MAILRAFT / PRODUCT

Acceptable Use Policy

This policy sets the boundaries for using MailRaft, including everything you send through MailRaft, every integration you connect and every automated action you trigger. It applies to every user, every workspace, every API key and every MCP tool invocation.

Effective date: 2026-10-09.

Prohibited content

• Unsolicited commercial email of any kind.
• Content that violates applicable law, including laws of the recipient jurisdiction.
• Content that infringes intellectual property or privacy rights of any person.
• Phishing, malware distribution, credential harvesting or any attempt to impersonate another party.
• Sexually explicit content involving minors, incitement to violence or content that promotes self-harm.
• Deceptive marketing, fraudulent financial schemes, or content designed to evade spam filters.

Prohibited audience sources

• Purchased email lists.
• Rented, harvested, scraped or otherwise non-consented lists.
• Lists built from unsolicited public contact information. A published address or business relationship alone is not permission to send marketing.
• Any list a provider or regulator has required you to stop using.

Required practices

• Marketing and bulk sending remain disabled. Before enabling subscription mail, MailRaft must provide a tested one-click HTTPS unsubscribe endpoint with List-Unsubscribe and List-Unsubscribe-Post headers, a visible opt-out link, and suppression before another marketing send. A mailto link alone is not one-click unsubscribe.
• Every outbound message must identify the sending organization and the reason the recipient is receiving the message in plain language.
• Send only mail the recipient has explicitly requested. Sender or owner approval is not recipient consent. Necessary account notices and requested individual replies are separate from subscriptions; they must not contain unsolicited promotions or be used to evade an opt-out.
• Honor stop requests immediately and do not switch senders to evade them. The restricted reply worker does not add mailing-list unsubscribe headers. Hard-bounce and complaint suppression is implemented; application-originated live feedback enforcement remains an acceptance gate before general sending.
• Keep your sender reputation good by respecting provider policies, authentication requirements and recipient preferences.

Technical boundaries

• Do not attempt to bypass tenant, scope, membership, revocation or rate-limit controls.
• Do not attempt to extract another tenant data through API misuse, injection or inferred responses.
• Do not expose MailRaft tokens or provider credentials in a browser bundle, a public repository, a chat message or a log file.
• Do not use MailRaft to proxy traffic to unapproved third-party systems.
• Do not deploy or operate crawlers, scrapers or automated agents against MailRaft without written permission.

Research and discovery

Automated contact discovery through adapters such as Apify is bounded by owner-approved actor, build, runtime and budget. Discovered contact records are research records only. Discovery never implies marketing consent. Outbound reach-outs still require full approval and must satisfy the required practices above.

Enforcement

• First breach: integration or action suspension while we investigate.
• Repeated or severe breach: suspension of the workspace and preservation of the audit trail for law-enforcement response where applicable.
• Fraud, child safety offences or evidence of coordinated abuse: immediate suspension and referral to the relevant authorities.

Reporting

• contact@mailraft.com for abuse reports
• contact@mailraft.com for security disclosures
• contact@mailraft.com for mail-delivery issues

Appeals

A suspended workspace may appeal in writing to contact@mailraft.com. The operator reviews appeals and documents the outcome; an independent review process is not yet established.