Skip to content
nomity
All policies

Acceptable Use Policy

Acceptable Use Policy for the Nomity platform covering websites, hosting, content management, commerce, CRM, messaging, AI features and email sending.

Effective date: 26 August 2026 Last updated: 04 October 2026

1. Scope

This Acceptable Use Policy ("AUP") governs use of the Nomity platform and every service delivered through it. Websites and hosting, content management, commerce, CRM, messaging, AI features, and email sending.

It applies to you as our customer, to every user you invite into your account, and to anyone you allow to use the platform through you. It forms part of, and is incorporated into, the Terms of Use. Capitalised terms not defined here have the meaning given in the Terms of Use.

You are responsible for all activity in your account, including the activity of your users and of anyone using your credentials. If they breach this AUP, you have breached it.

Nomity entities. The Nomity group comprises Nomity OÜ, Hobujaama 4, Kesklinna linnaosa, Tallinn 10151, Estonia, and Nomity (Pty) Ltd, 1A Link Road, Howick 3290, South Africa. Your contracting entity is identified in your Terms of Use.

2. Your data and your recipients

You are the controller of the personal data you load into the platform, including your contacts and recipient lists. Nomity is your processor. Our respective obligations, and the sub-processors we use, are set out in the Terms of Use and described in the Privacy Policy.

You must have a lawful basis for the personal data you process on the platform, and you must be able to produce evidence of it on request. Where you send marketing email, that basis is consent, and the requirements are set out in section 4.

3. Prohibited use

You may not use the platform, or permit it to be used, to:

Break the law. Do anything unlawful under the law applying to you, to us, or to the people your content reaches, including any breach of GDPR, UK GDPR, POPIA, or an equivalent data protection law.

Publish prohibited content. Store, host, publish or transmit content that is unlawful; that infringes another person's intellectual property, privacy or publicity rights; that sexually exploits or endangers a child; that promotes or incites violence, terrorism, or hatred against a person or group; that is defamatory; or that is fraudulent or deliberately deceptive.

Deceive people. Impersonate any person, business or entity; misrepresent your affiliation with one; forge or falsify headers, sender identity, or message origin; or operate a phishing, pretexting or credential-harvesting site or message.

Distribute malicious code. Upload, host, link to or transmit malware, ransomware, spyware, exploits, or any code intended to damage, disable or gain unauthorised access to a system.

Attack or abuse the platform. Attempt to gain unauthorised access to the platform, to another customer's account, or to any account, system or network reachable from it; probe, scan or test our security without our prior written permission; interfere with or overload the service or its infrastructure; circumvent rate limits, quotas, authentication, billing, or any technical control; or reverse engineer, scrape or resell the platform except as your agreement expressly permits.

Misuse the AI features. Use Nomity's AI features to generate spam, deceptive or misleading content, or content prohibited by this section; to build, enrich or infer recipient lists from sources you do not have consent to use; or to circumvent the consent requirements in section 4.

Abuse third-party services. Breach the acceptable use terms of a provider we build on, including Cloudflare, Postmark and Meta, or of any account you connect to the platform.

4. Email, messaging and anti-spam

Email is where breaches do the most damage: to your recipients, to other Nomity customers, and to our ability to deliver anyone's mail. It is governed in detail by the Anti-Spam Policy and the Email Sending Requirements, both of which form part of this AUP. In summary, and without limiting those documents:

  • Send only to people who have given you consent. Purchased, rented, scraped, harvested, appended and third-party lists are prohibited outright, whatever their stated provenance.

  • Keep the evidence. You must be able to show, for any address, how and when consent was obtained.

  • Identify yourself accurately. A truthful From name, on a sending domain you have verified with us, and a subject line that reflects the message.

  • Carry a working unsubscribe and a physical postal address in every marketing message. Opt-outs are honoured immediately and platform-wide; you may not send to an address after it opts out, and you may not remove, obscure or defeat the unsubscribe mechanism.

  • Do not send to role addresses such as postmaster@, abuse@, webmaster@, or to addresses obtained from a bounce, complaint or suppression record.

  • Bounce, complaint and suppression handling is ours, and is not optional. A hard bounce or spam complaint against an address suppresses that address across the entire Nomity platform, permanently, for every customer. You may not attempt to re-add, re-import or otherwise circumvent a suppression.

4.1 WhatsApp

The same principles apply to WhatsApp, and the channel adds rules we do not set. Messaging from a WhatsApp Business account connected to Nomity is governed in detail by the WhatsApp Messaging Requirements, which forms part of this AUP. In summary, and without limiting that document:

  • Opt-in must name WhatsApp and name your business. Consent to email you is not consent to message on WhatsApp, and holding someone's mobile number is not permission to use it. A website enquiry form that does not say both things is not opt-in.

  • Meta's rules bind you directly, including the WhatsApp Business Messaging Policy, the WhatsApp Business Terms of Service you accept when you connect your account, and the Commerce Policy. Where they conflict with ours, Meta's prevail.

  • Business-initiated messages need a template Meta approved, in the category Meta assigned. Meta may reject, recategorise, pause or disable a template, and may restrict your number. That is Meta's decision and we cannot overrule it.

  • Honour every stop request, however it arrives, and never use another number or account to reach someone who opted out or blocked you.

  • Automation must reach a person. Nomity's WhatsApp assistant is a scoped business tool rather than a general-purpose assistant, because Meta prohibits general-purpose assistants on the platform, and every automated conversation must have a prompt route to a human being you staff.

The same principles apply to any other messaging channel we make available, including SMS, together with that channel's own provider rules.

5. Reporting abuse

Report suspected abuse to privacy@nomity.com. Include the message, URL or account concerned, with full headers where the report relates to email.

We acknowledge every report within 24 hours and investigate promptly. Full detail on what to report and what happens next is in the Abuse Reporting Policy.

6. How we enforce this policy

We monitor for abuse, and we investigate reports and unusual sending patterns. We may inspect content and message data where it is necessary to investigate a suspected breach, in accordance with the Privacy Policy.

Where we find a breach we may, at our sole discretion and in any order:

  1. Warn you and require the breach to be remedied within a stated period;

  2. Throttle or restrict sending, publishing or other functions on your account;

  3. Remove or disable the content, message, campaign, list or domain concerned;

  4. Suspend your account or a service within it; or

  5. Terminate your account permanently and ban you from the platform.

Which step we take depends on the seriousness of the breach, the harm caused or risked, and whether it is repeated. We will normally warn first, and we work with customers to put things right. But we may suspend or terminate immediately and without prior notice where the breach is serious, including spam, phishing, malware, content that is unlawful or endangers a child, an attack on the platform, or conduct that puts our sending reputation or other customers' service at risk. We may also act immediately where we are required to by law, or by one of the service providers our platform depends on, including Cloudflare, Google Cloud Platform, Postmark, Resend and Meta, whose acceptable use terms bind everything sent through Nomity. Where one of them flags an account, domain or message, or asks us to investigate or stop sending, we act on it promptly, and may suspend before completing our own investigation.

We may notify the relevant authority or affected party where a breach requires it. Suspension or termination under this policy does not entitle you to a refund, and does not relieve you of amounts already due.

If you believe we have acted in error, email privacy@nomity.com and we will review the decision.

7. Changes

We may update this policy. Material changes will be notified to account owners by email and posted here with a revised "last updated" date. Continued use of the platform after a change takes effect is acceptance of it.

8. Contact