Acceptable Use Policy

This Acceptable Use Policy (the "AUP") applies to every customer, user, API key, campaign, list, and message sent through StellarMail, operated by Stellar Byte Technology Corp. (the "Platform", "we", "us"). It is incorporated into, and forms part of, the Terms of Service. If there is a conflict between this AUP and any other document regarding permitted use, this AUP governs.

Sending email on behalf of other people is a regulated activity. Under Canada's Anti-Spam Legislation ("CASL"), a service provider that aids, induces, procures, or facilitates a violation can be liable alongside the sender, and can be liable even where it did not intend the violation and was unaware of it. We also send through Amazon Simple Email Service, whose Acceptable Use Policy prohibits distributing, publishing, sending, or facilitating the sending of unsolicited mass email. We therefore enforce this AUP aggressively, and we would rather terminate a paying account than accept that exposure.

You may only send email to recipients who have specifically asked to hear from you. Consent must be knowing, specific to you as the sender, and specific to the kind of message you are sending. Silence, inactivity, pre-ticked boxes, and "we assumed you were interested" are not consent.

You must not send

• Any message to a recipient who has not given express or, where lawfully available, valid implied consent to receive that message from you.
• Any message to a recipient who has unsubscribed, marked your mail as spam, or otherwise withdrawn consent - regardless of which list, tool, or account you re-import them into.
• Any message where the consent you rely on was obtained by a different organisation, a predecessor brand, an affiliate, or an acquisition, unless the recipient consented to receive mail from that successor entity.
• Any message whose subject line, sender name, sender address, or header information is false, misleading, or disguises the true origin of the message.

Prohibited list sources - absolute

You may not upload, import, sync, or send to any list of addresses that was, in whole or in part:

• Purchased, rented, leased, licensed, bartered, or otherwise acquired from a third party, including "verified", "opt-in", or "GDPR-compliant" lists sold by data brokers;
• Scraped, harvested, or crawled from websites, social networks, directories, WHOIS records, conference attendee lists, job boards, app stores, public filings, or any other source, whether by you, by a contractor, or by software;
• Generated by dictionary attacks, permutation of names against a domain, pattern guessing, or any automated means of producing candidate addresses;
• Collected for an unrelated purpose - for example, addresses given to you for support, billing, shipping, recruitment, or account security - and then repurposed for marketing;
• Obtained from a co-registration, lead-generation, or "partner network" arrangement where the recipient was not clearly told, at the moment of collection, that they would receive email from you by name.

Every commercial message you send through the Platform must:

• Clearly and accurately identify you as the sender, including your legal or commonly used business name;
• Contain a valid physical postal address at which you can be reached. This is a hard requirement of the US CAN-SPAM Act and of CASL, and it is not optional for any tier of service, including the free tier;
• Contain a clearly visible, functioning unsubscribe mechanism that works for at least 60 days after sending and requires no login, payment, or reply to use;
• Honour unsubscribe requests promptly, and in no event later than 10 business days after the request. The Platform processes unsubscribes automatically and immediately; you must not re-add, re-import, or otherwise defeat that suppression;
• Use a sending domain and reply-to address you are authorised to use, correctly authenticated with SPF, DKIM, and (where applicable) DMARC;
• Accurately describe its own content in the subject line and preheader.

Statutory maximum penalties for non-compliant messages are severe: up to USD $53,088 per message under CAN-SPAM, and up to CAD $1,000,000 (individuals) or CAD $10,000,000 (organisations) under CASL. These liabilities are yours, and under the Terms of Service you indemnify us against them.

You may not use the Platform to send, host, link to, or facilitate:

• Phishing, credential harvesting, spoofing of another brand or person, business email compromise, or any message designed to deceive a recipient into disclosing information or transferring funds;
• Malware, ransomware, spyware, exploit kits, or links to any of the foregoing;
• Fraudulent, deceptive, or misleading offers, including fake invoices, fake delivery notices, fake security alerts, pyramid or Ponzi schemes, chain letters, and get-rich-quick schemes;
• Unlicensed financial, securities, cryptocurrency, or investment solicitations, including pump-and-dump promotion and unregistered token offerings;
• Content that is unlawful, defamatory, harassing, or that promotes violence, self-harm, terrorism, or discrimination against a protected group;
• Child sexual abuse material, or any sexual content involving minors, in any form;
• Illegal drugs, prescription pharmaceuticals sold without a prescription, counterfeit goods, stolen data, or illegal weapons;
• Content infringing another party's copyright, trademark, patent, trade secret, privacy, or publicity rights.

You also may not:

• Create multiple accounts, or use additional API keys, domains, sub-accounts, or identities, to evade a suspension, a sending limit, a bounce threshold, a quota, or a list suppression;
• Remove, alter, obscure, or render inoperative any unsubscribe link, tracking pixel disclosure, or sender identification inserted or required by the Platform;
• Resell, sublicense, or provide sending capacity to third parties as a bulk mail service without our prior written agreement;
• Probe, scan, load-test, reverse engineer, or attempt to circumvent the Platform's rate limits, quota system, authentication, or tenant isolation;
• Use the Platform in a way that damages the deliverability reputation of shared sending infrastructure, shared IP pools, or shared sending domains used by other customers.

We may also disclose account and message information to law enforcement, regulators (including the CRTC and the Office of the Privacy Commissioner of Canada), upstream providers such as Amazon Web Services, and mailbox providers, where we are legally required to do so or where it is reasonably necessary to investigate suspected abuse.

You are the sender of the messages you transmit through the Platform. Amazon Web Services Service Terms expressly state that AWS is not the "sender" of email transmitted through Amazon SES, and we do not assume that role either: we provide the tooling, you decide what is sent and to whom. Accordingly, you are responsible for complying with all laws applicable to your messages, including at minimum:

• CASL (Canada) - obtaining and documenting express or valid implied consent, identifying yourself, providing a working unsubscribe mechanism, and honouring withdrawals of consent within 10 business days;
• CAN-SPAM (United States) - accurate headers and subject lines, a clear disclosure that the message is an advertisement where required, a valid physical postal address, a functioning opt-out, and processing opt-outs within 10 business days;
• GDPR and UK GDPR - having and being able to demonstrate a lawful basis for processing your subscribers' personal data, providing the required transparency notices, honouring data subject rights, and executing a data processing agreement with us where you require one. As between you and us, you are the controller of your subscriber data and we act as your processor - see the Privacy Policy;
• PIPEDA and applicable provincial privacy legislation in Canada, and any other consumer protection, marketing, or data protection law applicable to you or to your recipients;
• The Amazon Web Services Acceptable Use Policy and AWS Service Terms, as they apply to email transmitted through Amazon SES.

You must maintain records sufficient to demonstrate the above, and you must provide them to us on request. You indemnify us for claims, fines, and penalties arising from your failure to comply, as set out in the Terms of Service.

To protect recipients, other customers, and our upstream providers, we apply the following controls. They are conditions of service, not features you can opt out of, and we may adjust them at any time in response to observed risk.

• Sending volume ramp-up. New accounts, new sending domains, and accounts with a changed risk profile start with reduced sending limits that increase gradually as a clean sending history is established. Requests to bypass the ramp may be refused.
• Bounce and complaint rate circuit breakers. We continuously monitor hard bounce rates, soft bounce patterns, and spam complaint rates via Amazon SES feedback notifications. Campaigns and accounts that cross our thresholds are automatically throttled or halted mid-send, without prior notice. Persistent or repeated breaches result in suspension.
• List validation and hygiene checks. Imported lists are screened for syntactically invalid addresses, known spam traps and role accounts, disposable domains, and signals characteristic of purchased or scraped data - such as improbable domain distributions or bulk sequential patterns. Imports that fail screening may be rejected or held for manual review.
• Double opt-in. Confirmed (double) opt-in is supported throughout the Platform, is the default for collection widgets and hosted signup forms, and may be required of any account whose complaint rate, bounce rate, or list provenance we consider a risk.
• Global suppression. Unsubscribes, hard bounces, and spam complaints are recorded in a suppression store and enforced at send time across all of your lists and campaigns. Suppression cannot be overridden by re-importing a contact.
• Per-tenant quotas and rate limiting. Sending volume, contact counts, and API request rates are metered and enforced per tenant.
• Content sanitisation. Customer-supplied HTML templates are sanitised before transmission to remove scripts and other active content.
• Abuse investigation. We log campaign metadata, sending activity, and administrative actions, and we review reports sent to abuse@stellarbyte.ca.

These controls reduce risk; they do not validate your consent for you, and passing them is not our approval of a list or a campaign. Responsibility for the lawfulness of what you send remains entirely yours.

If you have received unsolicited mail sent through StellarMail, or believe an account is violating this policy, report it to abuse@stellarbyte.ca. Please include the full message headers where possible, since they let us identify the sending account. We investigate every report and act on confirmed violations.

Recipients do not need our customers' cooperation to stop receiving mail: contact us directly and we will apply a global suppression for your address.

We may update this AUP as laws, upstream provider requirements, and abuse patterns change. Material changes will be posted here with a revised effective date, and where the change materially reduces what you are permitted to send we will make reasonable efforts to notify account owners in advance. Continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.

Questions about this policy: support@stellarbyte.ca.