# spun.ink — Acceptable Use Policy

> Version 2026-08-23 · effective 2026-08-23 · content hash: the SHA-256 of the served bytes, printed on the page itself at
> `spun.ink/legal/acceptable-use` and reproducible from the raw markdown at `spun.ink/legal/acceptable-use.md` ·
> English is the contract language.
> **Applies to:** every account, every site and everything published through spun.ink, on every plan
> (Free, Pro, Agency), from the moment an account exists — and to anyone who reports content to us.
> **Supersedes:** version 2026-08-20, readable at `spun.ink/legal/acceptable-use/2026-08-20`. That
> version differed only in the publication note below this block, which named the path this file has
> inside our version control. No rule and no procedure changed.
> Part of the spun.ink Terms of Service. Accepting the Terms accepts this document; there is nothing
> separate to sign.
> Previous versions: 2026-08-20. Every version stays reachable
> at `spun.ink/legal/acceptable-use/<version>`.

*Published as the **Acceptable Use Policy** at `spun.ink/legal/acceptable-use` (raw markdown at
`spun.ink/legal/acceptable-use.md`). Every version of this document is kept under version control
and served straight from it, so its history is complete.*

---

## In short

*This box is a plain-language summary, in the spirit of Article 14(1) of the Digital Services Act,
which requires the policy itself — not a separate summary — to be written in clear, plain, intelligible
language. **The summary is not the contract** — sections 1 to 16 below are. Where the two differ, the
sections win.*

- **Your site is yours.** You (or the AI agent you instruct) write it, publish it and answer for it.
  spun.ink stores and serves it. We do not write it, choose it, rank it or check it.
- **Some things you may not publish or do**: illegal content, terrorist content, child sexual abuse
  material, malware and phishing, other people's work without the right to use it, hate and threats,
  other people's private data without a lawful basis, spam — and you may not attack, overload or
  probe the platform. Sections 2 and 3 list this in full.
- **Some lawful things too.** Adult content, gore, gambling and the sale of weapons, drugs or tobacco
  are not hosted here even where they are legal — our own standards, written out in section 2.2 so
  that you know before you build, not after.
- **"Fair use"** means: a normal amount of traffic and requests for a website of your kind. The
  numbers we actually measure and enforce are in section 4. If you go over, we talk to you first.
- **Anyone can report illegal content** to `abuse@spun.ink`. We confirm we got it, a person looks at
  it, and we tell both you and the reporter what we decided and why. Section 7.
- **If we restrict something**, we tell you what we did, why, and how to argue with it — by e-mail to
  the address on your account. You can reply and ask a person to look again, complain to the Austrian
  regulator, or go to court. Sections 8, 9 and 10.
- **We do not use automated content moderation.** No filter, no classifier, no scanner. Every
  decision under this policy is made by a person.
- **We are a micro-enterprise**, so we publish no annual transparency report. Section 14 says so
  plainly instead of leaving you to guess.

---

## 1. What this policy is, and who it binds

**1.1** This is the Acceptable Use Policy referred to in the **Terms of Service**
(`spun.ink/legal/terms`). It is part of the Terms and is accepted with them. The words written with a
capital letter — Customer, Owner, Agent, Site, Content, Visitor, Submission, Plan, Operator token,
Free plan, Business, Consumer — have the meanings given in section 1 of the Terms.

**1.2 Rank order.** Where this policy and the Terms conflict, the Terms prevail, except that the
**Data Processing Agreement** (`spun.ink/legal/dpa`) prevails on anything to do with processing
personal data and the **Right of withdrawal** (`spun.ink/legal/withdrawal`) prevails on withdrawal
mechanics.

**1.3 It binds every plan.** The rules here apply identically on Free, Pro and Agency. A Free Site is
a real public website and carries the same duties as a paid one.

**1.4 It binds everything done under your account.** Everything your Agent does with a bearer token or
an Operator token of your account is your own act. **Business Customers only:** if you issue Operator
tokens (an Agency-plan feature), you must pass the Terms, this policy and the confidentiality duties
in the Data Processing Agreement on to whoever holds one, and you remain responsible for what they do.

**1.5 These are the grounds we may act on for content and conduct.** Sections 2, 3, 4, 5 and 6 are the
complete and **exhaustive** list of the objective, content- and conduct-based grounds on which we may
warn you, take Content down, suspend a Site or terminate an account under this policy — together with a
binding order from an authority or a court (section 12). We may not act against you on a content or
conduct ground that is not written here. **The Terms carry their own, separate and exhaustive list of
grounds for ending the contract itself** — non-payment, insolvency, and a name/mark claim a rename
cannot resolve among them — which this section does not repeat or narrow; see the Terms' own
suspension-and-termination section for that list. This is a deliberate constraint on us: under § 6
Abs 2 Z 1 KSchG, read with the Abs 2 chapeau, a clause letting a trader walk away from a consumer
contract *"ohne sachliche Rechtfertigung"* is not binding unless individually negotiated — and as a
standard, non-negotiated policy clause, that exception does not rescue a vague formula here, so we name
the grounds instead.

**1.6 Where the rest of the information lives.** spun.ink does not publish a separate "DSA page". The
contact points for authorities and for you, the supervisory authority, our service category and the
Data Act infrastructure disclosure are in the **Legal notice** (`spun.ink/legal/imprint`); the content
rules and this notice-and-action mechanism are here and, in outline, in the Terms. If you came looking
for a DSA page, those two documents are it. (We may split them into a standalone page later; nothing
is missing today.)

---

## 2. Content you may not publish

### 2.1 Content that is illegal, infringing or abusive

You may not publish, upload, fetch, store or transmit through spun.ink any of the following. This
applies to every part of a Site — pages, posts, templates, blocks, collection records, navigation,
settings, injected head or body code, uploaded assets and anything fetched by URL.

**(a) Illegal content.** Any information that, in itself or in relation to an activity, is not in
compliance with Union law or the law of a Member State that complies with Union law — whatever the
subject matter of that law (the definition in Article 3(h) of the Digital Services Act). If it would
be illegal offline, it is illegal here.

**(b) Child sexual abuse material.** Zero tolerance. Content of this kind is removed on discovery, the
account is terminated, the material and related data are preserved as required, and we report it to the
competent authorities. Reports about it can be made anonymously (section 7.4).

**(c) Terrorist content**, as defined in Article 2(7) of Regulation (EU) 2021/784 — material that
incites, solicits or threatens the commission of terrorist offences, solicits participation in a
terrorist group, or gives instruction on making or using explosives, firearms or other weapons for
those purposes. Section 11 sets out what we do about it.

**(d) Infringement of other people's rights.** Copyright, related rights, trade marks, designs,
patents, trade secrets, name and personality rights. This includes images, fonts, typefaces, icons,
templates, code, text and music you are not licensed to use, and **anything your Agent fetches from a
URL on your instruction** — a fetch is your act, not ours, and the same rights warranty applies to it
as to a direct upload.

**(e) Phishing, malware and deception.** Pages that imitate another organisation's login, payment or
identity flow; pages that collect credentials or payment details under a false identity; files or
scripts that install, drop or run malicious code; hidden collection mechanisms; deceptive redirects,
cloaking or any technique that shows a Visitor something different from what a reviewer sees.

**(f) Hate, violence and harassment.** Content that incites violence or hatred against a person or a
group, glorifies terrorism, threatens, stalks or targets a private individual, or promotes
self-harm. Content that is unlawful hate speech under the law applicable to you is already covered by
(a); this paragraph adds the cases where the content is our contractual concern even where legality is
contested.

**(g) Violations of other people's privacy.** Publishing personal data without a lawful basis;
publishing home addresses, phone numbers, identity-document images or similar with the effect of
exposing someone (doxxing); non-consensual intimate imagery; special-category data about identifiable
people. Publishing data about your own Visitors that they gave you for another purpose belongs here
too.

**(h) Spam and unsolicited messages.** Bulk unsolicited commercial e-mail sent from, advertised
through, or landing on a Site; doorway pages, link farms, scraped-content farms and other content
generated primarily to manipulate search rankings rather than to be read.

**(i) Fraud and consumer deception.** Fake shops, fake reviews and testimonials, invented scarcity,
pyramid and chain schemes, unlicensed financial or investment offers, and offers of goods or services
that may not lawfully be sold to the people you are addressing.

**(j) Content that is unlawful to make available to minors** without the protections the applicable
law requires.

**Our position on all of this:** spun.ink neither authors nor selects Content. We host it at your
request. That is the whole of our role, and we keep it that way deliberately — the platform makes no
model calls; the Agent that writes your Site is *your* agent, running under *your* key.

### 2.2 House standards — lawful content we still do not host

*Everything in section 2.1 is illegal, infringing or abusive. This section is different, and we say
so plainly: it restricts content that may be **perfectly lawful** where you are. A host is free to
set standards for what it hosts, and Article 14(1) of the Digital Services Act requires us to tell
you what ours are — in advance, in clear language, in the document you accept — instead of
surprising you with them later. These are ours, and they are the whole of them.*

We do not host, and you may not publish through spun.ink:

**(a) Sexual and adult content.** Pornography and sexually explicit imagery, video, audio or text;
content whose purpose is sexual arousal; advertising or booking for escort, webcam or sexual
services. *Not covered by this paragraph:* sexual-health education, medical and contraceptive
information, information and support for LGBTQ+ people, and artistic or documentary work that
contains nudity.

**(b) Graphic violence, gore and cruelty.** Shock content; imagery of real injury, death or human
remains; cruelty to animals; content that glorifies or celebrates violence, war or a violent
perpetrator. *Not covered by this paragraph:* news reporting, documentation, and historical, medical
or educational material — including material that is hard to look at.

**(c) Gambling and speculative money offers.** Casinos, betting and sports betting, lotteries,
raffles and loot-box mechanics; token, coin and NFT offerings; trading signals, copy-trading and
"financial freedom" schemes. This holds even where you hold a licence for the activity.

**(d) Weapons, drugs, tobacco and vaping products.** The sale or brokerage of firearms, ammunition,
explosives, weapon parts and printable weapon files; recreational drugs and the paraphernalia for
them; tobacco products, e-cigarettes and vaping liquids. This holds even where the sale is lawful
where you are. *Not covered by this paragraph:* hunting, sport-shooting and collectors' associations
that sell nothing; drug-policy, harm-reduction and addiction-support information; pharmacies and
licensed medical suppliers.

**What this section is, and what it is not.** A breach of it is a breach of contract — not a crime.
We will never tell you, a reporter or an authority that content restricted under this section was
illegal, and a statement of reasons for such a measure names this paragraph and nothing else
(section 9(e)). If your project needs any of the above, it is a good project for a different host:
section 17 of the Terms is how you take everything with you, and we charge nothing for it.

---

## 3. Things you may not do to the platform

**(a) Break, bypass or test our security.** Do not circumvent, disable or interfere with
security-related features; do not attempt to reach another account's data, another Site's templates,
or anything behind the tenant boundary; do not run scans, fuzzing or penetration tests against
spun.ink without our written agreement.

**(b) Take data that is not yours.** Do not collect or extract information or data from accounts,
Sites or Submissions that do not belong to you.

**(c) Use us to reach somewhere else.** Do not use the MCP endpoint, the fetch-by-URL uploader or any
Site as a proxy, a relay, an anonymiser, a scanning platform, or a staging point for an attack on a
third party or on us.

**(d) Abuse the resources.** No crypto-mining. No use of a Site or its asset storage as a general file
drop, backup target or content-delivery endpoint for traffic that has nothing to do with the Site. No
deliberate load generation, amplification or denial-of-service, against us or through us.

**(e) Do not evade limits or measures.** Do not create additional accounts to get around a plan
ceiling, a suspension or a termination; do not automate mass account creation; do not use a second
account to continue conduct that got a first one restricted.

**(f) Do not impersonate us.** Do not present a Site as being operated, endorsed, certified or
supported by spun.ink or City of Code GmbH, and do not use handles, domains, marks or wording that
suggest it (see section 6).

**(g) Do not mislead us or abuse the report channel.** No false reports, no impersonating another
Customer in correspondence, no forged authority orders. Section 13 says what happens to a sender who
does this repeatedly.

**(h) Do not harass the people who run this.** Threats, intimidation or abuse directed at our staff or
anyone providing part of the service.

**(i) Obey the law generally.** Do not use the service in a way that is inconsistent with any
applicable law or regulation.

*Sections 3(a)–(d) and (h) are adapted from the Basecamp open-source policies (see the attribution
note at the end of this document). We deliberately did not adopt that policy's "disparage or tarnish
us, in our opinion" clause or its "cancellation without prior notice" line: the first is too vague to
be a valid ground under § 6 Abs 3 KSchG, and the second is incompatible with the ladder in section 8
and with the statement of reasons we owe you under section 9.*

---

## 4. Fair use — what it means for storage, requests and bandwidth

### 4.1 The measured ceilings

These are the limits the engine actually counts and enforces. Your Agent can read your current usage against them at any time with the `get_account`
tool, and a create that would cross a ceiling comes back as a structured `over_quota` error naming the
limit and the usage — so the ceiling is felt by your Agent, never by your Visitors.

| Limit | Free | Pro | Agency |
|---|---|---|---|
| Sites | 1 | 3 | 25 |
| Content documents per Site (pages + posts) | 1,000 | 20,000 | 100,000 |
| Collection records per Site | 500 | 10,000 | 50,000 |
| Stored assets (total, per account) | 500 MB | 10 GB | 100 GB |
| Form Submissions per calendar month (per account) | 100 | 5,000 | 50,000 |
| Operator tokens | 0 | 0 | 10 |
| Revision history kept | 30 days | unlimited | unlimited |
| Minimum handle length | 6 characters | 3 characters | 3 characters |
| Custom domain | no | yes | yes |
| "Made with spun.ink" banner | yes | no | no |

Two of these are enforced as a **floor** and a **prune** rather than as a refusal, and we would rather
you learn that here than discover it:

- **Handle floor.** On the Free plan a site handle must be at least 6 characters. Short handles (3 to
  5 characters) are a paid capability. An existing handle is not taken away when a plan changes.
- **Revision prune.** On the Free plan, when a new revision is captured, revisions older than 30 days
  are deleted — **except** the most recent published snapshot, which is kept for as long as it is the
  one being served. Your published Site, its live draft, your Content and your assets are never
  touched by this. Downgrading a plan deletes nothing on the day it happens.

### 4.2 What happens when you reach a ceiling

- **Your Visitors never see a broken Site.** A form that has reached the monthly Submission ceiling
  shows a polite "temporarily unavailable" state; it never silently swallows a lead and never pretends
  a Submission was stored when it was not.
- **Your Agent gets a precise, structured error** naming the limit, the current usage and the tool that
  can help.
- **Nothing already stored is deleted, hidden or held hostage** because you are over a ceiling. Reading
  and exporting your own data stays available on every plan, always.
- **Downgrades are never destructive.** Dropping from Pro to Free does not delete Sites, Content or
  assets; it stops you creating more, and the Free-plan banner and history window apply again.

### 4.3 Fair use for requests and bandwidth

Requests and traffic are **not** metered per plan. They are governed by this fair-use rule instead:

> Use the amount of bandwidth and the number of requests that a website of your kind normally uses.
> Do not generate traffic artificially, do not use your Site as a distribution endpoint for files or
> media that belong to something else, and do not run sustained automated request volume against the
> management API beyond what building and maintaining your Sites requires.

**What is technically enforced today** — stated exactly, because we would rather be precise than
sound impressive:

- unauthenticated requests to the management endpoint: 5 per minute;
- sign-up and account-recovery requests: 5 per minute;
- form Submissions: 10 per minute per Site and visitor address, plus a hidden anti-bot field and an
  origin check;
- a single management request body: at most 40 MB;
- a single uploaded or fetched asset: at most 25 MB.

There is **no per-account request cap and no bandwidth meter in force today.** A flat anti-abuse
cap on authenticated management requests is planned.

### 4.4 What we do if your usage becomes a problem

1. **We contact you first**, by e-mail to the address on your account, saying what we measured and
   what we would like to change.
2. **We agree a fix or an upgrade** with you, with a reasonable period to act.
3. **Only if the load is actually threatening the service for other Customers** may we throttle or
   suspend before that conversation — and then only as narrowly and as briefly as the problem
   requires, with notice and reasons sent at the latest when the measure takes effect (section 9).

We do not send surprise overage invoices, and we do not charge for traffic.

### 4.5 The Free plan and the banner

Every Free Site shows a fixed footer banner reading *"Made with spun.ink · Build yours free"*. It is
advertising for us and it is the price of the Free plan. **It is not an imprint, a legal notice or a
disclosure for anybody** — not for you and not for us. If your Site needs an imprint (and it probably
does — see section 5), you must publish your own.

---

## 5. Your responsibilities for your Site

spun.ink hosts your Site. Everything a publisher owes to the public, you owe. We give no legal advice
and we do not check your Site for compliance.

**5.1 An imprint / legal notice.** Most Sites need one — in Austria under § 5 ECG for a business site
and under § 25 MedienG for the disclosure duty, and there are equivalents in every EU member state and
in many countries outside it. Publish it as its own page and link it from your navigation. Your Agent
can be asked to do this in one instruction. The Free-plan banner does not do it for you.

**5.2 A privacy notice for your Visitors.** You are the controller for everything your Site collects
from Visitors; we process it for you under the **Data Processing Agreement**. Publish it as its own
page and link it from your navigation, the same way as your imprint (section 5.1). A Visitor with a
question about your Site must be able to find and contact *you*, not us.

**5.3 Cookies and trackers you inject.** spun.ink itself sets only strictly necessary cookies and
ships **no consent tool of any kind**. If you inject analytics, pixels, embedded media, third-party
fonts or anything else through your Site's head or body code, the consent mechanism for it is yours to
build and to run — and it must meet the standard the law sets: no cookie wall, no pre-ticked box,
refusing as easy as accepting, and withdrawal as easy as consent.

**5.4 Forms and Submissions must be lawful.** Collect only what you need, tell Visitors what you do
with it, and never pre-tick a consent box in your own forms.

**5.5 Reading a Submission sends it to your AI vendor.** ⚠ **Please read this one — it surprises
people.** When your Agent calls `get_submission`, the Visitor's form data is returned **verbatim into
your Agent's context**, which means it is sent to whatever model vendor your Agent uses, under your own
account with that vendor. spun.ink makes no model calls and has no contract with that vendor. For that
step you are the controller: it is your instruction, your vendor, your responsibility — including
telling your Visitors about it in your own privacy notice if it applies. We flag this here, prominently
and separately, rather than burying it, because a clause of this kind hidden in the body of a document
would not become part of the contract at all (§ 864a ABGB).

**5.6 Mail you send to your Visitors** is yours. In Austria § 174 TKG 2021 forbids sending electronic
mail for direct-marketing purposes without prior consent; your own country's rule may differ. spun.ink
sends no mail on your behalf.

**5.7 AI labelling.** If your Site publishes AI-generated text on matters of public interest, or
deep-fake image, audio or video content, the labelling duties under Article 50(4) of the AI Act fall on
you as the deployer of your own Agent — not on us. A footer note or a per-post flag is the usual way to
do it.

**5.8 Accessibility.** Making your Site accessible is your duty where the law imposes one on you. The
engine's defaults aim at good practice; they are not a certification of your Site.

**5.9 Your own consumer-law duties. Business Customers only.** If you sell to consumers from your
Site, the pre-contractual information, the withdrawal instruction, the price display and the
alternative-dispute-resolution statement are yours to get right. Ours (in the Terms and in the Right of
withdrawal document) cover our contract with you, not your contract with your customers.

**5.10 Only use what you are entitled to use.** Every asset you upload or have fetched by URL: you
warrant you hold the rights.

---

## 6. Handles, subdomains and reserved names

**6.1 A handle is not property.** The handle that addresses your Site (`<handle>.myspun.ink` and the
platform path) is granted for use while your account exists. You acquire no ownership, no trade-mark
right and no transfer right in it.

**6.2 Reserved names.** Some handles can never be claimed, because letting one through would either
break the platform's own routing or let a Site speak with our voice. Four families are reserved:

- **infrastructure and mail DNS** — `www`, `mail`, `smtp`, `mx`, `ns1`, `cdn`, `status` and similar,
  plus the paths the engine itself routes (`me`, `preview`, `mcp`, `up`, `assets`, `signup`,
  `recover`, `webhooks`, …);
- **authentication and identity** — `login`, `auth`, `oauth`, `sso`, `secure`, `verify`, `account`,
  `password`, `session`, …;
- **billing and transactions** — `billing`, `pay`, `payment`, `checkout`, `invoice`, …;
- **our brand and our voice** — `spun`, `myspun`, `spun-ink` and their punctuation variants, plus
  words that address a Visitor as though they were talking to our organisation: `support`,
  `official`, `staff`, `admin`, `administrator`, `root`, `system`, `team`.

The list is enforced in the engine and is readable at any time through the `capabilities` tool; it may
be extended when a new impersonation risk appears. Handles are also normalised to lowercase letters,
digits and hyphens.

**6.3 Names and marks.** A handle, subdomain or custom domain that infringes someone's name or mark can
be the subject of a substantiated claim. Under Austrian law the relevant rules are § 43 ABGB (name),
§ 10 MSchG (registered trade mark) and § 9 UWG (business identifiers); comparable rules exist
elsewhere. On a substantiated claim, or on an order, we may require a rename, reassign the handle, or
suspend the Site under section 8 — after telling you and giving you the chance to answer, unless an
order leaves us no time.

**6.4 Released handles.** When an account is deleted, its handle and any custom domain are recorded in
a tombstone so they are not immediately re-usable by someone else. This is a safety measure against
impersonation of a site that used to exist.

---

## 7. Reporting illegal content — the notice-and-action mechanism

This section implements Article 16 of the Digital Services Act. **Anyone** — an individual, a company,
an authority, an affected person, a rights holder — may report content on a Site hosted by spun.ink.

### 7.1 Where to send a notice

**`abuse@spun.ink`** — the address for everything about content: notices under this section,
rights-holder claims, and removal orders.

The channel is electronic. We accept notices in **German and English**. Postal notices reach us at the
address in the **Legal notice** (`spun.ink/legal/imprint`), but electronic notice is faster and is what
the mechanism is designed for.

### 7.2 What a notice must contain

To let us act, a notice should contain all four of the elements Article 16(2) asks for:

1. **Why you believe the content is illegal** — a sufficiently substantiated explanation, and the
   legal basis if you know it;
2. **Exactly where it is** — the exact URL or URLs. **You may report several URLs in one notice**, and
   we would rather you did than split them;
3. **Your name and e-mail address** (see 7.4 for the exception);
4. **A statement that you believe in good faith that what you have written is accurate and complete.**

A notice that lets a diligent provider see the illegality **without a detailed legal examination**
gives us actual knowledge of that specific item under Article 16(3) — which is precisely why the first
two elements matter. A bare assertion that something is "illegal", with no explanation and no URL,
usually does not.

**Copyright warnings.** A rights holder's warning letter (*Abmahnung*) is treated as a notice under
this section and runs through the same process. Under § 81 Abs 1a UrhG an intermediary that enjoys the
liability exclusion in Articles 4 to 6 of the Digital Services Act may only be sued for an injunction
after such a warning — so sending one to `abuse@spun.ink` is both the fast route and the right one.

### 7.3 What we do with your identity

We process your notice in order to handle it. We reveal your identity to the Customer whose Content
you reported **only where that is strictly necessary** to identify the illegality — the typical case
being an intellectual-property claim, where the Customer cannot assess the claim without knowing who
is making it. Otherwise your identity stays with us.

### 7.4 Anonymous notices about child sexual abuse material

If your notice concerns an offence referred to in Articles 3 to 7 of Directive 2011/93/EU, **you do
not have to give your name or e-mail address.** We will act on an anonymous notice of that kind. (The
consequence is only that we cannot send you an acknowledgment or a decision.)

### 7.5 What happens next

1. **Acknowledgment.** If your notice carries electronic contact details, we confirm receipt without
   undue delay and give you a reference.
2. **Review by a person.** A human being at City of Code GmbH reads the notice, looks at the content
   and decides. We use **no automated content moderation and no automated decision-making** — no
   filter, no classifier, no hash-matching, no scanner. If that ever changes, this section changes
   first and we will say so in every decision notice, as Article 16(6) requires.
3. **Decision.** We decide in a timely, diligent, non-arbitrary and objective manner, weighing the
   rights of everybody involved, including the Customer's freedom of expression and the rights of the
   people affected. **We answer within the period the applicable law allows and no later** — one hour
   for a removal order under Regulation (EU) 2021/784, and without undue delay for everything else,
   which for a company this size means the same working day where the content is manifestly illegal.
   We name no shorter self-imposed deadline: an unstaffable promise is worse than none.
4. **We tell you the outcome** — without undue delay, together with information on how you can
   contest it (section 10).
5. **We tell the Customer**, with a statement of reasons (section 9), at the latest when the measure
   takes effect.

### 7.6 What we cannot do

We cannot arbitrate a factual dispute between you and a Customer, and we are not a court. Where the
illegality is genuinely contested and not manifest, our normal course is to forward the notice to the
Customer with a period to respond, and to act on the outcome — not to decide the merits ourselves.
Where a court or a competent authority decides, we follow the order (section 12).

---

## 8. What we can do about it — the measures ladder

**8.1 The grounds.** We may take a measure only on one of these grounds, and no other: a breach of
section 2, 3, 4, 5 or 6; a binding order from a competent authority or a court (section 12); or the
Terms' own grounds for termination (non-payment and the like), which are set out there, not here.

**8.2 The ladder.** We start at the lowest rung that solves the problem.

| Rung | Measure | What it means in practice |
|---|---|---|
| 1 | **Contact and warning** | An e-mail to the address on your account naming the item and the ground, with a period to fix it. This is where almost everything should end. |
| 2 | **Unpublish or remove the specific Content** | The page or post stops being served; the rest of the Site is untouched. Your working draft and your revision history stay. |
| 3 | **Suspend the Site** | Every public URL of that Site — handle, subdomain and custom domain — answers **HTTP 410 Gone**. Your management access is deliberately **not** cut: your Agent can still read, edit and export everything, so that you can fix the problem and get your data out. |
| 4 | **Terminate the account** | The contract ends and the account is erased, subject to the retention rules in the Terms. Reserved for repeated or grave breaches, for content of the kind in section 2(b), and for cases where a lesser measure cannot work. |

**8.3 Proportionality.** We take the least intrusive measure that is capable of dealing with the
problem, and we take account of everybody's rights, including the Customer's. Rung 3 for a single
illegal item is a blunt instrument, and we use it only where the item cannot be isolated, where the
Site as a whole is the problem, or where a legal deadline leaves no time for anything finer (the
one-hour clock in section 11 is the clearest example). Rung 4 is never the first answer to a first
breach.

**8.4 Timing.**

| Situation | When we act |
|---|---|
| Manifestly illegal content | Without undue delay — in practice the same working day |
| Contested or non-manifest content | Notice to the Customer with a period to respond, then a decision without undue delay |
| Removal order for terrorist content | Within **one hour** of receipt (section 11) |
| Order from an authority or court | Without undue delay, and by any deadline the order sets |
| Content suggesting a threat to someone's life or safety | Immediately, together with notification of the authorities (section 12.4) |

**8.5 Honest description of the mechanism today.** Rungs 2, 3 and 4 are carried out by an operator from
the console. There is no automated per-item restriction lever, no self-service reinstatement button,
and no `restrictions` field in the management API yet — a measure and its reasons reach you by
**e-mail to the account address** and nowhere else. That is a known gap, it is on the roadmap, and we
would rather write it down than let you assume a screen exists. Keep the account e-mail address
monitored and reachable: it is the only channel we have to you.

**8.6 Reinstatement.** If a measure turns out to have been unjustified, we reverse it without undue
delay and at our own initiative — you do not have to ask twice.

---

## 9. If we restrict something: the statement of reasons

Whenever we restrict your Content or your Site on the ground that it is illegal or incompatible with
these rules, you get a **statement of reasons** — by e-mail to the address on your account, **at the
latest when the measure takes effect**, whatever the reason and however the measure came about
(Article 17 of the Digital Services Act).

It will always contain:

- **(a)** what we did — removal, disabling of access, suspension of the Site or of the account — and,
  where relevant, its **territorial scope and its duration**;
- **(b)** the facts and circumstances we relied on, including whether we acted on a notice
  (section 7) or on our own initiative, and — only where strictly necessary — who notified us;
- **(c)** whether automated means were used: **the answer today is always "no"**;
- **(d)** where we treated the content as illegal: the legal ground and why the content falls under it;
- **(e)** where we treated the content as incompatible with these rules: **the exact paragraph of this
  policy** and why the content falls under it;
- **(f)** how to contest the decision — section 10, spelled out in the notice itself.

**Three exceptions, stated so they cannot surprise you.** No statement of reasons is owed where we act
on an order under Article 9 of the Digital Services Act (Article 17(5)) — in that case you get the
Article 9(5) information instead: that the order arrived, what effect we gave it, the reasons, the
territorial scope and your possibilities for redress. Nor is one owed where the content is **deceptive
high-volume commercial content** — inauthentic use of the service such as bots, fake accounts or other
manipulation designed to deceive (Article 17(2), second subparagraph). And the duty applies only where
we actually have your electronic contact details, which for a spun.ink account we always do.

---

## 10. If you disagree

**10.1 Reply and ask for a second look.** Answer the notice, or write to
`support@spun.ink`, and a **person** re-reviews the decision — someone who
will actually read your argument, not a form. We answer without undue delay. Where the measure was
unjustified, we reverse it without undue delay.

This internal review is **voluntary**. spun.ink is a hosting service and a micro-enterprise, so the
internal complaint-handling system in Article 20 and the certified out-of-court dispute settlement in
Article 21 of the Digital Services Act do not bind us. We offer the review anyway, because a
restriction with no way to argue back is not a fair contract term.

**10.2 Complain to the regulator.** You may complain about us to the Austrian Digital Services
Coordinator — **KommAustria**, supported by RTR-GmbH (Article 53 of the Digital Services Act; KDD-G).
Contact details are in the **Legal notice** (`spun.ink/legal/imprint`).

**10.3 Go to court.** Nothing here limits your right to a court. Consumers keep their statutory forum;
the jurisdiction clause in the Terms applies to business Customers only. Where you are a consumer,
the alternative-dispute-resolution body and our participation stance are stated in the Terms and in
the Legal notice.

**10.4 If you sent us a notice** and disagree with what we decided, the same reply channel is open to
you, and the decision notice you receive under section 7.5 names it.

**10.5 Terrorist content removed under an order.** See section 11.4 — the challenge runs against the
authority that issued the order, and we will give you a copy of it on request unless the authority has
forbidden disclosure.

---

## 11. Terrorist content and removal orders

Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online has applied since
**7 June 2022**. It binds every hosting service offering services in the Union, whatever its size.
This section is our policy statement under its Article 7(1).

**11.1 The rule.** Terrorist content as defined in Article 2(7) of that Regulation (section 2(c)
above) may not be published through spun.ink. Where we become aware of it, we remove it or disable
access to it.

**11.2 Removal orders.** A competent authority may order us to remove terrorist content or disable
access to it in all Member States. **We execute such an order as soon as possible and in any event
within one hour of receipt.** Removal orders reach the contact point published in the **Legal notice**
(`spun.ink/legal/imprint`), which states the languages it accepts, as Article 15(2) requires. **The
one-hour clock runs around the clock**, and the Legal notice names who executes an order at any hour:
the managing director, personally.

**11.3 Preservation.** Content removed under a removal order, and the related data, are preserved for
**six months** from the removal — for possible review proceedings and for the investigation and
prosecution of terrorist offences — and longer if a competent authority or a court asks for it. The
preserved material is kept under technical and organisational safeguards and is accessed only for those
purposes.

**11.4 We tell you.** Where we remove or disable access to your content on this basis, we make that
information available to you, and on request we tell you the reasons and your rights to challenge the
order, or give you a copy of the order itself. **The one exception**: where the issuing authority
decides that there must be no disclosure for reasons of public security, we may not tell you anything
at all — for as long as necessary, and for no longer than six weeks, extendable by a further six weeks.

**11.5 We use no automated tools.** No competent authority has decided that spun.ink is "exposed to
terrorist content", so we are under no obligation to take specific measures under Article 5, and we
take none. We use **no automated detection tools** for terrorist content. Article 7(1) asks us to
explain the functioning of any specific measures "where appropriate" and "where applicable" — there
are none to explain, and we say so rather than implying a capability we do not have. The complaint
mechanism in Article 10 applies to content removed as a result of Article 5 specific measures; since
we operate none, it does not apply today. If that ever changes, we will publish the mechanism before
we take the first such measure.

**11.6 Imminent threat to life.** Where we become aware of terrorist content involving an imminent
threat to life, we promptly inform the authorities competent for the investigation and prosecution of
criminal offences in the Member States concerned.

**11.7 Transparency report.** Article 7(2) requires a report, published before 1 March of the
following year, only for a calendar year in which we took action against terrorist content or were
required to. **This has not happened, so no report is due.** If it happens, the report will be
published on `spun.ink/legal`.

---

## 12. Orders from authorities and courts, and law-enforcement requests

**12.1 Orders to act against illegal content (Article 9 of the Digital Services Act).** On receiving
an order from a national judicial or administrative authority, we inform the issuing authority (or the
authority named in the order) **without undue delay** whether and when we gave effect to it. At the
latest when we do, we inform you — the affected Customer — of the order, the effect given to it, the
reasons, the territorial scope and your possibilities for redress. An order must meet the conditions
Article 9(2) sets, including a legal basis, a statement of reasons, the exact location of the content,
a territorial scope limited to what is strictly necessary, and transmission in a language we have
declared.

**12.2 Orders to provide information (Article 10).** We answer such orders from **information we have
already collected for the purpose of providing the service and that is within our control** — nothing
more. At the latest when we give effect to the order, we inform you, unless the order or the law
forbids it. Nothing in the Digital Services Act obliges us to record our Customers under their real
names, and we do not.

**12.3 What we actually hold about you**, so that you can judge what such an order can reach: your
e-mail address; a name, if you gave one; your plan and subscription status; verification timestamps;
your site handles and any custom domains; and your Content itself. We record **no IP address and no
user agent** for management (MCP) requests. Billing data — legal name, billing address, VAT
identification number, card — is held by our payment provider, not by us; the **Privacy Notice**
(`spun.ink/legal/privacy`) sets this out in full.

**12.4 Suspicion of a criminal offence threatening life or safety.** Where we become aware of
information giving rise to a suspicion that a criminal offence involving a threat to the life or
safety of a person has taken place, is taking place or is likely to take place, we promptly inform the
law-enforcement or judicial authorities concerned and provide all relevant information available
(Article 18 of the Digital Services Act). This is a duty, not a discretion, and it overrides any
expectation of confidentiality.

**12.5 Austrian disclosure procedure.** Under § 13 ECG we must give an Austrian court the information
by which a Customer of our service can be identified for the prevention, investigation or prosecution
of criminal offences, and give an Austrian administrative authority a Customer's name and address where that
is an essential precondition for its task. **A private third party gets your name and address only
through the court route in § 14 ECG** — before the competent commercial court, on showing an
overriding legal interest. We do not hand over a Customer's identity on a private demand, however
insistent. Removal orders under § 15 ECG — the ones protecting an individual's dignity, applied for
under Article 9 of the Digital Services Act — reach our contact point electronically; the court must
tell the applicant, within 14 days of transmission, whether and what response we gave. That 14-day
clock is the court's duty to the applicant, not a deadline for our own response.

**12.6 Requests from outside the EU** are answered only through mutual legal assistance or another
lawful channel, never on a voluntary basis, and you are told before we comply wherever the law permits
it. The Terms' switching-and-export section carries this commitment in full.

**12.7 One thing we will not tell you.** You may read elsewhere that a host's liability is governed by
§§ 13 to 18 ECG. That has not been true since **the end of 16 February 2024**, when §§ 17 to 19 ECG
were repealed. The liability rules for hosting services are now **Articles 4 to 8 of the Digital
Services Act**, which have applied since **17 February 2024**. §§ 13 to 16 ECG remain in force, but in
a different role — disclosure claims and removal-order procedure, as described above.

---

## 13. Repeated breaches, and repeated bad notices

**13.1 The legal position, honestly.** Article 23 of the Digital Services Act — the duty to suspend
recipients who frequently provide manifestly illegal content, and to stop processing notices from
people who frequently submit manifestly unfounded ones — binds **online platforms**. spun.ink is a
hosting service, not an online platform, and Article 19(1) excludes micro and small enterprises from
that whole Section in any case. **So Article 23 does not bind us.** We are telling you what we do
anyway, because "we can do whatever we like about repeat cases" is not an acceptable answer.

**13.2 What we do about repeated breaches by a Customer.** Where notices about your Sites are upheld
repeatedly, we move up the ladder in section 8 rather than repeating rung 1 forever. Our working rule:
**three upheld notices within twelve months** move an account from warnings to suspension, and further
breaches to termination. Every step still comes with a statement of reasons (section 9) and the reply
channel (section 10), and we look at the individual case — the number of items, their gravity, the
proportion they represent, and whether you fixed the earlier ones.

**13.3 What we do about repeatedly unfounded notices.** Where a sender repeatedly submits notices that
are manifestly unfounded, we may — after a warning, and for a stated period — stop processing further
notices from that sender. Notices concerning content of the kind in section 2(b), and notices from
authorities, are never affected by such a measure. The decision is made by a person and is open to the
same reply channel.

---

## 14. Transparency reporting

**14.1 We publish no annual transparency report, and here is why.** Article 15(1) of the Digital
Services Act would require providers of intermediary services to publish an annual report on their
content moderation. Article 15(2) exempts providers that qualify as **micro or small enterprises**
within the meaning of Recommendation 2003/361/EC. City of Code GmbH is a micro-enterprise (fewer than
10 staff and no more than €2 million in turnover and balance-sheet total), so the duty does not apply.
We say this plainly instead of leaving a reader to wonder where the report is. It is the **only**
Digital Services Act duty for hosting services that our size removes: Articles 9, 10, 11, 12, 14, 16,
17 and 18 all apply to us in full, today.

**14.2 We keep the log anyway.** For every notice we record when it arrived, when it was acknowledged,
what was decided, what was done and when we told everybody. That log is voluntary. It exists so that
the first report we ever owe can be built from real data rather than reconstructed.

**14.3 When this changes.** The exemption falls away at 50 staff or €10 million in annual turnover or
balance-sheet total (the small-enterprise threshold). Reaching it obliges us to publish, and this
section will be rewritten before the first report is due.

**14.4 Terrorist content.** The separate report under Article 7(2) of Regulation (EU) 2021/784 is not
size-dependent, but it is only due for a year in which we acted or were required to act. See
section 11.7.

---

## 15. Changes to this policy

We may change this policy. We will tell you by e-mail to the address on your account **at least 30
days** before a change takes effect, saying what changed, why, and when it takes effect. If you do not
object before that date, the new version applies to your account from then on. **If you object, or if
you would simply rather leave, you may terminate the contract free of charge with effect from the date
of the change, and we will not charge you for any period after it.** For a material change we may ask
for a fresh, explicit acceptance instead of relying on your silence.

Changes never apply retroactively, and **nothing is switched off, suspended, degraded, unpublished or
gated because you have not accepted or not answered a change notice.** Every version and its effective
date stay published, so you can always see what applied when.

---

## 16. Contact, and the other documents

| Purpose | Address |
|---|---|
| Anything about **content**: reporting illegal content (notice-and-action, section 7), rights-holder claims, removal orders | `abuse@spun.ink` |
| Anything about **you and us**: contesting a measure, the contact point for recipients of the service, data protection and data-subject requests, withdrawal declarations, the contract | `support@spun.ink` |

Two addresses, one company, and a person reads both. Write to either if you are unsure — nothing is
lost by choosing the wrong one.

The languages we accept are **German and English**. The postal address, the contact point for
authorities, the contact point for removal orders under Regulation (EU) 2021/784, and our supervisory
authority are in the **Legal notice**.

**The other spun.ink legal documents** — each of them part of, or accepted with, the Terms:

- **Terms of Service** — `spun.ink/legal/terms`
- **Privacy Notice** — `spun.ink/legal/privacy`
- **Legal notice** (Impressum, disclosure and contact points) — `spun.ink/legal/imprint`
- **Data Processing Agreement** — `spun.ink/legal/dpa`
- **Right of withdrawal** — `spun.ink/legal/withdrawal`

**spun.ink is a product and service of City of Code GmbH**, Adnet 436, 5421 Adnet, Austria · Commercial register FN 362676y, Landesgericht Salzburg · VAT identification number
ATU66573656.

---

*Version 2026-08-23 · effective 2026-08-23 · the content hash of this document is the SHA-256 of
the bytes served at `spun.ink/legal/acceptable-use.md`, printed on the HTML page at
`spun.ink/legal/acceptable-use`.*

*Sections 3(a)–(d) and 3(h) are adapted from the [Basecamp open-source
policies](https://github.com/basecamp/policies) / [CC BY
4.0](https://creativecommons.org/licenses/by/4.0/).*