Acceptable Use Policy

The rule

Send only what you are lawfully entitled to send, to people who have given you a lawful basis to contact them, with a working way to stop.

Everything below follows from that sentence. This policy forms part of the Terms of Service.

Consent and provenance

You must be able to show, for any recipient, where their address came from and on what basis you are contacting them. A purchased, scraped, appended or rented list is not a lawful basis, and a claim that the list was "opted in" by whoever sold it is not evidence.

Unsolicited commercial mail to an address obtained this way is the single most common cause of a sending domain being blocked, and the block lands on the domain, not on us.

Never send

• Messages to a recipient who has unsubscribed, bounced hard, or been suppressed for that workspace.
• Phishing, credential harvesting, or anything that impersonates another person, brand or authority.
• Malware, or links to it, including links through a redirector you do not control.
• Content that is unlawful where the recipient is, including content that infringes another party's rights.
• Material that sexualises children, incites violence, or harasses an individual.
• Anything designed to evade a spam filter, a block list, or a recipient's stated preference — including varying a sending domain to escape a reputation you earned.

Marketing messages

A marketing message must identify the sender, must say why the recipient is receiving it, and must carry a one-click way to stop that continues to work after the campaign ends.

The platform enforces suppression: once a recipient unsubscribes, hard-bounces or is erased, dispatch to them is refused for that workspace rather than left to the sender to remember.

Transactional messages

A transactional message is one a recipient's own action requires — a receipt, a verification code, a state change on something they hold. It may be sent without a marketing preference, because a preference is not a lawful basis for withholding a receipt.

Dressing marketing as transactional to bypass a preference is a breach of this policy, and the message category recorded against every send is how it is detected.

Security research

Testing the security of your own workspace is welcome. Testing against another customer's workspace, another customer's recipients, or the platform's shared infrastructure is not, unless we have agreed it in writing beforehand.

Report anything you find to security@notifhq.com. We will not pursue a researcher who reports in good faith and does not exfiltrate or destroy data.

What we do about a breach

A credible report is investigated. Where sending is actively harming recipients we suspend dispatch for the workspace first and investigate second — a suspension can be lifted, a phishing run cannot be recalled.

We will tell you what was suspended and why. Repeated or deliberate breach ends the agreement.

Report abuse originating from this platform to legal@notifhq.com.