Acceptable Use Policy

Last updated: October 4, 2026

This Acceptable Use Policy ("AUP") applies to everyone who uses the Smailor service (the "Service"). It supplements the Terms of Service. Capitalized terms that are not defined here have the meaning given in the Terms of Service.

1. Purpose

Smailor is built for legitimate email and, when enabled, SMS communication, support, and team collaboration. You must use the Service in a way that respects applicable law, the rights of others, and the stability and reputation of shared infrastructure.

Smailor is not a bulk email service provider, a newsletter platform, an anonymous or disposable mail service, or a general-purpose mail relay for third parties.

2. Unlawful or harmful use

You may not use, or help others to use, the Service to:

• break civil, criminal, or regulatory law in your jurisdiction, ours, or the jurisdictions where you send, receive, or process data;
• harass, threaten, intimidate, or dox a person, or encourage self-harm or violence;
• offer or distribute illegal goods, services, or child sexual abuse material, or to sexualize or exploit children;
• infringe intellectual property, trade secrets, privacy, publicity, or defamation rights (see the Copyright Policy for notice and takedown);
• impersonate a person, business, or public authority, or misrepresent an affiliation;
• process personal data in a way that is not permitted by law (for example, unlawful sensitive profiling of individuals without a valid legal basis and transparency); or
• breach sanctions or export-control law, or provide the Service to a sanctioned party.

3. Spam, phishing, and mail abuse

You may not use the Service to:

• send unsolicited bulk or commercial email (spam);
• use deceptive, spoofed, or fraudulent sender identity (phishing), or misleading subject lines, headers, or reply-to addresses;
• distribute malware, ransomware, or other harmful code;
• use purchased, scraped, stolen, or unlawfully obtained mailing lists, or to send to addresses that have not lawfully consented to receive your messages, where such consent is required;
• send to addresses harvested from our Service, or to role addresses at scale for marketing purposes;
• evade bounces, abuse reports, or unsubscribe or suppression mechanisms in bad faith; or
• operate a mail relay, forwarding chain, or gateway that passes third parties' mail through your account.

You are responsible for list hygiene, double opt-in where you promise it, and for lawful marketing and transactional practice in every country where you send mail.

4. Outreach and cold email

If you use the Service for outbound business contact, you must, in addition to Section 3:

• have a lawful basis for each recipient, and comply with the marketing rules of the recipient's country (in the EU, GDPR plus national ePrivacy rules; in France, the CNIL's rules on B2B and B2C prospecting; and equivalents such as CAN-SPAM, CASL, and PECR elsewhere);
• contact people in a professional capacity about something plausibly relevant to their role — not consumers at their personal address without consent where consent is required;
• identify yourself truthfully, including a real sender name, a working reply address, and where required your business identity and postal address;
• include a working opt-out in every marketing message, honour it promptly and permanently, and maintain your own suppression list;
• not send to an address after that person has objected, and not move them to a different list, address, or domain to keep contacting them;
• keep volume and pace proportionate — do not use multiple accounts, mailboxes, domains, addresses, or sending routes to spread a campaign and dodge limits or reputation controls; and
• not build or send sequences that continue regardless of response signals, negative replies, or complaints.

Where a campaign generates complaints, spam-trap hits, or blocklisting, we may stop it immediately.

5. Sending volume, bounces, and reputation

Outbound mail may share infrastructure with other customers, so your practices affect them. We work to the following thresholds and may throttle, park, require a dedicated configuration, or suspend sending when they are exceeded:

• hard bounce rate above roughly 5% of a send;
• complaint (spam report) rate above roughly 0.3%;
• any spam-trap hit, blocklisting, or feedback-loop pattern indicating non-consensual sending; or
• a sudden volume increase inconsistent with your account history.

These figures are operational guidance, not a contractual allowance: we may act sooner where the risk is clear, and we do not owe you a warning before protecting shared infrastructure.

5A. Telecom and SMS

The Telecom and SMS Terms also apply when SMS is enabled. For every marketing SMS, including messages to professional contacts, you must have provable prior, specific SMS marketing permission from the recipient as a Smailor platform rule. Do not use purchased, scraped, rented, or inherited phone lists without that permission; a general privacy notice, acceptance of terms, or permission to receive email is insufficient. Retain consent evidence and make it available for a proportionate abuse review.

• Clearly identify the organization on whose behalf the SMS is sent. Use only an approved sender name you are authorised to use. Never impersonate a public authority, carrier, financial institution, or another brand.
• Keep marketing and service messages separate. A discount, upsell, or brand promotion makes a message marketing even if it is labelled transactional or attached to a support conversation.
• Provide an effective, simple and no-extra-cost way to object in each marketing SMS. Process STOP and other objections across all your lists and sending channels, and do not re-import suppressed recipients. If a route cannot provide a working opt-out, do not send marketing SMS through it.
• Do not send phishing links, deceptive short links, malicious content, premium-rate callback prompts, or messages that conceal who benefits from the solicitation.
• Respect recipient location and any applicable local sending restrictions. Smailor may schedule marketing SMS for a later window as an additional platform rule; do not evade that by marking marketing as transactional, splitting campaigns, or sending through another account.
• Do not use SMS as the sole channel for emergency, medical, security-critical, or other urgent notices where delay or non-delivery could harm someone.

We may require identity or business verification, review sender names, request consent evidence, limit volume, pause a campaign, or suspend Telecom sending where a legal or abuse risk exists. Our technical checks do not certify your campaign's legality.

6. Email tracking

If you enable open tracking, link tracking, or similar measurement on mail you send, you are the controller of that processing. You must:

• have a lawful basis and give any notice or obtain any consent the recipient's law requires;
• respect an objection, and disable tracking for a recipient who asks;
• not use tracking to monitor individuals in a way that is disproportionate, covert where the law requires transparency, or aimed at people in a personal capacity; and
• turn tracking off if you cannot meet those obligations.

You may not use tracking to infer special-category data, to target vulnerable individuals, or to evade an opt-out.

7. Security, quotas, and shared infrastructure

You may not:

• attempt to gain unauthorized access to the Service, other accounts, or our or our vendors' systems;
• probe, scan, or stress-test the production Service for vulnerabilities without following our disclosure process (see the Security Policy);
• bypass authentication, throttling, quotas, registration IP or verified-account limits, CAPTCHA or Turnstile / bot-detection steps, or other signup security safeguards (see Privacy Policy for what we process);
• create or use multiple accounts to circumvent Fair use, pricing, bans, or suspicion handling where doing so violates the Terms;
• share a login, a mail access credential, an API key, or a webhook secret between people, publish one, or embed one in client-side code;
• use the Service, our AI features, or our APIs to extract our prompts, system instructions, model weights, other customers' data, or infrastructure details, or to inject instructions intended to alter how our systems handle other people's mail;
• scrape or crawl the Service, or automate account creation, outside what the documented API allows;
• resell, sublicense, or white-label the Service in breach of the Terms; or
• generate traffic or API load that unreasonably degrades the Service for others.

We may throttle, queue, or block messages or API calls to protect deliverability, infrastructure, and other customers.

8. Connected accounts and mail clients

• Only connect a Google, Discord, calendar, or sending-provider account that you are authorised to connect, and use a scoped, revocable credential rather than a main account password.
• Only issue a mail access credential for a mailbox you are entitled to use, keep it to yourself, and revoke it when it is no longer needed or may be compromised.
• Do not use a connected account or mail client to bulk-export another person's mailbox without their authority, or to build a shadow archive of a workspace you no longer have a right to access.
• Messages your mail client downloads are your responsibility, including their security and deletion.

9. AI-assisted features

You may not use the AI features to generate or scale spam, phishing, deceptive content, impersonation, harassment, or disinformation, to produce content that breaches Section 2, or to make consequential decisions about a person without human review. Output is a suggestion and must be checked before you send or act on it.

10. The embeddable widget

If you deploy the widget on your own site, you are responsible for your own privacy and cookie notices and for any consent required, for the lawfulness of your site's content, and for not using the widget to collect special-category data, payment card data, or credentials.

11. Regulated, restricted, and high-risk use

• If you operate in a regulated industry (for example health, financial services, insurance, or gambling), you alone are responsible for compliance with sector rules, licensing, and content and age restrictions.
• The following categories create elevated deliverability and legal risk and may require our prior written approval, and may be restricted or refused: adult content, gambling and betting, cryptocurrency and other financial promotion, loans and debt services, prescription pharmaceuticals and supplements, multi-level marketing and business-opportunity offers, and lead generation on behalf of undisclosed third parties.
• The Service is not designed for safety-critical or emergency response. Do not use it where system failure could cause death, serious injury, or other severe harm, and do not make it the sole channel for a time-critical notice.

12. Marketplace activity

If you use the marketplace, you must not list or request an address that you are not entitled to use, misrepresent the availability or characteristics of an address, bypass the marketplace to avoid fees, interfere with an active subscription, or use buyer or seller information for unrelated marketing or profiling. Sellers must keep listed domains under their control and maintain the service for active buyers. The Seller Agreement contains the additional rules for sellers.

13. Affiliate activity

If you take part in the affiliate program, you must not self-refer, create accounts to generate commissions, bid on our brand terms where the Affiliate Terms prohibit it, stuff cookies or referral parameters, promote Smailor through spam or misleading claims, or offer unauthorised rebates. The Affiliate Terms govern and we may reverse or forfeit commissions obtained in breach.

14. User content and third parties

• You are responsible for the legality and appropriateness of all content you or your end users process through the Service, including support tickets, attachments, auto-replies, contacts, and widget submissions.
• You may not use the Service to process content you are not entitled to use (for example confidential information of a third party without their consent, where consent is required).
• Where you process your end customers' personal data, you act as a controller in respect of that content and you instruct us in line with our Terms, the Privacy Policy, and an optional DPA.

15. Enforcement

If we reasonably believe you have breached this AUP or the Terms, we may take any lawful step, including warning you, rate-limiting or disabling a feature, removing or blocking content, revoking a credential, pausing sending, suspending or terminating your access, withholding affected amounts, and notifying regulators or law enforcement where required by law or reasonably necessary to protect people, the Service, or the security of others.

Where reasonable, we will try to contact you first and offer a chance to fix the issue, except where we must act immediately (for example to stop ongoing abuse, fraud, illegal content, a deliverability emergency, or a critical security incident).

Appeals. If you believe an action was taken in error, reply to the notice we sent or write to [email protected] with the details. We will review it, and we will tell you the outcome. We may preserve relevant records while a matter is investigated.

16. Reporting and contact