Notice and Action Policy
Draft, not in force. How to report illegal content, and the points of contact for authorities.
DraftNot in force until it is approved.
DRAFT. Not in force. Compiled by an agent from blueprint/27 §1.1, §4, §5, §6, §8.1 and §8.2 and the Digital Services Act as the plan cites it. No standard base was named by the plan (27 §2.0: "law-enforcement guidelines, ... no open standard found"), so this document is Studio's own clauses. It is not legal advice. No lawyer has reviewed it. It is not in force until Zakaria approves it (D54). The plan reads Studio as a hosting service and not an online platform under the DSA; that reading is Studio's own and is not a finding (27 §4).
No standard base. Written for Surf Studio. (27 §2.0 rule 5)
legal.document_versions field | Value |
|---|---|
doc | No value fits (terms, aup, dpa, outreach_arrangement, privacy, cookies, app_templates, idea_use only). See SCHEMA-FIT.md |
1. Points of contact
These are contact points, and nothing more. They are not a legal representative.
| Contact | Address | For |
|---|---|---|
| Single point of contact for authorities (DSA Art. 11) and for recipients of the service (DSA Art. 12) | legal@surfstudio.app | Legal notices; Member State authorities, the Commission, the Board; Founders and others who want to reach Studio directly |
| Reports about content | surfstudio.app/report (web form); abuse@surfstudio.app; copyright@surfstudio.app | Anyone |
| Data protection | privacy@surfstudio.app | Data subjects and supervisory authorities |
| Orders from authorities | lawenforcement@surfstudio.app | Authorities |
| Security vulnerabilities | security@surfstudio.app | Researchers. Not a notice of abuse |
Languages: English. You may write to these addresses and receive a reply from a person; Studio does not use only automated tools to communicate. These addresses are on surfstudio.app, which the plan buys when Studio's Site ships (27 §14 rule 1); the page is not published before the domain and the mailboxes exist.
No representative. Surf Platforms has not appointed a representative in the European Union or the United Kingdom. Write to privacy@surfstudio.app, or to legal@surfstudio.app for a legal notice. (27 §1.1 item 3, unchanged)
2. What Studio hosts, and what that means
Studio stores material at its Founders' direction. In this version that is the material a Founder submits for a Scan, Studio's captures of the Founder's App, and the films and files made for the Founder. Studio hosts no Founder's App or Site in this version. Where a later version does, a Founder who runs an App with public user content is the provider of that content, and Studio's role is as the host (27 §4).
3. How to report content
3.1 Use the web form at surfstudio.app/report or one of the addresses above. Every report is recorded first and gets an identifier.
3.2 A notice should contain (DSA Art. 16(2); the form asks for them one at a time):
- an explanation of why you consider the content illegal, or against the Acceptable Use Policy;
- the exact location of the content: each URL, on a host Studio serves;
- your name and email address (not needed for a report about child sexual abuse material);
- a statement that you believe in good faith that the information is accurate and complete;
- for copyright, the additional elements in the Copyright and Repeat-infringer Policy;
- for intimate images shared without consent: your signature, information to locate the image, a good-faith statement that it was shared without consent, and your contact details.
3.3 An incomplete notice is answered with what is missing.
3.4 Reporting organisations (brand-protection firms, registrars, hotlines) may send reports through Studio's reporting interface (POST /api/v1/abuse/reports) with a key Studio issues to the organisation. Its notices are checked the same way.
4. What Studio does
4.1 Acknowledges the report and tells the reporter the outcome (DSA Art. 16(4), (5)).
4.2 Tells the Founder what was reported and how long they have, and lets them remove the material, dispute the notice or ask Studio to decide. The reporter's details are held back where the law or safety requires it.
4.3 Decides in a timely, diligent and objective way (DSA Art. 16(6)): a person decides, with an automated recommendation; the decision records the provision relied on. Studio's targets, from receipt:
| Kind | Acknowledge | Founder's time | Studio acts by |
|---|---|---|---|
| Child sexual abuse material | Automatic | None; the Founder is told after | Blocked on a hash match; reported to the US National Center for Missing & Exploited Children within 24 hours of confirmation |
| Intimate images shared without consent | 1 hour | 12 hours | 24 hours, and never later than 48 hours from receipt |
| Threat to life | 15 minutes | None | Authorities told within 1 hour of assessment |
| Phishing or malware | 1 hour | None if confirmed by a reputation service or Studio's check, otherwise 4 hours | Restricted within 1 hour of confirmation |
| Copyright | 1 business day | 48 hours | 72 hours |
| Trademark, other illegal content, Acceptable Use Policy | 1 business day | 72 hours | 7 days |
These are Studio's targets for its own work, in business days of the entity's calendar, not promises to a reporter. Removal of intimate images within 48 hours is a commitment (27 Rule 11).
4.4 Acts, with the smallest thing that ends the harm: one object, then one route, then one App, then one account (27 Rule 8). Restricted content returns an HTTP 451 response with a link to the statement of reasons.
4.5 Explains. For every restriction, Studio sends the Founder a statement of reasons (DSA Art. 17(3)): what content and what action, the facts and circumstances, whether automated means were used to detect or decide, the legal or contractual ground, and how to appeal.
4.6 Appeal. A Founder may appeal once. Zakaria decides, with a second automated review recorded; a granted appeal reverses the action. (27 §6.2 item 6)
4.7 Acts before telling the Founder only for apparent child sexual abuse material, intimate images past the Founder's time, a threat to life, confirmed phishing or malware, a court order addressed to Studio, or a vendor deadline that would pass inside the Founder's time. Where Studio learns of a threat to life or safety, it tells the authorities (DSA Art. 18).
5. Child sexual abuse material
5.1 Studio compares images and videos it stores against known-material hashes before any model sees them.
5.2 A match is moved to a locked evidence store and removed from view. Studio reports apparent material to the National Center for Missing & Exploited Children's CyberTipline within 24 hours of confirmation and keeps the report's contents for one year, longer if an authority asks. Studio does not delete it early and does not hand it to a Founder. (27 §8.1; 18 U.S.C. §2258A)
5.3 Studio's registration with the CyberTipline: [PENDING. 27 §8.1 item 1 says Studio registers on day 0 at no fee. It is not recorded as done. Do not publish this sentence as in force until it is].
6. Intimate images shared without consent
Studio completes a valid removal request within 48 hours of receiving it, whoever runs the App, and makes reasonable efforts to find identical copies. (27 Rule 11, §8.2; the US TAKE IT DOWN Act, which the plan reads Studio not to be covered by, is applied anyway.)
7. Orders from authorities
Orders go to lawenforcement@surfstudio.app. Studio answers valid process addressed to it, redirects an authority to the Founder where the data is the Founder's, and tells the Founder before disclosure unless an order or law forbids it. (27 §10) The full guidelines are a separate document (27 §10) and are not drafted here.
8. Changes
A change follows Terms entry T-12.