Endorr Acceptable Use Policy

Section summaries in italics are for convenience only and are not legally binding.

Company details

---

1. Why we have this policy

Summary: Endorr is for preparing and storing print files. Don't use it to store, make or spread anything illegal or harmful.

1.1 This policy applies to everything you do with the Endorr Services, including:

• Endorr Studio, FileFixxr, PixlPilot AI and the PixlPilot API, PwrMockup and PrintReadySheets;
• Endorr Cloud and the Endorr Cloud for Windows app;
• all files, including temporary uploads, private files and files shared by link; and
• everything you create with our tools.

1.2 It applies to every user, including everyone in an organisation. Organisation owners and admins are responsible for making sure their members follow it.

1.3 If you break this policy, we may act under section 9, and the Terms of Service apply.

2. Zero tolerance: child sexual abuse material

Summary: Never. We act immediately, report it to the police, and close the account for good.

2.1 You must never upload, store, create, edit, upscale, process or share child sexual abuse material (CSAM), or any content that sexualises or sexually exploits minors (anyone under 18). This includes drawn, animated, AI-generated and AI-altered material. It also includes content that may not be illegal everywhere but sexualises minors.

2.2 If we become aware of apparent CSAM:

• we immediately disable access to it and to any share links;
• we suspend the account and its organisation access;
• we preserve the material and related information securely (section 12) and report it to the police and other competent authorities (section 11); and
• we close the account permanently, without notice and without the option to export files, and take steps to stop the person from creating new accounts.

2.3 There are no exceptions, including for "research", "awareness", "evidence" or "humour". If you come across CSAM, do not download, copy or share it, even to report it. Report the link or file location to us (section 8) or to the police.

3. Prohibited content

Summary: These kinds of content are not allowed anywhere in Endorr, whether private, shared or generated.

You must not upload, store, create, process or share content that:

3.1 Terrorism and violent extremism: promotes, glorifies, supports, recruits for, or gives instructions for terrorist offences or violent extremism. This includes propaganda from terrorist organisations and manifestos or footage of attacks shared to celebrate them.

3.2 Dangerous instructions: gives instructions or recipes for making or obtaining:

• illegal drugs or their precursors;
• weapons, including 3D-printed or untraceable firearms, or their illegal modification; or
• explosives, incendiary devices, or chemical, biological, radiological or nuclear agents.

3.3 Non-consensual intimate imagery: sexual or intimate images or videos of a real person shared or made without their consent. This includes "deepfakes", AI-generated nudity of real people, and images altered to undress someone.

3.4 Violence, hate and harassment:

• threatens, incites or glorifies violence against people or animals;
• attacks or dehumanises people because of race, ethnicity, national origin, religion, disability, sex, gender identity, sexual orientation, age or a similar characteristic;
• harasses, bullies, stalks or doxxes a person (publishes their private information to harm them); or
• encourages suicide, self-harm or eating disorders.

3.5 Malware and hacking tools: viruses, ransomware, spyware, exploit kits, phishing kits or other code intended to cause harm or gain unauthorised access.

3.6 Intellectual property infringement: infringes copyright, trademark, design rights, portrait rights or other rights. This includes:

• artwork or photos you have no right to use or print;
• counterfeit merchandise designs, such as fake brand logos or "bootleg" sports, band or fashion designs; and
• designs that copy another brand's trademark or trade dress in a way that suggests a connection.

3.7 Fraud and forgery (especially relevant for print):

• counterfeit or imitation banknotes, coins, stamps, tax stamps or other means of payment;
• forged or fake identity documents, passports, driving licences, residence permits, diplomas, certificates, licence plates, permits, official seals or stamps;
• fake tickets, vouchers, gift cards, invoices, receipts, prescriptions, labels or packaging meant to deceive;
• phishing pages or materials, fake login screens, or impersonation of a brand or authority; and
• other content made to commit fraud or scams.

We make no exceptions for images of banknotes or identity documents, including "specimen" versions or props.

3.8 Privacy violations: personal data of others used without a lawful basis, including identity documents, health data or contact details collected to harass, defraud or expose people.

3.9 Anything else illegal: content that is illegal under EU law, Dutch law, or the law of the country where it is made available. This includes illegal goods and services, illegal gambling, and the sale of controlled substances.

4. Prohibited conduct

Summary: Don't abuse share links, our infrastructure or our AI.

You must not:

4.1 Misuse share links or storage:

• use Endorr Cloud or share links as a file-distribution, hosting or content-delivery service for the public;
• use share links to spread content to large or anonymous audiences, for example on forums or social media. Share links are for sending your own design and print files to clients, colleagues, printers and other people you choose;
• host websites, software downloads, pirated media or adult content; or
• use Endorr as storage infrastructure for another service.

4.2 Scrape or overload: access the Services by automated means other than our published APIs and limits; crawl share links; or overload, flood, spam or disrupt the Services.

4.3 Get around limits or security: bypass plan limits, token metering, storage limits, rate limits or security controls. This includes creating multiple accounts to farm free tokens or storage, abusing promotions, or sharing paid accounts outside your seats.

4.4 Test our security without permission: probe, scan or test our systems without our written permission. To report a security vulnerability, follow https://endorr.com/security.

4.5 Reverse engineer our models or software: extract, copy, reverse engineer or reconstruct our AI models, weights or training data. This includes systematic querying of PixlPilot to clone it, and using outputs to train a competing model. Reverse engineering of our software is also not allowed, except where the law allows it.

4.6 Commit fraud: payment fraud, stolen payment methods, chargeback abuse, or giving false information to get access.

4.7 Evade enforcement: create new accounts after we have closed yours for a violation, or help someone else do so.

4.8 Abuse our people or processes: harass our staff, or knowingly submit false or abusive reports or appeals.

5. Extra rules for AI tools

Summary: Our AI tools are for preparing artwork, not for making illegal or harmful content.

5.1 You must not use PixlPilot AI, FileFixxr, PwrMockup or any other Endorr tool to create, alter, enhance, upscale, vectorise, cut out, restore or "clean up" content that is prohibited under sections 2 or 3. Examples:

• upscaling or restoring CSAM or intimate images;
• removing clothing or backgrounds to sexualise a real person;
• removing watermarks or copyright notices from images you don't have rights to; and
• making counterfeit banknotes or IDs print-ready.

5.2 You must not try to get around safety filters or restrictions in our AI tools.

5.3 If you use the PixlPilot API in your own product, you are responsible for making sure your users follow this policy. You must have your own process for handling reports about content processed through your integration.

6. How we look for abuse

Summary: We act on reports, and we may use automated tools that compare files against lists of known illegal material. We don't routinely look through your private files.

6.1 Reports. Most of our moderation starts with reports from users, rights holders, trusted flaggers, hotlines and authorities (section 8).

6.2 Automated detection. We may use automated tools on files when they are uploaded, processed or shared. These tools:

• compare a digital fingerprint ("hash") of a file with lists of known illegal material, such as known CSAM or known terrorist content, maintained by specialised organisations;
• detect malware; and
• detect abuse patterns such as mass sharing, link crawling or token fraud.

A hash match tells us that a file is the same as, or very similar to, a known item. It does not "look at" or interpret your design.

6.3 No routine manual review. We do not routinely open or look through private files by hand. Our staff only look at files:

• when a file has been reported or flagged by automated tools;
• when needed to investigate a specific suspected violation, a security incident or fraud;
• when you ask us to (for example in a support case); or
• when the law requires it.

For suspected CSAM, a designated staff member confirms the material only to the minimum extent needed, documents that step, and never downloads or redistributes it. We do not actively search for CSAM beyond the automated measures in section 6.2.

6.4 AI training is separate. Detection and moderation are not the same as AI training. We use files for AI training only if you have opted in (see the Privacy Policy).

6.5 Automated decisions. Some automated actions happen immediately, for example blocking an upload that matches known CSAM or malware. Every decision to close an account is reviewed by a person. For suspected CSAM, that person reviews the match and account information, not the material itself. Every statement of reasons tells you whether automated means were used.

7. Content you share by link

Summary: Shared content is held to the same rules, and anyone can report it.

7.1 Every share link page has a "Report" link that people can use without an Endorr account.

7.2 If we restrict content in a shared folder, we may disable the whole share link while we review it.

8. How to report illegal content or abuse

Summary: Use the form or abuse@. Tell us where the content is and why it's illegal.

8.1 Anyone can report content they believe is illegal or breaks this policy. Use the "Report" button, the reporting form (https://endorr.com/report), or email abuse@endorr.com. Reports must be submitted electronically.

8.2 To help us act quickly, a report should include:

(a) why you believe the content is illegal or breaks this policy, with enough explanation for us to understand, including the law involved if you know it;

(b) where it is: the exact share link, file name or other information that lets us find it;

(c) your name and email address. You do not need to give your name or email for reports of child sexual abuse material; and

(d) a statement that you believe in good faith that the information in your report is accurate and complete.

For intellectual property reports, please also tell us which work or trademark is infringed, and confirm that you are the rights holder or authorised to act for them.

8.3 What happens next. If you gave an email address, we will:

• confirm receipt without undue delay, within 1 working day;
• assess the report diligently, objectively and in a timely way: within 1 working day for manifestly illegal content, and within 5 working days for complex cases (we tell you if we need longer); and
• tell you our decision and how you can challenge it.

We tell you if we used automated means to handle your report. We don't share your identity with the person you reported unless the law requires it, or unless it's necessary for an intellectual property claim and you agree.

8.4 Urgent cases. If someone is in immediate danger, call 112 (in the Netherlands) or your local emergency number first. You can also report CSAM to the police (0900-8844 in the Netherlands) or, for material on public websites, to the Dutch hotline Offlimits (meldpunt.offlimits.nl).

9. What we may do

Summary: The action fits the violation. Serious cases mean immediate permanent closure.

9.1 Depending on how serious the violation is, how often it has happened and the context, we may:

• remove a file, or disable access to it or to a share link;
• restrict features, such as sharing, AI tools or the API;
• suspend uploads, the account or the organisation's access, temporarily or permanently;
• close the account and end the contract;
• preserve material and report it to authorities (sections 11 and 12); and
• cancel tokens or credits obtained through fraud or abuse.

9.2 We act diligently, objectively and proportionately. We consider the rights of everyone involved, including freedom of expression. Where we can, we act only against the specific content and not against more than necessary.

9.3 For less serious first violations, we usually warn you first and give you a chance to fix the problem. We act immediately and without warning for:

• CSAM;
• terrorist content;
• non-consensual intimate imagery;
• serious threats to life or safety;
• malware;
• counterfeit currency or ID documents;
• fraud; and
• where an authority orders us to.

9.4 Orders from authorities.

• We remove terrorist content within one hour of a removal order under Regulation (EU) 2021/784.
• We make CSAM inaccessible within the legal deadline after an order from the Dutch ATKM (currently 12 hours).
• We follow other valid orders from courts and authorities.

10. Statement of reasons and appeals

Summary: We tell you what we did and why, and you can ask us to look again.

10.1 Statement of reasons. If we remove or restrict your content, or suspend or close your account, we will send you a clear statement of reasons by email. It will cover:

• what we did, its scope and duration;
• the facts we relied on, including whether we acted on a report or on our own initiative;
• whether we used automated means;
• the legal or contractual ground (which law or which section of this policy) and why it applies; and
• how you can challenge the decision.

We may not send a statement where the law or an authority prohibits it, for example to avoid prejudicing a criminal investigation.

10.2 Appeals. You can appeal free of charge within 6 months of our decision, by replying to our email or via our appeal form (https://endorr.com/appeal). People who reported content can appeal our decision on their report in the same way. A person who did not take the original decision reviews each appeal. We will tell you the outcome and our reasons. If we got it wrong, we restore the content or account without undue delay.

10.3 Other options. You can also use a certified out-of-court dispute settlement body, where available, or go to court. Consumers keep their rights under mandatory law.

11. Reporting to authorities and cooperation

Summary: We report serious crimes and cooperate with lawful requests.

11.1 Threats to life or safety. If we become aware of information that gives rise to a suspicion that a criminal offence involving a threat to someone's life or safety has taken place, is taking place or is likely to take place, we promptly inform the law enforcement or judicial authorities concerned and give them the relevant information we have (DSA Art. 18).

11.2 CSAM. We report apparent CSAM to Offlimits (Meldpunt Kinderporno) and to the Dutch police. For material stored in our US region, we also report it to the US National Center for Missing & Exploited Children (NCMEC).

11.3 Other crimes and lawful requests. We may report other serious illegal activity to the competent authorities. We disclose user data to authorities only:

• in response to a valid legal order or request under the applicable law;
• where required by law; or
• where necessary to prevent serious harm.

We review every request, and we notify the user unless the law or the order prohibits this, or notification would put someone at risk. Our guidelines for authorities are at https://endorr.com/law-enforcement.

12. Preserving evidence

Summary: We don't just delete illegal material. We lock it away safely so the authorities can use it.

12.1 When we remove serious illegal content, especially CSAM or terrorist content, we do not simply delete it. We preserve a copy of the content and related data (for example account details, upload times, IP addresses and share-link history) in restricted, access-logged storage. This lets the authorities investigate and lets us handle appeals.

12.2 Preserved material is accessible only to a small number of designated, trained staff, and only to the extent strictly necessary. It is never redistributed, except to competent authorities as required by law.

12.3 We keep preserved material:

• for terrorist content: 6 months after removal (longer if an authority or court asks);
• for CSAM: only as long as needed for the report and follow-up by Offlimits or the police; deleted once the police confirm it can be, and no longer than 1 year unless the police or a court ask us to keep it longer;
• for other content: up to 6 months after the final decision, longer while a legal claim or authority request is pending.

After that, we securely delete it. See the Privacy Policy.

13. Repeat violations and misuse of reporting

Summary: Repeated violations lead to account closure. Abusing the report system gets you blocked.

13.1 Repeat infringers. We close the accounts of users who repeatedly upload or share content that infringes intellectual property or is otherwise illegal: three valid notices or violations within 12 months. Each strike expires after 12 months, and a successful appeal removes it.

13.2 Frequently providing manifestly illegal content. After a warning, we suspend for a reasonable period accounts that frequently provide manifestly illegal content.

13.3 Misuse of reporting. After a warning, we may stop processing reports or appeals from people who frequently submit manifestly unfounded ones.

14. Transparency

Summary: We'll publish what we're required to.

14.1 If we take action against terrorist content in a calendar year, we will publish a transparency report about it before 1 March of the following year. We also publish any other transparency reports the law requires.

14.2 Our status under the Digital Services Act. Endorr is a hosting service. Because content shared by public link can reach anyone, we apply the related rules (such as notice-and-action, statements of reasons and internal complaint handling) to public share links. Where Drukbaas B.V. qualifies as a micro or small enterprise, we rely on the exemptions in Article 19 of the Digital Services Act. Endorr is established in the Netherlands, so no EU legal representative is required.

14.3 Dutch Notice-and-Take-Down Code. We intend to follow the Dutch Notice-and-Take-Down Code of Conduct (Gedragscode Notice-and-Take-Down) when handling reports.

15. Changes

We may update this policy. We will tell you about significant changes in advance, as described in the Terms of Service.