Illegal Content Notice (DSA Art. 16)

Illegal Content Notice and Action Procedure

Version: 2.0
Effective date: 3 August 2026
Supersedes: version 1.1 of 2 August 2026
Provider: Pedro Cantueso García de Vinuesa (NIF 45748777Y), Avenida de la Arruzafa 50, 14012 Córdoba, Spain — operator of the service published at kreawave.com ("kreawave", "the Service")
Single point of contact (notices, recipients and authorities): [email protected]
Languages accepted: Spanish and English
Electronic notice endpoint: POST https://kreawave.com/api/takedown

This procedure implements the notice and action mechanism required by Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act, "DSA"), Article 16, together with the statement-of-reasons duty of Article 17 and the duty to notify suspicions of criminal offences of Article 18.

1. Purpose

This document explains how any person or entity — user or not, customer or not — can notify us that content present on the Service is illegal, and what we do when we receive such a notice.

It is a public document. It is not a contract: the contractual relationship with users is governed by the Terms of Service, and the rules on what may and may not be generated are set out in the Acceptable Use Policy. Where this procedure and the Terms of Service diverge, the Terms of Service prevail.

2. What kind of service kreawave is under the DSA, and why it matters

The Service is a provider of hosting services within the meaning of Article 3(g)(iii) DSA: at the request of the user, it stores information provided by that user (the input text; the audio file generated from it; and, when the corresponding modules are enabled, uploaded voice samples, images and video).

The Service is not an "online platform" within the meaning of Article 3(i) DSA. An online platform is a hosting provider that, at the request of the recipient, stores and disseminates information to the public. kreawave does not disseminate user content to the public: generated files are accessible only to the account that created them, through download links that are signed and time-limited; there is no public feed, no public profile, no sharing function and no public gallery of user output. The only publicly accessible audio published by the Service is our own voice catalogue, which is our own content and not user content.

The practical consequences are:

Articles 16, 17 and 18 DSA apply in full. They are addressed to providers of hosting services. This document is their implementation.
Article 6 DSA (liability exemption for hosting) is the reason a notice matters: once a notice gives us actual knowledge of illegal content, we must act expeditiously to remove it or disable access to it.
Section 3 of Chapter III DSA (Articles 20 to 28) — internal complaint-handling systems, out-of-court dispute settlement, trusted flaggers, measures against misuse, advertising transparency, recommender-system transparency — is addressed to providers of online platforms and therefore does not apply to the Service. We nevertheless operate the internal review described in §10.3 as a voluntary commitment.
Article 15(1) DSA (annual transparency reports on content moderation) does not apply, by virtue of the express exclusion in Article 15(2) DSA for providers that qualify as micro or small enterprises under Commission Recommendation 2003/361/EC and are not very large online platforms. The Service is operated by a single natural person. (Version 1.1 of this document cited Article 19 DSA for this exclusion; Article 19 excludes micro and small enterprises from Section 3, not from the Article 15 reporting duty. The correct basis is Article 15(2).)
If the Service ever ceases to qualify as a micro or small enterprise, or begins to disseminate user content to the public, this classification will be reassessed and this document updated before that change takes effect.

3. Scope — audio today; images and video when those modules are enabled

This procedure applies to every category of content the Service handles, whether or not the corresponding module is active today:

Content	Status on the effective date	Covered by this procedure
Audio generated from a user's text	Active	Yes
Input text submitted by the user and stored with the job	Active	Yes
Voice samples uploaded by a user for voice cloning	Module not enabled in production	Yes, from the moment it is enabled
Images generated by the Service	Module not enabled in production	Yes, from the moment it is enabled
Video generated by the Service	Not offered	Yes, from the moment it is offered
Voice samples published in our public catalogue	Active	Yes — see §12
Account-level conduct (repeat infringement, coordinated abuse)	Active	Yes — see §9.4

Wherever this document says "content", read it as covering audio, text, images and video alike.

4. What can be reported

Any content that the notifier considers illegal under Union law or the law of any Member State, including in particular:

Child sexual abuse material (CSAM) in any modality — audio, image or video — including AI-generated material (Articles 189 and 189 bis of the Spanish Criminal Code). Absolute priority: see §11.
Non-consensual sexual content, including sexual deepfakes and image- or voice-based sexual abuse.
Impersonation of a real person's voice, face or likeness without their consent: cloned or imitated voices, synthetic speech attributed to an identifiable person, face swaps, synthetic video of a real person.
Fraud and deception: synthetic voice or video used for scams, fake authority or celebrity endorsements, voice phishing.
Incitement to hatred, violence or terrorism, and content targeting protected groups.
Defamation and infringement of honour, privacy or image rights.
Intellectual property infringement: reproduction of protected works, performances or recordings, including a performer's distinctive vocal performance.
Any other content illegal under Spanish or EU law.

Content that is not illegal but breaches our Acceptable Use Policy can be reported through the same channels; it is handled as a contractual matter under the Terms of Service rather than under Article 16 DSA.

5. Regulatory framework

Instrument	Provision	What it requires of us
Regulation (EU) 2022/2065 (DSA)	Art. 6	Liability exemption conditional on acting expeditiously once we have actual knowledge
DSA	Art. 11	Single point of contact for Member State authorities, the Commission and the Board, with declared languages
DSA	Art. 12	Single point of contact for recipients of the service, by electronic means and not relying solely on automated tools
DSA	Art. 14	Terms and conditions stating any restrictions and the content-moderation policy (see Terms of Service and Acceptable Use Policy)
DSA	Art. 15(2)	Micro/small enterprise exclusion from the annual transparency report
DSA	Art. 16	Notice and action mechanism; contents of a valid notice; confirmation of receipt; notification of the decision and of redress possibilities; timely, diligent, non-arbitrary and objective processing
DSA	Art. 17	Clear and specific statement of reasons to the affected recipient
DSA	Art. 18	Duty to inform law enforcement where there is a suspicion of a criminal offence involving a threat to life or safety
Directive 2011/93/EU	Arts. 3 to 7	Offences for which a notice may be submitted anonymously (DSA Art. 16(2)(c))
Spanish Criminal Code	Arts. 189, 189 bis	CSAM, including technical/AI-generated material
Regulation (EU) 2024/1689 (AI Act)	Art. 50	Marking and disclosure of AI-generated content — see the AI Disclosure document
Regulation (EU) 2016/679 (GDPR)	Arts. 6, 30, 33	Lawful basis and records for the personal data contained in a notice — see the Privacy Policy

6. How to submit a notice

6.1 Electronic endpoint (no account required)

POST https://kreawave.com/api/takedown, content type application/json. All four fields are mandatory; a request missing any of them is rejected with HTTP 422 and nothing is recorded:

Field	Type	Limits	Meaning
`url_or_job_id`	string	1–512 characters	URL or job identifier of the reported content (DSA Art. 16(2)(b))
`motivo`	string	10–2 000 characters	Substantiated explanation of why the content is considered illegal (Art. 16(2)(a))
`reporter_email`	string	5–254 characters, valid address	Contact address of the notifier (Art. 16(2)(c))
`good_faith`	boolean	must be `true`	Statement of the notifier's bona fide belief that the information is accurate and complete (Art. 16(2)(d))

A valid notice returns HTTP 202 with a reference of the form td_ followed by 16 hexadecimal characters. That response is the confirmation of receipt required by Article 16(4) DSA. Keep the reference: it identifies your notice in any later correspondence.

To prevent flooding, this endpoint accepts a maximum of 5 notices per hour per IP address; beyond that it returns HTTP 429 and the notice is not recorded. If you legitimately need to submit more, use email.

6.2 Email — the channel for anyone who is not a developer

[email protected]. This is the accessible channel, and the one we recommend to individuals reporting content about themselves. Write in Spanish or English, include the information listed in §7, and we will reply with a reference and a decision as described in §9.

The Service does not publish a browsable web form. Email is the easily accessible and user-friendly mechanism required by Article 16(1) DSA, and it is available to anyone, with no account and no technical knowledge; the endpoint in §6.1 exists in addition, for technical and automated reporting.

6.3 Postal mail

Pedro Cantueso García de Vinuesa — Avenida de la Arruzafa 50, 14012 Córdoba, Spain. Slower, but valid, and the appropriate channel where a signed or evidenced communication is needed.

6.4 Anonymous notices

Article 16(2)(c) DSA dispenses with the notifier's name and contact details for notices concerning the offences referred to in Articles 3 to 7 of Directive 2011/93/EU (offences against children, including child sexual abuse material). The endpoint in §6.1 always requires a contact address for technical reasons, so anonymous notices of that kind must be sent by email or post; we will process them exactly as we process identified ones. For every other category, a contact address is required so that we can notify you of the decision under Article 16(5) DSA.

6.5 Never attach the reported content

Do not attach allegedly illegal material to your notice — above all, never attach CSAM. Sending it may itself be an offence and creates a copy we would be obliged to handle. A URL, a job identifier, a timestamp or a precise description is enough to locate the content. If we need the file itself in order to run the forensic check described in §12.2, we will ask you for it and tell you how to send it.

7. What a valid notice must contain (Art. 16(2) DSA)

a) A sufficiently substantiated explanation of the reasons why you consider the content to be illegal.
b) A clear indication of the exact electronic location of the content: URL, job identifier, or a description precise enough for us to identify it without a disproportionate search.
c) Your name and contact details, except in the case covered by §6.4.
d) A statement confirming your bona fide belief that the information and allegations in the notice are accurate and complete.

Helpful, but not required: the date and approximate time of generation or publication; your relationship to the content (data subject, rights holder, representative, third party); and, where you act on behalf of someone else, evidence of your authority to do so.

A notice that contains the elements in (a) and (b) with sufficient precision gives us actual knowledge of the content for the purposes of Articles 6 and 16(3) DSA, where it allows a diligent provider to identify the illegality without a detailed legal examination.

8. Confirmation of receipt

Endpoint: the td_… reference returned immediately with HTTP 202 is the confirmation of receipt (Art. 16(4) DSA).
Email and post: we confirm receipt by reply to the address provided, without undue delay and in any event within 72 hours of receipt, quoting the reference assigned to your notice.

Every notice — whatever the channel — is recorded with its reference, the reported content, the reason given, the notifier's contact address, the source IP address where applicable, the timestamp and its processing status.

9. Assessment and decision

9.1 Initial assessment: 72 hours

We carry out an initial assessment of every notice within 72 hours of receipt. Notices covered by §11 (maximum urgency) are handled immediately, without waiting for that window.

The assessment establishes:

whether the notice is sufficiently precise and adequately substantiated;
whether the content is in fact hosted by the Service and still exists (see §9.5);
whether the content is, prima facie, illegal or contrary to the Acceptable Use Policy.

9.2 Human review, no automated decisions

Notices are reviewed by a human being. No automated tool decides the outcome of a notice, and no automated system removes content in response to a notice. Automated systems are used only to receive notices, apply the anti-flooding limit in §6.1 and, once a decision to remove has been taken, execute it. This is the disclosure required by Article 16(6) DSA.

Independently of this procedure, the Service applies preventive moderation at generation time as described in the Acceptable Use Policy; that is a separate mechanism and is not a decision on a notice.

9.3 Possible outcomes

Outcome	Recorded status	Action	Communication
Illegal content confirmed	`actioned`	Removal or disabling of access (§10), with the account measures in §9.4	Decision notified to the notifier; statement of reasons to the affected user (Art. 17)
CSAM or threat to life or safety	`actioned`	Maximum urgency protocol (§11)	Report to the authorities; the user is not informed where doing so would prejudice a criminal investigation
Breach of the Acceptable Use Policy but not clearly illegal	`actioned`	Contractual measures under the Terms of Service and the Acceptable Use Policy	Decision notified to the notifier; statement of reasons to the affected user
Reasonable doubt / complex case	`reviewed`	Precautionary disabling where the risk of harm justifies it, and extended assessment — decision within a maximum of 30 calendar days from receipt	Notifier informed of the extension and of the reason
Content not illegal and not in breach	`dismissed`	Content maintained	Reasoned decision notified to the notifier
Unsubstantiated, unintelligible or abusive notice	`dismissed`	No action on the content	Notifier informed; repeated abuse handled under §14

Every notice remains pending until one of these outcomes is recorded.

9.4 Measures on the account

Where content is removed following a notice, the measure taken on the account is the one that corresponds to the seriousness of the conduct under the scale in Acceptable Use Policy §10.2, applied in a diligent, objective and proportionate manner as Art. 14.4 DSA requires. For serious and very serious infringements the account is suspended and all its active sessions are invalidated immediately, so that generation cannot continue with tokens already issued. For minor or isolated ones the measure may be limited to removing the content and warning the account holder. Removal of content does not, by itself and automatically, suspend an account. Suspension is a reversible measure and can be lifted if the internal review in §10.3 succeeds. Permanent termination for serious or repeated infringement is governed by the Terms of Service and the Acceptable Use Policy.

9.5 Content that no longer exists

Generated audio files are deleted automatically 7 days after generation, input texts are minimised 7 days after generation, and job records are pruned after 90 days, as described in the Privacy Policy. If you report content that has already passed those windows, the file may no longer exist. Report as early as possible. Even where the content is gone, we register the notice and may still act on the account.

10. Effects of a removal, and the rights of the affected user

10.1 What removal technically means

When a piece of content is taken down:

The corresponding job is marked as taken down. Any subsequent attempt to access it — by its owner or by anyone holding a link — returns HTTP 451 Unavailable For Legal Reasons.
The content disappears from the user's library and history.
The file is moved to a segregated evidence area and excluded from the automatic deletion described in §9.5. It is retained as evidence for the purpose of answering to the notifier, to the affected user and to the competent authorities, with access restricted to the operator. This is a separate retention basis from the ordinary retention windows, justified by the legal claims and legal-obligation grounds identified in the Privacy Policy.
For audio, a forensic verification of our watermark is run on the preserved file and its result is recorded (see §12.2).

10.2 Statement of reasons (Art. 17 DSA)

The affected user receives, at the email address of their account, a clear and specific statement of reasons containing:

a) the restriction imposed — removal or disabling of access, and any measure on the account;
b) the facts and circumstances relied on, including whether the decision was taken following a notice, and the identity of the notifier where the law does not require it to be withheld;
c) whether automated means were used — see §9.2;
d) where the decision is based on illegality, the legal ground and an explanation of why the content is considered illegal on that ground;
e) where the decision is based on a breach of our own rules, the contractual ground and the explanation;
f) clear and user-friendly information on the redress available.

Exception: where the removed content relates to criminal proceedings or to a report to the authorities, the statement of reasons may be deferred for as long as informing the user could prejudice the investigation, and in the cases covered by §11 it is deferred until the competent authority authorises it.

10.3 Redress for the affected user

Internal review. You may contest the decision by writing to [email protected], quoting the reference in the statement of reasons and setting out your reasons and any evidence. The review is carried out by a human, and we answer within 15 calendar days. If the review upholds you, the content is restored where it still exists and the suspension of the account is lifted. This internal review is a voluntary commitment: as explained in §2, Article 20 DSA does not apply to the Service.
Judicial action. You may bring the matter before the Spanish courts in accordance with the Terms of Service.
Supervisory authority. You may address the Digital Services Coordinator. Spain designated the Comisión Nacional de los Mercados y la Competencia (CNMC) as its Digital Services Coordinator by decision of the Ministry for Digital Transformation of 24 January 2024; at the date of this document the domestic law conferring its full enforcement powers is still pending adoption. Where the Coordinator of your own Member State is competent, you may address that authority instead.
Data protection. If your complaint concerns personal data, you may address the Spanish Data Protection Agency (AEPD) as described in the Privacy Policy.

10.4 No economic effect

A takedown decision under this procedure does not create any right to a refund, to the return of consumed volume or to a free re-generation of the removed content. The economic consequences of a breach of the Acceptable Use Policy, and the refund rules generally, are governed exclusively by the Terms of Service and the Refund Policy.

11. Maximum urgency: CSAM and threats to life or safety

Notices alleging CSAM in any modality (audio, image or video), or a serious and imminent threat to the life or safety of identifiable persons, are handled immediately and without waiting for the 72-hour window:

Immediate removal or disabling of access to the content.
Notification to law enforcement. Where the information gives rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the competent law-enforcement or judicial authorities and provide all relevant information available, as required by Article 18 DSA. In Spain the channels used are the National Police, the Guardia Civil (Grupo de Delitos Telemáticos) and INCIBE.
Activation of our internal CSAM protocol, which governs preservation, chain of custody, minimisation and reporting.
Content is not retained in accessible form. For any modality, we preserve strictly what the competent authority requires us to preserve, and nothing more; the material itself is never kept for review, comparison or training. When the image or video modules are enabled, visual material will be handled by retaining only the minimum metadata required for the report to the authorities and, where a perceptual-hashing mechanism is in place by then, its hash. No such mechanism is deployed today, because those modules are not enabled (Acceptable Use Policy §9.6).
The user is not informed for as long as informing them could prejudice the investigation (§10.2).

Do not attach the material to your notice (§6.5).

12. Notices concerning a person's voice, face or likeness

12.1 If the content is user-generated

If you believe that audio, an image or a video produced through the Service reproduces your voice, your face or your likeness without your consent, say so expressly in your notice and identify yourself as the data subject. These notices are treated as a priority below §11 and above ordinary notices, because the harm is personal and continuing. In addition to removal, you may exercise your rights of erasure and objection under the GDPR through the channels in the Privacy Policy; the two routes are independent and you may use both.

12.2 How we verify

Audio. All audio produced by the Service carries an imperceptible AudioSeal watermark. We operate a forensic verification tool, restricted to the operator, that determines from a supplied audio file whether the watermark is present, whether it is ours, and the corroborating voice identifier it carries. If you send us a file, we can therefore establish whether it came from this Service and, where it did, which job produced it — which is often decisive both for substantiated notices and for dismissing mistaken ones.
Voice samples uploaded for cloning. Where the voice-cloning module is enabled, each uploaded sample is stored with a cryptographic fingerprint of the original file, so a reported sample can be matched to the account that uploaded it and to the consent recorded at upload.
Images and video. When those modules are enabled, the equivalent provenance and marking mechanisms described in the AI Disclosure document will be used for the same purpose.

12.3 Voices in our public catalogue

Our catalogue voices are published by us, not by users. If you believe that a catalogue voice reproduces your own voice or the distinctive vocal performance of a person you represent, report it under this procedure. We will check it against our voice-provenance records and, where the notice is substantiated, withdraw the voice from the catalogue and from the generation engine.

13. Records, transparency and data protection of the notice itself

We keep an internal register of every notice received — reference, reported content, reason, notifier's contact address, source IP address where applicable, timestamps, decision and reasoning — without keeping a copy of the reported content in that register. The register is available for inspection by the competent authorities.
The personal data contained in a notice are processed to assess and answer it and to comply with our legal obligations under the DSA. The notifier's IP address is processed on the basis of our legitimate interest in preventing abuse of the mechanism. Retention and rights are as described in the Privacy Policy.
We do not publish an annual transparency report, for the reason given in §2 (Article 15(2) DSA). We are not an online platform and therefore do not submit statements of reasons to the Commission's DSA Transparency Database, an obligation that Article 24(5) DSA imposes on online platforms.

14. Abuse of the notice mechanism

Notices that are manifestly unfounded, repetitive, automated at volume or submitted in bad faith may lead to the electronic channel being blocked for the IP address or address concerned, without prejudice to the other channels remaining open for genuine notices. We reserve the right to take legal action in respect of abusive notices that cause us harm, and to inform the competent authorities where an abusive notice is itself unlawful. Article 23 DSA, which governs measures against misuse, is addressed to online platforms and does not apply to the Service; these measures are taken on a contractual and general-law basis.

15. Relationship with the other legal documents

Terms of Service — the contract; it prevails in case of any inconsistency.
Acceptable Use Policy — what may and may not be generated, and the consequences of infringement.
Refund Policy — all monetary matters. This procedure creates no refund right (§10.4).
Privacy Policy — how personal data are processed, including the data in a notice.
AI Disclosure — marking and disclosure of AI-generated content.
Cookie Policy — cookies and similar technologies.
Legal Notice — the provider's identification details.

In every case, and notwithstanding the order above, where two of our documents differ and one of them is more favourable to you as a consumer, the more favourable text applies (Art. 80.2 TRLGDCU). No rule of precedence in our documents may remove or reduce a right that Spanish or European consumer law gives you and that cannot be waived by contract (Art. 10 TRLGDCU).

16. Points of contact and contact details

Single point of contact for recipients of the service (Art. 12 DSA) and for Member State authorities, the Commission and the Board (Art. 11 DSA): [email protected]. Messages are read and answered by a human; the channel does not rely solely on automated tools.
Languages accepted (Art. 11(3) DSA): Spanish and English.
Postal address: Avenida de la Arruzafa 50, 14012 Córdoba, Spain.
Telephone: +34 621 34 26 94 (Monday to Friday, 10:00-14:00 CET)
Illegal content notices and urgent matters: [email protected], or the endpoint in §6.1.

17. Amendments and versioning

Every substantive change to this document raises its version number and its effective date. The version in force is the one published at https://kreawave.com/legal/takedown. Changes that affect the rights of users under the Terms of Service are notified in accordance with those Terms.