Acceptable Use & AI Safety Policy (AUP)

1. Corporate Identity, Scope & Human-in-the-Loop B2B SaaS Architecture

This Acceptable Use & AI Safety Policy ('AUP') forms an integral, legally binding part of the Terms of Service between Kuzey Tech Bilgi Teknolojileri Ticaret Limited Şirketi (Brand: Uptexx — https://uptexx.com | Product: NexoPost — https://nexopost.com, Registered Address: Cumhuriyet Mah. Kazım Karabekir Cad. No:2/28 Beşikdüzü, Trabzon, 61800, Turkey, MERSİS No: 0601112271100001, Tax ID / VKN: 6011122711 — Beşikdüzü V.D., Official Contact: info@nexopost.com) and every corporate or individual customer accessing NexoPost.

NexoPost is an enterprise Human-in-the-Loop (HITL) B2B SaaS platform designed exclusively for authorized content creation, multi-format aspect ratio formatting, editorial calendar planning, Magic Link client approval (/review/[token]), and publishing to the customer's own OAuth 2.0 authenticated social media accounts.

2. AI Safety, Deepfake / Voice Cloning Prohibition & EU AI Act (Art. 5 & 50) + MoR Compliance

Customers utilizing Nexo AI Studio (Text, Image, Voice Synthesis, and Video Generation) must strictly comply with international AI safety regulations, including Regulation (EU) 2024/1689 (EU AI Act Articles 5 and 50) and US federal/state impersonation laws. The following activities are strictly prohibited under zero tolerance:

• (a) Non-Consensual Intimate Imagery & Child Safety (Zero Tolerance): Generating, uploading, or distributing non-consensual sexual/intimate content (NCII), nudification ('Nudify'), NSFW/adult pornography, or Child Sexual Abuse Material / Exploitation (CSAM/CSAE — strictly reported to NCMEC under 18 U.S.C. § 2258A and international law enforcement).
• (b) Unauthorized Deepfakes, Face-Swap & Voice Cloning: Creating photorealistic face-swaps, deceptive deepfake videos, or synthetic voice clones of real individuals, celebrities, executives, or politicians without verifiable prior written consent (in strict compliance with the US ELVIS Act, DEFIANCE Act, FTC Impersonation Rule 16 CFR Part 461, and EU AI Act Art. 50).
• (c) Disinformation,Harm & Illicit Propaganda: Generating election interference, civic manipulation, defamation, cyberbullying, hate speech, self-harm encouragement, biometric categorization, or terrorist/extremist propaganda.
• (d) Synthetic Media Transparency (EU AI Act Art. 50): Customers must comply with applicable synthetic media disclosure and labeling obligations when publishing AI-assisted visual, audio, or video assets.

3. Real-Time AI Prompt & Media Moderation Shield (AWS Rekognition Safety Shield)

All user text prompts and uploaded media assets pass through NexoPost's real-time automated security layer — powered by AWS Rekognition Safety Shield and multi-stage Prompt Moderation API filters — prior to AI generation, cloud storage, or social publishing.

Prohibited, unsafe, or policy-violating prompts and media uploads are automatically blocked at the generation or upload stage. Severe or repeated attempts to bypass safety filters trigger immediate, permanent account suspension without refund ('without refund').

4. Zero Spam, Zero Scraping & Zero Fake Engagement Policy

NexoPost operates exclusively via official, passwordless OAuth 2.0 APIs and strictly prohibits any form of platform manipulation or unauthorized automation:

• No automated DM/comment spam bots, bulk cold messaging, or unsolicited commercial communications.
• No unauthorized data scraping, harvesting, credential stuffing, or reverse-engineering of third-party social network APIs.
• No buying, selling, exchanging, or facilitating fake followers, fake likes, artificial views, engagement pods, or click farms.

5. National & International Regulatory Compliance Framework Across All 8 Supported Regions

NexoPost enforces strict legal compliance across all eight supported linguistic and regulatory regions:

• Turkey (TR): Law No. 6698 on Personal Data Protection (KVKK), Law No. 5651 on Regulation of Publications on the Internet (Art. 8 & 9 content removal and access blocking obligations), Law No. 6563 on Electronic Commerce (İYS commercial message rules), Law No. 5846 on Intellectual and Artistic Works (FSEK), and Law No. 5237 Turkish Penal Code (TCK).
• European Union (DE, FR, ES, PT & All EU Member States): EU GDPR (Regulation 2016/679), EU Digital Services Act — DSA (Regulation 2022/2065 — Art. 14 & Art. 16 Notice-and-Action illegal content reporting mechanism), EU AI Act (Regulation 2024/1689), Germany DDG, BDSG & StGB § 86a/130, France Loi Informatique et Libertés, LCEN & Loi SREN (2024 deepfake & cyber-harassment law), and Spain LOPDGDD & LSSI-CE.
• United Kingdom (UK — EN): UK GDPR, Data Protection Act 2018, and UK Online Safety Act 2023 (OSA).
• United States & Canada (US / CA — EN, ES, FR): CCPA / CPRA & US state privacy statutes, DMCA (17 U.S.C. § 512 — Copyright Notice/Takedown & Repeat Infringer Account Termination Policy), COPPA (15 U.S.C. § 6501 — Strict 18+ B2B Age Requirement), 18 U.S.C. § 2258A (NCMEC CSAM mandatory reporting), CAN-SPAM Act, FTC Act Section 5 & Impersonation Rule (16 CFR Part 461), DEFIANCE Act, and Canada PIPEDA / Quebec Law 25 / CASL.
• Brazil & Latin America (BR / LATAM — PT, ES): Brazil LGPD (Lei nº 13.709/2018), Marco Civil da Internet (Lei nº 12.965/2014) & Consumer Defense Code (CDC); Mexico LFPDPPP, Colombia Ley 1581, and Argentina Ley 25.326.
• Middle East / GCC (KSA & UAE — AR): Saudi Arabia PDPL (Royal Decree M/19), Anti-Cyber Crime Law (Royal Decree M/17) & SDAIA Generative AI Guidelines; United Arab Emirates Federal Decree-Law No. 45 of 2021 (PDPL) & Federal Decree-Law No. 34 of 2021 on Combatting Rumors and Cybercrimes (strict prohibition of cyber fraud, defamation, public order offenses, and synthetic rumors/deepfakes).
• Global Russian-Speaking Markets & International Sanctions Compliance (RU & Global Sanctions): Full compliance with OFAC (SDN List), US BIS EAR, European Union, UK (OFSI), and United Nations (UN) sanctions regimes. The Russian Ruble (RUB) and any transactions involving sanctioned jurisdictions, banks, or restricted entities are permanently prohibited.

6. Merchant of Record (MoR) Prohibited Commercial Activities List

In strict accordance with our Global Merchant of Record (MoR) payment compliance standards (including PayPro Global, FastSpring, Dodo Payments, and Creem.io), NexoPost may not be used to promote, schedule, or facilitate:

• Illegal goods or services, counterfeit products, stolen digital assets, or intellectual property infringement.
• Unlicensed gambling, sports betting, casinos, lotteries, or sweepstakes.
• Pyramid schemes, Ponzi schemes, get-rich-quick schemes, or unlicensed financial, crypto, forex, or investment advisory.
• Controlled substances, prescription pharmaceuticals, tobacco/vapes, firearms, weapons, or ammunition.
• Malware, spyware, phishing links, deceptive commercial practices, or using the platform to distribute third-party cash rewards, cashback, or marketplace payouts.

7. Intellectual Property, Audio/Music/Media Copyright Responsibility (DMCA & FSEK) & Customer Warranty

Customers retain ownership of their lawful content and bear 100% exclusive legal and financial responsibility for ensuring they hold valid commercial synchronization, master use, public performance, and broadcasting licenses for all uploaded or AI-generated text, image, audio, and video assets across every target social network.

8. Official Non-Affiliation Disclaimer for Third-Party AI Models & Social Networks

NexoPost is an independent B2B SaaS platform developed by Kuzey Tech Bilgi Teknolojileri Ticaret Limited Şirketi (Uptexx). NexoPost is not affiliated with, endorsed by, or sponsored by any third-party AI providers (including OpenAI, Google Gemini, Anthropic, Groq, Runware, ElevenLabs, Deepgram, or Tavily) or social media networks (including Meta, Instagram, Facebook, TikTok, YouTube, X, LinkedIn, Pinterest, Threads, Bluesky, or Mastodon). All third-party trademarks and logos are the property of their respective owners.

9. Violation Reporting (DSA Art. 16 Notice-and-Action / DMCA Takedown / KVKK & GDPR) & Enforcement SLA

Any person, copyright holder, or regulatory authority may report suspected illegal content, copyright infringement (DMCA / FSEK), or AUP violations directly to our Legal & Abuse Desk at info@nexopost.com.

NexoPost commits to a strict 24–48 hour Notice-and-Action review and takedown SLA. Accounts found violating this policy are subject to immediate content removal and permanent account termination without prior notice and without refund ('without refund').

10. Official Corporate & Legal Contact Details

Legal Entity: Kuzey Tech Bilgi Teknolojileri Ticaret Limited Şirketi (Brand: Uptexx — https://uptexx.com | Product: NexoPost — https://nexopost.com) | Registered Address: Cumhuriyet Mah. Kazım Karabekir Cad. No:2/28 Beşikdüzü, Trabzon, 61800, Turkey | MERSİS No: 0601112271100001 | Tax ID (VKN): 6011122711 (Beşikdüzü Vergi Dairesi) | Official Legal & Abuse Contact: info@nexopost.com.