Anti-Spam Policy

• You must have permission for every recipient.
• You must identify yourself, including a postal address.
• You must give an immediate, working unsubscribe.
• Your sending domains must pass SPF, DKIM (2048-bit), and DMARC alignment.
• Complaint rate above 0.3% triggers automatic review; above 0.5% triggers suspension.

For the purposes of this policy, "spam" includes any of the following, whether or not your jurisdiction has a specific anti-spam law:

• Sending commercial email to recipients who have not given permission;
• Sending to email addresses harvested, scraped, purchased, rented, traded, or otherwise acquired without direct consent;
• Sending to role addresses (info@, sales@, admin@) en masse without prior business relationship;
• Continuing to send to a recipient after they have unsubscribed or complained;
• Sending content that misrepresents the sender, subject, intent, or origin of the message;
• Hiding or omitting the sender's postal identity;
• Using a Mailapp account to send through an external relay or test mailing-list resilience.

Acceptable bases for sending

• Express opt-in. The recipient submitted a form or checked a box opting in to your marketing emails. We log the source, IP, timestamp, and form URL.
• Double opt-in (required for EU/UK/Brazil/Canada). The recipient confirmed their address by clicking a verification link.
• Existing customer relationship. The recipient bought from you within the last 24 months and you provided a clear notice at the point of sale.
• Soft opt-in (UK PECR). Recipient provided their email during a negotiation for a similar product, with a clear opt-out at every touchpoint.

Not acceptable

• Lists purchased, rented, or scraped.
• Lists acquired in an M&A transaction unless the recipients gave consent specifically transferable to the acquirer.
• Public-domain or LinkedIn-scraped email addresses.
• Conference attendee lists obtained without a notice that emails would be sent by you.

• Include the sender's legal business name and a valid postal address (CAN-SPAM, CASL, GDPR).
• Subject lines and pre-headers must accurately reflect the content of the email.
• Mark commercial communications as advertisements where required by local law (e.g., "Ad" tag for unsolicited commercial email in certain jurisdictions).
• Provide a working, clearly-visible unsubscribe mechanism in every commercial email. Mailapp also adds one-click List-Unsubscribe headers (RFC 8058) automatically.
• Unsubscribe must take effect within ten business days of the request (CAN-SPAM); Mailapp processes most within 5 seconds.
• You must not require login, payment, or completion of a form to unsubscribe.

• SPF record on every sending domain.
• DKIM with RSA 2048-bit keys, rotated annually.
• DMARC at policy p=quarantine or stricter for high-volume senders (Yahoo/Google 2024 requirement).
• BIMI recommended where eligible (Verified Mark Certificate).
• Mailapp signs every outbound message and refuses to send from a domain that fails alignment.

• Hard bounces are automatically added to your suppression list; you must not re-add them.
• Soft bounces are retried; after a threshold, they convert to hard bounces and are suppressed.
• Spam complaints are immediately suppressed.
• Recipients who haven't engaged in 12+ months should be flagged for re-engagement or removal (we'll surface them automatically).
• Suppression lists are global per workspace and cannot be exported with raw addresses for use outside Mailapp.

• Mailapp continuously monitors complaint rates, bounce rates, authentication, content patterns, and reputation signals from major receivers.
• Crossing a threshold triggers an automated review, a human review, throttling, suspension, or termination — proportional to severity and history.
• Phishing, malware, or fraud sent through Mailapp is suspended on detection and reported to relevant authorities.
• If you operate at the edge of these rules, your CSM can pre-approve campaigns and warm-up plans.

Forward the email with full headers to hello@mailapp.app. We investigate every report within 24 hours. If the report is valid, we'll suspend the sender and add the recipient to a global suppression list so they cannot be re-added.