Acceptable use policy

DRAFT — not legal advice. Requires review by a qualified lawyer before use.

• Document: Acceptable Use Policy for the outreach platform, part of the Terms of Service · Language: English · Version: 0.1 draft · Date: 2026-10-26
• Basis: docs/research/06-legal-compliance.md R4, F3–F7, T2; docs/decisions/ADR-006-sending-model.md D2, D3 (status “proposed”); brief §7. All placeholders were closed on 2026-10-27 (F1-64); sentences marked † still await lawyer confirmation. Numeric thresholds are proposed defaults from ADR-006 and are configuration, not legal limits.
• This policy does not ban purchased or third-party lists as such. It requires a source document for every list and bans unlawful ones.

1. Purpose and scope

1.1 This policy protects Recipients, our customers’ sender reputation and the platform. It applies to every workspace, user, campaign, list and mailbox connected to the Service.

1.2 It supplements the Terms of Service. A breach can lead to limits, suspension or termination under section 10.

2. Your responsibility for lawful outreach

2.1 You decide who you contact and why. You must comply with the law that applies to the sender and to each Recipient, including email-marketing, data protection and, for Türkiye, commercial-message rules.

2.2 The Service’s country rules and controls help you but do not replace your own legal assessment (see the Terms, section 4). Rules in the Service are drafts until reviewed by a lawyer.

3. Lawful basis and country rules

3.1 Set the country and recipient type. For every list or contact you must give, or accept the Service’s resolved, country and recipient type (corporate generic address, named employee, sole trader, other professional). Where the country or type is unknown, the Service applies the strictest rule and blocks cold sending until you set it.

3.2 Consent-required recipients. Do not send cold email to recipients in jurisdictions or categories where prior consent is required unless you hold a valid consent record that you can produce. In the product’s current rule set these include recipients in Germany, Austria, Italy, Denmark, Spain, Poland and the Netherlands (also for business addresses), non-tacir professionals in Türkiye, and Canadian recipients without a documented implied-consent path. The Service’s country table is the reference and is subject to change.

3.3 Türkiye. For commercial email to tacir/esnaf without consent, the recipient addresses must be registered in İYS and refusals checked before sending, and you must confirm this in the Service. This applies to foreign senders mailing Turkish recipients too.

3.4 No consent-request emails. Do not send a “may we email you?” message to a recipient from whom consent is required before sending, where the law forbids it (for example in Türkiye) or where such a message may not itself be promotional (Italy).

3.5 Notices. Include the information notice the law requires of you as controller, in the first email where required, including the source of the data. Use the Service’s notice block as a starting point; its sufficiency is your responsibility.

4. Lead sources and source documentation

4.1 Source document. For each list or lead source you must record where the data came from, when, by what method and on what basis you may use it. The Service stores source, provider, timestamp and method for every record.

4.2 Purchased and third-party lists are allowed only if the vendor’s terms permit your use, you can show the data was lawfully obtained, and the country rules in section 3 are met. Lists without a documented provenance may not be used.

4.3 Prohibited collection through the platform: scraping or extracting data from LinkedIn (including by browser extension, headless or logged-in automation, or fake accounts) and from Google Maps website pages. These methods are marked high-risk (riskli) and are not offered. Data a user types in by hand after viewing a profile personally is classed as sensitive (tos_sensitive) and is subject to lawyer review; you remain responsible for the notice duties.

4.4 Provider terms. Use lead and data providers only through your own account and within their terms. You may not use the Service to redistribute a provider’s data to others.

4.5 Named employees from websites. Collecting named business email addresses from public sources is sensitive: publication of an address for professional contact is not, in itself, a basis for marketing use (KVKK Board 2022/861). Record the basis and give the notice in your first email.

5. Prohibited content and conduct

5.1 You must not use the Service to send or support:

• (a) phishing, fraud, impersonation, malware or deceptive offers;
• (b) messages with forged, misleading or concealed header, routing or sender information, or a misleading subject line;
• (c) messages that hide the sender’s identity or the commercial nature of the message where the law requires it to be shown;
• (d) address harvesting or dictionary-style address guessing;
• (e) messages to recipients who have opted out or are on the suppression list, or any attempt to remove, bypass or reset suppression;
• (f) content that is unlawful where it is sent or received†;
• (g) use of another person’s mailbox or domain without authorisation;
• (h) any attempt to evade sending limits, health controls, blocklist checks or monitoring.

5.2 We scan content for phishing and fraud patterns and may block, hold or review a message or campaign.

6. Mandatory message elements

6.1 Every message must carry, as set by the country rule for the sender and Recipient: your legal name, a working contact channel, a valid physical postal address where required (United States and Canada), the identification fields required in Türkiye for tacir/esnaf senders, and, in Canada, the name of the party on whose behalf the message is sent. The Service builds the footer from these rules; you must keep your sender details accurate.

6.2 Every message must carry a visible working unsubscribe link and the List-Unsubscribe and one-click headers. The unsubscribe link must keep working for at least 60 days after sending.

6.3 Where the Turkish commercial nature is not obvious, the subject must carry a label such as “tanıtım”, “kampanya” or “bilgilendirme”.

7. Unsubscribe and complaint handling

7.1 An unsubscribe or objection is applied immediately and in any case within 48 hours (ADR-006 D2). It suppresses the contact across all of your campaigns at once. Legal deadlines are longer (three business days in Türkiye; ten business days under CAN-SPAM and CASL); we apply the stricter, shorter platform default.

7.2 Replies that ask you to stop are unsubscribes. Handle them as such even if they arrive in free text.

7.3 You must not email a suppressed contact again from any campaign, mailbox or list. You may not ask a Recipient to withdraw an opt-out.

7.4 You respond to Recipient complaints and data subject requests addressed to you. We can help as processor.

8. Sending limits and health thresholds

8.1 Daily limits. The effective daily limit is the lowest of your plan limit, your own setting, the platform default (30 per mailbox per day) with a cold-sequence ceiling of 50, the mailbox ramp-up stage, and the provider cap, multiplied by the mailbox health factor. Overrides above 50 need an audited override. New mailboxes ramp up gradually, and new workspaces may carry additional graduated limits.

8.2 Proposed default thresholds (configurable; measured over a window of at least 100 sends):

8.3 Major mailbox providers apply their own bulk-sender rules (authentication with SPF, DKIM and DMARC, a spam rate under 0.3% and one-click unsubscribe for senders above 5,000 messages a day). Staying inside our thresholds does not guarantee delivery. A campaign cannot start until SPF, DKIM and DMARC pass and are aligned for its sending domain.

8.4 Open tracking is off by default. Click tracking is available only with your own verified tracking domain and is disclosed in your notices. Open rates are not used as a health signal.

9. Monitoring, investigation and abuse detection

9.1 We monitor bounce, complaint and unsubscribe rates, content patterns and account behaviour per workspace. Platform administrators see workspace roll-ups, not contact or message content.

9.2 When we investigate, we may ask for source documents and consent or İYS evidence. We may read content only in a logged, time-limited support session started under the Terms. Access without your consent happens only for abuse or legal reasons and is notified to you afterwards (Terms of Service, section 11.3).

9.3 We may share information with mailbox providers, regulators or law enforcement where the law requires.

10. Suspension and termination

10.1 Automatic actions. If a threshold in section 8 is reached, the Service pauses the affected campaign, mailbox or workspace. A 5.7.x policy rejection by a receiving server pauses the mailbox, not the Recipient.

10.2 Manual actions. We may limit, suspend or terminate a workspace for: repeated or serious breaches; use of a prohibited source or method; sending to suppressed or consent-required recipients without a basis; failure to provide a source document on request; or legal order.

10.3 Process. We tell you the reason where we reasonably can, the steps to restore access, and how to appeal. To appeal, write to support@gondero.com; we review the suspension and answer in writing.†

10.4 Fees are not refunded for suspensions caused by a breach, except where mandatory law requires a refund.†

11. Reporting abuse

11.1 To report abuse or send an opt-out request about a message sent through the Service, write to hello@gondero.com. We forward data subject requests to the responsible customer and act on abuse reports.

12. Changes to this policy

12.1 We may update this policy and will give reasonable advance notice of material changes. Threshold values are configuration and may change with notice in the Service.

13. Contact

13.1 Faruk Sancak TiklaWeb Bilişim Hizmetleri (sole proprietorship), Atatürk Mahallesi Dilek Sokak No: 12 İç Kapı No: 5, Küçükçekmece / İstanbul, hello@gondero.com.

14. Notes for the reviewing lawyer

• The “no purchased list ban” stance (source document instead) follows the product brief; confirm it is defensible in DE, AT, IT, DK, ES, PL, NL, TR and CA, where consent is needed (06 T1, L1).
• Thresholds and daily limits are ADR-006 proposals (status “proposed”), not legal figures. The 5,000 per day, 0.3% and one-click statements about mailbox providers come from the deliverability research (05) as relayed in the project notes and must be re-checked before publication.
• Confirm the scraping prohibition and the manual LinkedIn exception against LinkedIn’s and Google’s terms as read in 06 F7.
• Section 3.4: confirm the scope of the Turkish ban on consent-request emails (Reg. art.7/4) and the Italian rule.
• Confirm that the suspension and automatic-pause design is compatible with the Terms and mandatory law.
• Filled 2026-10-27 (F1-89) from content-input/company.md: name, tax office and number, address and e-mail addresses. It is a sole proprietorship, so there is no MERSIS number; the tradesperson or trader status is for the accountant to confirm. The mailboxes hello@, support@, privacy@, billing@ and security@gondero.com are open. legal@, abuse@, postmaster@, dmarc@ and no-reply@ do not exist yet, so hello@gondero.com is used for legal notices and abuse reports until they do. Statements in the header that the company country is unknown are superseded (Türkiye); the options were decided on 2026-10-27. All placeholders were closed on 2026-10-27 (F1-64); the status table is in README.md.
• † Clauses awaiting lawyer confirmation: 5.1(f), 10.3, 10.4.