Acceptable Use Policy

1. Consent and how you got the address

This is the rule that matters most, and the one we act on fastest.

• You may only message a person who has given verifiable consent, or for whom another valid legal basis exists, appropriate to the type of message you are sending.
• You must be able to produce the evidence of that consent on request: where it was collected, when, and what the person agreed to receive.
• You may not use lists that were purchased, rented, leased, swapped, scraped from a website, harvested from a directory, generated by guessing addresses, or obtained from any third party who cannot show consent for you specifically.
• Consent given to one business does not transfer to another. Acquiring a company does not automatically transfer consent to message its list for a different brand or purpose.
• You may not send to role addresses harvested at scale, to addresses obtained from a data breach, or to any address on your own suppression list.
• For WhatsApp and other messaging channels, the platform's own opt-in rules apply on top of this, and they are stricter than email.

When you import contacts in bulk, you declare where they came from. That declaration is what you rely on if a recipient or a regulator asks — so make it accurate.

2. Unsubscribe and sender identity

• Every marketing message must offer a working, obvious way to stop receiving them, and it must work with one action — no login wall, no survey, no "reply with the word" obstacle course.
• An opt-out must be honoured immediately, across the channel it was given in. You may not re-add an unsubscribed contact through an import, an integration or a new audience.
• You may not suppress, hide, shrink, obfuscate or break the unsubscribe link, nor route it to a page that fails.
• You may not circumvent the platform's suppression list — including by splitting the same sending across accounts, organisations, projects or domains.
• The sender name, the from address and the reply-to must identify you honestly. You may not impersonate another business, another person, or a service you do not operate.
• You may not falsify headers, forge the origin of a message, or send from a domain you are not authorised to use.
• A message must not disguise its commercial nature, and the subject line must not misrepresent the content.

3. Prohibited content and activity

You may not use Publiq to send, host, promote or facilitate:

Unlawful and harmful

• Anything unlawful under Brazilian law or the law applicable to you or to the recipient.
• Fraud, deception, impersonation, fake invoices, or any scheme designed to obtain money or data by misleading the recipient.
• Phishing, credential harvesting, or messages that imitate a bank, a government body, a delivery company, a platform or any service in order to extract information.
• Malware, ransomware, spyware, or links and attachments that deliver them.
• Content that sexually exploits or endangers children, in any form. This is reported to the competent authorities, not merely removed.
• Hate speech, incitement to violence, harassment, threats, or content that degrades a person or group on the basis of race, ethnicity, national origin, religion, disability, gender, sexual orientation or any other protected characteristic.
• Content that infringes copyright, trademark, trade secret or another person's rights.
• Doxxing, or the publication of another person's personal data without a lawful basis.

Deceptive commercial offers

• Financial schemes: pyramid and Ponzi structures, multi-level marketing recruitment, "get rich quick" offers, guaranteed-return investments, unlicensed securities or credit offers, and cryptocurrency promotions with promised returns.
• Credit repair, debt relief and loan offers that promise an outcome that cannot be guaranteed, or that misstate rates, fees or terms.
• Health, medical, supplement and weight-loss claims that promise a cure, a diagnosis or a result, or that are not supported by the evidence a competent authority would require.
• Gambling, betting and lottery offers where they are not lawful for the recipient.
• Adult and sexually explicit content, and services related to it.
• Prescription pharmaceuticals sold without the required authorisation, controlled substances, illegal drugs, tobacco and vaping products where restricted, weapons and ammunition.
• Counterfeit goods, stolen goods and services that facilitate their sale.

Technical abuse

• Probing, scanning, load-testing or attacking the platform or any third party through it.
• Circumventing quotas, rate limits, anti-abuse controls, CAPTCHA or a suspension, including by creating additional accounts.
• Using the service to relay traffic for an undisclosed third party, or reselling it as your own outside an agency arrangement your plan enables.
• Reverse engineering the platform, or extracting its data or models beyond what the API permits.

4. Deliverability and reputation thresholds

Bounce and complaint rates are the clearest objective signal that a list was not collected properly. We monitor them per organisation and per sending domain, and we act on them.

You must keep basic list hygiene: honour unsubscribes at once, remove hard bounces, stop sending to addresses that have not engaged over a long period, and authenticate your sending domain with SPF, DKIM and DMARC.

5. Third-party platform rules

Every connected channel carries the rules of the platform behind it, and those rules bind you directly.

• Meta: the Meta Platform Terms, the Developer Policies, and for WhatsApp the Business Messaging Policy and the Commerce Policy — including message template approval, the customer service window, and the rules on what may be sent outside it.
• TikTok: the developer terms and the messaging and advertising policies.
• Telegram: the Bot API terms.
• Google: the API Services User Data Policy for any connected Google account.
• You may not use an automation to evade a platform's messaging window, its rate limits, its template rules or its quality rating.
• You may not use the platform APIs to bulk-message people who did not initiate contact with you, where the platform requires that they did.

A platform may restrict, suspend or ban your account for its own reasons. That risk is yours, as stated in the Terms. Where a platform requires us to act against an account, we act.

6. What happens when this policy is breached

Our response is graduated, and it is chosen by the severity of the breach and the risk to other customers — not by the order of the list below.

1. Warning: we tell you what we saw and what has to change, with a deadline.
2. Limitation: we cap sending volume, pause a specific campaign, disable a channel or require re-verification of a list, while the issue is investigated.
3. Suspension: sending or the account is suspended. Data is preserved. We tell you what would restore the account, which normally means evidence of how a list was collected, a cleaned list, or a corrected message.
4. Termination: the account is closed under the Terms. Fees already paid are not refunded where termination follows a breach of this policy.

A serious breach permits immediate suspension without prior notice. That includes phishing, malware, child sexual exploitation material, a clearly purchased or scraped list, a spam complaint rate that endangers shared sending reputation, an order from a competent authority, and a demand from a third-party platform. In those cases we act first and explain afterwards, because the alternative is letting the harm continue while we correspond.

You may appeal any enforcement decision by replying to the notice we send, or by opening a support ticket. We will look again, and we will tell you the outcome and the reason. Repeated breaches, or a breach after a warning, are treated as material and normally end in termination.

Where a breach causes us loss — a blocklist listing, an IP reputation incident, a platform penalty or a regulatory fine — the indemnity in the Terms of Service applies.

7. Reporting a violation

If you received a message you did not consent to, or you saw unlawful content sent through Publiq, report it. The Report Abuse page explains what to include and how quickly we respond, and the address is [ABUSE EMAIL].

We also welcome reports from mailbox providers, blocklist operators and platform trust-and-safety teams at the same address.

8. Contact

Questions about this policy: [LEGAL CONTACT EMAIL]. Abuse reports: [ABUSE EMAIL]. [LEGAL ENTITY NAME], [CNPJ], [REGISTERED ADDRESS].