AI Acceptable Use Policy

Updated Date: July 1, 2026, 12:00 AM

This Artificial Intelligence Acceptable Use Policy ("Policy") applies to Customers' use of all services offered by Collaborne B.V. dba NEXT and its affiliates, subsidiaries ("NEXT") or third-party systems, products, applications or functionality that interoperate with services offered by NEXT, that incorporate artificial intelligence ("AI") as well as generative AI (collectively, "Covered AI Services"). Within the Covered AI Services, those that use Generative AI will be referred to as the "Covered Generative AI Services" if referenced separately.

NEXT may change this Policy by posting an updated version of the Policy and such updates will be effective upon posting (see last updated date in the title above).

A Customer's violation of this Policy will be considered a material breach of the Master Cloud Agreement between NEXT and its Customers ("MCA") or other agreement governing the Customer's use of the Services. Defined terms here shall have the same meaning as ascribed to it in the MCA.

APPLICABILITY: NEXT is committed to ensuring that our Services and specifically the generative AI System are used safely, responsibly, ethically, and in compliance with applicable laws and regulations. Therefore, this Policy sets out the standards and requirements for acceptable use of the Services and applies to all Authorized Users, Customers, developers, integrators, deployers and any other individuals or organizations accessing or using the Service, businesses and enterprises using the Platform for customer support and engagement; developers and integrators building or customizing AI Systems; End Users interacting with AI Systems deployed through the Platform; resellers, partners, and service providers; and any other individuals or organizations accessing the Services (all shall be referred to in this policy as "Customers", "End Users" and "Authorized Users" as terms are defined in the MCA)

This Policy is designed to:

  • Promote safe and responsible use of AI System technology.

  • Protect the rights, safety, and privacy of individuals.

  • Ensure compliance with applicable legal and regulatory requirements, including the EU AI Act (AIA), EU Digital Services Act (DSA), and data protection laws.

  • Maintain the integrity, security, and reliability of our Platform.

  • Foster trust and transparency in AI-powered customer interactions.

1. Prohibited Uses and Activities

Customers may not use a Covered AI Service, nor allow Authorized Users or any third party to use a Covered AI Service, for the following:

Automated Decision-Making Processes with Legal Effects:

  1. As part of an automated decision-making process with environment or legal significant effects, unless the Customer ensures the final decision is made by human, and takes additional factors into consideration other than the Services and AI System's recommendations; Customer is transparent about the Covered AI Service and the logic involved in the decision-making process, including providing subjects of the decision with the right to receive an explanation of the role of the Covered AI Service in the decision-making and the main reasons for the decision.

  2. As part of an automated decision-making lending or candidate screening, or any scoring of any kind.

  3. Generating individualized advice that in the ordinary course of business would be provided by a licensed professional. This includes, for example, financial and legal advice, medical advice, treatment or diagnosis to End User. For clarity, this section does not limit Customer from using Covered AI Services for other purposes, such as customer support in regulated industries, or to assist a licensed professional where Covered AI Services were not leveraged in the generation of individual advice. When using the Covered AI Services a human must review the Output and monitor the AI System.

Explicitly Predicting or Categorizing Based on Protected Characteristic:

  1. Explicitly predicting, or categorizing based on an individual's protected characteristic, including, but not limited to, racial or ethnic origin, and past, current, or future political opinions, religious or philosophical beliefs, trade union membership, sex life, sexual orientation, disability, health status, medical condition, financial status, criminal convictions, or likelihood to engage in criminal acts.

  2. Additionally, Customer may not submit images, videos or audio recordings of individuals for the purposes of creating, analysing, or categorizing based on, biometric identifiers, such as face prints or fingerprints or scans of eyes, hands, voiceprints, or facial geometry.

Social Scoring and Crime Prediction:

  1. Evaluating, classifying, scoring or rating individuals or groups based on their social behaviour or personality characteristics where such scoring leads to unfavourable treatment unrelated to the original context of the collected data; or unjustified or disproportionate treatment relative to the assessed behaviour.

  2. Assessing or predicting the risk of an individual committing a criminal offense, based solely on profiling or assessing their personality traits and characteristics.

The aforesaid does not include scoring performance of the customer support, success and enjoyment in general terms.

Emotion and Facial Recognition:

  1. Detecting, inferring, or assessing individuals' emotions in the workplace or in educational institutions, except where such use is strictly necessary for medical or safety purposes.

Child Exploitation and Abuse:

  1. Creating, sending, uploading, displaying, storing, processing, or transmitting material that may be harmful to minors including, but not limited to, for any purposes related to child exploitation or abuse, such as real or artificial Child Sexual Abuse Material (CSAM).

2. Illegal or Dangerous Activities

Customers may not use a Covered Generative AI Service, nor allow its Authorized Users or any third party to use any Covered Generative AI Services, for the following:

  • Encourage or support terrorism, violent extremism, or human trafficking.

  • Encourage self-harm, suicide, or violence against individuals or groups.

  • Provide instructions for or facilitate illegal activities, including the creation or distribution of weapons, controlled substances, or malicious code.

  • Weapons Development advertising, marketing, distributing, or selling weapons, weapon accessories, or explosives, unless provided through customer support and approved in writing by NEXT.

  • Targeting, creating, or distributing political campaign materials for external public or semi-public audiences. Political campaign material refers to material that may influence a political process by using deep fake, etc. except as specifically approved in writing by NEXT for providing customer support to a political party.

  • Creating, sending or marketing adult content.

  • Create, distribute, or promote content that is harmful, violent, or hateful (including hate speech), or for bullying, intimidation, offensive conduct, or humiliation of individuals or groups.

3. Security and Integrity

Customers may not use a Covered AI Service, nor allow its Authorized Users or any third party to use any Covered AI Services, in a manner that harms the safety of others or the security of the Services, including:

  • Creating, distributing, or facilitating spam, phishing, or malware, misusing, damaging, interfering with, or disrupting NEXT's infrastructure or other customers and services.

  • Attempting to bypass safety filters, abuse protections, or security mechanisms, such as manipulating AI Systems to violate the guardrails, escalation points and policies.

4. Deceptive, Misleading, or Manipulative Use

Customer may not use a Covered AI Service, nor allow its Authorized Users or any third party to use any Covered AI Services to deceive, mislead, or manipulate others:

  1. Engaging in fraud, scams, or other deceptive practices or impersonating individuals (living or dead) without explicit disclosure and consent, including by using known voices.

5. Customer-Connected Models

Where Customer connects its own or a third-party large language model or AI system to the Services, Customer is responsible for its use of that model, including compliance with the applicable model provider's acceptable-use policy, code of conduct, or equivalent terms. This Section applies only to models Customer elects to connect; it does not apply to models NEXT provides as part of the Services.

6. Reporting and Appeals

If you believe this Policy has been violated or encounter harmful or illegal content, please report it to: security@nextapp.co. If your access to the Services has been suspended or terminated due to an alleged violation of this Policy, you may submit an appeal by contacting us at the same email address.

Questions & Answers

Security and data protection

Security and data protection

How NEXT manages subprocessors?

How NEXT manages subprocessors?

How can controllers get notified of new or changed subprocessors?

How can controllers get notified of new or changed subprocessors?

Do you support EU-only processing for AI/transcription?

Do you support EU-only processing for AI/transcription?

What due-diligence does NEXT perform on subprocessors?

What due-diligence does NEXT perform on subprocessors?

Can customers object to a new subprocessor?

Can customers object to a new subprocessor?

Questions & Answers

How NEXT manages subprocessors?

NEXT has established a rigorous process for the selection and management of subprocessors. This includes: 1) Risk-based due diligence & inventory (service description, data types, access, controls, assurance). 2) Contracts & DPAs: Article 28(4) obligations flow down to subprocessors; change notifications & objection handled per DPA (Article 28(2)). 3) International transfers: Where required, NEXT AI implements EU SCCs (2021) to legitimize transfers controller→processor and processor→subprocessor. 4) Minimization: NEXT AI aims to use as few subprocessors as possible to deliver the service.

How can controllers get notified of new or changed subprocessors?

NEXT provides notice of intended changes to the subprocessor list and allows objections as required under GDPR Art. 28(2) via the DPA. Contact security@nextapp.co if you need to confirm your notification channel.

Do you support EU-only processing for AI/transcription?

Yes—per the list above, AssemblyAI and Microsoft Azure AI can be used in the EU, and Gladia is EU-hosted. Configure your workspace to use EU options where required. Refer to vendor rows and your contract/SOW for specifics.

What due-diligence does NEXT perform on subprocessors?

NEXT follows a vendor-management program (inventory, risk tiering, control reviews, contractual clauses, and audit/assurance as needed).

Can customers object to a new subprocessor?

Yes — controllers may object in writing within 15 days of receiving a Subprocessor Change Notice, on reasonable data protection grounds. If no objection is raised within this period, the change is deemed accepted. If an objection cannot be resolved, the customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees. See DPA Section 6 for full details.