Publishing rules

Version 2026-10-17.7. These rules apply to everything published with edeck.me: the accounts of those who create sites (the "owner") and all the content of their sites —texts, images, products, links, forms, emails sent from them, custom domains and the content generated with the panel's artificial intelligence, which is the owner's content for all purposes—. They must be accepted to create a site, and breaching them allows edeck.me to remove content, suspend sites and block accounts as explained in section 6. Section 11 also sets out the personal data processing that edeck.me carries out on the owner’s behalf.

1. What can be published

edeck.me is meant for websites and online shops of businesses, professionals, freelancers, associations, personal projects, portfolios and blogs that offer lawful products, services or information. The owner is solely responsible for what they publish and for complying with the regulations that apply to their activity.

2. What is prohibited

Nothing of what follows may be published, linked, sold, offered or promoted, and the site may not be used to facilitate it. Each section has a code (N1, N2…), which is the one quoted in notices and decisions.

N1. Child sexual abuse

Any content that sexualises minors, whether real, drawn or computer-generated, or that facilitates their exploitation or contact with them for sexual purposes. Zero tolerance: immediate blocking of the account and all its sites, preservation of the evidence and report to the authorities.

N2. Sexual and adult content

Pornography and any sexually explicit content, in images, video, text or links.
Sexual, escort or sex-dating services, erotic webcams and the sale of erotic content (subscriptions, packs, "exclusive content").
Nudity with a sexual purpose, even if partially covered or pixelated.
Intimate content of another person shared without their consent, or created or manipulated (including AI-generated images, "deepfakes") to show them in sexual situations.

Allowed, without explicit images: lingerie, swimwear, sexual health and education, and art or information without a sexual purpose.

N3. Fraud, scams and deception

Impersonating another person, company, brand, bank or public body, or imitating their website ("phishing"), and deceptively asking for passwords, bank or card details.
Fake shops or shops that take payment with no intention of delivering; made-up prices, stock, delivery times or features.
Pyramid or Ponzi schemes, promises of easy or guaranteed earnings, investments, crypto-assets or financial services without the authorisation required by law.
Fake giveaways, prizes or gifts; made-up or bought reviews, ratings or testimonials.
Counterfeit products or replicas of registered trademarks.
Sale of fake degrees, official documents, prescriptions, certificates or identities, and of accounts, personal data or databases obtained without consent.

N4. Malware and technical abuse

Viruses, trojans, spyware, ransomware, cryptocurrency miners or any code that runs on the visitor's device without their knowledge or will.
Phishing kits or pages, deceptive redirects, disguised downloads and links that hide their real destination.
Unsolicited bulk email (spam), also through the site's forms; search engine spam (doorway pages, link farms, hidden text, copied or mass-generated content made only for ranking).
Using the site or the platform to attack, scan or overload other systems; trying to access data or sites of other owners; circumventing the limits, billing or security measures of edeck.me.
Using the site only as file storage, a download server, a URL shortener or a redirector to other websites.

N5. Illegal or dangerous products and services

Drugs and narcotics, including "new psychoactive substances", and paraphernalia presented for consuming them.
Prescription medicines, doping substances and medical devices without the required authorisation; remedies that claim to cure serious diseases.
Firearms, their parts and ammunition, explosives, unauthorised fireworks, and instructions to make or modify them.
Gambling, betting, casinos, lotteries and paid raffles without the corresponding licence.
Protected species, their parts or derivatives; stolen goods or goods of unlawful origin.
Hacking services, spying on devices or accounts, or breaching third-party systems.

Alcohol, tobacco, vaping products, CBD and other regulated products may only be sold if the owner complies with the regulations that apply to them (licences, labelling, age verification, ban on sales to minors) and proves it to us when asked.

N6. Hate, violence and terrorism

Inciting hatred, discrimination or violence against people or groups because of their origin, ethnicity, nationality, religion, sex, sexual orientation, gender identity, disability, age or any other personal circumstance.
Glorification, propaganda, recruitment or financing of terrorism or violent extremism.
Threats, harassment, humiliation or publishing a person's details to target them ("doxxing").
Graphic violence or cruelty to people or animals shown to shock or to celebrate it.
Promoting suicide, self-harm or eating disorders.

N7. Third-party rights

Texts, images, videos, music, fonts or software the owner has no rights to; copies of other people's websites.
Distributing or linking to pirated content: films, series, live sports, IPTV, software or keys without a licence.
Using other people's trademarks, trade names or domains in a way that may mislead about who is behind the site.
Personal data of third parties published without a legal basis, and images of people —especially minors— without their consent or that of their representatives.

N8. Harmful false information

Deliberately false information that may cause real harm: about health and treatments, about emergencies or disasters, or to manipulate elections.

N9. Owner's details and obligations

Providing false account or billing details, or someone else's, or creating accounts to circumvent a block.
Collecting visitors' data (forms, orders, sign-ups) without informing them or processing it in accordance with the General Data Protection Regulation.
Selling without stating who sells, the total price, delivery costs, the right of withdrawal and how to complain, as required by consumer and e-commerce law (in Spain, the LSSI).
Transferring, selling or renting the account or the site to third parties so that they publish what these rules prohibit.

N10. Any other illegal content

Any content or activity contrary to Spanish law, European Union law or the law of the country the site is aimed at, even if it is not in the list above, and anything an authority or a court orders us to remove.

3. Content generated with artificial intelligence

The texts, images and designs the panel generates with AI are a proposal: the owner must review them before publishing and is responsible for them like for any other content. The panel's AI may not be used to try to produce anything prohibited in section 2.

4. Content review

edeck.me does not review what is published in advance and is not obliged to, but it may review at any time, automatically or manually, any site that is published or being prepared, especially when it receives a report or detects signs of abuse. Content not having been removed does not mean it is allowed.

5. How to report a site

Anyone can tell us about a site that breaches these rules or the law with the Report content form (linked in the footer of every website) or by writing to abuse@edeck.me. So that we can act, please include:

the exact address (URL) of the content;
which rule or right is breached and why;
your name and email, except for reports of child sexual abuse, which may be anonymous;
a statement that the information in the report is accurate and complete and that you make it in good faith.

We acknowledge receipt, review the report diligently and let the person who made it know our decision, as set out in Regulation (EU) 2022/2065, the Digital Services Act.

Single point of contact (Articles 11 and 12 of the Digital Services Act), for Member State authorities, the European Commission and users: abuse@edeck.me, in Spanish or English.

6. Measures for breaches

Depending on the seriousness, repetition and risk for visitors, other owners or the platform, edeck.me may apply one or more of these measures:

Notice to the owner, stating the rule breached and a deadline to fix it, usually 72 hours.
Removal or disabling of the specific content (a page, a product, an image, a form).
Site suspension: the site is no longer visible on the internet —at its edeck.me address and on its custom domain— and a suspended-site notice is shown instead. The owner can still sign in to the panel to fix it, unless the account is also blocked.
Account block: the owner cannot sign in to the panel or create sites, and all the account's sites are suspended.
Permanent termination: the account and its subscriptions are cancelled, and the content is deleted after the retention period, except what we must keep as evidence or by law.
Report to the authorities when there are signs of a crime or the law requires it.

Without prior notice, the site is suspended or the account blocked in the cases of sections N1, N3 and N4, of terrorism (N6), when there is an immediate risk for visitors or the platform, and when an authority or a court orders it. Accounts created or used to circumvent a previous block are blocked too, as are, after checking, accounts that share identification details, payment details or domains with a blocked account and are used to circumvent the block.

Every decision is sent to the owner by email with the measure applied, the facts, the rule it is based on and how to appeal, unless the law or an order from the authorities prevents it.

7. Effects on payments

Suspending a site for a breach does not stop its subscription by itself; the owner can cancel it at any time from the panel or by writing to abuse@edeck.me. If the account is blocked, its subscriptions are cancelled with effect at the end of the period already paid and nothing more is charged while the block lasts. If the block is lifted, the cancellation of the subscriptions that were cancelled because of the block is undone, and they renew as normal; any the owner had cancelled before remain cancelled. The owner can cancel or reactivate them from the panel. If edeck.me terminates the account for a serious or repeated breach, periods already invoiced are not refunded to business customers; consumers are refunded the proportionate part of the paid period that is not provided. If the measure is lifted because it is shown there was no breach, the service is restored and the proportionate part of the time it was suspended is refunded.

8. Appealing a decision

The owner can ask us to review a measure by replying to the email in which it was notified, or by writing to abuse@edeck.me, within six months of receiving that email. The appeal is reviewed by a person, not by an automated system, and the answer is given in writing with its reasons. If the breach is fixed, the measure can be lifted.

We offer this internal review voluntarily: as a hosting service that is not an online platform, edeck.me is not subject to Articles 20 and 21 of Regulation (EU) 2022/2065 (Digital Services Act) and has not joined any out-of-court dispute settlement body. At any time, and without having to appeal to us first, the owner can lodge a complaint with the Digital Services Coordinator of the EU country where they live or are established (in Spain, the Comisión Nacional de los Mercados y la Competencia, CNMC, which is responsible for that role) or go to the courts. The email notifying each measure reminds the owner of this, in their language.

9. Data we keep

We keep the acceptance of these rules (version, date, account, site and the IP address from which they were accepted), the reports received and the decisions taken, with evidence of the content removed, for as long as necessary to handle appeals and comply with legal obligations. More information in the edeck.me privacy policy.

10. Changes to these rules

We may update these rules to adapt them to the law or to new uses of the platform. Each version has its date. Substantive changes are announced to owners in advance and they are asked to accept the new version; the current text is always available in the panel and on edeck.me.

11. Data that edeck.me processes on the owner's behalf

For the personal data of the visitors and customers of their site, the owner is the controller and edeck.me is their processor, under Article 28 of the General Data Protection Regulation (GDPR). By accepting these rules, the owner entrusts edeck.me with that processing on the terms of this section.

Buyer accounts. The account a buyer uses to sign in to a shop belongs to edeck.me and works in every shop made with edeck.me: edeck.me, not the owner, is the controller of that account (email, password, first and last name, phone, ID document and address if given, saved addresses, cart and favourites), which is governed by the account terms. The buyer sees in their profile in any shop the orders they placed in all of them; the owner only sees the orders placed on their site and never knows in which other shops someone buys, nor whether they had the account before joining their shop. The orders, balance, customer record (the buyer's link with their shop, since when they have been a customer and their permission for notices and offers) and messages of their site remain the owner's, within this processing, for as long as the site exists (see "End of the processing"). The owner gives edeck.me these instructions: that their customer list shows the account details of each buyer from the moment they join their shop, kept up to date with what the buyer changes or deletes in their account and without the owner being able to modify them (the buyer changes them from their account, or edeck.me does); and that the orders of their shop placed with an account are also shown to that buyer, and only to them, in their profile in the other shops, where edeck.me processes them as controller of the account. edeck.me and the owner are not joint controllers of this data: each answers for its own part.

Subject matter and duration: hosting and serving the site; storing what its forms collect, its orders and its customers' balance; sending the site's emails, and measuring its visits. It lasts as long as the site is on edeck.me.
Data and data subjects: the data the owner and the people who use their site enter on it (for example, identification, contact details, address, orders and messages) and the browsing data of the audience measurement described below. Data subjects: the site's visitors, customers and contacts.
Audience measurement: edeck.me counts each site's visits with Umami, hosted on its own servers, with no cookies. Only if the visitor accepts analytics cookies in the site's notice, a random code (vs_vid) is also stored in their browser for 13 months to know if they come back; it is deleted if they withdraw their permission. The IP address and browser are used on the spot to work out the approximate country, region and city and a pseudonymous visitor code that changes every month and is different on each site; the IP address is not stored. The pages viewed, the referrer, the campaign parameters of the address, the browser, operating system, device type, screen size and language are recorded. Statistics are kept for a maximum of 25 months. The owner sees them in their panel. The cookie and privacy texts the panel generates explain this to visitors; if the owner uses their own texts, they must include this information.
Instructions and purpose: edeck.me processes this data only to provide the service, following the owner's instructions, which are those given by setting up and using their site. It does not use it for its own purposes or disclose it to third parties, unless required by law. To run and improve the service it only uses aggregated figures per site (for example, total visits), which identify nobody.
Confidentiality and security: the people authorised to process the data are bound by confidentiality. edeck.me applies technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), passwords stored irreversibly, separation of each site's data, two-factor authentication in the panel and restricted access to the server.
Support access: to deal with a question or a problem with the site, edeck.me staff may view the owner's panel exactly as the owner sees it, in read-only mode and for 30 minutes at most each time, without being able to change anything. Each access is recorded with its reason and the owner is notified by email at that moment.
Sub-processors: the owner authorises edeck.me to use as sub-processors IONOS SE, which provides the server and email from the European Union, and Backblaze, Inc., which stores the backups in its Amsterdam data centre (European Union). Backups are encrypted on edeck.me's server before being sent, with a key Backblaze does not have, so it cannot read their content. edeck.me will notify the owner of any change of sub-processor sufficiently in advance for them to object, by cancelling the plan at no cost if they disagree, and will impose on them the same obligations it assumes in this section. Services the owner signs up for and connects on their own (payment gateways, Google Analytics or others) are the owner's relationships with those providers, not sub-processing by edeck.me.
Artificial intelligence features of the panel: they send to their provider (currently DeepSeek, with servers in China) only what the owner writes or selects in them to generate text. The owner must not include personal data of their visitors or customers there: it is not part of this processing.
International transfers: the site's data is stored and processed in the European Union. If a sub-processor ever had to access it from outside, this will only happen with one of the safeguards in Chapter V of the GDPR; Backblaze backups, moreover, travel and are stored encrypted.
Assistance: edeck.me will help the owner, as far as possible, to respond to data subjects exercising their rights and to meet their obligations on security, personal data breach notification, impact assessments and prior consultation with the supervisory authority, and will notify them without undue delay of any security breach affecting their site's data.
End of the processing: when the site is permanently deleted, edeck.me deletes its data, including its visit statistics, except for the following, which it keeps so that the site's customers do not lose their purchase information and can claim against the owner, ask for help or be contacted if a problem comes up. From the deletion onwards, edeck.me is responsible for it as data controller, no longer as processor, and explains this in its privacy policy:
- the site's orders, payments, balances, coupons and products: they are its customers' purchase history: they can still see the orders placed with their edeck.me account in it, and can ask edeck.me for the record of the rest, such as their balance;
- the messages sent through the site's forms, until one year after they were sent, the same period they have while the site is active; they are not shown to anyone and are only used to help whoever sent them or to contact them;
- a copy of the owner's details as seller that the site published on its legal pages (name or company name, tax ID, address, email, phone and registration details, only those filled in) and the shop's currency. The seller details are shown to buyers next to their orders from the site, so they know whom to claim against, and are kept with no deletion deadline; if you object, they are deleted unless needed for a possible or ongoing claim.
Deleted data may remain in the encrypted backups until they expire, at most about 12 months; if a backup ever has to be restored, it is deleted again before being served. Before the deletion, the owner can download a full copy of their site from Billing ("Download my site").
Compliance: edeck.me will make available to the owner the information needed to demonstrate compliance with this section, will allow audits where appropriate, and will tell the owner if it considers that one of their instructions infringes data protection law.