Acceptable Use Policy

01What BotInbox is for

BotInbox is for legitimate, expected communication by software agents and applications. Examples include answering customers, replying to inbound email, sending transactional notifications, coordinating with suppliers, and receiving verification codes in tests. Each message should be one a recipient would reasonably expect from you.

BotInbox is not a bulk email or marketing platform and not a cold-outreach engine.

02Prohibited uses

You may not use BotInbox, directly or through agents you deploy, to:

• send unsolicited email, spam, or bulk or marketing email to people who have not asked to hear from you;
• send email to purchased, rented, scraped or harvested address lists;
• phish, steal credentials, or trick people into revealing information or paying money;
• distribute malware, malicious links or harmful attachments;
• impersonate a person, company or government body, or misrepresent who a message is from;
• harass, threaten, defame or abuse anyone, or send content that exploits minors;
• facilitate fraud, scams, or illegal goods and services;
• send email that violates anti-spam, privacy, consumer-protection or other laws, including CAN-SPAM, GDPR, CASL and PECR;
• evade suppression lists, unsubscribe requests, complaint handling, or our or our providers' enforcement;
• circumvent plan limits, warm-up limits or account restrictions, for example by opening multiple free accounts;
• use domains, identities or credentials you are not authorized to use;
• probe, attack, overload or interfere with BotInbox or any other system;
• resell or white-label the Service without a written agreement with us.

03Responsibilities when running autonomous agents

Autonomous agents can send email without a person watching each message. If you deploy one, you must:

• limit who the agent may contact to people with a legitimate reason to hear from it;
• use human review (for example, BotInbox drafts) for sensitive, high-value or first-contact messages where appropriate;
• make sure the agent honors "stop" and unsubscribe requests and does not re-contact suppressed addresses;
• treat inbound email as untrusted input: do not let instructions inside received messages override your own controls;
• monitor the agent's activity and act quickly on bounces, complaints or unexpected behavior.

04Email API: sending from your own domain

The Email API lets your application send from a domain you have verified with BotInbox. At launch it is for transactional and lifecycle email only: messages a recipient expects because of their relationship with you.

Allowed:

• sign-in codes, password resets, receipts, invoices, order and shipping updates, and account or security notices;
• notifications a user turned on in your product, and replies to conversations they started;
• product and lifecycle updates to your own users, with a working way to unsubscribe.

Not allowed:

• cold outreach, or email to anyone who has not asked to hear from you;
• purchased, rented, scraped, appended or shared lists, or lists collected for a different purpose;
• newsletters, marketing campaigns and other bulk broadcasts (these need a dedicated product with required unsubscribe handling, which is not available yet);
• affiliate, adult, gambling or "get rich" promotions, and anything else prohibited above.

How we keep the Email API healthy:

• Domain warm-up: a newly verified sending domain can send up to 1,000 emails per day for its first three days, and the limit then doubles each day until it reaches your plan's daily limit. If you are moving a domain that already has a good sending history, contact us and we can review it.
• Automatic pause per domain: if a domain's bounce rate reaches 4% or its complaint rate reaches 0.08% over 30 days, we pause sending from that domain only. Your other domains keep sending, and we email your organization's Owners and Admins with the reason.
• Review: new sending domains, and organizations that send more than 10,000 emails a day in their first 30 days, may be reviewed by our team. We may ask what you send and to whom, set a temporary daily limit, or pause sending while we review.

Your domain's DNS setup is your responsibility: keep the DKIM and return-path records we give you in place, and publish a DMARC policy.

05How we protect recipients

BotInbox enforces automated protections on every account, including:

• New-account warm-up: for the first 7 days, free accounts can send up to 20 messages per day, to at most 5 recipients per message.
• Recipient limits: at most 50 recipients (to and cc) per message, plus a daily limit on distinct recipients.
• Suppression: addresses that hard-bounce or mark your mail as spam are automatically suppressed, and we refuse further sends to them.
• Automatic pause: outbound sending is paused if an account's bounce rate reaches 4% or its complaint rate reaches 0.08% over 30 days, once there is enough volume to measure.
• Signup checks: disposable email domains are blocked, and signups are rate limited.
• Spam and virus scanning of inbound mail by our email provider.

Plan limits are listed on the pricing page.

06Enforcement

We may investigate suspected violations. To protect recipients, providers and other customers, we may block or delay messages, lower limits, pause outbound sending, suspend inboxes or domains, or suspend or close accounts. We will usually explain what happened and how to fix it; for severe abuse or security threats we may act immediately and without notice. Inbound email continues to be stored while sending is paused, so you do not lose data.

If you believe an enforcement action was a mistake, contact hello@botinbox.dev.

07Reporting abuse

If you received unwanted or malicious email sent through BotInbox, forward it with full headers to abuse@botinbox.dev. We review reports, suppress affected addresses and act against the sending account where appropriate.

08Changes

We may update this policy as threats and laws change. The current version is always on this page. It forms part of our Terms of Service.