Legal

Version 1.0 — 17 August 2026 — De Buck Technologies, Belgium (the "Operator"). Contact: contact@elephantpool.ai

A. API Services Agreement

A.1 Who we are, what this is

These terms govern access to the ElephantPool inference API (the "Service"), operated and sold by De Buck Technologies, Belgium, acting in its own name as the sole contracting party ("merchant of record"). The Service executes requests against open-source / open-weight AI models on infrastructure operated by the Operator and by independent third-party suppliers under the Operator's control framework. You contract only with the Operator.

A.2 Early access

The Service is in early access: capacity, model catalog, pricing and features may change with short notice; no service levels are guaranteed unless separately agreed in writing (SLA addendum for business customers on request).

A.3 Accounts, credits, billing

• Usage is metered per token at the prices published at elephantpool.ai/#models at the time of each request, and is debited from prepaid API credits.
• API credits: denominated in EUR, purchasable via our payment processor (Stripe), usable only to pay for the Operator's own services, non-transferable between accounts, never redeemable with third parties. Unused credits are refundable to the original payment method on simple request, less payment-processing costs. Credits are not e-money, not a deposit and bear no interest.
• You are responsible for keeping API keys confidential; usage under your keys is attributed to you. Spend limits can be set per key.

A.4 Acceptable use

You may not use the Service for unlawful content or activity, to violate third-party rights, to attempt to attack or probe the network or its suppliers, or in breach of the licenses of the underlying models (linked per model in the catalog). We may filter, suspend or terminate abusive traffic.

A.5 Data protection & confidentiality

• Prompts and outputs are processed transiently in memory for the sole purpose of executing your request; they are not written to persistent storage and not used to train models.
• Billing records retain only quantitative metadata (token counts, timestamps, model, cryptographic digests) — never content.
• The EU-Sovereign tier, when selected, restricts execution to attested or contractually bound machines physically located in the EU. A standard Data Processing Agreement (art. 28 GDPR) is available for business customers on request.

A.6 Output & IP

As between you and the Operator, you own your prompts and the outputs generated for you, subject to the applicable open-model licenses. Outputs are generated by statistical models and are provided without warranty of accuracy; you are responsible for reviewing them before use.

A.7 Liability

To the maximum extent permitted by law, the Operator's aggregate liability under this agreement is capped at the amounts you paid for the Service in the 12 months preceding the event; indirect and consequential damages are excluded. Nothing limits liability for fraud or wilful misconduct.

A.8 Term, changes, law

Either party may terminate at any time; unused credits are refunded per A.3. We may amend these terms with 30 days' notice (continued use constitutes acceptance). Belgian law applies; courts of Belgium have exclusive jurisdiction, without prejudice to mandatory consumer protections of your country of residence.

B. Host Supplier Agreement

B.1 Nature of the relationship

By operating the mahout agent, you act as an independent supplier of computing services to the Operator. This agreement is a services contract: it is not employment, not a partnership, not an investment, and confers no right to profits, interest or returns on capital. You bring hardware you already own or lawfully control; you are paid only for metered work actually performed and verified.

B.2 Your obligations

• Use only hardware and electricity you are entitled to use; comply with your local laws (including any house rules or landlord/electricity constraints that apply to you).
• Run only unmodified, signed versions of the mahout agent; do not attempt to manipulate benchmarks, receipts or verification.
• Keep your payout and identity information accurate; identity verification is performed by our payment processor (Stripe) and is a condition of payout.

B.3 Work, verification, pay

• The network routes inference (and, later, training-support) jobs to your machine based on its measured capabilities. No volume of work is guaranteed; estimates shown anywhere are illustrative only.
• Pay: 80% of the published token revenue of each job your machine serves and that passes verification, credited to your balance with a signed receipt you can independently verify against the public anchor.
• Payouts: monthly by SEPA transfer via Stripe once your balance reaches €50. Amounts for jobs that fail cryptographic verification, or that result from manipulation, are withheld; manipulation leads to termination and forfeiture of unpaid manipulated amounts.
• Self-billing: the Operator issues a monthly statement/self-billing invoice on your behalf summarizing services rendered.

B.4 Taxes & status

You are responsible for the tax and social-security treatment of your earnings in your country. Notice for Belgian residents: recurring monthly earnings are likely to qualify as professional income (requiring self-employed status, e.g. "à titre complémentaire", and an enterprise number) rather than occasional "revenus divers"; consult your accountant. The Operator provides an annual earnings statement.

B.5 Safety & software

The agent is open source and runs inference engines in sandboxed containers with no network egress; it never executes client code. It may download signed model weights and engine images (disk quota you control) and applies signed automatic updates. You can pause or uninstall at any time; draining running jobs cleanly is appreciated and reflected in your reputation score.

B.6 Liability, term, law

The Operator is not liable for hardware wear, electricity costs or lost earnings expectations; your sole remedy for payment disputes is the receipt-based reconciliation process. Either party may terminate at any time; verified unpaid balances above €10 are paid out at the next cycle. Belgian law applies; courts of Belgium, without prejudice to mandatory protections of your habitual residence.

C. Privacy Policy

C.1 Controller

De Buck Technologies, Belgium — contact@elephantpool.ai. This policy covers the website, the API and the mahout agent.

C.2 What we process

• Account data (clients & hosts): email, name/company, country, hashed credentials. Legal basis: contract.
• Payment & identity data: processed by Stripe as independent processor/controller for payments and host identity verification (KYC); we store only tokenized references and payout status. Legal basis: contract, legal obligation.
• Usage metadata: token counts, model used, timestamps, latency, cryptographic receipt digests — required for billing, payouts and fraud prevention. Retained 7 years (accounting law). Legal basis: contract, legal obligation, legitimate interest (fraud prevention).
• Host telemetry: hardware inventory, benchmark results, temperatures/load, availability — required to schedule and pay for work. Legal basis: contract.
• Prompt/output content: not stored. Content exists transiently in memory on the gateway and the serving machine and is never logged, retained or used for training.
• Website: no analytics trackers, no advertising cookies; localStorage holds only your theme and language preferences.

C.3 Recipients & transfers

Processors: Stripe (payments/KYC), EU hosting providers for the control plane. Standard-tier inference may execute on supplier machines inside or outside the EU; the EU-Sovereign tier guarantees EU-only execution. We do not sell personal data. Public blockchain anchors contain only cryptographic digests, never personal data or content.

C.4 Your rights

Access, rectification, erasure, restriction, portability and objection per GDPR arts. 15–21, via contact@elephantpool.ai. You may lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be / gegevensbeschermingsautoriteit.be).