Acceptable Use Policy

Contracting provider: SendPost, LLC DBA SendX, DBA SendWorks

Policy and abuse contact: abuse@sendx.io

This Acceptable Use Policy applies to products and services offered by SendPost, LLC under the SendWorks, SendX, SendPost, SendVerify and SendHealth names, including related software, APIs, SMTP relay, delivery infrastructure, analytics, verification and list-hygiene services, and successor or additional products and services (Services). This policy applies regardless of which of our websites publishes it or which brand you use. Product-specific limits apply only to the relevant Service or plan. “You” means the customer contracting for the Services. “Sender” means the business, brand or other person on whose behalf a message is sent, including your clients and tenants. You are responsible for authorized users and for activity you enable through your account.

This policy forms part of your agreement with the SendWorks contracting provider identified above (Agreement). It covers message content, audience acquisition, uploaded data, linked offers and destinations, integrations and use of our infrastructure. A Restricted Sender Addendum or written approval may impose additional conditions. No approval permits illegal conduct or a use prohibited by Section 3. The Agreement governs other contractual matters and order of precedence.

Standard means a legitimate sender with ordinary operational needs and low identified regulatory, abuse and reputation risk. Standard senders may use supported self-service onboarding, subject to screening and continuing compliance.

Complex means a legitimate, low-risk sender requiring capabilities such as multiple brands or tenants, high volume, custom routing, enterprise integration or dedicated infrastructure. Complexity alone does not make a sender Restricted. These senders may use SendX, SendPost and other suitable Services under the applicable service arrangement.

Restricted means a sender, industry or use with heightened legal, consent, abuse or reputation concerns, including Schedule A. Restricted sending requires enhanced underwriting, a managed service arrangement and specific written approval before production traffic. Opening an account, paying an invoice, receiving a sales proposal or passing automated checks is not approval. Verification-only use also requires written approval where the underlying activity is Restricted, but need not include a sending service.

Prohibited means a use described in Section 3 or the prohibited boundaries in Schedule A. We do not authorize these uses at any price or infrastructure tier.

We assess the underlying activity and traffic, not merely the company’s description. Different tenants or streams may receive different classifications if they can be effectively separated. You must disclose uncertain or mixed uses before activation. Pending clarification, you may not initiate the affected restricted or potentially prohibited activity. We may reclassify a use when new information changes its risk.

You must not use the Services to carry out, promote or materially facilitate unlawful conduct, fraud, scams, exploitation, threats, targeted harassment, violent extremism, child sexual exploitation, nonconsensual sexual content, counterfeit trade or infringement of another person’s rights. Pornographic and sexually explicit commercial content and commercial sexual services are prohibited as a SendWorks business policy, even where locally lawful.

You must not impersonate another sender, conceal the responsible business, falsify evidence, fabricate consent, disguise a destination to defeat review, or make materially deceptive product, financial, earnings or health claims. Pyramid schemes, fictitious investments, guaranteed-return scams and unauthorized sale of regulated goods are prohibited.

You must not send unsolicited marketing, use stolen or unlawfully obtained data, reactivate suppressed recipients without valid renewed permission, or acquire lists in ways Section 4 forbids. Unsolicited outreach remains prohibited even if local law might allow it. Customer value, low complaint rates and successful address verification do not override this rule.

You must not conduct phishing, distribute malicious code, steal credentials, operate an open relay, exploit systems, probe accounts without authorization, attack networks, or interfere with the Services or another customer. Authorized security testing requires our prior written agreement on scope. Account credentials and API keys must be protected and assigned through supported access controls.

You must not evade screening, rate limits, billing, sanctions restrictions, suspension or recipient filtering by cycling accounts, domains, IPs, tenants or providers. We do not support persons or transactions where providing the Services would violate applicable sanctions or export restrictions. Routing blocked traffic through another SendWorks product or an agency is prohibited.

Marketing requires affirmative, demonstrable permission to receive the relevant messages from the identified sender or clearly disclosed brand. Consent must be voluntary and adequately specific as to purpose. A business relationship, public email address, business card, abandoned checkout or absence of an objection does not by itself satisfy this policy. Apply stricter local requirements where they exist.

Do not upload for marketing or send to purchased, rented, scraped, harvested, guessed, appended or brokered addresses, or generic partner lists. Do not use bundled co-registration that obscures who will send. A service provider may collect permission on a sender’s behalf only where that sender and purpose are clearly disclosed and the sender retains auditable evidence. Merely purchasing a lead or receiving an agency assurance is insufficient.

Keep the permission text and version, named sender, collection source, date, affirmative action, applicable purpose and subsequent withdrawals. Retain only supporting personal data that is necessary and lawful. You must provide proportionate evidence upon request. A privacy notice alone is not evidence of subscription. Use confirmed opt-in when required by law or by your approval conditions.

Use lists only within the permission given. Permission for one brand does not automatically extend to another brand, an acquiring company or an agency’s other clients. Submit acquisitions, material purpose changes and transferred databases for review before sending. Preserve the original permission scope and suppression history during migration.

Suppress invalid addresses, hard bounces, complaints and opt-outs promptly. Do not repeatedly retry permanent failures or rebuild a suppressed audience from a fresh import. Apply withdrawals across all systems and providers serving the same sender and purpose. Broader requests must be honored to the extent required by their scope and applicable law. Avoid disclosing one tenant’s recipient data to unrelated tenants.

Before using a stale or inactive audience, assess the age, permission evidence and relevance of the relationship. We may require exclusion of unproven records, a limited rollout or renewed permission obtained through a lawful channel. Do not send a re-permission campaign to people you cannot lawfully and permissibly contact. List cleaning improves data quality; it does not restore expired or missing permission.

Use accurate identity, routing information and subjects. Marketing messages must identify the responsible sender, include a valid postal address and any disclosures required for the offer or jurisdiction, and provide a conspicuous, functioning unsubscribe method. It must not require payment, an account login or unnecessary personal information. Honor the request without delay and no later than two calendar days after receipt, or sooner where law or applicable requirements demand. This SendWorks service standard applies even where local law allows more time.

For SendX, use the supported unsubscribe and suppression functions. For SendPost, implement equivalent functioning controls and synchronize events with the sender’s source systems. Use one-click unsubscribe and relevant headers where required by receiving providers or our communicated technical requirements. A custom preference center must include an effective way to stop the covered marketing.

A transactional message must serve a genuine recipient-triggered or otherwise expected service purpose, such as a requested password reset, receipt or account security notice. Maintain evidence of the underlying relationship or event and a lawful basis for processing. Marketing permission is not required by this policy for a genuinely necessary transactional message, but it cannot be used to evade a marketing opt-out.

Treat a message containing promotional material as marketing for this policy unless we approve a documented classification consistent with applicable law. Necessary account notices may continue after a marketing opt-out only when lawful, relevant and free of promotional additions. Separate these streams technically and operationally. Prevent attackers from abusing signup, invitation or password-reset workflows to flood recipients.

SendPost may support both approved marketing and transactional traffic. Neither the API nor SMTP access changes these requirements. Use only approved channels; email-to-SMS delivery requires express service authorization and separate channel compliance.

Use SendVerify only for addresses and related information you are authorized to process for a lawful, disclosed purpose. Do not use verification or threat results to enumerate people, enrich stolen datasets, identify victims, enable harassment, validate prohibited marketing lists or bypass another service’s safeguards. Purchased or scraped marketing data cannot be washed through verification to qualify for sending.

Submit only data needed for the verification operation. A deliverable result, risk score or clean list does not establish consent, identity, legality, regulatory eligibility or guaranteed inbox delivery. You remain responsible for lawful collection, privacy notices, processing authority, permitted retention and any transfer or disclosure of results.

Do not upload passwords, full payment card data, government identifiers, protected health information or similarly sensitive regulated records unless a specific supported use, necessary safeguards and required written agreements have been approved in advance. Routine account notices should minimize sensitive details and direct recipients to secure systems. Do not assume that a product is suitable for regulated health data or that a business associate agreement exists.

Comply with the applicable data processing agreement and privacy obligations. Secure integrations, limit privileges and promptly notify us of account compromise, exposed credentials or misuse affecting the Services. Preserve relevant evidence and cooperate with containment. Our review and retention of data remain subject to the Agreement, applicable law and our privacy commitments.

Verify control of sending domains and configure the authentication, alignment and DNS records required for the service and recipient destinations, including SPF, DKIM and DMARC as applicable. Follow the approved warmup, volume and concurrency limits. Obtain approval before material changes to routing, traffic profile or sending capacity.

We may require separate tenant identities, sending and tracking domains, credentials, queues, rate limits, IP pools or dedicated resources. Restricted traffic must use the isolation design documented in its approval and must not enter general shared sending pools without an expressly approved segregated arrangement. Do not merge restricted and low-risk streams in a way that defeats attribution, monitoring or containment.

Dedicated resources reduce certain shared exposures but do not eliminate domain, network, provider or company reputation risk. Isolation is not permission to send otherwise unacceptable traffic, and no infrastructure choice guarantees delivery or immunity from enforcement. We may limit or decline a use that cannot be safely supported within available controls.

We may impose stream-specific limits and require lower volume, additional validation, campaign review or temporary quarantine. Numerical monitoring thresholds communicated to you are operating limits, not safe harbors: evidence of abuse can warrant action below them. A good aggregate account score does not excuse a harmful tenant or campaign.

For SendX plans priced by contact count, unless your applicable Order or plan terms expressly provide otherwise, the maximum number of unique contacts you may email during a billing cycle is your plan’s contact limit plus an additional allowance equal to 30% of that limit or 5,000 contacts, whichever is smaller.

Maximum unique contacts emailed per billing cycle = plan contact limit + the smaller of (30% of the plan contact limit) and 5,000.

For example:

• A 2,500-contact plan permits up to 3,250 unique contacts emailed per billing cycle.

• A 10,000-contact plan permits up to 13,000 unique contacts emailed per billing cycle.

• A 25,000-contact plan permits up to 30,000 unique contacts emailed per billing cycle.

• A 50,000-contact plan permits up to 55,000 unique contacts emailed per billing cycle.

A unique contact is a distinct recipient email address emailed through the account during the applicable cycle. Emailing the same address more than once during that cycle counts as one unique contact for this limit. The count is cumulative across the account’s lists, campaigns and automations; it is not limited to the contacts stored in the account at a particular moment. Deleting, archiving, unsubscribing, suppressing or replacing a contact does not remove that address from the cycle’s count if it has already been emailed.

You must not rotate lists or move contacts, traffic or sending activity between accounts, tenants or Services to evade applicable limits or charges. Routine list maintenance and compliance with unsubscribe, suppression or deletion requirements remain required and are not prohibited list rotation; they do not reset usage already incurred.

This allowance applies only to the number of unique contacts emailed during the applicable cycle. It does not increase your plan’s stored-contact capacity, total email volume, sending rate, verification credits or other limits. An offer of unlimited emails does not mean unlimited unique recipients. The applicable cycle and any different trial, custom, agency or enterprise limits must be specified in your plan terms or Order.

If you exceed the applicable limit, we may restrict further sending and require a plan upgrade or another agreed capacity arrangement before sending resumes, subject to the Agreement. Any additional charges must be authorized by the applicable pricing terms or Order. Repeated or deliberate evasion may result in suspension or termination under this policy and the Agreement.

SendPost delivery plans, SendVerify or SendHealth services, and other plans not priced by contact count remain subject to their own documented usage limits. The SendX allowance above does not automatically apply to those Services. The prohibition on evading applicable limits applies across all Services.

If you operate an agency, reseller, franchise network, marketplace, SaaS platform or other multi-tenant service, you remain responsible under your Agreement for the activity you enable. Require each underlying sender to accept obligations at least as protective as this policy and maintain enforceable authority to stop its activity. Identify the contracting party, business operator and responsible brand for each stream.

Maintain an accurate inventory of clients, tenants, domains, responsible contacts, use cases, audience sources, jurisdictions and approval status. You must be able to attribute each message and verification job to the relevant tenant and provide records on request. Shared credentials or opaque relay chains that prevent attribution are not acceptable.

A partner relationship, commission arrangement or agency-level infrastructure approval does not approve every client. Each Restricted sender, its material offers and intended jurisdictions must receive specific written SendWorks approval before activation. Do not substitute a new operator, move a declined client into another subaccount or extend an approval to related brands without authorization. Low-risk tenants may onboard through an approved scalable process; this does not waive their individual obligations.

Perform first-line screening, verify the information you submit, train relevant staff, monitor misuse and promptly escalate material concerns. You must give us the information and contractual access needed to investigate a tenant and must enforce our restrictions through your systems. An agency may gather evidence and recommend a decision, but it cannot issue SendWorks approval or represent a client as certified legally compliant by us.

Maintain per-sender permission and suppression controls. Do not share lists across clients without a valid, specific authorization and lawful basis. Preserve withdrawals across an operator’s applicable brands and tools while respecting privacy limits between unrelated clients. Implement a tested ability to disable an individual tenant, credential or stream promptly.

Where the issue is isolated and containment is effective, we may restrict the affected tenant or stream. We may restrict the broader account when attribution or containment fails, violations recur, the agency conceals activity, or the exposure threatens other customers. You must not route affected traffic through another account while review is pending.

Any managed service requirement, onboarding fee, usage charge or dedicated infrastructure commitment must be documented in the applicable commercial terms. Paying these charges does not guarantee approval or reinstatement. Referral status, volume discounts and commissions do not reduce required diligence or permit prohibited uses. Only the authorized SendWorks approval process can grant restricted-use permission.

Provide complete and accurate information about your legal entity, ownership or control where relevant, websites, brands, products, intended audiences, recipient countries, sending purpose and expected volumes. Provide licenses and registrations where applicable, material enforcement history, relevant provider suspensions and the reasons for changing providers. Disclose unresolved abuse, blocklist, payment-processor or regulatory issues material to the proposed use.

We may request permission records, acquisition flows, sample messages, linked pages, product catalogs, list age and source, past volume and delivery metrics, authentication details and tenant controls. For Restricted uses, we may require specialist legal advice, licensing verification, claims substantiation or evidence of controls for recipient age, geography and eligibility. Redact unnecessary personal information and use approved secure transfer methods.

Review may result in Standard approval, Complex approval with service conditions, Restricted managed approval, a request for information or remediation, legal or specialist escalation, or decline. We assess business legitimacy, messaging practices, technical containment and the resources required to support the use. Commercial attractiveness cannot override a prohibited-use boundary.

A conditional decision is not production approval. Where remediation is feasible, we will identify the affected use, deficiencies, required evidence and review conditions. Examples include excluding unproven list segments, correcting subscription flows, providing licenses, removing unsupported claims throughout linked destinations, securing domains or separating tenants. Cosmetic disclaimers and temporary changes made solely to pass review are insufficient.

Submit evidence that the changes are implemented. We may require a controlled pilot, lower limits or further review before authorizing full production. A Restricted approval must identify the sender and brands, permitted products and message purposes, territories, approved acquisition sources, infrastructure conditions, monitoring requirements and any expiry or review date. Activities outside that scope require fresh approval. Silence or elapsed time does not constitute approval.

Keep your information current. Obtain advance review before adding restricted products, operators, jurisdictions, material acquisition sources or substantially different traffic. Notify us promptly of license loss, enforcement action, compromised accounts, material consent failures or a provider suspension affecting the approved use. Stop the affected activity immediately where it is unlawful or outside your authorization.

We may periodically re-underwrite senders and review reported complaints, message and linked content, recipient responses, bounce patterns, domain reputation, anomalous volume and compliance evidence. Reviews may use automated signals and human assessment. You must cooperate with proportionate requests and retain relevant records while an identified investigation is pending, subject to law. We do not promise to examine every message or discover every violation.

Depending on the facts, we may request corrective action, reject a job, quarantine messages, lower limits, require infrastructure changes, suspend affected functions or terminate access under the Agreement. We may act immediately without a cure period when reasonably needed to stop suspected illegality, fraud, security compromise, material abuse, urgent reputation harm, evasion or a binding legal or provider restriction.

Where advance notice and remediation are appropriate, we will communicate the issue and conditions for continued use. When we suspend or materially restrict access, we will ordinarily identify the affected scope, general reason and available review route. We may limit information or delay notice where disclosure would compromise security, an investigation, another person’s privacy or a legal obligation.

You must stop affected traffic and preserve relevant records. Do not resend quarantined or rejected messages through another SendWorks account or stream. Release of held messages requires our authorization and fresh confirmation that they remain timely, permitted and within the recipient’s current preferences. We may discard unsafe or expired queued traffic consistent with the Agreement and legal requirements.

You may request human reconsideration by resubmitting your business for review, following the steps on our Managed Sending page, and provide supporting records, corrected facts and remediation evidence. We will consider relevant information and communicate the outcome. A review request does not itself restore access. We may require renewed underwriting, revised terms, a monitored pilot or additional safeguards; persistent or unremediable violations may result in a final decline.

No sales representative, agency or informal support exchange may waive a prohibited use. Restricted approvals must come through the authorized review process. Our decision concerns eligibility for the Services and is not a legal opinion, regulatory certification or endorsement of your business. You remain responsible for your products, claims, recipients and legal obligations.

Report suspected misuse to abuse@sendx.io. Where available, include the original message or headers, sender, relevant domain or URL, time and nature of the concern. Do not send passwords or unnecessary sensitive information. We may request additional evidence and cooperate with lawful requests from authorities, affected providers or other appropriate parties as permitted by the Agreement and applicable law.

We may revise this policy using the notice and amendment process in the Agreement. New classifications and controls apply on the notified effective date, subject to applicable law and existing contractual rights. Existing customers are not automatically approved for Restricted activity because they previously sent traffic or signed a contract. We may provide a documented transition or remediation period where lawful and safe; urgent risks may require immediate action.

Fees, refunds, liability, indemnities, termination mechanics, data export and deletion are governed by the Agreement and any applicable addendum. This policy does not independently change those provisions. Required legal rights of notice, explanation, challenge or remedy remain unaffected.

This schedule is part of the policy. Each Restricted category requires advance written approval under Section 13. Approval is limited to the actual operator, offer, audience, territories and service use reviewed. The listed eligibility conditions are necessary, not a promise of acceptance. Section 3 applies to every category.

Restricted: online or land-based gambling promotions, betting, casino operations and associated affiliate acquisition. Lottery, sweepstakes, social casino and prize-based models require classification review when their legal treatment is uncertain. Ordinary video games without gambling-like offers are not Restricted solely because they are games.

Provide the operator identity, relevant licenses or a substantiated explanation of the lawful basis where licensing is not required, permitted territories, recipient targeting methods, age controls, permission records and affiliate oversight. Maintain effective exclusion of ineligible territories, underage recipients and self-excluded or otherwise barred recipients. Apply jurisdiction-specific product and channel preferences and responsible-gambling requirements. Show how exclusions reach agencies and marketing systems before a campaign.

Prohibited: illegal or unlicensed operations where licensing is required, targeting underage or barred people, evading territorial restrictions, deceptive winnings or bonus representations, and sending despite applicable self-exclusion. An offshore license does not establish eligibility in every recipient jurisdiction.

Restricted: bona fide supply to verified research or institutional customers for lawful nonclinical research. Provide product identities, suppliers and intended uses, buyer eligibility controls, sales jurisdictions, relevant regulatory history, complete website and affiliate materials, and specialist regulatory analysis when requested.

Research labels alone do not establish eligibility. Review considers the actual business and marketing context, including linked stores, testimonials, imagery, instructions, affiliates and customer targeting. Under this policy, consumer-facing sales of research peptides for self-administration are not eligible. Evidence of human-use promotion requires escalation and may place the activity in the prohibited category.

Prohibited: unlawful sale or promotion of unapproved drugs, deceptive research labeling, or research-compound campaigns promoting human dosing, injection, weight loss, bodybuilding, anti-aging or disease treatment outside an established lawful medical pathway. Removing a claim from an email while retaining it on a linked page does not remediate the issue. A lawful prescription or clinical service must be assessed separately under A3; it cannot rely on research-supply approval.

Restricted: pharmaceutical promotion, compounding, prescribing services, online pharmacies and material regulated medical-product claims. Provide applicable provider and pharmacy credentials, product authorization or other lawful pathway, service territories and claims support. Prohibited: unlawful prescribing, diversion, counterfeit or illegally marketed products and unsupported treatment claims. Do not transmit regulated patient data without the separately approved safeguards in Section 8. Routine low-risk business communications by a healthcare organization require use-specific assessment, not automatic pharmaceutical classification.

Restricted: weight-loss, sexual-performance, disease-related or similarly elevated-risk supplement and wellness offers. Provide ingredient and product information, substantiation, required disclosures and acquisition sources. Prohibited: deceptive efficacy or safety claims and unlawfully marketed ingredients or products. Ordinary lawful food or wellness retail without elevated claims may be Standard or Complex after classification review.

Restricted: lending, credit repair, debt settlement, debt collection, investment solicitation, trading signals and cryptocurrency or token promotions. Provide required authorizations, territories, risk disclosures, offer terms and acquisition evidence. Prohibited: fraudulent investment schemes, deceptive guaranteed outcomes, predatory or unlawful offers, and services designed to evade financial restrictions. Ordinary accounting software or factual corporate notices are not Restricted solely because they relate to finance.

Restricted: businesses primarily sending third-party offers, multi-level compensation opportunities and lead generation for restricted products. Disclose every material offer owner, compensation relationship, acquisition flow and downstream sender. Prohibited: pyramid schemes, earnings fraud, undisclosed switching of promoted offers, and brokering or renting marketing lists. A publisher’s disclosed affiliate links or SendWorks referral relationship alone does not make it Restricted; consent scope and the underlying offer remain decisive.

Restricted: alcohol, tobacco, nicotine, vaping, cannabis or cannabinoid products, firearms and other tightly controlled goods where lawful. Provide jurisdiction-specific eligibility, required authorizations, age controls and marketing restrictions. Prohibited: unlawful trade, unlawful targeting or evasion of required checks. Lawfulness in one location does not establish eligibility elsewhere. We may decline an otherwise lawful use that our infrastructure or service providers cannot support.

Restricted: dating services and nonexplicit adult-oriented retail, subject to truthful presentation, adult eligibility and privacy protections. Prohibited: the explicit sexual content and commercial sexual services identified in Section 3, exploitation, trafficking and deceptive relationship schemes. Legitimate relationship counseling or ordinary retail is assessed on the actual content and audience.

Permission-based political advocacy, fundraising, news publishing, real estate, education and ordinary SaaS are not Restricted solely by category. We may require enhanced review for concrete concerns such as deceptive fundraising, sensitive targeting, unverifiable permission, unresolved prior abuse or opaque third-party sending. A prior provider’s rejection is a review input, not proof of illegality and not an entitlement to admission.

Unlisted uses are subject to the same principles. If legality, sender identity or consent cannot be substantiated, the affected use remains unapproved. Managed infrastructure cannot substitute for missing evidence. We may decline a use where remaining legal, operational or reputation risk cannot be adequately controlled.