Acceptable Use Policy

1. Consent and how you got the address

This is the rule that matters most, and the one we act on fastest.

• You may only message a person who has given verifiable consent, or for whom another valid legal basis exists, appropriate to the type of message you are sending.
• You must be able to produce the evidence of that consent on request: where it was collected, when, and what the person agreed to receive.
• You may not use lists that were purchased, rented, leased, swapped, scraped from a website, harvested from a directory, generated by guessing addresses, or obtained from any third party who cannot show consent for you specifically.
• Consent given to one business does not transfer to another. Acquiring a company does not automatically transfer consent to message its list for a different brand or purpose.
• You may not send to role addresses harvested at scale, to addresses obtained from a data breach, or to any address on your own suppression list.
• For WhatsApp and other messaging channels, the platform's own opt-in rules apply on top of this, and they are stricter than email.

When you import contacts in bulk, you declare where they came from. That declaration is what you rely on if a recipient or a regulator asks — so make it accurate.

2. Unsubscribe and sender identity

• Every marketing message must offer a working, obvious way to stop receiving them, and it must work with one action — no login wall, no survey, no "reply with the word" obstacle course.
• An opt-out must be honoured immediately, across the channel it was given in. You may not re-add an unsubscribed contact through an import, an integration or a new audience.
• You may not suppress, hide, shrink, obfuscate or break the unsubscribe link, nor route it to a page that fails.
• You may not circumvent the platform's suppression list — including by splitting the same sending across accounts, organisations, projects or domains.
• The sender name, the from address and the reply-to must identify you honestly. You may not impersonate another business, another person, or a service you do not operate.
• You may not falsify headers, forge the origin of a message, or send from a domain you are not authorised to use.
• A message must not disguise its commercial nature, and the subject line must not misrepresent the content.

3. Prohibited content and activity

You may not use Publiq to send, host, promote or facilitate:

Unlawful and harmful

• Anything unlawful under Brazilian law or the law applicable to you or to the recipient.
• Fraud, deception, impersonation, fake invoices, or any scheme designed to obtain money or data by misleading the recipient.
• Phishing, credential harvesting, or messages that imitate a bank, a government body, a delivery company, a platform or any service in order to extract information.
• Malware, ransomware, spyware, or links and attachments that deliver them.
• Content that sexually exploits or endangers children, in any form. This is reported to the competent authorities, not merely removed.
• Hate speech, incitement to violence, harassment, threats, or content that degrades a person or group on the basis of race, ethnicity, national origin, religion, disability, gender, sexual orientation or any other protected characteristic.
• Content that infringes copyright, trademark, trade secret or another person's rights.
• Doxxing, or the publication of another person's personal data without a lawful basis.

Deceptive commercial offers

• Financial schemes: pyramid and Ponzi structures, multi-level marketing recruitment, "get rich quick" offers, guaranteed-return investments, unlicensed securities or credit offers, and cryptocurrency promotions with promised returns.
• Credit repair, debt relief and loan offers that promise an outcome that cannot be guaranteed, or that misstate rates, fees or terms.
• Health, medical, supplement and weight-loss claims that promise a cure, a diagnosis or a result, or that are not supported by the evidence a competent authority would require.
• Gambling, betting and lottery offers where they are not lawful for the recipient.
• Adult and sexually explicit content, and services related to it.
• Prescription pharmaceuticals sold without the required authorisation, controlled substances, illegal drugs, tobacco and vaping products where restricted, weapons and ammunition.
• Counterfeit goods, stolen goods and services that facilitate their sale.

Technical abuse

• Probing, scanning, load-testing or attacking the platform or any third party through it.
• Circumventing quotas, rate limits, anti-abuse controls, CAPTCHA or a suspension, including by creating additional accounts.
• Using the service to relay traffic for an undisclosed third party, or reselling it as your own outside an agency arrangement your plan enables.
• Reverse engineering the platform, or extracting its data or models beyond what the API permits.

4. Deliverability thresholds, and the automatic response

Bounce and complaint rates are the clearest objective signal that a list was not collected properly. The platform measures them for every organisation and acts on them on its own — this section describes exactly what it does, so nothing here is a surprise.

How it is measured

• The window is the current calendar month, in UTC, measured over the sends made in that period. It resets when the month turns.
• A sweep runs every 30 minutes.
• Nothing is decided below 50 sends in the period. Ten sends with one bounce is 10% and means nothing — that is not evidence, and we do not act on it in either direction.
• Both rates are checked. Whichever puts you in the worse tier is the one that decides; where they tie, the complaint rate is the one reported, because a recipient marking a message as spam is a human judgement about the sender, while a bounce may just be an old address.

What each tier actually does

• Warning: we record the decision and email the account owner. Nothing is blocked. This tier exists so you can fix the list before losing any function.
• Restriction: marketing sending is refused — broadcasts, including scheduling one for later.
• Transactional sending keeps working throughout: the API, SMTP and automations are untouched. A list problem must not take your product down. Password resets, receipts and confirmations continue to go out.

Total suspension of an account is never automatic. It stays a human decision, taken under the Enforcement section for a serious breach — never by a rate crossing a line. A false positive that switches off someone's whole account is catastrophic and, in the customer's memory, irreversible.

How the restriction is lifted

By itself. On any later assessment with enough volume, if the rate has come back below the FIRST threshold, the restriction is removed automatically and the account owner is emailed. You do not need to open a ticket.

Note that you exit below the first threshold, not the second: an organisation restricted at 5% bounce only comes back below 2%. That gap is deliberate. Releasing at the same line that restricts would leave an account hovering on the threshold restricted and released on alternate cycles, which is worse for everyone than one clear recovery.

What to do about it

Clean the list. Remove addresses that hard-bounced, remove the ones you bought or inherited and cannot evidence, and remove contacts who have never opened anything. Then keep sending to the people who do engage: the rate is a proportion, so healthy sends dilute it and it falls back on its own. Fixing the cause is faster than waiting for the month to turn.

You can see the decision

Every warning, restriction and release is written to the audit trail of your own organisation — not to an internal log you cannot reach. The entry records which threshold was crossed, the rate that was measured, the volume it was measured over, and the window. If we restrict you, you can see exactly why, without asking us.

5. Third-party platform rules

Every connected channel carries the rules of the platform behind it, and those rules bind you directly.

• Meta: the Meta Platform Terms, the Developer Policies, and for WhatsApp the Business Messaging Policy and the Commerce Policy — including message template approval, the customer service window, and the rules on what may be sent outside it.
• TikTok: the developer terms and the messaging and advertising policies.
• Telegram: the Bot API terms.
• Google: the API Services User Data Policy for any connected Google account.
• You may not use an automation to evade a platform's messaging window, its rate limits, its template rules or its quality rating.
• You may not use the platform APIs to bulk-message people who did not initiate contact with you, where the platform requires that they did.

A platform may restrict, suspend or ban your account for its own reasons. That risk is yours, as stated in the Terms. Where a platform requires us to act against an account, we act.

6. What happens when this policy is breached

Our response is graduated, and it is chosen by the severity of the breach and the risk to other customers — not by the order of the list below.

This ladder is the human one, applied to a breach of the rules above. It is separate from the automatic response to deliverability rates described in the previous section, which never suspends an account and never touches transactional sending. The two can coincide, but one does not imply the other.

1. Warning: we tell you what we saw and what has to change, with a deadline.
2. Limitation: we cap sending volume, pause a specific campaign, disable a channel or require re-verification of a list, while the issue is investigated.
3. Suspension: sending or the account is suspended. Data is preserved. We tell you what would restore the account, which normally means evidence of how a list was collected, a cleaned list, or a corrected message.
4. Termination: the account is closed under the Terms. Fees already paid are not refunded where termination follows a breach of this policy.

A serious breach permits immediate suspension without prior notice. That includes phishing, malware, child sexual exploitation material, a clearly purchased or scraped list, a spam complaint rate that endangers shared sending reputation, an order from a competent authority, and a demand from a third-party platform. In those cases we act first and explain afterwards, because the alternative is letting the harm continue while we correspond.

You may appeal any enforcement decision by replying to the notice we send, or by opening a support ticket. We will look again, and we will tell you the outcome and the reason. Repeated breaches, or a breach after a warning, are treated as material and normally end in termination.

Where a breach causes us loss — a blocklist listing, an IP reputation incident, a platform penalty or a regulatory fine — the indemnity in the Terms of Service applies.

7. Changes to this policy

This policy is kept separate from the Terms precisely so it can be revised on its own: abuse patterns change faster than a contract can be renegotiated. The date at the top of the page is always the edition in force.

For a change that materially affects what you may do, we notify you in advance. The notice is sent from a dedicated internal tool to the people who answer for the contract in each organisation — the owner and the administrators — and it states the type of change, the subject and the date it takes effect. Resending the same notice changes nothing: each one carries a unique reference, and a repeat of that reference is ignored rather than delivered twice.

Every notice is also written to the audit trail of your own organisation. That means the history of what you were told is available to you inside the application, not only in an inbox — you can check months later what was communicated, when, and from what date it applied, without opening a ticket and without depending on an email having survived a filter. Neither that record nor our own register of notices is deleted by age.

An organisation under suspension is still notified. Suspension is temporary and reversible, the data is still with us and the contract is still in force, so a change to this policy binds that organisation just the same — and it is precisely what someone under restriction most needs to read. An organisation that has been archived is not notified: the relationship has ended.

Where the change is the addition of a subprocessor, a stricter rule applies and the software enforces it: 30 days, checked by the system, with a right to object. The Subprocessors page sets it out.

8. Reporting a violation

If you received a message you did not consent to, or you saw unlawful content sent through Publiq, report it. The Report Abuse page explains what to include and how quickly we respond, and the address is [ABUSE EMAIL].

We also welcome reports from mailbox providers, blocklist operators and platform trust-and-safety teams at the same address.

9. Contact

Questions about this policy: [LEGAL CONTACT EMAIL]. Abuse reports: [ABUSE EMAIL]. [LEGAL ENTITY NAME], [CNPJ], [REGISTERED ADDRESS].