Information for competent authorities submitting legal requests concerning the 10 Seconds service.
These Guidelines explain how the operator of 10 Seconds (the "Publisher") assesses requests from law enforcement, judicial, and other competent authorities. They do not replace applicable law or prescribe exclusive requirements for legally valid service.
Receipt of an email does not, by itself, establish valid service of process, jurisdiction, or an obligation to disclose information. Legally prescribed service channels remain available. The Publisher may independently verify the authority and authenticity of any request before acting.
The Publisher is established in the United Arab Emirates. Requests are assessed under applicable UAE law, relevant international judicial cooperation arrangements, and any other legal regime binding on the Publisher in the circumstances.
Foreign authorities may need to use mutual legal assistance (MLAT), judicial recognition, or another authorised cross-border procedure. Such procedures are not necessarily the exclusive route where a legally applicable instrument permits direct service.
Where applicable, this includes European Production Orders (EPOs) and European Preservation Orders (EPresOs) under Regulation (EU) 2023/1543 on the European Production and Preservation Orders for Electronic Evidence in Criminal Proceedings ("e-Evidence Regulation"), together with the corresponding rules concerning designated establishments and legal representatives.
The Publisher assesses jurisdiction, authenticity, legal basis, scope, proportionality, and applicable restrictions before acting. It may seek clarification, legal advice, modification, or judicial review where appropriate, including where a request appears overbroad, lacks proper legal authority, or conflicts with applicable fundamental-rights or human-rights standards. A request for clarification or review does not automatically suspend a binding legal deadline.
10 Seconds provides end-to-end encrypted private text communications. In the ordinary operation of the messaging service, enforced server-side:
These statements concern the Publisher's messaging system. Disappearance from a chat interface does not guarantee the absence of screenshots, photographs, copies, or other evidence on a participant's device. The Publisher's forensic watermark embedded in every session may, however, allow a leaked screenshot to be traced to the account that captured it; requests concerning watermark attribution should specify the screenshot in question.
The absence of retained chat data must be distinguished from information arising outside the messaging system. Depending on the circumstances and request, the Publisher may hold:
This is not a representation that these records exist for every user or can be linked to a particular chat. Availability and any reliable association must be established for each request. The Publisher will not invent missing identifiers or present an unverified association as an established identity.
Payment providers (Stripe, CoinPayments), hosting providers, and other third parties may independently hold information under their own systems and legal obligations. These Guidelines do not describe or guarantee their retention practices. Authorities should address requests for independently held third-party records to the relevant custodian where appropriate.
To facilitate verification and a timely response, requests should include (to the extent required or permitted by applicable procedure):
These practical requirements do not invalidate a request that otherwise satisfies mandatory legal requirements. The Publisher does not respond to informal requests, voluntary disclosures without legal basis, or overly broad or bulk data requests; such requests will be returned for completion or declined.
Requests are assessed promptly and within applicable legal deadlines. No general response target overrides a shorter statutory or judicial deadline.
Information is disclosed only where a sufficient legal basis exists and only to the extent lawfully required or permitted. Informal correspondence does not, by itself, establish entitlement to user information.
Where requested information is not held, is no longer available, or cannot be identified from the information supplied, the Publisher will explain that limitation as required by the applicable procedure.
The Publisher may seek to narrow, modify, challenge, or refuse a request where legally justified — including where it lacks jurisdiction, is insufficiently specific, is disproportionate, or conflicts with applicable fundamental-rights or data-protection protections. These Guidelines do not promise that every request will be challenged.
Preservation and disclosure are separate measures. A preservation request does not, by itself, authorise disclosure of the preserved information.
Upon receipt of a legally binding preservation request from a competent authority, the Publisher takes the steps required by applicable law concerning specified information within its possession, custody, or control. Standard initial preservation period: 90 days, renewable where legally permitted. Scope, duration, renewal, and release depend on the applicable legal instrument (national preservation order, EPresO under Regulation (EU) 2023/1543, equivalent UAE procedure, etc.).
A preservation request cannot retrospectively recover information that was never retained or was already unavailable before the obligation arose. The service's ordinary ephemeral operation does not override a binding preservation obligation applicable to information actually within the Publisher's control.
A request to collect future information, intercept communications, or provide another form of forward-looking assistance requires a separate assessment of legal authority and technical capability.
Authorities reporting an emergency involving danger of death or serious physical injury should clearly identify:
Emergency requests are prioritised when received and identified. This contact address is not an emergency-response service; the Publisher does not promise continuous monitoring or a guaranteed response within 24 hours. Persons facing immediate danger should contact the competent local emergency services directly.
Emergency disclosure is assessed under applicable law and is limited to information actually available and lawfully disclosable. Labelling a request "EMERGENCY" does not itself authorise disclosure or make unavailable information recoverable.
Where applicable reporting duties arise — notably under Article 18 of Regulation (EU) 2022/2065 (Digital Services Act) for activities within its scope — the Publisher makes the required notification to the competent authorities on its own initiative.
The Publisher prohibits use of the service for child sexual exploitation or abuse (see Acceptable Use Policy) and assesses information brought to its attention under applicable reporting laws.
Where the Publisher is subject to 18 U.S.C. §2258A and the statutory reporting threshold is met, it makes the required report to the National Center for Missing & Exploited Children (NCMEC) CyberTipline as soon as reasonably possible and complies with the associated preservation and security obligations.
Reports to UAE competent authorities (UAE Public Prosecution, Dubai Police, TDRA) are undertaken where required by applicable UAE law. Where a cross-border coordination is appropriate, the Publisher cooperates with the competent authority that may itself engage Interpol or other police-to-police channels through its National Central Bureau. Reports are not automatically distributed to every international organisation or law enforcement agency.
This section does not represent that the Publisher routinely scans or can decrypt private conversations. Any restriction of service is assessed in light of applicable law, available technical means, and the circumstances, including any requirement to preserve evidence or maintain confidentiality.
Where lawful and reasonably practicable, the Publisher seeks to inform an affected user of a request concerning their information, before or promptly after disclosure.
Notification may be prohibited, delayed, or inappropriate where a binding non-disclosure order applies, where disclosure would create a serious safety risk, or where another lawful ground requires withholding notice. Notification may also be impossible where no reliable contact method is available (notably for pseudonymous accounts).
The Publisher may seek review of a confidentiality restriction where legally justified. It does not guarantee advance notice or a challenge to every non-disclosure order.
Legal requests and supporting material may themselves contain personal or sensitive information. They are handled for the purposes of assessing and responding to the request, complying with legal obligations, and establishing or defending legal rights. Access and disclosure are limited to what is necessary and lawful.
Where the GDPR applies, processing and international disclosure require an appropriate legal basis and compliance with applicable transfer rules. Article 48 GDPR provides that a judgment or decision of a third-country authority requiring the transfer or disclosure of personal data may be recognised or enforceable only where based on an international agreement (such as an MLAT) in force between that country and the EU or a Member State. A foreign authority's request alone does not automatically satisfy those requirements.
Equivalent UAE data-protection rules (Federal Decree-Law No. 45/2021 on Personal Data Protection) apply to processing undertaken in connection with requests directed at the Publisher.
Enterprise packs (5 to 1000 seats) are available to individuals and organisations. Purchasing an Enterprise pack does not, by itself, make the purchaser the data controller of every sub-account user's information or grant access to their private communications. The Enterprise master can create, rename, and reset sub-accounts' passwords, but cannot access sub-accounts' private cryptographic keys or chat content.
Requests are assessed according to the actual contractual arrangements, the parties' legal roles, and the information each party possesses or controls. A request directed at a sub-account is not automatically redirected to the Enterprise master purchaser; however, where a Data Processing Agreement designates the Enterprise purchaser as controller for administrative sub-account data, authorities may need to approach that purchaser for data under their control.
These Guidelines describe the Publisher's request-handling approach and the messaging architecture identified above. They do not confer investigative powers, restrict lawful judicial authority, or guarantee anonymity or immunity from investigation to any user.
Applicable law prevails in the event of a conflict. The Publisher updates these Guidelines when material changes to the service or legal framework require it. Changes do not retroactively alter the Publisher's duties concerning requests already made or information already lawfully disclosed.
Version 2026.14 · Effective 2026-10-22.
Published by Sterling and Pierce Holding L.L.C-FZ, Meydan Free Zone, Dubai (UAE).
Contact: contact@10seconds.io — single point of contact for legal process.