Acceptable Use & Anti-Spam Policy

Platform: Sendora  •  Version: [1.1]  •  Effective: 01/04/2026

This Policy governs every message sent through Sendora, operated by Caresoft Systems Private Limited. It forms part of the Terms of Use and prevails over them on any question of what may be sent, to whom.

1. Why this policy is strict

• Email: our upstream provider measures bounce and complaint rates and can suspend sending. Depending on your configuration, that suspension may affect other customers on the same infrastructure.
• WhatsApp: Meta scores each sender's quality. Blocks and "report business" taps lower it, then restrict the number, then ban it — in days, not months.
• Domain reputation: a poor sending record follows a domain for months, and affects the ordinary business email sent from it too.

2. What counts as permission

3. What does not

3.1 On that last one

If your business model depends on contacting people who never asked to hear from you, Sendora is not the right platform, and we would rather say so before you subscribe than suspend you afterwards.

4. WhatsApp is different

5. Email standards

• Authenticate your domain. SPF, DKIM and DMARC must be configured before your first campaign. We will not enable sending from an unauthenticated domain.
• Use your own domain, not a free mailbox address, as the From address.
• The From name and address must accurately identify you. No impersonation, no misleading sender names.
• Subject lines must be honest and reflect the content. No fake "Re:", no fake "Fwd:", no false urgency, no misleading claims.
• Include a working postal address for your business.
• Include a visible unsubscribe link in every marketing email (§6).
• Do not use hidden text, invisible characters or image-only emails to evade filters.
• Do not send from a domain you do not control, or forge headers.

6. Unsubscribe and opt-out

• The unsubscribe link must be visible — not grey text at 6pt, not hidden in an image.
• It must work in one click. No sign-in, no password, no "confirm your reasons", no survey.
• List-Unsubscribe headers are added automatically. Do not strip or override them.
• Opt-outs take effect immediately, and always within 24 hours.
• For WhatsApp, honour any opt-out language a recipient sends, in any form. If someone says stop, they have said stop.
• Do not make people ask twice. A recipient who has to unsubscribe a second time reports as spam instead, and that costs you far more.

7. Suppression is permanent

8. List hygiene

• Import contacts you collected yourself and can account for.
• Populate the consent fields on import — source, date, method. Sendora provides them for a reason.
• Re-engage or remove contacts who have not opened or responded in [12] months. Old addresses become spam traps.
• Do not send to an old list "one last time to clean it". That is precisely the send that gets an account suspended.
• Validate before you send. Sendora validates format and flags likely-invalid addresses; act on those flags rather than sending anyway.
• Warm up new domains and new sending volumes gradually. Going from zero to 50,000 emails in a day looks exactly like a compromised account.

9. Bounce and complaint thresholds

• Rates are measured per account and per sending domain, over a rolling window.
• Where a threshold is approached, we notify you and expect list remediation before further sending.
• Where a threshold is crossed, sending is paused automatically and a review is required to resume.
• A complaint rate of 0.1% is one complaint in a thousand. It is a low bar because inbox providers set it there, and it is not negotiable by us.

10. Prohibited content

You must not send, through any channel:

11. Regulated categories

Permitted, but with conditions. We may require evidence before enabling sending.

12. Healthcare messaging

• Appointment and reminder messages must be minimal — that something is due, not what it is about.
• Do not segment a marketing campaign by a condition and then send content that reveals the segment. "Because you have diabetes" in a subject line is a disclosure.
• Patient contact lists require the patient's consent for the specific purpose. Treating a patient database as a marketing list is a breach of confidence, and in most cases of law.
• Prescription medicines may not be advertised to the public.
• Verify the number belongs to the patient. Numbers change hands.

13. Identifying yourself

• Every message must clearly identify the sender — the actual business, not a brand nobody recognises.
• Include a postal address and a working contact route.
• Do not send on behalf of an undisclosed third party. If you are an agency, the underlying advertiser must be identified to us and to recipients.
• Do not use a sender name, domain or number designed to look like another business.
• Where a message is an advertisement, it must be recognisable as one.

14. Technical rules

• Do not attempt to exceed your sending limits, or split a campaign across accounts to do so.
• Do not operate multiple accounts to spread reputational damage or evade suppression.
• Do not use the API to bypass consent fields, suppression checks or content screening.
• Do not obscure links through cloaking services or URL shorteners we have not approved.
• Do not include tracking that a recipient could not reasonably expect, or attempt to identify recipients across sites.
• Do not probe or test the platform's security without written authorisation.

15. Indian telecom rules

• Compliance is yours. Sendora does not register you, does not maintain your DLT entries, and does not check numbers against DND for you.
• Where you send SMS through a route requiring DLT registration, you must hold it before sending.
• Time-of-day restrictions apply to promotional messaging. Do not schedule campaigns into the night.
• WhatsApp Business messaging operates under Meta's policy in addition to any Indian requirement — satisfying one does not satisfy the other.
• Consumer Protection Act, 2019 rules on misleading advertisement apply to your content whatever the channel.

16. Sending outside India

If your list includes recipients outside India, their law applies to you, not just Indian law:

• EU and UK: the GDPR and ePrivacy rules generally require prior consent for marketing email, with narrow exceptions. "Legitimate interest" is not a safe assumption for cold email.
• United States: CAN-SPAM requires accurate headers, a postal address and a working opt-out honoured within 10 days.
• Canada: CASL is among the strictest regimes, with significant penalties and consent requirements.
• Middle East and Singapore and others have their own regimes, some with do-not-call registries.

You are responsible for compliance in every jurisdiction you send to. We do not geofence your list for you.

17. What we monitor

• Automated screening checks for prohibited content categories and known malicious links.
• We review message content where a complaint, an abuse report, an upstream provider notice or an automated flag requires it — logged with a reason you can request.
• We may require consent evidence for a list at any time, and expect it within [3] working days.
• New accounts and new domains are reviewed before high-volume sending is enabled.

18. Enforcement

19. Complaints and abuse reports

• Anyone may report a message sent through Sendora to [email protected], including recipients, providers and regulators.
• Reports are acknowledged within [24] hours and investigated within [5] working days.
• A recipient reporting a message is suppressed immediately, before any investigation.
• We identify the sending customer to a recipient only where required by law or by a lawful authority; otherwise we act on it ourselves.
• We act on notices from upstream providers, and on lawful directions, within the timelines required.

20. Contact

This Policy is not exhaustive. Conduct not listed may still be a breach if it is unlawful, damages deliverability, or would embarrass a reasonable recipient. We may update it on [15] days' notice, or immediately where a provider or the law requires.