Prestance Lab ← Legal documents

Acceptable Use Policy

Version 1.8 · Last updated 2026-09-04 · legal@prestancelab.com

This Acceptable Use Policy (the “Policy”) sets the operational rules that bind the Customer, its Beneficiaries, and every Authorized User when accessing the Solution. It is incorporated by reference into the General Terms and Conditions at §4.2 and is binding on the same terms as the Agreement itself. Read together with the Data Processing Agreement and the Security policy, it defines the Solution’s instructions for use (as defined by Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, hereafter the “EU AI Act”).

1. Scope and definitions

This Policy binds the Customer, all Beneficiaries, and all Authorized Users as those terms are defined in the General Terms and Conditions (the “GTCs”). Capitalized terms used here without further definition have the meaning given to them in the Agreement.

Any breach of this Policy is a material breach of the Agreement and may trigger the remedies described in Section 8 below, including suspension, deployment of the circuit-breaker under GTC §4.6, and termination under GTC §12.2.

2. Intended purpose and permitted use

The Solution’s intended purpose, within the meaning of the EU AI Act, is to (i) assist Authorized Users in a sales-advisor role with clienteling tasks — knowing who to reach out to, preparing a client brief, capturing a debrief into a client file after a visit, drafting follow-up and outreach messages that the advisor sends from their own tools, keeping reminders and dates, and answering product and brand questions; (ii) provide voice-based practice simulations in which the Solution plays a client and gives the advisor private coaching feedback; and (iii) provide aggregated team signals — activity counts and recurring conversation patterns — to the Customer’s management. Use that deviates from this intended purpose is not compliant with the Agreement and may entail the qualification of the Customer as “provider” under Article 25(1)(c) of the EU AI Act, per GTC §3.2.

More specifically, the Solution does not pursue the objective of assessing the social value, trustworthiness, or general desirability of individuals. It supports the advisor’s own client work, generates simulated conversational interactions for practice, and limits any feedback to predefined professional competencies and practice metrics (e.g., communication effectiveness, objection handling, adherence to the Customer’s service standards, or product knowledge).

The scoring or performance indicators generated in practice sessions are therefore limited in scope and context, are visible to the advisor only, and should be understood solely as pedagogical indicators intended to support the advisor’s own skills development. Management receives counts and patterns, never an individual’s scores, transcripts, or words.

In particular:

3. Prohibited content

The Customer, its Beneficiaries, and Authorized Users will not submit to the Solution, generate through the Solution, or use the Solution to disseminate any of the following:

  1. Illegal content.
  2. Harassment, discrimination, hate speech, or content that incites violence against any individual or group, including on the basis of race, religion, gender, sexual orientation, disability, or any other protected characteristic.
  3. Sexual content, sexually suggestive content, or content of a personal-relationship nature outside the legitimate scope of clienteling and client-conversation practice.
  4. Content involving minors in any practice scenario other than fact-based product-knowledge questions appropriate to the Customer’s regulatory context.
  5. Client personal data beyond what clienteling requires. A client file may hold what the advisor needs to serve that client — name or initials, contact preferences, purchase and visit history, stated preferences and sizes, occasions and dates, and notes — recorded on the Customer’s instructions and under the Customer’s own clienteling notices to its clients. It must not hold special-category data within the meaning of Article 9 GDPR (health, religion or beliefs, sexual orientation, political opinions, ethnic origin, and the like), nor data of persons who are not clients or prospects of the Customer.
  6. Real client personal data as practice content. Practice sessions use synthetic or pseudonymized client personas. A real client’s personal data must not be used as practice content without the prior, documented, explicit consent of that client.
  7. Contacting the Customer’s clients through the Solution. The Solution drafts; the advisor sends every client-facing message from their own telephone, messaging application, or mailbox. The Solution’s own channels must not be used, or configured, to call, message, or email a client of the Customer.
  8. Confidential Information of third parties that the Customer is not entitled to disclose to Prestance Lab under existing contractual or legal obligations.
  9. Attempts to misuse the Solution to extract competitive intelligence from simulated personas, bypass safety instructions, or elicit Outputs that would breach this Policy — including but not limited to prompt-injection techniques.

4. Prohibited use of Outputs — HR and automated decision-making

The Outputs of the Solution — including an advisor’s practice transcripts, scores and coaching feedback (visible to that advisor only), the aggregated team signals provided to management, and any derivative metric — must not be used:

  1. As the sole or principal basis for any human-resources decision, including but not limited to hiring, promotion, demotion, bonus or variable-pay calculation, performance review, role assignment, disciplinary action, access to professional opportunities or termination of employment;
  2. As the basis for any automated decision-making within the meaning of Article 22 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) — in that regard, the Solution is designed to support human-led coaching processes and does not autonomously make decisions concerning employees;
  3. To infer the emotional state, mental health, mood, personality, or any similar data within the meaning of Article 5(1)(f) of the EU AI Act (Regulation (EU) 2024/1689), of any natural person.

Managers receive aggregated signals only. The Customer will not seek to obtain, from the Solution or from Prestance Lab, an individual’s practice transcripts, recordings, scores, or words for any of the purposes above, and is responsible for ensuring that all internal communications about the Solution’s Outputs — to managers, to HR, and to Authorized Users themselves — are consistent with these restrictions.

Customers remain solely responsible for ensuring that their use of the Solution and any decisions taken on the basis of its Outputs comply with all applicable laws and regulations, including employment, labour, anti-discrimination, data protection, and workplace monitoring laws.

5. Account security

  1. Authorized Users must keep their Login Credentials confidential and secure, as required by GTC §5.3.
  2. Each user account is personal to one Authorized User. Account sharing is prohibited. Where an account is fully reassigned to a different Authorized User, the previous user immediately loses access (GTC §5.3).
  3. Each seat is bound to the telephone number and email address enrolled for it: the assistant serves only calls and messages that originate from them and rejects unknown senders. This binding is a sender filter, not an authentication factor. A lost, changed, compromised, or reassigned device, number, or mailbox must be reported to support@prestancelab.com without undue delay so the seat can be re-bound.
  4. Multi-factor authentication must be enabled wherever the Customer’s identity provider supports it.
  5. Suspected credential compromise must be reported to security@prestancelab.com without undue delay.

6. Compliance with upstream sub-processor AUPs

The Solution relies on third-party artificial-intelligence, infrastructure and channel sub-processors. The Customer, Beneficiaries and Authorized Users will comply with the acceptable-use policies of the sub-processors whose systems carry Authorized User content (the full list, including observability and analytics providers, is in the DPA, §7), which are incorporated into this Policy by reference:

Where a sub-processor’s acceptable-use policy and this Policy address the same matter, the stricter restriction prevails.

7. Reporting violations

Suspected violations of this Policy must be reported to abuse@prestancelab.com. Reports should include:

Prestance Lab will acknowledge receipt within 2 business days and will investigate in good faith. The Customer may be asked to assist with the investigation in respect of conduct attributable to its Beneficiaries or Authorized Users.

8. Consequences of breach

  • Prestance Lab may suspend the Customer’s, a Beneficiary’s and/or an Authorized User’s access immediately upon an actual or suspected material breach of this Policy, pending investigation.
  • Prestance Lab may deploy the circuit-breaker described in GTC §4.6 — interrupting and stopping the Solution where, acting reasonably, Prestance Lab considers it necessary to do so or to comply with the EU AI Act or any other applicable law. No compensation is due to the Customer where the circuit-breaker is deployed.
  • The Customer remains responsible for the acts and omissions of its Beneficiaries and Authorized Users under the Agreement.

9. Updates to this Policy

In accordance with GTC §2.7, Prestance Lab may update this Policy from time to time. Material changes will be notified to active Customers at least 30 days in advance, unless the change is required by applicable law or is needed to address a material security risk, in which case it may take effect with shorter notice.

10. Contact