Content Moderation and Safety Policy

been reviewed or approved by a qualified lawyer in any jurisdiction. It must not be published, linked from the product, or relied upon until it has been reviewed by counsel admitted in each jurisdiction in which the service is offered. Parts of this document describe mandatory criminal reporting duties. Those parts in particular must be reviewed by counsel and by a named accountable officer before the Service accepts a single production upload. Every item marked [CONFIRM: ...] is an open question the client must answer.

• Document: Content Moderation and Safety Policy
• Service: clothy.co virtual clothing try-on service (the "Service")
• Provider: [CONFIRM: legal entity name, company number, registered address, country of incorporation]
• Version: 0.1 draft
• Effective: [CONFIRM: effective date]
• Audience: This document is written to be published. Sections 7 to 10 double as the internal runbook and contain operational detail that the client may prefer to hold in an internal-only annex. See NOTES FOR COUNSEL item 1.

0. Plain-language summary

• Every image you upload is screened automatically before it is processed. Screening looks for the things our Acceptable Use Policy forbids, principally images of children, nudity and sexual content.
• If screening flags something, processing stops. Depending on what was flagged, the upload is either rejected outright, or held for a person to look at.
• When a person does look, the design intent is that they see a blurred or derived version of the image, not the full-resolution original. Looking at your data at all requires a time-boxed approval, and for body photographs and measurements it requires a second staff member to approve. Every time your data is decrypted, it is logged and you get a record of it.
• If we find material that appears to be child sexual abuse material, we are legally required to report it. We do that, we preserve the evidence, and we do not tell the account holder.
• You can appeal almost every moderation decision. The exception is a decision connected to a live law enforcement referral.
• Normally we delete your data and destroy your encryption key when you ask. If we are under a legal duty to preserve evidence, that duty wins and key destruction is blocked until the duty ends. We will tell you that has happened unless we are prohibited from doing so.

1. Scope and purpose

1.1 This policy explains how content submitted to the Service is screened, what happens when content is flagged, how review is conducted, what enforcement follows, how to appeal, and how we discharge mandatory reporting duties.

1.2 It applies to all Content as defined in the Acceptable Use Policy: full-body photographs of users, garment listing images and screenshots, generated try-on renders, written fit reports, and free text entered by users.

1.3 The substantive rules about what is and is not permitted are in the Acceptable Use Policy. This document is about process, not about rules.

1.4 This policy sits alongside, and does not replace, the Privacy Policy, the Biometric Policy, law-enforcement-guidelines.md, and security-policy.md.

2. Design principles

2.1 Minimise the number of human eyes. The Service processes photographs of people's bodies. The correct default is that no person at the provider ever sees them. Every part of this policy is designed around reducing, logging and constraining human viewing.

2.2 Minimise resolution and fidelity at review. Where a human must review, the design intent is that they are shown blurred, downsampled or otherwise derived imagery sufficient to make the decision, and that full-resolution access is a separately approved escalation. [CONFIRM: whether blurred or derived review imagery is implemented today. The brief describes face suppression fields on uploads but does not confirm a blurred review pipeline. Do not publish this as a statement of current fact until it is verified. An inaccurate description of how staff view user photographs would be an unfair or deceptive act or practice under section 5 of the FTC Act, 15 U.S.C. section 45, and a breach of the transparency obligations in Articles 12 to 14 of the UK and EU GDPR.]

2.3 Automate the easy calls, escalate the hard ones. Automated screening should reject the clear cases without human involvement and should route only genuinely ambiguous cases to a person.

2.4 Log everything, make the log tamper-evident. Administrative actions are recorded in a hash-chained, tamper-evident audit log. Every decryption of user data is individually logged.

2.5 Never let a business decision override a legal duty. Where a legal preservation or reporting duty applies, it takes precedence over deletion requests, over retention schedules, and over user convenience. See section 9.

3. What gets screened, and when

3.1 Screening runs at upload, before the image is used for measurement estimation, before it is sent to any third-party AI processor, and before any render is produced.

3.2 The following classes of content are screened:

3.3 [CONFIRM: the actual screening stack. The brief does not identify a content classification provider. If screening is performed by a third party, that provider must appear in subprocessors.md with a transfer mechanism and a no-training commitment. If screening is performed by the same AI provider that performs measurement estimation, say so, because it changes what data is shared and with whom.]

3.4 No general monitoring obligation. We screen content submitted to us. We do not conduct general monitoring of user activity and we are not required to. Article 8 of Regulation (EU) 2022/2065 (the Digital Services Act) expressly prohibits Member States from imposing a general monitoring obligation on providers. In the United States, 18 U.S.C. section 2258A(f) confirms that nothing in the reporting provisions requires a provider to affirmatively search, screen or scan for the facts or circumstances that trigger a report. Our screening is voluntary and is designed to prevent harm, not to satisfy a monitoring duty.

3.5 Face suppression. Uploads carry face_detected, face_suppressed, suppression_method and suppressed_at fields. The intent is that faces are suppressed before any image is sent to a third-party AI processor. [CONFIRM: whether face suppression runs client-side before upload, or server-side after upload. The landing page currently says "your face never leaves your device". If suppression is server-side, that claim is false and must be corrected immediately. An inaccurate privacy claim is itself an unfair or deceptive practice under section 5 of the FTC Act and, in the EU and UK, a fairness and transparency breach under Article 5(1)(a) GDPR. This is the single most urgent item in this document set.]

4. Screening outcomes

4.1 Every screened item receives one of four outcomes.

4.2 Soft block is the default for the common, innocent failures: a photograph that is not full-body, a photograph with no person in it, a photograph with poor lighting, an image the classifier believes contains underwear where the user simply wore close-fitting clothing.

4.3 Hold for review is used where the classifier is uncertain and the cost of getting it wrong is high in either direction, for example where an adult of small stature is flagged as a possible minor.

4.4 Hard block plus escalation is used where the classifier is confident that the content falls into a category triggering a legal duty or a permanent enforcement outcome.

4.5 [CONFIRM: the confidence thresholds at which each outcome triggers, and who owns tuning them. A published policy does not need to state thresholds, but the internal runbook must, and the thresholds must be reviewed because both false-positive and false-negative rates carry serious consequences here.]

5. Human review

5.1 Who reviews

5.1.1 Review is performed by trained staff. [CONFIRM: whether review is performed by employees, by contractors, or by an outsourced trust and safety vendor. If any part of review is outsourced, that vendor is a processor and must appear in subprocessors.md, with a data processing agreement, a transfer mechanism, and confidentiality and welfare commitments.]

5.1.2 Reviewers handling escalations under section 8 must be a named, restricted subset of staff with specific training on the handling, non-proliferation and reporting of child sexual abuse material. [CONFIRM: who these people are, what training they receive, and what welfare support is provided. Trust and safety staff exposed to this material require occupational health support as a matter of both duty of care and employment law.]

5.2 How review is authorised

5.2.1 A reviewer cannot browse user data. To view any encrypted user data, a reviewer must hold an approved, time-boxed access grant scoped to the specific item.

5.2.2 Access to body measurements, photographs and try-on outputs requires the approval of a second, different staff member. This is a two-person rule and it is enforced technically, not by policy alone.

5.2.3 Every decryption is logged individually in the tamper-evident admin audit log, and a privacy_events record is written to the affected user's account so that the user can see that their data was accessed.

5.2.4 Administrative access uses a separate authentication realm from customer accounts, with mandatory time-based one-time-password two-factor authentication.

5.3 What the reviewer sees

5.3.1 The design intent is that a reviewer is shown blurred or otherwise derived imagery sufficient to make the decision, and not the full-resolution original. [CONFIRM: as at section 2.2. Do not publish as fact until verified.]

5.3.2 Where the reviewer cannot make the decision from derived imagery, escalation to full-resolution review requires a fresh grant and a fresh second approval, and is separately logged.

5.3.3 Reviewers must not download, copy, screenshot, forward, or retain any reviewed imagery outside the review tool. For material within section 8, doing so may itself be a criminal offence.

5.4 Timeframes

5.4.1 We aim to complete review of a held item within [CONFIRM: target, suggest 24 hours for ordinary holds].

5.4.2 Escalations under section 8 are handled immediately and are not queued.

6. Enforcement outcomes

6.1 Enforcement follows the ladder in the Acceptable Use Policy section 6.2.

6.2 Where an item is removed or an account restricted, and the affected user is a recipient of the service in the European Union, we issue a statement of reasons meeting Article 17 of the Digital Services Act. The statement covers:

(a) whether the decision entails removal, disabling of access, demotion, restriction of visibility, suspension or termination of the service, or suspension or termination of the account; (b) the facts and circumstances relied on, including whether the decision was taken on the basis of a notice submitted under Article 16 or on our own initiative; (c) where automated means were used, information to that effect; (d) the contractual ground or the legal ground relied on and an explanation of why the content is considered incompatible with it; (e) the redress available, including the internal complaint-handling system, out-of-court dispute settlement, and judicial redress.

6.3 [CONFIRM: DSA classification. Article 17 applies to hosting services generally, so it likely applies regardless. Articles 20 to 24 apply only to online platforms. See acceptable-use-policy.md NOTES FOR COUNSEL item 2.]

6.4 We do not issue a statement of reasons where doing so would prejudice an ongoing law enforcement referral, or where we are legally prohibited from doing so. Article 17(1) of the DSA carves out deceptive high-volume commercial content; the criminal referral carve-out here rests on [CONFIRM: counsel to identify the precise basis for withholding a statement of reasons where a section 8 referral is live. The DSA does not contain an express exception. In practice providers rely on the fact that reporting duties and non-disclosure obligations under national criminal law override. This needs a considered position, not an assumption.]

7. Escalation: non-consensual intimate imagery and threats to safety

7.1 Where screening or review identifies content that appears to be an intimate visual depiction of an identifiable individual created or shared without consent, or content indicating a threat to the life or safety of a person:

(a) processing stops and the content is quarantined, not deleted; (b) the account is restricted immediately under Acceptable Use Policy section 6.3; (c) an escalation is raised to [CONFIRM: named role or team] within [CONFIRM: target, suggest 1 hour].

7.2 Non-consensual intimate imagery reported by a depicted person. Requests received under Acceptable Use Policy section 3.5.3 are actioned within 48 hours of a valid request, as required by section 3 of the TAKE IT DOWN Act (Pub. L. 119-12, 2025). We also make reasonable efforts to identify and remove identical copies.

7.3 Threat to life or safety, EU users. Article 18 of the Digital Services Act requires a hosting provider that becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, to promptly inform the law enforcement or judicial authorities of the Member State concerned and to provide all relevant information available. Where we cannot identify the Member State concerned with reasonable certainty, we inform the authorities of the Member State in which we are established or in which our legal representative is established, or Europol, or both. [CONFIRM: our Member State of establishment and whether an Article 13 DSA legal representative in the EU has been appointed. If EU users are served and we are not established in the EU, an Article 13 legal representative is mandatory and its details must be published.]

7.4 Threat to life or safety, other jurisdictions. We contact local emergency services or the relevant law enforcement authority. See law-enforcement-guidelines.md.

8. Escalation: suspected child sexual abuse material

This section is the most important operational content in this document. It is written as a runbook because it must be followed exactly, under time pressure, by people who will not be reading it for the first time in an emergency.

8.1 The legal duty in the United States

8.1.1 Under 18 U.S.C. section 2258A(a), a provider of an electronic communication service or a remote computing service that obtains actual knowledge of any facts or circumstances indicating an apparent violation of the child sexual exploitation offences listed in that section (including 18 U.S.C. sections 2251, 2251A, 2252, 2252A, 2252B and 2260) must, as soon as reasonably possible, make a report to the CyberTipline of the National Center for Missing and Exploited Children ("NCMEC").

8.1.2 Under 18 U.S.C. section 2258A(a)(3), we must register with NCMEC and provide a mailing address, telephone number, facsimile number, electronic mail address, and an individual point of contact. [CONFIRM: NCMEC ESP registration has not been completed. It must be completed before production launch. Identify the individual point of contact by name and role.]

8.1.3 Under 18 U.S.C. section 2258A(e), a knowing and wilful failure to report carries civil penalties, currently up to [CONFIRM: current penalty figures with counsel. The statute distinguishes first and subsequent knowing and wilful failures and distinguishes providers by size.]

8.1.4 Under 18 U.S.C. section 2258A(f), we are not required to affirmatively search, screen or scan for such material. Our screening is voluntary.

8.1.5 Under 18 U.S.C. section 2258B, providers making a good faith report have limited liability protection. That protection depends on the report being made in good faith and in accordance with the statute, which is why the runbook must be followed.

8.2 The legal position in the European Union

8.2.1 Article 18 of the Digital Services Act applies where the material indicates a threat to the life or safety of a person, as set out in section 7.3.

8.2.2 Regulation (EU) 2021/1232 provided a temporary derogation from the ePrivacy Directive permitting number-independent interpersonal communications services to conduct voluntary detection of child sexual abuse material. That derogation, as extended, expired on 3 April 2026. [CONFIRM: the current state of EU law. The proposed Regulation laying down rules to prevent and combat child sexual abuse (COM(2022) 209 final) was still in negotiation as at the date of this draft. Counsel must confirm the position at publication. In any event, clothy.co is unlikely to be a number-independent interpersonal communications service, so Regulation 2021/1232 probably never applied to it. Confirm rather than assume.]

8.2.3 There is no single EU-wide equivalent of the section 2258A CyberTipline duty. Reporting is made to national law enforcement, and in practice through national hotlines that are members of the INHOPE network. [CONFIRM: the reporting route for each EU Member State in which users are served, or a decision to route all EU reports through a single national authority based on our place of establishment or our Article 13 legal representative.]

8.3 The legal position in the United Kingdom

8.3.1 [CONFIRM: the UK position with counsel. Key points to settle: (a) whether the Service is a regulated user-to-user service or a search service under the Online Safety Act 2023, which turns on whether user content is shared with other users; (b) the effect of the Protection of Children Act 1978 section 1, under which making, distributing or possessing an indecent photograph of a child is an offence, and the scope of the section 1B defence for a person acting for the purposes of the prevention, detection or investigation of crime, because the runbook below involves staff necessarily viewing and retaining such material; (c) the status and commencement of any mandatory reporting duty for child sexual abuse introduced by the Crime and Policing Bill; (d) whether membership of the Internet Watch Foundation is appropriate.]

8.3.2 The section 1B point is not academic. If a UK-based reviewer views or preserves such material without a statutory defence, the reviewer commits an offence. Do not launch UK operations until this is resolved.

8.4 The runbook

Trigger. Automated screening returns a high-confidence CSAM classification, or a reviewer forms a suspicion during any review, or a report is received from a user or third party.

Step 1: Stop and contain (immediately).

• Halt all processing of the item. Do not send it to any third-party AI processor.
• Quarantine the item in encrypted storage. Apply a preservation flag.
• Suspend the account. Do not delete anything.
• Suppress the account's export function and its deletion function. See section 9.

Step 2: Do not proliferate (immediately).

• Do not download, copy, screenshot, print, email, or place the item in any chat, ticket, or document.
• Do not attach the item to an internal ticket. Reference it by identifier only.
• Do not send it to outside counsel, to a vendor, or to anyone other than NCMEC and law enforcement through the approved channel.

Step 3: Confirm and escalate (within [CONFIRM: target, suggest 1 hour]).

• Escalate to [CONFIRM: named accountable role, for example the Head of Trust and Safety, plus a named deputy. This must be a person, not a queue.]
• Confirmation requires two members of the trained escalation team. The two-person rule applies.
• If, after confirmation, the material is assessed as not CSAM, record the assessment and its reasons in the audit log, then release the item to the ordinary review path. Do not silently release.

Step 4: Report to NCMEC (as soon as reasonably possible after actual knowledge).

• File through the NCMEC CyberTipline ESP reporting portal or API.
• Under 18 U.S.C. section 2258A(b), the report may include, and to the extent available should include:
  • information concerning the involved individual, including name, address, email address, user identifier, IP address, and any other identifying information;
  • historical reference, including the date and time of the relevant events or of the account registration;
  • geographic location information, including the IP address or verified billing address, or, if not reasonably available, at least one form of geographic identifying information such as an area code or postal code;
  • any image of apparent child pornography relating to the incident;
  • the complete communication containing the image, including any data or information regarding the transmission and any images, data or information attached to it.
• Record the CyberTipline report number in the audit log.

Step 5: Preserve (statutory).

• Under 18 U.S.C. section 2258A(h), the contents of a report must be preserved for 90 days after the submission of the report to NCMEC, and a completed submission is treated as a request to preserve the contents for one year after submission. [CONFIRM: the current statutory preservation period with counsel. The REPORT Act (2024) amended this area and the period should be verified against the current text of section 2258A rather than against secondary sources.]
• The preservation flag must block key destruction. See section 9.
• Preservation must be in a secure location and access to it is restricted to the escalation team and to law enforcement acting under valid legal process.

Step 6: Do not notify the account holder.

• The account holder is told that their account has been suspended for a violation of the Acceptable Use Policy. They are not told that a report has been made, and they are not told what was found.
• Do not respond substantively to appeals or data subject access requests relating to the reported material while a referral is open. Route them to [CONFIRM: named role] and to counsel. A data subject access request may be restricted where compliance would prejudice the prevention, investigation, detection or prosecution of criminal offences: see UK Data Protection Act 2018 Schedule 2 Part 1 paragraph 2, and GDPR Article 23(1)(d) as implemented in each relevant Member State.

Step 7: Cooperate with law enforcement.

• Requests from law enforcement are handled under law-enforcement-guidelines.md.
• Nothing in that document is intended to slow down a CSAM investigation, but the legal process requirements in it still apply to compelled disclosure of unrelated account data.

Step 8: Record and review.

• Record every step, timestamped, in the tamper-evident audit log, with the identity of every person involved.
• Conduct a post-incident review covering detection, timing, and whether the runbook was followed. Record it. Do not include the material itself in the review record.

8.5 What we do not do

8.5.1 We do not investigate. We are not a law enforcement agency and we do not attempt to build a case, identify a victim, or contact anyone connected to the material.

8.5.2 We do not use the material for model training, evaluation, or classifier tuning.

8.5.3 We do not share the material with any commercial third party, including our AI processor.

8.5.4 We do not send the material outside the approved reporting and preservation channel for any reason.

9. Interaction with deletion, retention and crypto-shredding

This section states the rule that must be built into the system, not merely written down.

9.1 The normal position. A user may delete their account. Deletion shreds the user's per-user data encryption key. Because all sensitive derived data and imagery is encrypted at rest under that key using envelope encryption, destroying the key renders the data permanently unrecoverable, including in immutable backups. A shredded_keys tombstone is reconciled hourly so that restoring a backup cannot resurrect a shredded key. This is our documented erasure mechanism for the purposes of Article 17 of the UK and EU GDPR.

9.2 The exception: a preservation obligation blocks key destruction.

9.2.1 Where a preservation obligation applies to a user's data, key destruction is blocked. The key is retained, in escrow, until the obligation lapses.

9.2.2 A preservation obligation arises from any of the following:

(a) a statutory preservation duty, including the duty under 18 U.S.C. section 2258A(h) following a CyberTipline report; (b) a preservation request from law enforcement, including a request under 18 U.S.C. section 2703(f); (c) a litigation hold arising from actual or reasonably anticipated litigation, regulatory investigation, or arbitration; (d) a court order, subpoena, warrant or equivalent legal process; (e) an open internal safety escalation under section 7 or section 8 of this policy.

9.2.3 This must be a technical control, not a procedural one. The deletion pipeline must check for an active hold before it destroys a key, and must fail closed. A hold flag that only lives in a ticketing system, or that relies on an engineer remembering, is not a control. [CONFIRM: whether a preservation flag that blocks key shredding exists in the system today. The brief describes crypto-shredding and an hourly tombstone reconciliation, but does not describe a legal hold mechanism. If it does not exist, it is a launch blocker, because an automated hourly sweep that destroys keys will destroy evidence we are legally required to preserve, and it will do so without anyone deciding to.]

9.3 Scope of a hold. A hold is scoped as narrowly as the obligation permits. A hold arising from a single reported item should not, without a reason, freeze every unrelated user's data.

9.4 Duration and release. Each hold records the obligation it arises from, the date it was applied, the person who applied it, and a review date. Holds are reviewed at least [CONFIRM: review cadence, suggest quarterly]. When the obligation lapses, the hold is released and the ordinary deletion or retention rule resumes, which for a deleted account means the key is shredded at that point.

9.5 Telling the user. Where we cannot complete a deletion request because of a hold, we tell the user that their request has been received, that completion is deferred because of a legal obligation, and when we expect to complete it. We do not tell them where the obligation came from where doing so would prejudice a criminal investigation or where we are prohibited from telling them. This is consistent with Article 12(4) and Article 23 GDPR and with law-enforcement-guidelines.md section 6.

9.6 Retention schedule for moderation records. Moderation decisions, statements of reasons, appeal records and audit log entries are retained for [CONFIRM: retention period. Note the tension: DSA Art. 24(5) requires statements of reasons to be submitted to the Commission transparency database for online platforms, and limitation periods for challenges suggest a multi-year retention, while GDPR data minimisation pushes the other way. A common landing point is 12 to 24 months for the decision record and longer for the audit log. Note also that upload retention defaults to 30 days and body data retention defaults to 30 days, so a moderation record must not silently extend the retention of the underlying imagery.]

9.7 The imagery itself is not retained for moderation purposes beyond the ordinary retention schedule, except where a preservation obligation under section 9.2 applies.

10. Appeals and redress

10.1 Every moderation decision except one is appealable. The exception is a decision connected to a live escalation under section 8, while the referral is open.

10.2 The appeal route, the deadline, and the review standard are set out in Acceptable Use Policy section 8. In summary:

(a) appeals go to [CONFIRM: appeals contact address or in-product route]; (b) the window is [CONFIRM: suggest 6 months]; (c) the reviewer is a person who was not involved in the original decision; (d) where the original decision was automated, the appeal is decided by a human being, which reflects Article 20(6) of the Digital Services Act and Article 22 of the UK and EU GDPR; (e) we aim to decide within [CONFIRM: suggest 10 business days].

10.3 On a successful appeal we reverse the enforcement action, restore access, and record the reversal. We cannot restore content that has already been deleted, which is why soft-blocked uploads should be re-uploaded rather than appealed where the user simply wants to proceed.

10.4 EU users may in addition use a certified out-of-court dispute settlement body under Article 21 of the Digital Services Act and may complain to their national Digital Services Coordinator. [CONFIRM: subject to the online platform classification question.]

10.5 Nothing in this policy limits your right to complain to a data protection authority or to go to court.

11. Transparency reporting

11.1 We intend to publish a periodic transparency report covering, at a minimum:

(a) the number of items screened and the number blocked, by outcome category; (b) the number of items held for human review, and median time to decision; (c) the number of accounts restricted, suspended and terminated, by ground; (d) the number of appeals received, upheld and rejected, and median time to decision; (e) the number of notices received from third parties, including copyright and trade mark complaints and non-consensual intimate imagery reports, and how they were actioned; (f) the number of law enforcement and government requests received, by type and jurisdiction, and how many were complied with, in whole or in part; (g) the use of automated means in moderation and their accuracy where measurable.

11.2 We do not publish the number of CyberTipline reports at a granularity that could identify an individual case. We may publish an aggregate annual figure. [CONFIRM: whether to publish CSAM report counts at all. Most large providers do. Doing so at low volume can be identifying and can prejudice investigations. Take a view with counsel.]

11.3 Publication cadence: [CONFIRM: suggest annually to begin with, moving to semi-annually. Note that DSA Art. 15 requires hosting services to publish transparency reports at least once a year, and Art. 24 imposes additional requirements on online platforms with a six-month cadence for certain figures.]

11.4 See law-enforcement-guidelines.md section 9 for the government request element of the report.

12. Governance and review

12.1 This policy is owned by [CONFIRM: named accountable role].

12.2 It is reviewed at least annually, and on any of the following triggers: a change in screening technology, a change in the law cited in this document, a serious incident, a regulatory inquiry, or the addition of a sharing or social feature to the product.

12.3 The addition of any feature that lets one user see another user's content is a material change that requires this policy, the Acceptable Use Policy, and the DSA classification analysis to be redone before launch.

13. Contact

• Report content: [CONFIRM: abuse reporting address]
• Report non-consensual intimate imagery: [CONFIRM: dedicated NCII reporting route]
• Appeals: [CONFIRM: appeals address]
• Law enforcement: see law-enforcement-guidelines.md
• Privacy: [CONFIRM: privacy contact]