Anti-spam policy

Permission-based sending only

You may only send to people who gave you permission to email them. In practice that means someone signed up, bought something, or otherwise asked to hear from you, and you can show when and how.

Purchased, rented, scraped, or appended lists are not allowed. Not as a one-off, not "just to test", and not if the vendor told you the list was opted in. Uploading one is grounds for immediate suspension.

Account review before you send

Every account is reviewed by a person before it can send. We ask what you are sending, to whom, and how they joined your list.

Warm-up for new senders

Once a person here has reviewed a new account, it warms up. Its first mail to addresses it has never mailed goes out in small batches, transactional mail included, and each batch has to come back clean on bounces and spam complaints before the next one goes. While an account warms up, the spam-complaint line it is held to is stricter than the usual one, and a batch that crosses a line waits for a person here instead of going out. Mail to people the account has already reached is never held by warm-up.

It exists so one careless newcomer cannot spend everyone else's delivery. A batch waiting its turn goes out by itself, and the numbers behind warm-up are in the API reference.

One-click unsubscribe on all marketing email

Every marketing message carries a working unsubscribe link and the List-Unsubscribe headers that let a mailbox provider offer one-click opt-out in its own interface. You cannot turn this off.

An unsubscribe applies across your entire workspace, not just the sequence it came from. Someone who opts out stays opted out even if a later import re-adds their address.

Genuinely transactional email, such as a password reset or a receipt, is exempt, because an unsubscribe link on a password reset is not a feature. Do not use a transactional send to deliver marketing.

Complaint and bounce thresholds

We monitor spam complaints and hard bounces per account and enforce thresholds on them. Sustained rates above what mailbox providers tolerate will get your sending paused while we work out what happened.

We hold every account to the limits the email industry publishes. Google's sender guidelines ask senders to keep spam complaints below 0.3% and recommend staying under 0.1%, and Amazon SES, which delivers every email we send, places an account under review once its bounce rate reaches 5%. Marketing sending pauses automatically when an account's complaints or bounces put those limits at risk, and we warn you before that. Rates are judged on recent sending, once there is enough of it to mean something. Transactional mail, such as password resets and receipts, is never stopped by a marketing pause, and complaints about it never pause anything. It stops for one reason only: when the transactional mail itself bounces at a level real addresses never reach, which means the addresses did not come from your own users. We email everyone on the account when that happens, and a person here restores sending.

A pause is not a punishment. A sending reputation takes months to build and days to destroy, and once it is gone it is gone for everyone sharing the infrastructure.

What you may not send

• Anything to a list you did not build yourself with consent.
• Content that misrepresents who the sender is, including forged headers or a misleading From address.
• Deceptive subject lines that do not match the message.
• Malware, phishing, or links to either, whether or not you knew.
• Anything illegal where you are, where we are, or where the recipient is.

How we enforce this

A new account can send only within its own organization until a person here has reviewed it: to team members who have confirmed their email address, and to addresses on domains it has verified.

We would rather fix a problem with you than close your account. In most cases the first step is a conversation. Where the risk to other senders is immediate, such as a purchased list or an active phishing campaign, we suspend first and talk afterwards.

Reporting abuse

If you received email through SendHeron that you did not ask for, tell us at [email protected]. Include the full message with headers if you can. We investigate every report.

See also the GDPR and data residency page for where contact data is stored and who processes it, and the terms of service.