Draft – subject to legal review

Sendonis Acceptable Use and Anti-Spam Policy

Effective date: [EFFECTIVE DATE]

This Acceptable Use and Anti-Spam Policy (the "AUP") forms part of the Sendonis Terms of Service between you and Sinapp Sağlık Eğitim Yazılım Danışmanlık Ltd. Şti. ("Sendonis"). Capitalised terms not defined here have the meaning given in the Terms. The AUP applies to all email and SMS sent through the Sendonis API and Web App. Sendonis does not offer SMTP relay.

Sendonis has a zero-tolerance policy for spam. Our email is delivered through Amazon SES and our SMS through [SMS PROVIDER]; you must also comply with their acceptable use policies as communicated to you.

1. Permission (consent) requirements

1.1 You may only send Messages to Recipients who have given you permission to receive that type of Message from you, through that channel, in a way that is valid under the laws of the Recipient's location (and of your location). As a rule, Sendonis requires opt-in consent for all marketing/commercial Messages, even where local law would allow less.

1.2 Permission must be:

• specific – given to you (not to a partner, affiliate or list vendor);
• recent – lists that have not been mailed for more than [MAX LIST AGE / RE-PERMISSION PERIOD] must be re-permissioned before use;
• documented – you must keep records of how, when and where each Recipient opted in (source, timestamp, IP or method, consent wording) and provide them on request.

1.3 Transactional messages (e.g. password resets, receipts, order and account notifications) must be genuinely transactional, requested by or necessary for an existing relationship with the Recipient, and must not contain marketing content beyond what applicable law permits.

1.4 Türkiye (İYS). If you send commercial electronic messages to Recipients in Türkiye, you must comply with Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages, including registering with İYS where required, registering consents in İYS, checking İYS before each sending, and honouring rejections (opt-outs) within the legal timeframe. Consent exceptions (e.g. for merchants/tradespeople) must be applied only where lawful.

1.5 Other regimes. You must also comply with, as applicable: GDPR and ePrivacy rules (EU/EEA), UK GDPR and PECR (UK), CAN-SPAM, TCPA and state laws (US), CASL (Canada), and the laws, regulator rules and carrier codes of every country to which you send.

2. Prohibited lists and list practices

You must not send to, upload or import:

• purchased, rented, leased, borrowed, shared, traded or "co-registration" lists;
• lists obtained by harvesting, scraping, crawling or extracting addresses or phone numbers from websites, directories, social networks or other sources;
• lists generated by dictionary attacks, randomisation or number generation;
• lists of role addresses (e.g. abuse@, postmaster@, noc@) or distribution lists without the express consent of their owners;
• addresses or numbers that have previously unsubscribed, complained, or hard-bounced (suppressed contacts), unless the Recipient has given fresh, documented opt-in consent;
• lists appended or enriched via third-party data matching ("e-appending");
• contacts whose consent was obtained in connection with a different brand, product or purpose;
• contacts collected through pre-ticked boxes, consent hidden in terms and conditions, or consent made a condition of an unrelated service where unlawful.

3. Prohibited content and uses

You must not use the Service to send, store or facilitate:

• unsolicited bulk or commercial messages (spam);
• phishing, spoofing, impersonation or messages designed to obtain credentials or payment data deceptively;
• malware, viruses, or links to malicious or compromised sites;
• illegal content or content promoting illegal activity, including illegal gambling, illegal drugs, counterfeit goods, unlicensed financial services or pharmaceuticals;
• content that is defamatory, harassing, hateful, discriminatory, threatening, or incites violence;
• child sexual abuse material or any content sexualising minors (reported to authorities);
• sexually explicit content or adult services [DECIDE: prohibited entirely or allowed with restrictions];
• "get rich quick", pyramid/MLM recruitment, debt relief, credit repair, payday loans, cryptocurrency or investment solicitations, or similar high-risk content [ADJUST HIGH-RISK CATEGORY LIST];
• content that infringes intellectual property, privacy or publicity rights;
• political or election messaging, except where permitted by law and expressly approved by Sendonis in writing;
• misleading subject lines, headers, sender names or "From" addresses;
• URL shorteners from public shared domains, or link cloaking intended to evade filters;
• messages to Recipients who are children below the applicable age of digital consent, unless with verified parental consent and lawful;
• special categories of personal data or other sensitive data, unless agreed in writing.

You must not: test Recipient addresses for validity by sending ("list washing"/"list cleaning" via the Service); use the Service to send on behalf of unvetted third parties; attempt to evade filters, rate limits, quotas, budget limits or suspensions; use multiple Accounts to spread a list; or interfere with the Service or other customers.

4. Required elements in every Message

4.1 Sender identification. Every Message must clearly identify you (or the brand on whose behalf you send) as the sender. Email "From" names and addresses must be accurate and use a domain you have verified with Sendonis. Header information must not be false or misleading.

4.2 Physical address and contact. Marketing emails must include your valid physical postal address and contact information, as required by CAN-SPAM, CASL and other laws.

4.3 Unsubscribe. Every marketing/commercial email must include a clear, functional unsubscribe link. Sendonis adds a List-Unsubscribe header supporting one-click unsubscribe (RFC 8058) and/or an unsubscribe link; you must not remove, hide or disable these. Unsubscribe must not require login, payment, or providing information other than the address. Opt-outs received through Sendonis are added to your suppression list automatically; opt-outs you receive by other means must be processed promptly and in any case within [UNSUBSCRIBE PROCESSING TIME] (and within the shorter period required by law, e.g. 10 business days under CAN-SPAM, 10 business days under CASL, and 3 business days for İYS rejections [LAWYER TO CONFIRM DEADLINES]).

4.4 Subject lines and content must reflect the content of the Message and must not be deceptive.

5. Bounce, complaint and quality thresholds

5.1 Sendonis processes bounce and complaint notifications for your Account and automatically adds hard bounces and complaints to your Account's suppression list, which Sendonis maintains in its own systems. In addition, addresses that hard-bounce or complain are added to the suppression list of our email delivery provider (Amazon SES), which is maintained for the Sendonis service only and applies to all customers' sending on the Service. An address suppressed this way cannot be emailed by any Sendonis customer until it is removed.

5.2 You must keep your sending within the following thresholds, measured over [MEASUREMENT WINDOW] (and subject to a minimum sample of [MIN SAMPLE SIZE] messages):

Drafting note: Amazon SES places accounts under review at a bounce rate of about 5% and a complaint rate of about 0.1%, and may pause sending at about 10% and 0.5%. Mailbox-provider bulk-sender guidance (e.g. Gmail/Yahoo) expects complaint rates to stay below 0.3%, ideally below 0.1%. The confirmed automatic-pause thresholds (4% bounce, 0.08% complaint) are below these levels. Warning levels are still open (suggestion: 2% bounce / 0.05% complaint).

5.3 If you reach a warning level, we may notify you, reduce your sending rate or require list hygiene. If you reach a maximum level, sending for your Account (or the affected sender/domain) is paused automatically until we review it. We may require evidence of consent, list cleaning, re-permission campaigns or a reduced ramp-up before re-enabling sending.

6. SMS-specific rules

6.1 Consent. You must have the express prior consent required by law for every marketing SMS (and for transactional SMS where required), and comply with the rules of the destination country, carriers and [SMS PROVIDER], including İYS (Türkiye), TCPA, CTIA guidelines and 10DLC/toll-free/short-code registration (US), and equivalent rules elsewhere.

6.2 Sender ID. You may only use sender IDs (alphanumeric headers, long codes, short codes or toll-free numbers) that you are entitled to use and that have been registered or approved where required (e.g. operator/BTK-related header registration in Türkiye, 10DLC brand/campaign registration in the US, sender ID registration in other countries). Sender IDs must identify you or your brand and must not impersonate others.

6.3 Identification and opt-out. Every marketing SMS must identify the sender and include a clear opt-out instruction (e.g. "Reply STOP to opt out" or the locally required mechanism, such as the İYS-compliant rejection method in Türkiye). Sendonis recognises the opt-out keywords [SMS OPT-OUT KEYWORDS] (e.g. STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, and locally required equivalents such as "RET" [CONFIRM LOCAL KEYWORDS]) where the destination and number type support inbound replies, and adds opted-out numbers to your suppression list.

6.4 Quiet hours. You must not send marketing SMS outside permitted hours. By default, Sendonis requires that marketing SMS are not sent during [SMS QUIET HOURS] in the Recipient's local time, or the stricter hours required by local law (for example, U.S. TCPA restricts telephone solicitations before 8 a.m. and after 9 p.m. local time, and several U.S. states impose stricter windows).

6.5 Content. SMS must comply with carrier content restrictions (e.g. the "SHAFT" categories – sex, hate, alcohol, firearms, tobacco – and cannabis in the US, which are generally prohibited or restricted), and may not use public URL shorteners.

6.6 Frequency and help. You must disclose message frequency where required, and respond to HELP requests where required by carrier rules.

7. Domain and authentication requirements

• You must verify each sending domain and publish the DNS records we provide (DKIM, and where applicable SPF/custom MAIL FROM).
• You must publish a DMARC record for each sending domain (at least p=none) and should progress to an enforcing policy where practical.
• You must not send from free webmail domains (e.g. gmail.com, yahoo.com) or domains you do not control.

8. Enforcement

8.1 We may, at our discretion and without liability: issue warnings; throttle, queue or reject Messages; pause sending; require list audits or evidence of consent; lower quotas or budget limits; remove content; suspend or terminate your Account; withhold sending credits obtained through abuse; and report unlawful activity to Third-Party Delivery Providers, carriers, regulators or law enforcement.

8.2 Serious violations (e.g. phishing, malware, purchased lists, CSAM, deliberate evasion) may result in immediate termination without prior notice.

8.3 You are responsible for any fines, carrier penalties or costs caused by your breach of this AUP, as set out in the Terms.

9. Reporting abuse

If you receive unwanted email or SMS sent through Sendonis, or believe the Service is being misused, please contact [ABUSE EMAIL] and include, where possible, the full message headers (for email) or the sender ID, time and content (for SMS). We investigate all reports and may share relevant information with the sending customer and Third-Party Delivery Providers as necessary to resolve the issue. Recipients can also unsubscribe at any time using the unsubscribe link or opt-out keyword in the message.

10. Changes

We may update this AUP to reflect legal, carrier or provider requirements. Material changes will be notified in accordance with the Terms; changes required by law or by Third-Party Delivery Providers may apply immediately.