Acceptable Use / Anti-Spam Policy

1.1 This Policy sets out rules for the acceptable and lawful use of the 404 Emails Service for sending marketing and other commercial electronic communications, including anti-spam and anti-abuse rules.

1.2 This Policy applies to every Customer and its authorised users and to all communications sent through the Service, including campaigns, automations and forms.

1.3 Capitalised terms not defined in this Policy have the meaning given to them in the Service's Terms of Service (the "Terms").

2.1 This Policy forms part of the Terms and applies together with them. In the event of a direct conflict between this Policy and the Terms, the Terms prevail, unless this Policy expressly imposes a stricter requirement on the Customer on a specific point.

2.2 This Policy supplements, and provides further detail on, in particular Sections 4 (Customer Responsibility for Marketing Legality), 5 (Lists and Contact Acquisition), 6 (Anti-Abuse Protection), 7 (Ownership of Customer Data and Licence) and 10 (Suspension and Termination) of the Terms.

2.3 The Customer remains solely responsible for its campaigns, contact sources, the legal basis for contacting them, sender identity, and compliance with the laws applicable to its marketing activity.

2.4 404 Emails provides the Service's technical infrastructure. The fact that the Service can be technically configured to send, or does send, a given campaign does not mean that campaign is lawful, and 404 Emails does not thereby guarantee or confirm its lawfulness.

2.5 This Policy does not constitute individualised legal advice, and 404 Emails does not pre-approve campaigns or assess their legal compliance.

3.1 The Customer may send marketing or other commercial electronic communications through the Service only where it has a lawful ground or right to do so under applicable law (a lawful basis).

3.2 For Customers and recipients in the Czech Republic and the European Union, such a lawful basis may, where legally relevant, include in particular:

• the recipient's valid prior consent; or
• the limited existing-customer exception permitting the sender to offer its own similar products or services, where all requirements imposed by applicable law are satisfied.

3.3 The exception under paragraph 3.2(b) does not apply automatically or universally; its availability depends on the specific factual circumstances and on satisfying all legal requirements, which the Customer alone must assess and for which it alone is responsible.

3.4 This Policy is not an exhaustive legal analysis of electronic-marketing requirements and does not replace qualified legal advice.

3.5 Where the Customer sends communications to recipients outside the Czech Republic or the European Union, it is responsible for complying with the rules applicable in the relevant jurisdiction, which may differ from the framework described above.

4.1 Where the Customer relies on a recipient's consent as its lawful basis, that consent must be valid under applicable law and, where applicable law requires prior consent, must be obtained before the marketing communication is sent.

4.2 The Customer must maintain sufficient evidence demonstrating consent or another right to contact the recipient, for as long as it continues to contact that recipient, and thereafter for a reasonable period required or recommended by applicable law.

4.3 Such evidence may, depending on the circumstances, include in particular:

• identification of the recipient or contact;
• the date and time it was given;
• the source or form through which the consent was obtained;
• the scope and purpose for which the consent was given;
• the wording and version of the text presented to the recipient at the time;
• confirmation evidence (double opt-in), where used; and
• other relevant evidence of the lawful basis or of an existing customer relationship.

4.4 This Policy does not state that double opt-in confirmation is generally legally mandatory for every send. Use of double opt-in is recommended by the Provider as good practice, and Forms within the Service support it as an optional feature the Customer may enable per form. In specific cases of heightened abuse risk, the Provider may, under Section 14, require its use or the provision of corresponding consent evidence as a condition of continued sending.

4.5 The Provider does not require the Customer to collect personal data beyond what is reasonably necessary for the purpose of demonstrating consent.

5.1 The Customer must not use, within the Service, contacts obtained by:

• scraping or other unauthorised collection of data from websites or public directories for unsolicited marketing that the Customer has no lawful right to conduct;
• address harvesting;
• stolen or leaked data;
• otherwise unlawfully obtained personal data;
• generating or guessing email addresses without a lawful right to contact them;
• fabricated consent records;
• deceptive collection methods; nor
• any method that breaches applicable privacy or direct-marketing law.

5.2 The public availability of an email address does not, by itself, establish permission to send marketing communications to it through the Service.

5.3 Purchased, rented, shared, brokered or other third-party-sourced contact lists may be used by the Customer within the Service only if it can demonstrate that:

• acquisition of the data was lawful;
• the recipients' consent or other applicable lawful basis actually covers this Customer and the intended marketing use;
• the source had the lawful right to provide the data for that use;
• applicable transparency and recipient-information requirements were satisfied;
• applicable direct-marketing rules permit the intended communication; and
• opt-outs and suppression records relating to the affected contacts are respected.

5.4 If the Customer cannot demonstrate the conditions set out in paragraph 5.3, it must not use that list through the Service.

5.5 The Provider may request evidence of compliance with the conditions of this Section before allowing or continuing sending.

5.6 The mere fact that a contact database was purchased does not, by itself, make it either lawful or unlawful; what matters is whether the conditions in paragraph 5.3 are satisfied.

6.1 Every marketing or other commercial campaign sent through the Service must provide recipients with an appropriate, clear, effective and easy way to stop receiving further such communications, where required by applicable law.

6.2 For commercial communications sent to recipients in the Czech Republic and the European Union, the opt-out must be simple and free of charge to the recipient.

6.3 The Customer must not:

• hide the unsubscribe mechanism;
• make it misleading;
• condition it on payment;
• require unnecessary steps;
• require login or account creation merely to unsubscribe;
• continue marketing after an effective unsubscribe; nor
• intentionally circumvent the suppression mechanisms applied by the Service.

6.4 The Service automatically inserts an unsubscribe link into every campaign and automation message sent through the Service, which the Customer cannot remove or disable.

6.5 A recipient's click on the unsubscribe link is processed automatically, without requiring the Provider's manual approval, and takes effect for future sending. This is without prejudice to the reasonable technical time needed to process and propagate that change across the Service's systems.

6.6 The Service automatically checks suppression status immediately before each individual send and will not send a message to a contact in an active suppressed state.

6.7 The Customer must not:

• send to contacts in an active suppressed state;
• remove a suppression merely to resume marketing without a valid reason;
• re-import or otherwise re-add an unsubscribed contact in order to bypass suppression;
• create another list, workspace or account in order to bypass suppression; or
• otherwise manipulate a contact's state in order to evade unsubscribe, bounce or complaint controls.

6.8 The Customer may contact a recipient previously in a suppressed state again only where that recipient has lawfully re-consented or otherwise established a new valid lawful basis, through a mechanism actually supported by the Service for that purpose. Suppression arising from a hard bounce or a complaint is not intended to be removed by self-service merely to resume sending.

7.1 The Customer must:

• accurately identify the sender or the person on whose behalf the communication is sent;
• use only sender / "from" information it is authorised to use;
• not impersonate another person, business or domain;
• not materially mislead recipients about the sender or the purpose of the communication; and
• comply with legally required commercial-message identification.

7.2 The Customer must not engage in:

• deceptive sender identity;
• spoofing or impersonation;
• fraudulent message headers;
• misleading message routing or domain practices; and
• phishing.

7.3 Within the Service, the sender ("from") address is always tied to a domain the Customer has verified through the sending-settings verification process; the Customer chooses the local part of the address, while the Service technically derives the domain part from the verified domain. The Customer cannot enter an arbitrary full sender address when sending a campaign outside this mechanism.

7.4 The Provider does not technically verify the truthfulness of every statement or identity appearing within content created by the Customer.

8.1 The Customer must not use the Service for:

• spam or unlawful unsolicited commercial communications;
• phishing;
• fraud or fraudulent schemes;
• distribution of malware;
• credential theft;
• impersonation of another person;
• unlawful collection, disclosure or use of personal data;
• harassing or threatening communications;
• content or activity that is unlawful under the law applicable to that activity;
• attempts to compromise the security of the Service, Resend, recipients or third-party systems;
• abuse intended to damage sender reputation, deliverability, network integrity, or infrastructure providers' reputation; or
• circumvention of enforcement, suspension or technical restrictions.

9.1 The Customer must maintain reasonable hygiene of its contact list.

9.2 The Customer must not intentionally continue sending to addresses it knows to be invalid or that repeatedly bounce.

9.3 The Customer must respect the complaint and suppression handling applied by the Service.

9.4 Where the Service records a hard bounce or a spam complaint for a contact, that contact is automatically and permanently placed into a suppressed state; that suppression is not intended to be removed by the Customer through self-service.

9.5 The Provider may restrict sending where bounce, complaint, abuse or other deliverability indicators present a reasonable risk to recipients, the Service, or its infrastructure providers. This assessment is based on the level of risk in the particular case, not on a fixed numeric threshold of bounces or complaints.

10.1 Where the Customer uses the Service's forms or integrations to collect subscribers, it is responsible for choosing the appropriate disclosure and consent wording displayed in that form.

10.2 The Customer is responsible for the lawful basis and direct-marketing permission applicable to that method of collection.

10.3 The Customer must not use deceptive or pretextual signup mechanisms.

10.4 The Customer must provide the required privacy information.

10.5 The Customer must preserve evidence where required.

10.6 The fact that the Service provides a form or a checkbox does not, by itself, establish legal compliance; that responsibility rests with the Customer.

10.7 Not every form necessarily requires a consent checkbox; the appropriate way to establish a lawful basis depends on the specific factual and legal situation and is the Customer's responsibility. Forms within the Service support a consent checkbox with customer-editable wording and an optional double opt-in confirmation step under Section 4.4.

11.1 Automations are subject to exactly the same anti-abuse and lawful-contact rules as manually sent campaigns.

11.2 Using an automation does not, by itself, create permission to contact a person.

11.3 The Customer remains responsible for:

• the design of the automation's trigger;
• its recipients;
• lawful sending;
• compliance with unsubscribe and suppression rules; and
• the content of messages sent by the automation.

11.4 Automations within the Service are subject to the same suppression and recipient-eligibility checks immediately before every send as manual campaigns.

11.5 The Provider does not legally review the Customer's automation logic.

12.1 The Customer must not attempt to circumvent:

• suppressions;
• unsubscribe state;
• bounce or complaint controls;
• sending limits;
• domain verification;
• account or workspace restrictions;
• suspension;
• abuse investigations;
• provider restrictions; nor
• technical safeguards.

12.2 Prohibited conduct under paragraph 12.1 includes, among other things, using multiple accounts or workspaces, re-importing contacts, changing identifiers, or other techniques primarily intended to evade enforcement of this Policy.

13.1 The Provider may investigate suspected abuse of the Service.

13.2 The Provider may reasonably request information or evidence such as:

• the source of contacts;
• consent records;
• the signup method;
• evidence of an existing customer relationship;
• the campaign's purpose;
• ownership of, or authorisation to use, the sending domain; and
• an explanation of unusual complaint or bounce activity.

13.3 The Customer must cooperate reasonably.

13.4 Failure to provide adequate evidence may result in restrictions on sending or suspension, where reasonably necessary.

13.5 This Policy does not guarantee that every investigation will follow a fixed notice or hearing procedure.

14.1 This Section applies in accordance with Section 6 (Anti-Abuse Protection) and Section 10 (Suspension and Termination) of the Terms.

14.2 Depending on the seriousness and level of risk, the Provider may proportionately take steps including in particular:

• a warning or a request for remediation;
• a temporary restriction on sending;
• disabling a campaign or automation where technically supported by the Service;
• suspension of the relevant functionality, workspace or account;
• termination, where permitted by the Terms;
• preserving or reporting narrowly scoped evidence where required by law; and
• cooperating with infrastructure providers or public authorities where required by law or appropriate under the Terms or applicable law.

14.3 Serious or urgent abuse may justify immediate action without prior notice where necessary to protect recipients, infrastructure, provider relationships, or legal compliance.

14.4 This Policy does not introduce any arbitrary monetary penalties; any financial liability is governed exclusively by the Terms.

15.1 Sending-infrastructure providers and other third-party providers, including Resend, may also impose their own restrictions, suspend delivery, or reject messages under their own rules.

15.2 The Provider cannot guarantee that a technically correctly configured message will be accepted or delivered by Resend or downstream email providers.

15.3 This Section does not make third-party providers' own rules contractually binding on the Customer beyond what the Terms already provide.

16.1 404 Emails is provided by a company established in the Czech Republic within the European Union. The Customer may, however, contact recipients in other countries through the Service.

16.2 The Customer is responsible for identifying and complying with the laws applicable to:

• the Customer itself;
• the recipient;
• the campaign;
• the target jurisdiction; and
• the type of communication.

16.3 The Czech- and EU-law rules described in this Policy are not an exhaustive overview of legal requirements applicable worldwide and must not be construed as such.

17.1 Suspected abuse of the Service or breaches of this Policy may be reported by recipients or third parties to 404branding@gmail.com, until a dedicated abuse-reporting address is established.

17.2 To help with the investigation, it is useful for a report to include in particular:

• the sender;
• the approximate date;
• subject or campaign information;
• the reason for the complaint; and
• relevant message headers or screenshots, where available.

17.3 Reporters should not include passwords, credentials, or other unnecessary sensitive personal data in their report.

17.4 This Policy does not set a binding timeline for handling an individual abuse report.

18.1 The Provider may update this Policy in the future.

18.2 The Provider will give reasonable notice of material changes where required or appropriate.

18.3 The Customer's silence is not automatically treated as acceptance of a change in every circumstance.

18.4 The current version and effective date are always stated in the header of this Policy.

18.5 This Policy may be made available in Czech and in English. The Czech version shall prevail.

18.6 This Policy relates to, and where applicable refers to, the Privacy Policy and the Data Processing Agreement (DPA).

18.7 Provider contact: 404branding@gmail.com.