# spun.ink — Legal notice > Version 2026-08-20 · effective 2026-08-20 · content hash: the SHA-256 of the served bytes, printed > on the page itself and reproducible from the raw markdown at `spun.ink/legal/imprint.md`. > Applies to: spun.ink and every service City of Code GmbH provides under that name — the platform > site at `spun.ink`, customer sites served at `.myspun.ink`, and customer domains served by > spun.ink. > Supersedes: — > This page is **statutory information, not a contract term.** There is nothing here to accept. The > contract is the **Terms of Service** (slug `terms`, published at `/legal/terms`). This page is > written in English; a German courtesy version may follow. --- ## Summary in plain words - spun.ink is operated by **City of Code GmbH**, a company seated in Adnet, Austria. - Section 1 tells you who we are and how to reach us. You can always write to us by e-mail, and a person reads that mailbox. - Sections 5 to 8 are for authorities, for our customers and for anyone who wants to report content on a site we host. They name the mailboxes, the languages we work in, and the authority you can complain to about us. - Section 9 says where your data physically lives and what we do if a government outside the EU asks for it. - Section 12 is different in kind: it is a short reminder that **the website you build on spun.ink needs its own legal notice.** Ours does not cover yours. **This summary is not the legal notice — the numbered sections below are.** Where the summary and a numbered section differ, the numbered section is what applies. --- ## 1. Who we are spun.ink is a product and service of City of Code GmbH. ``` City of Code GmbH Adnet 436, 5421 Adnet, Austria E-mail: support@spun.ink · +43 664 8111838 Commercial register: FN 362676y · Firmenbuchgericht: Landesgericht Salzburg VAT identification number: ATU66573656 Managing director (Geschäftsführer): DI Norbert Egger, BSc Chamber membership: Wirtschaftskammer Salzburg, Fachgruppe UBIT Trade (Gewerbe): Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik (IT-Dienstleistung), granted in Austria · GISA no. 18008487 Applicable trade law: Gewerbeordnung 1994 (ris.bka.gv.at) Trade authority (Gewerbebehörde): Bezirkshauptmannschaft Hallein ``` Registered seat (Sitz): Adnet, Austria. The address above is the address at which City of Code GmbH can be served with official and judicial documents. ## 2. How to reach us | What you want | Where to write | |---|---| | Anything about **content** — reporting illegal content on a site we host (see section 7), a rights-holder claim, a removal order | abuse@spun.ink | | Anything about **you and us** — this notice, the Terms, a question about the service, data protection and requests about your own personal data, withdrawing from a consumer contract (see the **Right of withdrawal**, slug `withdrawal`) | support@spun.ink | Two addresses, one company, and a person reads both. Write to either if you are unsure — nothing is lost by choosing the wrong one. Postal mail reaches us at the address in section 1. Austrian law requires a second, direct channel besides e-mail — a telephone number or a contact form. Ours is **+43 664 8111838** (section 1), which is what § 5 Abs 1 Z 3 ECG asks for as the Supreme Court reads it. Together with the two e-mail addresses and the postal address it also satisfies Article 12(1) DSA, which requires letting recipients of the service **choose the means of communication** rather than forcing one on them. **How fast we answer.** Within the period the applicable law allows, and no later: **one hour** for a removal order under Article 3 of Regulation (EU) 2021/784, counted from receipt; **one month** for a request about your own personal data (Article 12(3) GDPR), extendable by two months for a complex request, and we tell you if we extend; **without undue delay** for a notice about illegal content (Article 16 DSA), which for a company this size means the same working day where the report is clear. A person reads both addresses; nothing here is answered by a machine. ## 3. Trade law, chamber and supervision - City of Code GmbH is entered in the Austrian commercial register (Firmenbuch); the register number and the register court are in section 1. - It is a compulsory member of **Wirtschaftskammer Salzburg**, professional group (Fachgruppe) **UBIT** — Unternehmensberatung, Buchhaltung und Informationstechnologie. - The trade exercised is *Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik* (IT services), a free trade (freies Gewerbe) **granted in Austria**. - The applicable trade law is the **Gewerbeordnung 1994**. The consolidated text is public at . - The competent trade authority (Gewerbebehörde) is the **Bezirkshauptmannschaft Hallein**. - We deliberately state no share-capital figure anywhere on this site. Under UGB § 14 Abs 2 an Austrian company that mentions its capital must then also state the amount of contributions not yet paid up; we avoid the question by not mentioning capital at all. Do not add a figure here. ## 4. Disclosure under § 25 of the Austrian Media Act (Offenlegung gemäß § 25 MedienG) Under MedienG § 25 Abs 1 last sentence, a provider that is also a *Diensteanbieter* under ECG § 3 Z 2 may publish this disclosure together with the information in section 1. That is what this page does. We publish the **full disclosure for a "large website"**, because spun.ink carries a blog whose articles go beyond presenting our own products and are capable of influencing public opinion. That classification is our own conservative reading; no court or authority has ruled on it for a website of this kind, and counsel may later conclude that the shorter disclosure under MedienG § 25 Abs 5 would have been enough. - **Medieninhaber (media owner):** City of Code GmbH - **Unternehmensgegenstand (business purpose):** Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik — the development and operation of software and online services, spun.ink among them - **Sitz (seat):** Adnet, Austria; full address in section 1 - **Vertretungsbefugte Organe (bodies authorised to represent):** managing director (Geschäftsführer) DI Norbert Egger, BSc - **Aufsichtsrat (supervisory board):** none - **Beteiligungsverhältnisse (ownership):** Dipl.-Ing. Norbert Egger, BSc holds the entire share capital — **100 % of the capital and 100 % of the voting rights** — directly and in his own name. There is no second shareholder, no trustee relationship (Treuhandverhältnis), no silent participation (stille Beteiligung), no foundation and no association involved at any level. - **Other media undertakings (MedienG § 25 Abs 3):** none — the person named above owns no other Medienunternehmen and no Mediendienst, so there is nothing to list. **Grundlegende Richtung (Blattlinie).** The German wording is the operative text; the English is a translation. > *Information über die Produkte und Dienstleistungen der City of Code GmbH, insbesondere die > agentenbetriebene Website-Plattform spun.ink, Förderung von deren Absatz sowie Beiträge und > Meinungen zu KI-agentengestützter Website-Erstellung und Web-Publishing.* > Information about the products and services of City of Code GmbH, in particular the agent-operated > website platform spun.ink; promotion of their sale; and articles and opinions on website creation > and web publishing by AI agents. A change to this declaration takes effect only once it has been published (MedienG § 25 Abs 4). **This disclosure covers spun.ink's own site and blog only.** For a website a customer builds and publishes on spun.ink, the customer is the Medieninhaber — see section 12. ## 5. Contact points under the Digital Services Act and the TCO Regulation Regulation (EU) 2022/2065 (Digital Services Act, "DSA") has applied since 17 February 2024. Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online ("TCO Regulation") has applied since 7 June 2022. Both require us to name and keep current the contact points below. **Point of contact for authorities — Article 11 DSA.** For Member State authorities, the European Commission and the European Board for Digital Services. - Mailbox: **abuse@spun.ink** — the content channel, which is where an order or a request about hosted content is acted on. - Postal address: as in section 1. - Languages: **German and English.** **Point of contact for recipients of the service — Article 12 DSA.** For our customers and for anyone who uses a site we host, including visitors of customer sites. - Mailbox: **support@spun.ink** (see the mailbox note in section 2). - Postal address: as in section 1. - Languages: **German and English.** - **A person reads this mailbox and answers it. This channel does not rely solely on automated tools.** The `submit_feedback` tool in the platform's MCP interface is *not* this contact point: it is a one-way channel for a customer's agent and has no reply path. **Contact point for removal orders — Article 15 of Regulation (EU) 2021/784.** For removal orders concerning terrorist content. - Mailbox: **abuse@spun.ink** — the same content channel as the Article 11 point, monitored with the one-hour deadline in mind. - Postal address: as in section 1. - Languages: **German and English.** - **Who executes it:** the managing director, personally, at any hour — reachable on the telephone number in section 1. City of Code GmbH is a one-person company, which is why the answer is a name and not a rota: there is nobody for the order to wait behind. ## 6. What kind of service spun.ink is spun.ink stores information provided by our customers, at their request, and makes it available on each customer's own web address. In the DSA's categories that makes City of Code GmbH a provider of a **hosting service** (Article 3(g)(iii)) — **not an online platform**. The reasoning in one line: every customer site has its own origin and its own address, there is no shared interface across customers, no feed, no ranking and no recommendation of one customer's content to another's audience; what is published, and where, is decided by the customer. **Honest caveat:** this is our reading of the DSA, supported by the guidance of the Austrian Economic Chamber. (The regulator RTR's own DSA pages list only the generic service categories — mere conduit, caching, hosting, online platform — without addressing website-builder classification specifically, so we do not cite RTR for that reading.) There is no ruling of the Court of Justice of the European Union and no decision of the Austrian Digital Services Coordinator on website builders. The practical difference is small — the duties this page discharges by existing (Articles 11, 12, the Article 15 transparency-report exemption, and 16) apply to us either way. Article 14's terms-and-conditions content-moderation disclosure lives in the Terms of Service instead (section 7); Articles 17 and 18 are case-by-case conduct duties triggered by an actual moderation action or removal order, not duties a static page discharges by existing. **Transparency report.** Article 15 DSA requires an annual transparency report, but exempts providers that are micro or small enterprises within the meaning of Commission Recommendation 2003/361/EC. City of Code GmbH is below those thresholds today, so no report is published. This exemption ends if the company grows past them, and we will publish a report from that year on. Under Article 7(2) of the TCO Regulation a transparency report is due only for a year in which we actually took action against terrorist content; none has occurred. ## 7. Reporting illegal content on a site we host If you believe that content on a website hosted by spun.ink is illegal, write to **abuse@spun.ink** (see the mailbox note in section 2). This is our notice-and-action mechanism under Article 16 DSA. There is no web form today; the mailbox is the channel. So that we can act on a notice, please include all four of these: 1. **Why** you consider the content illegal, explained well enough for us to follow — and the legal basis, if you know it. 2. **Where** it is: the exact URL or URLs. You may report **several URLs in one notice**. 3. **Who you are:** your name and e-mail address. *Exception:* a notice concerning an offence under Articles 3 to 7 of Directive 2011/93/EU (child sexual abuse material) may be sent **without** a name or e-mail address. 4. **A statement** that you believe, in good faith, that what you say is accurate and complete. What happens next: - If your notice carries contact details, we confirm receipt without undue delay. - **A person reviews the notice. We use no automated content moderation** — no automated tool decides whether content stays up or comes down. - We decide in a timely, diligent, non-arbitrary and objective way, and we tell you the outcome and how you can seek redress against that decision. - The customer affected by a measure receives a statement of reasons and can contest it. The content rules themselves, the measures we may take, the statement of reasons and the customer's route to contest a decision are set out in the **Terms of Service** (slug `terms`, published at `/legal/terms`) — Article 14(1) DSA requires them there, and that is where they live. ## 8. Supervisory authority and your right to complain about us The Austrian **Digital Services Coordinator** is the **Kommunikationsbehörde Austria (KommAustria)**, supported by **RTR-GmbH**, designated by the Koordinator-für-digitale-Dienste-Gesetz (KDD-G), in force since 17 February 2024. City of Code GmbH is established in Austria, so KommAustria is our Coordinator of establishment. Under Article 53 DSA you may lodge a complaint against us with the Digital Services Coordinator of the Member State **where you are located or established** — that Coordinator assesses it and, where appropriate, passes it to ours. For the trade-law side, the competent authority is the Bezirkshauptmannschaft Hallein (section 3). For data protection, see section 10 of the **Privacy Notice** (slug `privacy`, published at `/legal/privacy`); the supervisory authority there is the Austrian Datenschutzbehörde. ## 9. Where your data lives — information under Article 28 of the Data Act Regulation (EU) 2023/2854 (Data Act) has applied since 12 September 2025. Article 28(1) requires us to publish, and keep current, the jurisdiction our infrastructure is subject to and the measures we take against unlawful access by governments outside the EU. Article 28(2) requires our contracts to name this page; the Terms of Service do. **Scope note.** Article 28(1)(b) and Article 32 are legally scoped to **non-personal data** only (Data Act Art. 1(3)(f): "Chapter VII applies to any non-personal data held in the Union by providers of data processing services"). Most of what spun.ink stores — account data, and Submissions, which may include personal data — is *personal* data. For that data, the government-access protection that applies is GDPR Chapter V (standard contractual clauses, the EU-U.S. Data Privacy Framework), covered in the **Privacy Notice** (slug `privacy`, published at `/legal/privacy`), not the Data Act. The jurisdiction disclosure in Article 28(1)(a) below applies regardless of data category; the measures in the next subsection are split accordingly. **Jurisdiction of the ICT infrastructure — Article 28(1)(a).** - All production infrastructure for spun.ink runs in **Google Cloud region `europe-west1` (Belgium)** — the application cluster, the managed MySQL database that holds all content and account data, the private storage bucket that holds uploaded assets, the container registry, the log store, the secret store and the certificate service. - That infrastructure is operated under EU law by **Google Cloud EMEA Limited** (Ireland), whose ultimate parent is **Google LLC** (United States). The Data Processing Agreement, Annex 2, names the entity and its authorised group sub-processors in full. - Outbound account e-mail (address verification, recovery, deletion) is relayed through Google Workspace. - Payments, invoices and receipts are processed by **Stripe Payments Europe, Limited** (Ireland). - City of Code GmbH is an Austrian company; **Austrian and EU law apply** to the service and to the contract. **Measures against international governmental access — Article 28(1)(b) and Article 32.** These two Articles bind us for **non-personal data**; what they require, for that category: - **Recognition only under a treaty:** a judgment, decision or order of a court or authority outside the EU requiring us to hand over or give access to non-personal data held in the Union is recognised or enforceable only if it rests on an international agreement in force — for example a mutual legal assistance treaty. Where no such agreement exists, we review the request against the conditions in Article 32(3) and object where they are not met. - **Minimum data:** where a request must be answered, we provide the minimum amount of data the request permits. - **We tell you:** we inform the customer that a request from an authority outside the EU exists **before** complying with it — unless the request serves law-enforcement purposes and for as long as telling you would undermine that activity. **As a matter of our own operational practice** — for all data we hold, personal and non-personal alike, and not because Article 28/32 mandates it for personal data: - **Region pinning:** data at rest stays in the EU region named above. We do not replicate customer data to any region outside the EU. - **Private storage:** the asset bucket is private; files are served through short-lived signed URLs, never by public bucket access. - **Encrypted transport:** TLS 1.2 or better on every connection to the service. - **Contracts:** data-processing agreements with our infrastructure and payment providers, including the providers' commitments on how they handle government requests for data. Your right to switch provider, to export your content, and what we hand over when you leave, are in the **Terms of Service** (slug `terms`, published at `/legal/terms`). The register of the data structures and formats we export is the agent documentation on spun.ink. ## 10. Complaints and consumer dispute resolution Write to **support@spun.ink** (see the mailbox note in section 2). We would rather settle a complaint directly, and we answer every one. For **consumers**, the Austrian alternative-dispute-resolution body competent for contracts concluded online is the **Internet Ombudsstelle** — the body Austrian law names as *"der Internet Ombudsmann"* (AStG § 4 Abs 1 Z 6) — . The statutory fallback body (Auffangschlichtungsstelle, AStG § 4 Abs 2) is the **Schlichtung für Verbrauchergeschäfte** — . **We do not commit in advance to taking part in proceedings before a consumer arbitration body, and we are not obliged to.** Participation is voluntary for a service like ours, and AStG § 19 Abs 1 and 2 only require a trader who commits or is obliged to name a body. We name the Austrian body above so that you can reach it anyway, and we decide case by case — a complaint to us is answered by a person either way (section 10 of the Acceptable Use Policy). Independently of that decision: if a dispute with a consumer cannot be settled directly, we will send the consumer, on paper or another durable medium, the name and website of the competent body and state whether we will take part in a proceeding before it (AStG § 19 Abs 3). This section is about consumers. Business customers are not covered by these bodies; the Terms of Service govern. ## 11. The other spun.ink legal documents | Document | Slug | Published at | |---|---|---| | **Terms of Service** — the contract; content rules, moderation, billing, switching and export | `terms` | `/legal/terms` | | **Privacy Notice** — what we do with personal data | `privacy` | `/legal/privacy` | | **Data Processing Agreement** — where we act as processor for a customer's visitor data | `dpa` | `/legal/dpa` | | **Acceptable Use Policy** — what may not be published or done | `acceptable-use` | `/legal/acceptable-use` | | **Right of withdrawal** — the consumer withdrawal instruction and model form | `withdrawal` | `/legal/withdrawal` | | **Legal notice** — this page | `imprint` | `/legal/imprint` | Each document is served both as a web page and as its raw text at the same address with `.md` appended, without a login and without JavaScript. **Where two things you may be looking for actually live.** There is no separate "DSA page" and no separate sub-processor page. The DSA information is split on purpose: the contact points, the supervisory authority, the service category and the reporting channel are on *this* page (sections 5 to 8); the content rules, the moderation policy, the statement of reasons and the redress path are in the Terms of Service, where Article 14(1) DSA requires them anyway. The list of sub-processors and the catalogue of technical and organisational measures are Annexes 1 and 2 of the Data Processing Agreement. Both are consolidations we may split out later, not omissions. --- ## 12. Imprint requirements for your own site *This section is guidance for spun.ink customers. It is not part of the statutory information above, and it is not legal advice.* The legal notice on this page covers **spun.ink itself**. It does not cover the website you build and publish with spun.ink. For that site, you are the operator — and in Austrian terms the *Diensteanbieter* under ECG § 3 Z 2 and the *Medieninhaber* under the Media Act. What that means in practice: - **Your site probably needs its own legal notice**, as its own page, reachable from every page. Under Austrian law it names your name or firm, your address, an e-mail address plus a second direct channel, your register and VAT numbers where you have them, your chamber and trade, and your supervisory authority. - **If your site carries content beyond presenting yourself** — a blog, opinion pieces, journalism — the fuller disclosure under MedienG § 25 may apply to it too: your business purpose, the people authorised to represent you, your owners, and a declaration of the site's basic direction. - **Your site needs its own privacy notice**, as a separate page, if it collects anything from visitors — a form, an analytics script, an embedded font or video. - **Anything non-essential you inject** through your site's head code — analytics, tracking pixels, third-party fonts, embeds — needs your own consent mechanism (TKG 2021 § 165 Abs 3). **spun.ink ships none.** - **The free-plan banner is not an imprint.** The "Made with spun.ink" line on a free site identifies the platform, not you, and satisfies no disclosure duty of yours — or of anyone else's. - **Where you are established decides which rules apply to your site — with one big exception.** Within the European Economic Area, the requirements in the coordinated field are those of the state in which you are established (ECG § 20 Abs 1, which applies only inside the EEA) — except for consumer-contract obligations, including statutory information duties, which ECG § 21 Z 6 excludes from that principle entirely: if your site sells to consumers elsewhere in the EEA, their state's consumer-information rules may still apply to you, not just your home state's. Outside the EEA, other rules apply. Either way they may demand more, or different, information than the list above. We do not check whether your site complies, and we give no legal advice. Your agent can create a legal-notice page for your site the same way it creates any other page — ask it to.