Anti-spam Policy

This policy explains the rules for sending email through SorviAI. It applies to every customer, every user in a workspace, and every message sent using our sending infrastructure or a mailbox connected to our platform.

It forms part of our Terms of Service. Breaking it is a breach of your agreement with SORVI AI LTD and can lead to the enforcement set out below. Conduct that is not about email, such as what you publish on a storefront, is covered by our Abuse Policy.

The platform sends email in three ways, and all three are relationship-based rather than promotional.

SorviAI is not a bulk email or marketing platform. It has no campaign builder, no list management and no mass-send feature, and that is deliberate. It does not, however, cap the number of recipients on a single document email or throttle how much a workspace sends, so staying within this policy is up to you. Using document sending or a connected mailbox to push out marketing to a large list is a misuse of the product and breaches this policy. If you need to run marketing campaigns, use a dedicated email marketing service built for it.

Business document emails are sent with open and click tracking switched on by default. Our email provider, SendGrid, adds a tracking pixel and rewrites the links, and records opens and clicks on its own side; SorviAI does not currently receive or store those results. Customer Portal emails (invitations, password resets and sign-in reminders) and workspace invitations are sent without tracking. Our Cookie Policy explains what this means under the law.

• Have a reason to be emailing them. Either they asked, or you have a real business relationship, as defined under Permission. For marketing to individuals in India, including sole proprietors and named contacts at a business, the law will need their consent from 13 May 2027, and the law in many other countries already does: see Your legal duties.
• Be honest about who you are. Real sender name, real address, real reply-to, from a domain you control.
• Make the subject line match the message. No bait, no fake replies, no fake urgency.
• Stop when asked. Immediately, permanently, and without making the person ask twice.
• Keep your own house in order. Keep addresses current, remove bounces, and do not email people whose details you obtained from someone else.

You may only send to an address where at least one of these is true.

• They are your customer or supplier. You are sending a document arising from an actual transaction: an invoice for work done, a quote they requested, a purchase order you are placing.
• They asked to hear from you. They signed up, enquired, or otherwise gave you their address for this purpose.
• They wrote to you first. You are replying to a conversation they started.
• You have an existing business relationship and the message relates to it.

These conditions are the minimum for any email. They are not enough on their own for marketing. Where a message promotes your products or services, the law of the recipient’s country decides whether you need their prior consent. In India you will need it for individuals from 13 May 2027, with no exception for existing customers, as Your legal duties explains, and other countries set their own rules. A document email that also carries a promotion, a discount offer or a request for a review is treated as marketing for this purpose.

Records

You must be able to show where an address came from and why you were entitled to use it. If we receive a complaint we may ask, and “it was in our system” is not an answer. Keep enough of a record to demonstrate consent or the relationship it rests on.

Where you rely on consent, the record has to prove it: who consented, when, how, and what they were told. The dependable way is double opt-in: the person enters their address, you send a confirmation message to it, and you log when they confirmed, from which form, and the wording they agreed to. SorviAI’s own newsletter sign-up form on our website uses double opt-in and records when, from which form and from which IP address the person confirmed; it does not yet store the wording shown. The confirmation message must only ask the person to confirm; it must not itself market anything. The Digital Personal Data Protection Act 2023 requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action (section 6(1)), and a pre-ticked box is not consent.

There is no “sometimes” column on this table, which is the point of it.

Every message must clearly identify who sent it. The platform enforces part of that for you: how a message is addressed depends on whether the sending address has been confirmed and whether its domain has been authenticated.

Authenticated domains

We support authenticating your whole sending domain by adding DNS records we generate for you. This publishes SPF and DKIM so that receiving mail servers can confirm the message genuinely came from you, and we check those records before the domain is treated as authenticated. If a domain’s authentication lapses after it was checked, a message that the provider refuses is resent from SorviAI’s sending address instead, addressed as the table shows for a confirmed or unconfirmed sender.

We strongly recommend authenticating your domain. Authenticated mail is far more likely to reach the inbox, and it protects your domain from being spoofed by someone else. We also recommend publishing a DMARC record.

Required in every message

• A sender name and address that accurately identify your organisation.
• A working reply-to address that a human monitors.
• Your business identity, and a valid postal address where the message is promotional in nature.
• Accurate headers throughout. Do not alter them to disguise the message’s origin or path.

Business identity in your emails

A marketing email must not disguise or conceal who is sending it, and must give a working way to opt out. An Indian company must show its name, registered office address, corporate identity number, telephone number, email address and website on its business letters, bill heads and notices (Companies Act 2013, section 12(3)(c)), and putting the same details in the signature of each sender address you use is the safe course. Your registered number can also be printed on your documents through the company ID field in your organisation settings. An emailed tax invoice must carry the particulars GST law requires. The law of a recipient’s own country may add more.

Transactional documents such as an invoice or a purchase order do not need an unsubscribe link, because the recipient needs them and cannot reasonably opt out of being invoiced. That is true only while the message stays transactional: add a promotion to it and it becomes marketing.

Anything promotional is different. If a message markets your products or services, it must include a clear and working way to opt out, and you must honour it.

• The opt-out must be obvious and easy to use, needing no login, no account and no explanation from the recipient.
• You must act on it immediately and permanently. Once someone has said stop, the next marketing message to them breaches this policy, and in most countries the law; from 13 May 2027, withdrawing consent in India must be as easy as giving it (DPDP Act, section 6(4)).
• An opt-out request is valid however it arrives, including a plain reply saying “stop” or a phone call.
• You must not charge a fee, require a reason, or make someone opt out more than once. Beyond the ordinary cost of sending the request, opting out must cost the recipient nothing.
• You must keep a suppression record so the address is not re-added later by an import. SorviAI has no suppression list for the contacts in your workspace, so keep this record yourself.

Whatever the legal position, you must not use SorviAI to send:

• Anything unlawful, defamatory, harassing, discriminatory or obscene.
• Malware, ransomware, or attachments and links intended to compromise a recipient’s device.
• Phishing, or anything designed to trick a recipient into revealing credentials, card details or bank details, including messages impersonating another business, a bank, a government body or a tax authority.
• Chain letters, pyramid schemes, “get rich quick” offers or fraudulent investment promotions.
• Content that infringes someone else’s copyright or trade mark.
• Anything requiring a licence or approval you do not hold, such as a financial promotion that a financial regulator requires to be made or approved by an authorised firm.
• A misleading advertisement, which the Consumer Protection Act 2019 prohibits.

When your organisation connects a Microsoft 365 mailbox to TeamEmail, messages are sent through your own mail provider rather than our sending infrastructure. This policy still applies to them.

• Your mail provider’s own acceptable use terms apply in addition to ours, and they may act independently of us.
• Abuse from a connected mailbox risks your own domain’s reputation, which we cannot repair for you.
• If we receive credible abuse reports about mail sent through a connected mailbox, we may ask you to disconnect it, and we may suspend the workspace under Enforcement if the mail does not stop.
• A shared mailbox does not dilute responsibility. Your organisation is accountable for every message any of your users sends from it.

We do not read your business correspondence. We do keep a record of what was sent, and we act on the abuse signals that reach us, because deliverability is shared across all customers.

• Send logs. We keep a record of messages sent from your workspace: the sender name and address, the recipients including any cc and bcc, the subject, the full message body, the time, the delivery outcome and any error returned. The record is used for delivery troubleshooting, audit and abuse investigation. It is kept for the life of the workspace, as our Privacy Policy sets out; no automatic deletion runs.
• Delivery outcomes. Each message carries the outcome our sending provider returned when we handed it over, including any error. Bounces and spam complaints that mailbox providers report later do not reach us automatically yet; we act on them when they are reported to us.
• Abuse reports. We act on complaints from recipients, mailbox providers and blocklist operators.
• Rate limiting. We apply limits to domain verification, and to messages sent from a portal to a business’s support address, to contain abuse and protect the platform. Nothing caps the number of recipients or throttles the volume of document email or connected-mailbox sending.

Our aim is to fix problems, not to catch people out. Most breaches are a customer misunderstanding what the product is for, and a conversation resolves them.

• We get in touch. We tell you what we are seeing and what needs to change, and give you a reasonable chance to fix it.
• We may suspend the workspace if the problem is not resolved, as set out in our Abuse Policy, including what happens to your data during a suspension.
• We may terminate for serious or repeated breaches, in line with the Terms of Service.

For severe abuse, specifically phishing, malware or a large unsolicited send in progress, we may suspend the whole workspace immediately and contact you afterwards. We cannot pause sending on its own: suspension stops the whole workspace, sign-in included. Refunds in these circumstances are covered by our Refund Policy, which excludes refunds where an account is suspended for breach of terms.

This policy sets our rules. The law sets its own, and you are responsible for meeting it in every country you send to.

India

India has no law written for email marketing in particular. What governs it is the law on personal data, and the general law on fraud and misleading claims.

• An email address is personal data. That includes a named contact’s work address, such as [email protected]. Until 13 May 2027, section 43A of the Information Technology Act 2000 and the SPDI Rules 2011 apply to personal data you hold.
• From 13 May 2027, marketing needs consent. Under the Digital Personal Data Protection Act 2023, marketing to a person in India rests on their consent: free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, after a notice telling them what you will use their data for (sections 5 and 6). Marketing is not one of the legitimate uses that need no consent (section 7), and there is no exception for existing customers. You must be able to prove the consent, and must stop when it is withdrawn.
• Children. From the same date, data of anyone under 18 needs verifiable consent from a parent or guardian, and may not be used for targeted advertising (section 9).
• Honesty. Cheating by impersonation using a computer resource is an offence under section 66D of the Information Technology Act, and the Consumer Protection Act 2019 prohibits misleading advertisements.
• SMS and calls. Commercial SMS and voice calls are governed by TRAI’s Telecom Commercial Communications Customer Preference Regulations 2018: sender and template registration, respect for recipients’ registered preferences, and consent for promotional messages. SorviAI sends no SMS, WhatsApp messages or calls. If you send them through another service, those rules apply to you.

Recipients in other countries

Our own marketing

We hold our own marketing to the same rule. Sign-ups through the newsletter form on our website are confirmed by double opt-in. Not every address we hold rests on recorded consent: our earlier launch “notify me” list was single opt-in, and addresses imported into the newsletter from our customer records can be marked as confirmed without a confirmation email. Until each of those people re-confirms by email, we send them no marketing. Marketing to businesses always identifies us, carries our postal address, offers an opt-out and honours it. We send no marketing by SMS, WhatsApp or phone.

Where you use SorviAI to send to your own contacts, you are the Data Fiduciary for those contacts and we process their data on your behalf. Our respective roles are set out in our Privacy Policy and our Data Processing Agreement.

If you received unwanted email sent through SorviAI, tell us at [email protected]. Include the full message with headers if you can, since headers are what let us identify the sending account.

Every report is a complaint to our Grievance Officer, Deepak Gupta. We acknowledge it within 24 hours, weekends included, resolve it within 7 days, and act sooner where the report involves phishing or malware.

Because we usually process the sender’s data on its behalf, we may pass your request to the customer who sent the message so they can act on it, and we will tell you when we have. If you asked them to stop and they did not, tell us: that is a breach of this policy and we will treat it as one.

If you are not satisfied, and reporting crime

• If you disagree with our decision on your complaint, you can appeal to the Grievance Appellate Committee within 30 days, at gac.gov.in.
• Report phishing and other cyber crime on the National Cyber Crime Reporting Portal, cybercrime.gov.in. If you have lost money to online financial fraud, call 1930 straight away.
• Unwanted commercial SMS and calls are dealt with by your telecom operator under TRAI’s rules, not by us.

We may update this policy as sending standards and the law change. The version and effective date at the top tell you which one you are reading. This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

We will announce changes on this page and notify workspace owners by email at least 30 days in advance of material changes, except where an immediate change is needed to address abuse or meet a legal requirement. How a change takes effect in your contract is governed by the Terms of Service.

For abuse reports, or questions about whether a planned send is acceptable, use the details below. If you are not sure whether something is allowed, ask first. It is a great deal easier than unwinding a suspension.

Our full company details are on our Legal Notice and Grievance Officer page. This policy is written in English, and we answer in English.