhelpbot first.

1.5 Harassment, threats and targeted hate

Generating content that harasses, threatens, intimidates or incites violence against an individual or a group based on a protected characteristic, or generating credible doxxing material or threats of physical harm.

1.6 Deceptive synthetic media

Generating deepfakes of real people without their consent; synthetic political or news material designed to mislead about real events or real public figures; fabricated reviews, testimonials or evidence intended to defraud individuals or institutions.

1.7 Circumvention

Attempting to circumvent the access controls, content filters or rate limits of OneProvider, of any model provider or of any third-party system. This includes reverse-engineering API behaviour for the purpose of evasion, scraping model weights, rotating multiple keys to dodge rate limits or exploiting vulnerabilities in our infrastructure.

1.8 Intellectual-property violations

Generating content that infringes copyright, trademark, patent, trade-secret or other IP rights of a third party, or that circumvents digital rights management or content protection mechanisms.

1.9 Resale of the gateway as a wrapped product

Reselling, sub-licensing or rebranding the Service as your own gateway product without explicit written permission from OneProvider. Building a downstream product that uses the API as one of several components is fine and expected; directly white-labelling the gateway itself is not.

1.10 Multiple accounts, bonuses and the referral programme

The welcome bonus, first top-up bonus, review bonus and referral rewards are for one person and one cabinet. You must not: create or use several cabinets, sign-ins (Google, Telegram, email) or devices as one person to obtain a bonus or reward more than once; sign up with automated, disposable or third-party addresses; invite yourself, or another cabinet you control, through your referral link; give another person’s or a made-up marketplace order number for the review bonus; claim a bonus and then dispute or refund the payment. For a violation we may refuse a bonus or reward, revoke unused bonuses and rewards, deduct their equivalent from the cabinet balance, merge or close duplicate cabinets, and suspend or ban a cabinet. To check this we compare sign-in data: IP address, User-Agent, device cookie, sign-in method and verified email (see the Privacy Policy ). If you think a decision is a mistake (a shared IP, one family computer), contact support and we will review it manually.

2. Rate Limits

We enforce per-key rate limits to maintain fair access. Limits are set per key and may change; if you receive HTTP 429, reduce concurrency. Requests that exceed your allotment receive HTTP 429. Repeated and intentional circumvention — creating multiple keys solely to side-step a rate limit, rotating keys programmatically, distributing concurrent load across otherwise-isolated balances — is a violation of this AUP.

3. API Key Security

You are solely responsible for the security of your API key. You must:

• Keep the key confidential and never share it with parties who are not authorized to spend its balance.
• Never embed the key in client-side code, mobile applications shipped to the public, or any public repository.
• Store the key in a secret manager (environment variable, vault, 1Password CLI, AWS Secrets Manager) — never in plaintext on disk.
• Rotate the key immediately if you suspect compromise.
• Use separate keys for development and production where possible.
• Protect access to your cabinet: never share your password, and sign out on devices you do not control.

If a key is leaked, delete it in your cabinet and create a new one, or message @Oneproviderhelpbot and we will revoke it and re-issue it at no cost. You remain responsible for usage incurred prior to revocation, except where you can demonstrate that the unauthorized use occurred after you notified us and took reasonable mitigation steps.

4. Monitoring and Enforcement

We use automated metadata analysis and manual investigation of credible reports to detect violations of this AUP. This monitoring may include:

• Analysis of request metadata (model, token counts, request frequency) to identify anomalous patterns.
• Review of key activity flagged by automated abuse detection.
• Investigation of credible reports from users, third parties or law enforcement.

Enforcement relies on metadata and evidence supplied in reports. As noted in our Privacy Policy , OneProvider does not store or inspect prompt or response bodies for AUP monitoring.

5. Enforcement Actions

Where a violation is detected we may take one or more of the following actions:

• Warning. A written notice asking you to bring use into compliance.
• Temporary suspension. Restriction of the key or cabinet while we investigate.
• Rate-limit reduction. Lower the key’s rate-limit to mitigate abuse while permitting legitimate use to continue.
• Permanent revocation. Immediate revocation of the key, forfeiture of remaining balance, for severe or repeated violations.
• Revocation of bonuses. Cancelling credited bonuses and rewards and, for repeated violations, banning the cabinet.
• Referral. Report to law enforcement, a model provider, or a marketplace, where the violation involves illegal activity or harms a third party.

6. Reporting Violations

If you become aware of a violation of this AUP, please report it to @Oneproviderhelpbot . Include the approximate timestamp, screenshots, or sample output. If the key must be identified, use only the support bot's protected key-linking flow. We investigate all credible reports and keep reporters confidential to the extent permitted by law.

7. Policy Enforcement

We enforce our Acceptable Use Policy and may act on abuse and fraud signals from automated detection, user reports and law enforcement. As part of enforcement we may process the metadata necessary to investigate and address a policy violation.

8. Contact

• Telegram: @Oneproviderhelpbot
• Email: support@oneprovider.dev
• Legal entity: OneProvider Ltd., Trust & Safety, Nicosia, Cyprus. Full registered address available on written request via Telegram support.

OneProvider · API gateway

One rule: don't hurt people

Build on top of us. Don't spam, don't phish, don't generate CSAM. Security research welcome — tell us first.