Terms of Service

These Terms of Service (the “Terms”) govern access to and use of the StopNCII.org hash list by industry partners (each a “Partner”). For the avoidance of doubt Partners include those who have been provided with access to the hash list via the online automated onboarding process or the manual process via our Partnerships Team

1. Introduction

   1. South West Grid for Learning Trust Ltd: Belvedere House, Woodwater Park, Pynes Hill, Exeter, EX2 5WS. A charitable trust company registered in England and Wales. Company Number: 5589479, Charity Number: (England and Wales) 1120354 (Scotland) SC051351, VAT Number: GB 880 861 888. The SWGfL Privacy Policy can be found here.
   2. The Terms are agreed and entered into between South West Grid for Learning Trust, a charitable company registered in England and Wales (“SWGfL”), operator of StopNCII.org, and the Partner identified in the Partner Registration Form.
   3. StopNCII.org is a free tool designed to help prevent the non-consensual sharing of intimate images (NCII) online. The platform enables victims to generate hash values of their intimate images without uploading the images themselves. Those hashes are made available to Partners to enable detection and removal of matching content across their platforms.
   4. By completing the Partner Registration Form and/or signing the Data Sharing Partnership Agreement, the Partner agrees to be bound by these Terms.

2. Definitions

   Data Sharing Partnership Agreement	Means the Agreement that Partners are required to sign before being provided with access to the Hash List. The Agreement requires Partners to formally agree to these Terms.
   Eligibility Criteria	Means the standards a Partner will have to meet in order to be granted access to the Hash List.
   Hash List	Means the database of hash values and associated metadata (including case identifiers and timestamps) generated by the StopNCII.org platform and made available to Partners under these Terms.
   Hash values
   NCII	Means non-consensual intimate imagery: intimate or sexual images or videos of a person, real or synthethic, created and/or shared without their consent.
   Partner	Means an organisation that has been approved by SWGfL to access the Hash List for the purpose of detecting and removing NCII on its platform(s).
   Partner Platform	Means the digital platform(s) operated by the Partner, as identified in the Partner Registration Form.
   Partner Registration Form	Means the application and eligibility form submitted by the Partner to SWGfL prior to access being granted.
   SWGfL	South West Grid for Learning Trust, company registration number 03948864, charity registration number 1099649.

3. StopNCII Partnership

   1. StopNCII relies on website operators, particularly platforms which permit user generated content, to integrate the StopNCII hashes (referred to as “the StopNCII hashlist”) into their service. Integration of the StopNCII hashlist across additional partner platforms broadens the reach of the StopNCII hashlist, maximising the opportunity to prevent NCII being shared online.
   2. In order to enable SWGfL continue this vital work, SWGfL charges a compulsory minimum donation (“Partnership Fee”) to each organisation which partners with StopNCII (“StopNCII Partners”) to receive the StopNCII hashlist and API integration key.
   3. The Partnership Fee is calculated based on a StopNCII Partner’s Annual Revenue; as follows:

   Annual Revenue	Partnership Fee
   New Business	£1,000.00
   Below £10 Million	£4,000.00
   Between £10 & £249 Million	£8,000.00
   Between £250 & £499 Million	£12,000.00
   Between £500 & £999 Million	£16,000.00
   Over £1 Billion	£20,000.00

   • Annual Revenue means the total turnover throughout the Partner’s latest financial year immediately preceding the commencement of their partnership with SWGfL. Proof of Annual Revenue may be requested by SWGfL.
   • New Businesses are defined as organisations which have been incorporated for less than two years and which have less than £10million in Annual Revenue.

4. Eligibility and Vetting

   1. Access to the Hash List is not open to all organisations. Partners must satisfy SWGfL’s Eligibility Criteria and complete a screening process before access is granted.
   2. The vetting process will assess, among other things:
      • The Partner’s legitimate operational need to access the Hash List;
      • The adequacy of the Partner’s technical and organisational security measures;
      • The Partner’s ability and commitment to implement the Hash List within a reasonable timeframe;
      • The Partner’s commitment to comply with applicable law, including data protection obligations; and
      • Any reputational, ethical, or legal risk factors identified by SWGfL.
   3. SWGfL reserves the right to refuse access to platforms which host or disseminate illegal material, or which promote or encourage unlawful acts.
   4. SWGfL reserves the right to refuse access to any applicant at its sole discretion and is not required to provide reasons for refusal.
   5. Approval of a Partner Registration Form does not constitute a guarantee of continued access. SWGfL may review eligibility at any time.

5. Access and API Keys

   1. Upon approval, SWGfL will provide the Partner with credentials to access the Hash List via the StopNCII.org API or such other delivery mechanism as SWGfL specifies.
   2. Access credentials are personal to the Partner and must not be shared with third parties or used to enable access by any other organisation.
   3. The Partner is solely responsible for the security of its API keys and any other access credentials issued by SWGfL. The Partner must:
      • store API keys securely, including by using appropriate secrets management practices and never embedding keys in publicly accessible code, repositories, or configuration files;
      • restrict access to API keys to those personnel who require them for the purposes of the Permitted Purpose; and
      • rotate API keys promptly in the event of any actual or suspected compromise, and in any event upon the departure of any personnel who had access to them.
   4. The Partner must notify SWGfL without undue delay, and in any event within 24 hours, upon becoming aware of any actual or suspected compromise, unauthorised disclosure, or loss of API keys or access credentials.
   5. Where SWGfL becomes aware, whether through notification from the Partner or otherwise, of an actual or suspected key compromise, SWGfL may immediately suspend the Partner’s API access without prior notice as a protective measure.
   6. SWGfL will notify the Partner of any such suspension as soon as practicable. Suspension under this clause does not constitute a breach of these Terms by SWGfL and does not entitle the Partner to any refund or reduction of fees.
   7. Access will be reinstated once SWGfL is satisfied that the Partner has revoked the compromised credentials, issued new keys, and taken reasonable steps to prevent recurrence. SWGfL may require the Partner to provide a written summary of the incident and the remedial action taken before reinstating access.

6. Permitted Use of the Hash List

   1. The Partner may use the Hash List solely for the purpose outlined in the Data Sharing Partnership Agreement (the “Agreed Purpose”).
   2. he following uses are expressly prohibited:
      • Using the Hash List for any purpose other than the Agreed Purpose;
      • Redistribution, resale, sublicensing, or disclosure of the Hash List or any part of it to any third party;
      • Using the Hash List to train machine learning models or algorithms, except as strictly necessary to implement the Agreed Purpose on the Partner Platform;
      • Any commercial exploitation of the Hash List beyond its use for the Permitted Purpose.
   3. The Partner must implement the Hash List within [30] days of access being granted, unless an alternative implementation timeline has been agreed in writing with SWGfL.

   [NOTE: Implementation timeframe to be confirmed

7. Security

   1. The Partner must implement and maintain appropriate technical and organisational measures to protect the Hash List against unauthorised access, disclosure, alteration, or destruction.
   2. SWGfL may conduct periodic security assessments of the Partner’s implementation arrangements, on reasonable notice.

8. Acceptable Use

   1. The Partner must access the Hash List in a manner that is consistent with the efficient and fair operation of the StopNCII.org API and does not place unreasonable demand on SWGfL’s infrastructure.
   2. The Partner must designate a single authorised integration point (“Primary Integration”) through which all API requests are made. The Partner is responsible for distributing the Hash List data across its own internal systems and services from that Primary Integration. The Partner must not configure multiple independent services, applications, or infrastructure components to query the StopNCII.org API directly.
   3. The Partner must not make requests to the API at a frequency that exceeds the rate limits notified by SWGfL from time to time. SWGfL will publish current rate limits in its API documentation and will provide reasonable advance notice of any changes. Where no specific rate limit has been notified, the Partner must apply reasonable throttling consistent with the intended use case of periodic hash list synchronisation.
   4. The Partner must implement appropriate local caching of the Hash List so as to minimise unnecessary API calls. The Partner must not make repeated full-list retrieval requests where an incremental or delta update mechanism is available.
   5. SWGfL reserves the right to throttle, suspend, or terminate API access with immediate effect where it reasonably determines that the Partner’s usage is causing or risks causing degradation of service to other Partners or to the StopNCII.org platform. SWGfL will notify the Partner as soon as practicable where such action is taken and will work with the Partner in good faith to resolve the issue.
   6. The Partner must promptly notify SWGfL if it becomes aware that its integration has generated or is likely to generate request volumes materially exceeding its normal usage patterns (for example, due to an automated process error or misconfiguration).

9. Term and Termination

   1. These Terms take effect on the date the Partner’s access is activated and continue on a rolling basis until terminated in accordance with the Partner’s Data Sharing Partnership Agreement.
   2. On termination for any reason, the Partner must immediately cease use of the Hash List and securely delete or destroy all copies of the Hash List in its possession or control, and certify in writing to SWGfL that it has done so within [5] business days of termination.

10. General

    1. Entire Agreement. These Terms, together with the Data Sharing Partnership Agreement and the Partner Registration Form, constitute the entire agreement between the parties in relation to access to the Hash List and supersede all prior agreements and understandings.
    2. Amendment. SWGfL may amend these Terms on [30] days’ written notice to the Partner. Continued access to the Hash List after the notice period constitutes acceptance of the amended Terms.
    3. Notices. Notices under these Terms must be in writing and sent to the addresses set out in the Partner Registration Form (for the Partner) and to legal@swgfl.org.uk (for SWGfL), or such other address as notified in writing.
    4. Governing Law and Jurisdiction. These Terms are governed by the law of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.

Schedule 1 — Reporting Requirements

Partners are required to submit reports to SWGfL on the following basis: