Copyright and AI disclosure policy

copyright_policy · v1 · en

Draft. This text has not yet been reviewed by a lawyer and is not in force.

The Spanish text is the binding one; this translation is for information.

Copyright and AI disclosure policy

Status: draft, written 2026-09-23 (Stage 16). It is not in force until the S-08 lawyer's opinion has been read against it and `legal:seed --publish` has been run. The Spanish text (`copyright_policy.es.md`) is the binding one; this is a translation for information.

This is the compliance record of 16-hardening.md §5: what the service does with other people's work, what it discloses about its own, and where in the code each of those claims is enforced.

1. What an item is made of

Every item this service publishes is generated from extracted facts, never from the source's prose. Stage 3 extracts facts from an article; Stage 4 merges them into a story; Stage 6 generates from the story's facts and its neutral summary and never sees a source body. A quotation reaches the generator as a fact with its speaker attached (D-13), so an outlet's sentence does not travel with it.

Every item links to the outlets its story came from and names them. Hyperlinking is outside the Spanish press right unconditionally (TRLPI art. 129 bis.6(b)).

2. The overlap check, and what it is for

The generator is not shown source prose, so the longest run of words an item shares with any source body should sit near zero. The service measures it anyway, on every item, as the longest run of consecutive normalised tokens shared with any source body — excluding runs that are entirely a named entity, runs inside a quotation attributed to a named speaker, and gazette text, which TRLPI art. 13 puts outside intellectual property altogether.

Soft threshold: 6 words. The item is regenerated.
Hard threshold: 8 words. Publication is blocked.

Those are the numbers of D-49, and they are lower than the only benchmark European case law offers: in **C-5/08 *Infopaq*** the CJEU held that eleven consecutive words can already constitute reproduction in part. Both earlier drafts of this policy guessed above that figure and neither survived reading it.

The check is a regression alarm on the rule in §1, not a licence to copy up to eight words. If it fires at all, something in the generation path has started showing the model text it should never see, and the right response is to find that, not to raise the number. They are engineering defaults until the S-08 opinion; changing them means changing `config/content.php` and this policy in the same commit, and `tests/Architecture/ComplianceRecordTest` fails if only one of the two moves.

3. Collection, and how a refusal is honoured

Test-mode posture (D-89, 2026-09-27). The crawler presents a desktop browser's user agent on every request and reads no `robots.txt` and no `tdm-reservation` header. The owner chose this for the build and test period, so that the collected data is not skewed by sites that answer a declared bot differently from a reader. It never signs in to anything.

This section cannot be published as it stands. RDL 24/2021 art. 67.3 (Directive 2019/790 art. 4.3) makes a rights reservation expressed "in an appropriate manner, such as machine-readable means" binding on text and data mining, and until 2026-09-27 this policy honoured three evidences of one: a `robots.txt` rule naming our agent, a `tdm-reservation: 1` header, a terms clause. A `robots.txt` block on other companies' AI agents (GPTBot, ClaudeBot and the like) was never one of them (D-78), and that reading stands. Before this policy goes in force the posture of D-89 is revisited against the S-08 lawyer's opinion; that is a gap, not a decision.

What survives is the operator's reservation. A source's refusal is two fields, written only by `App\Ingest\Actions\SourceRefusals`:

- `crawl_allowed` — an operator's switch: false stops page fetches for the source. - `tdm_reserved`, with `tdm_evidence` and `tdm_checked_at` — set by an operator, today only by a takedown about collection (`App\Legal\Actions\BlockSource`), and lifted only by an operator.

A reserved source is still fetched for metadata, linked and counted as an outlet — hyperlinking is outside the right — but where `tdm_reserved` is true:

- no `article_bodies` row is written for it; - no compressed source-body copy is kept against a generated item; - the article is never enriched. The gate is in the enrichment path and not only in the fetcher, because a body that reached the pipeline before the reservation was made would otherwise still be processed.

There is no quarterly re-probe any more: `sources:probe-tdm` read the two machine-readable evidences D-89 stopped reading, and went with them.

Where a source's terms make collection a licensing question rather than a technical one, it becomes a licensing conversation and not a workaround.

4. Photographs

Source photographs are referenced, never re-hosted. Unsplash images are hotlinked as its API requires. Every other image carries licence and credit metadata, and the credit line is rendered automatically on every surface from one renderer, so an item cannot appear without it.

5. AI disclosure — Regulation (EU) 2024/1689, art. 50(4)

Article 50(4) of the AI Act has applied since 2 August 2026. It requires a deployer of an AI system that generates text published to inform the public on matters of public interest to disclose that the text was artificially generated. Article 50(5) requires the disclosure in a clear and distinguishable manner at the latest at the time of first exposure.

This is the description of this product, not an edge case. Therefore:

- Automatic publication, and every channel in our own network, carries the disclosure on every item. There is no human review, so no exception applies. - Review mode relies on the exception in art. 50(4) for content that has undergone human review or editorial control where a natural or legal person holds editorial responsibility. The terms of service name the customer — not Notimia — as the person who holds editorial responsibility for the items they review and approve. A customer who has not accepted the version of the terms that says so is asked to before they use the service again. - Turning automatic publication on is the act that creates the obligation, so the interface says so at that moment rather than leaving it to the terms. - One renderer produces all three labels — generated with AI, sponsored, affiliate — before any truncation and at the top of the item, with the advertiser named where there is one. There is never a second disclosure path.

The evidence that the label was rendered is the approval record of each item and the audit row the renderer writes per publication.

6. Personal data

The privacy policy is a separate document. What belongs here is that the processor inventory behind it is not complete: the data-processing agreement and the processing location of several vendors are still being collected (study S-31), and the privacy page is not published until no cell in that table is empty.

7. Takedown

Anyone may ask for an item to be removed, or for their site not to be collected, at `/legal/takedown`. We answer within 72 hours to the address given.

Three answers are possible and they are not the same answer:

- the item is removed from every channel it reached; - the source is marked as having reserved its rights, which stops its bodies being stored and its articles being enriched, and is reversed only by an operator; - the claim is rejected, with the reason.

Every outcome is recorded with its timestamp, so the 72 hours are a fact and not a promise.

8. Where this is enforced in the code