Anti-spam Policy

This policy explains the rules for sending email through SorviAI. It applies to every customer, every user in a workspace, and every message sent using our sending infrastructure or a mailbox connected to our platform.

It forms part of our Terms of Service. Breaking it is a breach of your agreement with SORVI AI LTD and can lead to the enforcement set out below. Conduct that is not about email, such as what you publish on a storefront, is covered by our Abuse Policy.

The platform sends email in three ways, and all three are relationship-based rather than promotional.

SorviAI is not a bulk email or marketing platform. It has no campaign builder, no list management and no mass-send feature, and that is deliberate. It does not, however, cap the number of recipients on a single document email or throttle how much a workspace sends, so staying within this policy is up to you. Using document sending or a connected mailbox to push out marketing to a large list is a misuse of the product and breaches this policy. If you need to run marketing campaigns, use a dedicated email marketing service built for it.

Business document emails are sent with open and click tracking switched on by default. Our email provider, SendGrid, adds a tracking pixel and rewrites the links, and records opens and clicks on its own side; SorviAI does not currently receive or store those results. Customer Portal emails (invitations, password resets and sign-in reminders) and workspace invitations are sent without tracking. Our Cookie Policy explains what this means under the law.

• Have a reason to be emailing them. Either they asked, or you have a real business relationship, as defined under Permission. For marketing to individuals, French law usually needs their consent even then, and this policy treats sole traders as individuals: see Your legal duties.
• Be honest about who you are. Real sender name, real address, real reply-to, from a domain you control.
• Make the subject line match the message. No bait, no fake replies, no fake urgency.
• Stop when asked. Immediately, permanently, and without making the person ask twice.
• Keep your own house in order. Keep addresses current, remove bounces, and do not email people whose details you obtained from someone else.

You may only send to an address where at least one of these is true.

• They are your customer or supplier. You are sending a document arising from an actual transaction: an invoice for work done, a quote they requested, a purchase order you are placing.
• They asked to hear from you. They signed up, enquired, or otherwise gave you their address for this purpose.
• They wrote to you first. You are replying to a conversation they started.
• You have an existing business relationship and the message relates to it.

These conditions are the minimum for any email. They are not enough on their own for marketing. Where a message promotes your products or services, the law of the recipient’s country decides whether you need their prior consent. In France you need it for individuals unless the existing-customer exception described under Your legal duties applies; professionals may be emailed at their work address about matters related to their job, provided they were told they could object when the address was collected and can object in every message. This policy treats sole traders as individuals. A document email that also carries a promotion, a discount offer or a request for a review is treated as marketing for this purpose.

Records

You must be able to show where an address came from and why you were entitled to use it. If we receive a complaint we may ask, and “it was in our system” is not an answer. Keep enough of a record to demonstrate consent or the relationship it rests on.

Where you rely on consent, the record has to prove it: who consented, when, how, and what they were told. The dependable way is double opt-in: the person enters their address, you send a confirmation message to it, and you log when they confirmed, from which form, and the wording they agreed to. SorviAI’s own newsletter sign-up form on our website uses double opt-in and records when, from which form and from which IP address the person confirmed; it does not yet store the wording shown. The confirmation message must only ask the person to confirm; it must not itself market anything. The GDPR requires consent to be freely given, specific, informed and unambiguous, and a pre-ticked box is not consent.

There is no “sometimes” column on this table, which is the point of it.

Every message must clearly identify who sent it. The platform enforces part of that for you: how a message is addressed depends on whether the sending address has been confirmed and whether its domain has been authenticated.

Authenticated domains

We support authenticating your whole sending domain by adding DNS records we generate for you. This publishes SPF and DKIM so that receiving mail servers can confirm the message genuinely came from you, and we check those records before the domain is treated as authenticated. If a domain’s authentication lapses after it was checked, a message that the provider refuses is resent from SorviAI’s sending address instead, addressed as the table shows for a confirmed or unconfirmed sender.

We strongly recommend authenticating your domain. Authenticated mail is far more likely to reach the inbox, and it protects your domain from being spoofed by someone else. We also recommend publishing a DMARC record.

Required in every message

• A sender name and address that accurately identify your organisation.
• A working reply-to address that a human monitors.
• Your business identity, and a valid postal address where the message is promotional in nature.
• Accurate headers throughout. Do not alter them to disguise the message’s origin or path.

Business identity in your emails

A marketing email must not disguise or conceal the identity of the sender, and must give a valid address to which the recipient can send an opt-out request (Code des postes et des communications électroniques, article L34-5). Advertising sent by email must be clearly identifiable as advertising and identify the person on whose behalf it is sent (loi n° 2004-575 du 21 juin 2004, article 20). A company registered in France must also show its SIREN number, its registration with the registre du commerce et des sociétés and the city of that registry, and its registered office, legal form and share capital on its business correspondence and commercial documents (Code de commerce, articles R123-237 and R123-238). Put these details in the signature of each sender address you use. Your registered number can also be printed on your documents through the company ID field in your organisation settings; SorviAI has no dedicated field for legal form or share capital.

Transactional documents such as an invoice or a purchase order do not need an unsubscribe link, because the recipient needs them and cannot reasonably opt out of being invoiced. That is true only while the message stays transactional: add a promotion to it and it becomes marketing.

Anything promotional is different. If a message markets your products or services, it must include a clear and working way to opt out, and you must honour it.

• The opt-out must be obvious and easy to use, needing no login, no account and no explanation from the recipient.
• You must act on it immediately and permanently. Once someone has said stop, the next marketing message to them breaches this policy, and French law. French law sets no fixed number of days for this; our rule is immediately.
• An opt-out request is valid however it arrives, including a plain reply saying “stop” or a phone call.
• You must not charge a fee, require a reason, or make someone opt out more than once. Beyond the ordinary cost of sending the request, opting out must cost the recipient nothing.
• You must keep a suppression record so the address is not re-added later by an import. SorviAI has no suppression list for the contacts in your workspace, so keep this record yourself.

Whatever the legal position, you must not use SorviAI to send:

• Anything unlawful, defamatory, harassing, discriminatory or obscene.
• Malware, ransomware, or attachments and links intended to compromise a recipient’s device.
• Phishing, or anything designed to trick a recipient into revealing credentials, card details or bank details, including messages impersonating another business, a bank, a government body or a tax authority.
• Chain letters, pyramid schemes, “get rich quick” offers or fraudulent investment promotions.
• Content that infringes someone else’s copyright or trade mark.
• Anything requiring a licence or approval you do not hold, such as a promotion for financial products or services that the law reserves to an authorised firm.

When your organisation connects a Microsoft 365 mailbox to TeamEmail, messages are sent through your own mail provider rather than our sending infrastructure. This policy still applies to them.

• Your mail provider’s own acceptable use terms apply in addition to ours, and they may act independently of us.
• Abuse from a connected mailbox risks your own domain’s reputation, which we cannot repair for you.
• If we receive credible abuse reports about mail sent through a connected mailbox, we may ask you to disconnect it, and we may suspend the workspace under Enforcement if the mail does not stop.
• A shared mailbox does not dilute responsibility. Your organisation is accountable for every message any of your users sends from it.

We do not read your business correspondence. We do keep a record of what was sent, and we act on the abuse signals that reach us, because deliverability is shared across all customers.

• Send logs. We keep a record of messages sent from your workspace: the sender name and address, the recipients including any cc and bcc, the subject, the full message body, the time, the delivery outcome and any error returned. The record is used for delivery troubleshooting, audit and abuse investigation. It is kept for the life of the workspace, as our Privacy Policy sets out; no automatic deletion runs.
• Delivery outcomes. Each message carries the outcome our sending provider returned when we handed it over, including any error. Bounces and spam complaints that mailbox providers report later do not reach us automatically yet; we act on them when they are reported to us.
• Abuse reports. We act on complaints from recipients, mailbox providers and blocklist operators.
• Rate limiting. We apply limits to domain verification, and to messages sent from a portal to a business’s support address, to contain abuse and protect the platform. Nothing caps the number of recipients or throttles the volume of document email or connected-mailbox sending.

Our aim is to fix problems, not to catch people out. Most breaches are a customer misunderstanding what the product is for, and a conversation resolves them.

• We get in touch. We tell you what we are seeing and what needs to change, and give you a reasonable chance to fix it.
• We may suspend the workspace if the problem is not resolved, as set out in our Abuse Policy, including what happens to your data during a suspension.
• We may terminate for serious or repeated breaches, in line with the Terms of Service.

For severe abuse, specifically phishing, malware or a large unsolicited send in progress, we may suspend the whole workspace immediately and contact you afterwards. We cannot pause sending on its own: suspension stops the whole workspace, sign-in included. Refunds in these circumstances are covered by our Refund Policy, which excludes refunds where an account is suspended for breach of terms.

This policy sets our rules. The law sets its own, and you are responsible for meeting it in every country you send to.

France

Article L34-5 of the Code des postes et des communications électroniques, article 20 of loi n° 2004-575 du 21 juin 2004 (the LCEN), the GDPR and the Loi Informatique et Libertés. The same rules cover email and SMS. The CNIL enforces them and can fine; the DGCCRF can also act.

• Individuals need prior consent. Marketing email and texts to individuals need their prior consent: free, specific and informed, given before the first message, never a pre-ticked box and never buried in your terms. Many small businesses are sole traders; this policy requires you to treat them as individuals, which is stricter than the law in some cases.
• The existing-customer exception is the one exception. It applies only where you obtained the address from your own customer in the context of a sale or a service; you market only your own similar products or services; and you gave them a clear and easy way to object, free of charge, both when you collected the address and in every message. An enquiry or a quote that did not lead to a sale is not enough, and it does not cover an address you bought or were given by someone else.
• Professionals at work. The CNIL accepts marketing email to a professional at their work address without prior consent where the message relates to their job, they were told when their address was collected that they could object, and every message lets them object simply and free of charge. The GDPR still applies to a named employee’s address, such as [email protected]: you need a lawful basis, must tell them how you use it, and must stop when they object.
• Sender identity. Do not disguise or conceal who is sending, use a subject line that matches the message, always give a valid address for opt-out requests, and make advertising identifiable as advertising.
• Proof. You must be able to show the consent or the relationship you rely on; see Records.

The rest of the European Union

Article 13 of the ePrivacy Directive (2002/58/EC), as each country has written it into its own law, and the GDPR. The consent rule and the existing-customer exception are the same; each country decides how to protect business addresses (article 13(5)), and some require consent for them too. Each country’s regulator enforces them.

Recipients outside the European Union

Our own marketing

We hold our own marketing to the same rule. Sign-ups through the newsletter form on our website are confirmed by double opt-in. Not every address we hold rests on recorded consent or the soft opt-in: our earlier launch “notify me” list was single opt-in, and addresses imported into the newsletter from our customer records can be marked as confirmed without a confirmation email. Until each of those people re-confirms by email, we send them no marketing. Marketing to businesses always identifies us, carries our postal address, offers an opt-out and honours it.

Where you use SorviAI to send to your own contacts, you are the data controller for those contacts and we are your processor. Our respective roles are set out in our Privacy Policy and our Data Processing Agreement.

If you received unwanted email sent through SorviAI, tell us at [email protected], in English and French. Include the full message with headers if you can, since headers are what let us identify the sending account.

We investigate every report. We acknowledge it within 2 working days and act sooner where the report involves phishing or malware.

Because we are usually the processor rather than the sender, we may pass your request to the customer who sent the message so they can act on it, and we will tell you when we have. If you asked them to stop and they did not, tell us: that is a breach of this policy and we will treat it as one.

Reporting to a regulator

In France you can also report unwanted marketing email to Signal Spam (www.signal-spam.fr), and complain to the CNIL (cnil.fr/fr/adresser-une-plainte). If you were the victim of phishing, the State’s assistance service cybermalveillance.gouv.fr explains what to do, and you can file a complaint with the police or the gendarmerie. Elsewhere in the EU, the authority that enforces the rules on electronic marketing is usually the data protection or communications regulator.

We may update this policy as sending standards and the law change. The version and effective date at the top tell you which one you are reading. This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

We will announce changes on this page and notify workspace owners by email at least 30 days in advance of material changes, except where an immediate change is needed to address abuse or meet a legal requirement. How a change takes effect in your contract is governed by the Terms of Service.

For abuse reports, or questions about whether a planned send is acceptable, use the details below. If you are not sure whether something is allowed, ask first. It is a great deal easier than unwinding a suspension.

Write in English and French; we answer in English. Our full company details are in our Mentions légales.