Terms and Conditions

1. The parties

The Service is operated by Moonlighter AB (Sweden, organisationsnummer 559395-7979) (“we”, “us”). “You” means the person or organisation using the Service. If you are accepting these terms on behalf of an organisation, you confirm that you have authority to bind that organisation.

2. The Service

The Service is an API platform that lets you call data and validation capabilities, including the Payee Assurance product. Capabilities fetch data from public registries, licensed data providers, and our own algorithmic checks, and return structured responses with provenance and an audit record.

Capability behaviour, pricing, and coverage are described on the public catalog at strale.dev/capabilities and are part of these terms by reference. We may add, change, or remove capabilities; material changes are communicated under Section 12.

3. Accounts and API keys

To use authenticated parts of the Service you create an account and generate API keys. You are responsible for keeping your API keys confidential and for activity performed using them. Notify us at compliance@strale.io if you suspect a key has been compromised so we can revoke it.

Some capabilities are available without an account via x402 pay-per-use; in that mode, payment of the on-chain invoice is your authentication and you accept these terms by paying.

4. Pricing, billing, and refunds

• Wallet model. You top up a prepaid balance via Stripe and the Service deducts per-call fees as you make API calls. Top-ups are non-refundable except as set out below or as required by applicable consumer-protection law.
• x402 pay-per-use. Each call is paid on-chain in USDC at the moment it is executed. There are no recurring charges and no subscription.
• Free trial. New accounts receive trial credits as announced on strale.dev/pricing. Trial credits have no cash value and cannot be redeemed.
• Failed calls are not charged. If a capability execution fails on our side or returns a structured error before the upstream call succeeds, no fee is debited.
• Account closure refund. If you close your account, unused wallet balance is refundable on request within 60 days of closure. After 60 days the unused balance is forfeit.

5. Acceptable use

You agree not to use the Service to:

• break the law, evade sanctions, or facilitate fraud;
• process personal data of EU/UK data subjects without an appropriate lawful basis;
• circumvent rate limits, quotas, or the Service’s authentication;
• resell the Service as your own or build a competing product whose primary purpose is to mirror Strale’s capability catalog;
• scrape or systematically extract Strale’s own metadata (capability descriptions, test results, pricing) outside of the documented public endpoints;
• use AI-assisted capability outputs as the sole basis for decisions with legal or significant effects on a person without human review.

For capabilities that involve special-category data under Art. 9 GDPR (e.g. PEP and sanctions screening) or criminal-conviction data under Art. 10 GDPR (e.g. adverse-media checks), you confirm that you have identified and rely on an appropriate condition under Art. 9(2) / Art. 10 GDPR (or the UK equivalent) for processing such data.

We may suspend or terminate accounts that breach this section. Serious or repeated breaches result in termination without refund.

6. Your data and ours

You retain all rights to the data you send to the Service and to the structured responses you receive. We process your data only to provide the Service and as set out in our Privacy Policy. We do not use your data to train models and we do not sell it.

Strale retains all rights to the platform itself: the executors, orchestration, audit-trail engine, test infrastructure, and accompanying documentation. You receive a non-exclusive, non-transferable licence to use the Service during the term of these terms.

Data fetched from public registries and similar third-party sources is governed by those sources’ own terms. We pass through that data to you with the provenance attached so you can verify its origin.

For capabilities that wrap third-party screening providers (currently: Dilisense for sanctions, PEP, and adverse-media checks; Serper for adverse-media fallback), the upstream provider’s own service terms govern our access to their data. Their liability to us is contractually limited; those limitations may constrain our practical recourse, and therefore yours, in the event of upstream data error, omission, or outage. Provenance fields on each response identify the upstream provider so you can apply your own due-diligence judgement.

7. Service availability

We aim to keep the Service available continuously, but we do not offer a contractual uptime SLA at this stage. We may schedule maintenance windows, throttle abusive traffic, and depend on third-party data sources whose own availability we do not control. When an upstream source is unavailable, we serve cached results where we have them and return a structured error otherwise.

We publish quality and reliability scores for each capability via our public quality endpoint; those scores are our best estimate of execution quality and not a contractual warranty.

8. Warranty and liability

The Service is provided “as is” and “as available”. To the maximum extent permitted by law, we disclaim all warranties not expressly granted in these terms, including warranties of merchantability, fitness for a particular purpose, and non-infringement.

Capability outputs are evidence to inform your decisions, not decisions in themselves. You are responsible for any action you take based on a Service response. Where a capability returns an explicit decision-readiness object, you should consult that object before treating a response as actionable.

Compliance and screening capabilities specifically. Capabilities marketed for compliance use — including sanctions screening (sanctions-check), politically-exposed-persons screening (pep-check), and adverse-media screening (adverse-media-check) — return evidence about the matches found in upstream data sources at the moment of the call. They are not regulatory determinations. A “no match” or is_sanctioned: false response does not mean the subject is free of sanctions, PEP status, or adverse coverage; it means the upstream provider’s index, as configured at that moment, did not surface a match for the query as written. You remain responsible for: (a) querying with appropriate name variants, (b) applying your organisation’s risk appetite and additional controls, and (c) any regulatory determination you are required to make. Where applicable law requires human review of an automated decision (e.g. EU AML Directive, UK MLR 2017 Regulation 28A, GDPR Art. 22), that review is your obligation, not ours.

To the maximum extent permitted by law, our aggregate liability arising out of or related to these terms in any 12-month period is limited to the greater of (a) the fees you paid us in that period or (b) EUR 1,000. We are not liable for indirect, incidental, special, or consequential damages, or for loss of profits, revenue, data, or goodwill.

Nothing in these terms limits liability for fraud, gross negligence, wilful misconduct, or any liability that cannot be limited under applicable law.

9. Indemnification

You agree to indemnify and hold us harmless from third-party claims arising out of (a) your use of the Service in breach of these terms, (b) your use of capability outputs in a way that infringes the rights of a data subject or third party, or (c) data you submit that you do not have the right to process.

10. Term and termination

These terms apply for as long as you have an account or are using the Service. You may close your account at any time from your dashboard or by emailing us. We may suspend or terminate your account on notice for material breach of these terms; in cases of unlawful use, security risk, or sanctions risk, we may suspend immediately and notify you afterwards.

Sections that by their nature should survive termination (data rights, warranty disclaimers, liability limits, indemnification, governing law) survive.

11. Changes to these terms

We may update these terms. Material changes (pricing, liability, governing law, acceptable use) are communicated by email at least 30 days before they take effect. Non-material changes take effect on posting. Continued use of the Service after changes take effect means you accept the updated terms.

12. Governing law and disputes

These terms are governed by the laws of Sweden, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

Disputes will be resolved in the Stockholm District Court (Stockholms tingsrätt) as the court of first instance, except that we may bring claims relating to unauthorised access, fee non-payment, or intellectual-property infringement in any court of competent jurisdiction.

Mandatory consumer-protection rights of consumers resident in the EU/UK are not affected by this clause.

13. General

• If any provision is held unenforceable, the rest remain in effect.
• You may not assign these terms without our consent; we may assign them as part of a corporate transaction.
• These terms (with the Privacy Policy) are the entire agreement between us on the subject.
• Failure to enforce a provision is not a waiver.