Acceptable Use Policy

This Acceptable Use Policy (the "AUP") is part of the Zym Labs Terms of Service at https://zymlabs.com/legal/terms (the "Terms") and applies to everyone who uses the Service. Capitalized terms not defined here have the meanings given in the Terms. You are responsible for compliance with this AUP by your Account Users and by anyone who uses the Service through your account.

The Service exists to help businesses communicate with, and understand, people who have chosen to hear from them. This AUP describes conduct and content that are not permitted. The lists below are illustrative, not exhaustive.

Some rules in this AUP apply only to messages sent through delivery channels that we provide and whose sending reputation is shared among our customers ("Shared Infrastructure"). If you connect your own email service provider, SMS provider, or other delivery channel ("Customer Infrastructure"), those rules do not apply to messages sent through it, but you remain responsible for complying with the law, your provider's terms, and the rest of this AUP.

These rules apply when you use the Service to send email, SMS, push, in-app, or any other message.

2.1 Permission. You may message only people who have given you permission to contact them, or with whom you have an existing relationship that makes the message expected and lawful. Permission is specific to your brand and to the type of message the person agreed to receive. It does not transfer to other brands, products, or companies, and a person who signed up for one kind of message, such as receipts, has not agreed to another, such as promotions.

2.2 Prohibited recipient sources. You may not use the Service to contact anyone whose information was:

• purchased, rented, or borrowed from a third party, regardless of any opt-in the third party claims to hold;
• harvested or scraped from websites, apps, directories, or social networks;
• obtained from a partner, co-registration, or sweepstakes form that did not clearly name you as a sender; or
• inactive, meaning the person has not opened, clicked, replied to, or otherwise engaged with you for an extended period, such as two years, unless you first re-confirm their permission.

2.3 Sender identity and content. Every message must accurately identify you as the sender and must not use deceptive subject lines, headers, sender names, or links. Promotional messages must include a working unsubscribe mechanism and the physical address or other disclosures required by applicable law. Messages must not contain links or promotions unrelated to the brand the recipient agreed to hear from.

2.4 Opt-outs. You must honor every unsubscribe, STOP, or other opt-out request as required by Section 5.2 of the Terms. You must not require a login, fee, or additional information to process an opt-out, must not re-subscribe anyone without new permission, and must keep suppression lists synchronized across every system you use to contact the same people.

2.5 SMS and other carrier-delivered messages. In addition to the rules above, for SMS, MMS, and similar messages you must:

• obtain express written consent before the first message, with disclosure that the person is agreeing to receive recurring automated messages from you, that consent is not a condition of purchase, and that message and data rates may apply;
• include opt-out instructions such as "Reply STOP to unsubscribe" in the first message and periodically thereafter, and process STOP and the other standard opt-out keywords;
• send one confirmation message after an opt-out and nothing further until the person consents again;
• send only during the hours permitted by the law of the recipient's location;
• complete any sender registration that carriers or regulators require, such as 10DLC campaign registration, with accurate information;
• publish a privacy policy and SMS program terms that contain the disclosures carriers require, including a statement that text messaging opt-in data and consent will not be shared with third parties or affiliates for marketing, a description of the program, message frequency, "message and data rates may apply," and STOP and HELP instructions, and link to both from every opt-in form, with any consent checkbox unchecked by default; sample language is in the Documentation;
• protect verification flows, forms, and APIs that trigger messages against fraudulent or artificially inflated traffic, and not use the Service to generate or relay such traffic; and

2.6 Restricted categories on Shared Infrastructure. Mailbox providers and carriers filter or block the categories below, and the resulting complaints affect every customer who shares our infrastructure. You may not use Shared Infrastructure to send messages whose primary purpose relates to:

• affiliate marketing, meaning promotions for products or services with which you have no relationship other than an affiliate commission or link;
• multi-level, network, or referral marketing recruitment;
• get-rich-quick, work-from-home, or make-money-online offers;
• sale of social media followers, likes, or engagement;
• high-risk financial services, including debt relief, credit repair, payday or short-term high-interest loans, and third-party loan brokering;
• cryptocurrency and related products and services;
• data or list brokerage, list rental, lead generation, or the sale or transfer of contact data;
• gambling, betting, lotteries, and betting tips; or
• prescription medications, pharmaceutical products, and telehealth services.

You may send these categories through Customer Infrastructure if the content is lawful where it is received, complies with your provider's terms, and complies with the rest of this AUP. We decide whether a message falls within a restricted category.

2.7 Age- and location-restricted products. If your messages relate to alcohol, tobacco, cannabis, firearms, gambling, or adult content, you must verify that every recipient is of legal age in their location, ensure the content is lawful where it is received, and be able to show us the measures you use to do so.

2.8 Evasion. You may not take any action designed to evade spam, fraud, or abuse detection, whether ours, a carrier's, or a mailbox provider's. This includes deliberate misspellings, nonstandard characters, rotating domains or numbers to spread volume ("snowshoeing"), and content crafted to defeat filters.

2.9 Email authentication and one-click unsubscribe. If you send marketing or other bulk email through Shared Infrastructure, you must authenticate each sending domain with SPF, DKIM, and a published DMARC policy, and each marketing message must include a one-click unsubscribe header that conforms to RFC 8058 as well as a visible unsubscribe link. Unsubscribe requests received through the header must be processed within two days. These reflect the requirements of major mailbox providers for bulk senders. The Service adds the one-click unsubscribe header to marketing email sent through Shared Infrastructure; you must include the visible unsubscribe link.

You may not use the Service to store, send, or link to content that:

• is unlawful where it is sent or received, or promotes unlawful goods, services, or activity;
• is fraudulent, deceptive, or misleading, including phishing, fake invoices, impersonation, and pyramid schemes;
• infringes or misappropriates any copyright, trademark, patent, trade secret, privacy, or publicity right;
• is defamatory, harassing, threatening, or abusive, or that promotes violence or hatred against any person or group;
• sexually exploits or endangers minors, or discloses personal information about minors;
• contains malware, spyware, or any code designed to damage, interfere with, or gain unauthorized access to any system;
• offers or sells mailing lists, or prescription medication without a valid prescription or from an unlicensed pharmacy;
• contains protected health information, payment card numbers, government identification numbers, financial account credentials, or other data prohibited by Section 5.7 of the Terms; or
• promotes cannabis, CBD, alcohol, firearms, or tobacco in violation of applicable law or carrier rules.

You may not:

• use the Service to collect data about people without providing the notices and obtaining the consents that applicable law requires, including for cookies and tracking on your own properties;
• use data obtained through the Service to make decisions about a person's eligibility for credit, insurance, employment, housing, or other benefits regulated by the Fair Credit Reporting Act or similar laws;
• use the Service for emergency communications or for any purpose where failure could cause death, injury, or physical or environmental damage;
• resell, sublicense, or share the Service with third parties, or operate it on behalf of anonymous or undisclosed senders;
• exceed, circumvent, or manipulate rate limits, usage limits, or metering;
• interfere with another customer's use of the Service, or with the deliverability or reputation of our shared infrastructure;
• misrepresent your identity, affiliation, or the purpose of your account during registration or sender registration; or
• use the Service in any way that violates the Terms or applicable law.

You may not attempt to breach or test the security of the Service or any connected system without our prior written authorization. Prohibited activities include:

• accessing data or accounts that are not yours, or probing, scanning, or testing the vulnerability of any system or network;
• circumventing authentication, authorization, or other security controls;
• forging headers, sender information, or any part of a message or packet;
• introducing malicious code, or launching denial-of-service attacks or similar disruptions;
• using automated means to access the Service other than through our documented APIs and SDKs; and
• sharing credentials or API keys, or allowing them to be used by anyone other than the Account User to whom they were issued.

If you discover a vulnerability in the Service, report it to [email protected]. We appreciate good-faith reports and will not pursue action against researchers who report responsibly, avoid privacy violations and service disruption, and give us a reasonable time to fix the issue before disclosure.

These thresholds apply to messages sent through Shared Infrastructure, where your sending patterns affect other customers. We monitor the following indicators and may take action under Section 7 if they are exceeded:

• Spam complaint rate of 0.1% or more of delivered email over any 30-day period, or any rate that a mailbox provider or carrier flags as excessive.
• Hard bounce rate of 5% or more over any 30-day period, which indicates a list that was not permission-based or has not been maintained.
• Spam trap hits, blocklist listings, or carrier filtering attributable to your sending.

7.1 What we may do. If we believe you have violated this AUP, we may take any action we consider appropriate, including:

• warning you and requesting corrective action within a stated period;
• refusing, delaying, or stopping specific messages or campaigns;
• removing or disabling access to content;
• requiring you to move to Customer Infrastructure or dedicated sending infrastructure, or to authenticate additional sending domains;
• suspending a channel, sending domain, phone number, or integration;
• suspending or terminating your account under Sections 11 and 12 of the Terms; and
• reporting the conduct to law enforcement, carriers, or mailbox providers where we believe it is unlawful or harmful.

7.2 Notice. We will give you notice and an opportunity to correct the problem where practicable. Where conduct causes or threatens immediate harm to recipients, other customers, or the Service, we may act first and notify you afterward.

7.3 Monitoring and investigation. We may, but have no obligation to, monitor use of the Service for compliance with this AUP. To determine whether a violation occurred, we may review message content, complaint data, bounce patterns, list acquisition records, consent records you are required to keep under the Terms, and signals from carriers and mailbox providers. You agree to cooperate with our investigation and to respond to our requests promptly.

7.4 No waiver. Our decision not to act on a violation does not waive our right to act on that or any later violation.

If you receive an unwanted message sent through the Service, or believe a customer is violating this AUP, report it to [email protected]. For email, forward the complete message including headers. Mailbox providers, carriers, and blocklist operators may use the same address. We review reports and act on substantiated violations.

Copyright complaints should follow Section 8.4 of the Terms. Security vulnerabilities should go to [email protected].

We may update this AUP as laws, carrier rules, and abuse patterns change. Updates take effect on posting at https://zymlabs.com/legal/aup, except that a change that materially restricts your permitted use will be handled as described in Section 17 of the Terms.