Anti-Spam Policy

InboundKit is an inbound email processing service: we receive emails sent to your InboundKit addresses and deliver them to your webhook endpoints as structured JSON. We also send a small set of transactional emails to registered users of our platform (the "Platform Emails") using Amazon Simple Email Service (SES).

This policy describes how we prevent abuse of our outbound email channel, handle bounces and complaints, and ensure full compliance with CAN-SPAM, CASL, and Amazon SES acceptable use policies.

1. Who We Email

We send Platform Emails only to individuals who have explicitly registered for an InboundKit account. We do not:

• Purchase, rent, or use third-party email lists.
• Harvest email addresses from websites or other sources.
• Send emails to addresses that were obtained through co-registration or list sharing.
• Add users to any mailing list without affirmative opt-in consent.

2. Transactional Emails Only

All Platform Emails are strictly transactional in nature. They are sent solely in response to actions taken by the recipient or to provide information essential to their use of the Service. These include:

• Account registration and email verification.
• Password reset and security notifications.
• Billing receipts, invoices, and payment failure alerts.
• Plan usage limit warnings and overage notifications.
• Critical service alerts (e.g. webhook delivery failures, domain configuration issues).

We do not send marketing emails, promotional campaigns, newsletters, or any bulk commercial email through our SES sending configuration. Marketing communications, if ever introduced, would require an explicit separate opt-in and would use a separate sending infrastructure.

3. Bounce Handling

We have configured Amazon SES SNS (Simple Notification Service) notifications for bounce events on all sending identities. Our systems process these notifications automatically:

• Hard bounces (permanent delivery failures such as non-existent addresses) trigger immediate, automatic suppression. The address is added to our internal suppression list and will never be emailed again.
• Soft bounces (temporary failures) are retried according to SES retry policy. Addresses that accumulate repeated soft bounces over time are also suppressed.

We monitor our bounce rate and take corrective action if it rises above Amazon SES thresholds (2% for hard bounces). Our bounce rate is routinely near zero because we email only verified registered users.

4. Complaint Handling

We have configured Amazon SES SNS notifications for complaint events (spam reports) on all sending identities. Complaint notifications are processed automatically:

• Any address that generates a spam complaint is immediately and permanently added to our suppression list and will receive no further Platform Emails.
• Complaints are reviewed by our operations team to identify and address any root-cause issues in our email sending practices.

We monitor our complaint rate and maintain it well below the Amazon SES threshold of 0.1%.

5. Suppression List

We maintain a permanent internal suppression list that includes:

• All hard-bounced addresses.
• All addresses that have submitted a spam complaint.
• All addresses where the user has unsubscribed from non-essential notifications.

No email is ever sent to an address on our suppression list, regardless of whether a new account is created using that address. Addresses are not removed from the suppression list unless the recipient explicitly contacts us and requests removal for a legitimate reason.

6. User Notification Preferences

Registered users can manage their notification preferences from the InboundKit dashboard. Users may opt out of non-critical notifications (e.g. usage summaries) at any time. Certain security and billing notifications are considered essential to the Service and cannot be disabled while an account is active.

7. Unsubscribe

All non-essential Platform Emails include a one-click unsubscribe link. Users may also unsubscribe by emailing [email protected]. Unsubscribe requests are processed within 10 business days as required by CAN-SPAM, and typically within minutes through our automated system.

8. Inbound Email Processing (Not Outbound)

InboundKit's core service — receiving emails sent to your assigned addresses and forwarding them as webhook events — does not involve InboundKit sending any email on behalf of users. We do not relay, re-send, or forward any user emails using our SES sending credentials. Inbound email goes in; webhook JSON comes out.

9. Reporting Abuse

If you believe you have received unsolicited email from an InboundKit address, or if you have questions about this policy, please contact us at [email protected]. We take abuse reports seriously and investigate all complaints promptly.

10. Policy Updates

We may update this Anti-Spam Policy as our practices evolve. The "last updated" date at the top of this page reflects when changes were most recently made. Continued use of the Service after updates constitutes acceptance of the revised policy.