Acceptable Use Policy

1. Purpose and scope

This Acceptable Use Policy applies to every RouteKite account, workspace, domain, Sending Address, contact, list, template, campaign, transactional message, API request, attachment, asset, webhook, integration, and recipient preference flow. A Customer is responsible for its Users, vendors, applications, and anyone acting through its credentials or workspace.

You must use RouteKite lawfully, honestly, securely, and in a way that respects recipients and does not interfere with the Service, other customers, providers, or third parties.

2. Permission-based email requirements

You may send through RouteKite only when you can demonstrate a lawful and appropriate basis. You must not:

• send unsolicited bulk or commercial email, commonly called spam;
• use purchased, rented, harvested, appended, scraped, guessed, or automatically generated recipient lists;
• send to a recipient after an applicable unsubscribe, consent withdrawal, complaint, or suppression;
• use misleading, forged, incomplete, or inaccurate sender, reply, domain, routing, business identity, postal, or subject information;
• hide marketing content inside a message falsely classified as transactional or service-critical;
• remove, conceal, break, or bypass required unsubscribe, preference, business-identity, postal-address, suppression, or provider controls;
• send on behalf of another person, brand, or organization without documented authority; or
• continue sending when bounce, complaint, block, abuse, or provider feedback shows that the practice is unsafe or unauthorized.

You must keep appropriate permission evidence, identify the sender and message purpose accurately, monitor sending vendors, and honor applicable opt-out deadlines. RouteKite may require evidence of list source, consent, business identity, sender authority, or remediation before allowing sending to continue.

3. Prohibited content and activity

You must not use RouteKite to create, store, facilitate, promote, or send:

• phishing, credential theft, malware, ransomware, spyware, malicious code, or harmful attachments;
• fraud, scams, deceptive offers, impersonation, counterfeit goods, or manipulation intended to obtain money, credentials, or sensitive information;
• content or conduct that is unlawful, defamatory, threatening, harassing, exploitative, or that unlawfully discriminates against or endangers a person;
• child sexual abuse material, sexual exploitation, non-consensual intimate material, or content that sexualizes or exploits minors;
• material that infringes or misappropriates copyright, trademark, privacy, publicity, confidentiality, or other rights;
• instructions or services intended to evade sanctions, export restrictions, court orders, provider rules, law enforcement, or RouteKite safeguards;
• unlawful weapons, controlled-substance, gambling, financial, medical, political, or other regulated activity without all required authority, notices, and safeguards; or
• content likely to cause material harm to RouteKite's sending reputation, providers, infrastructure, customers, or recipients.

A lawful industry or topic is not automatically prohibited, but high-risk or regulated use may require additional review and may be unavailable when RouteKite or its providers cannot support it safely.

4. Security and platform abuse

You must not:

• access or attempt to access another account, workspace, tenant, message, file, API key, secret, system, or data without authorization;
• probe, scan, exploit, or test RouteKite, a provider, or another customer without prior written authorization that clearly defines the scope;
• introduce malicious code, automate credential attacks, bypass authentication or multi-factor authentication, or interfere with audit records;
• reverse engineer, scrape, crawl, copy, or extract the Service except through documented interfaces and permissions;
• share credentials, expose API keys or webhook secrets, or knowingly allow a compromised credential to remain active;
• forge callbacks, webhooks, delivery events, signatures, identity tokens, unsubscribe activity, billing events, or provider evidence; or
• use RouteKite to attack, monitor, profile, or track a person unlawfully.

Good-faith security research still requires written authorization before testing RouteKite. A public interface, API route, or account does not create permission to test beyond normal use.

5. Infrastructure and service protection

You must not:

• circumvent a rate limit, quota, plan, suppression, sending pause, access restriction, billing control, or enforcement action;
• create duplicate accounts, workspaces, domains, keys, or traffic patterns to evade a limit or conceal coordinated activity;
• send traffic that is intentionally malformed, excessive, deceptive, or designed to exhaust RouteKite or provider resources;
• cause unreasonable bounce, complaint, unsubscribe, block, retry, webhook-failure, or abuse rates;
• resell or provide RouteKite as an unauthorized sending relay, credential service, or subprocessor; or
• interfere with another customer's use, system availability, delivery reputation, or provider relationship.

Respect documented size, recipient, attachment, concurrency, idempotency, webhook, and API limits. Contact us before a material traffic increase so we can evaluate operational and provider impact.

6. Customer compliance and control duties

A Customer must:

• know who is using its workspace and assign the least privilege reasonably needed;
• verify domains and Sending Addresses honestly and remove access when authority ends;
• secure accounts, keys, secrets, integrations, devices, and exported data;
• review Customer Data and sending workflows for applicable communications, privacy, consumer-protection, intellectual-property, sanctions, and industry rules;
• maintain accurate business identity, physical postal address, recipient notices, and permission evidence;
• investigate recipient complaints and promptly stop harmful or unauthorized activity;
• keep a working method for recipients and RouteKite to contact the sender; and
• cooperate with reasonable abuse, security, compliance, billing, or provider investigations.

7. Monitoring and enforcement

Core Infinite LLC may use automated and manual signals to protect RouteKite, including rate, authentication, delivery, bounce, complaint, unsubscribe, suppression, webhook, billing, provider, and security information. We do not promise to pre-screen every message or file.

When we reasonably suspect a violation, we may:

• request information, proof of permission, sender authority, or a remediation plan;
• delay, reject, suppress, quarantine, or stop a message or campaign;
• reduce limits or disable a domain, Sending Address, API key, webhook, integration, User, or workspace;
• preserve relevant evidence and cooperate with providers, recipients, rights holders, or lawful authorities;
• require corrective action before restoring service; or
• suspend or terminate access under the Terms of Service.

Urgent risk may require immediate action without advance notice. Where reasonably practicable, we will provide a reason and an opportunity to correct or appeal the action. Evasion, retaliation, or repeated violations may result in permanent termination.

8. Reporting abuse or security concerns

Report suspected spam, phishing, fraud, harmful content, unauthorized access, or other RouteKite abuse to support@routekite.comwith the subject “RouteKite abuse report.” Include the sender, date, message identifier or headers, relevant URL, and a concise description when available. Do not send passwords, API keys, payment credentials, or unnecessary sensitive information.

9. Changes to this policy

We may update this policy to respond to product, provider, threat, legal, or operational changes. We will update the date above and provide additional notice when required by law or when a change is materially adverse. Continued use after the effective date is governed by the revised policy.