Skip to content
nomity
All policies

Anti-Spam Policy

This Anti-Spam Policy sets the rules for all email and messaging sent through the Nomity platform. It covers permission requirements, list building methods and prohibited sources.

Nomity Anti-Spam Policy

Effective date: 26 August 2026 Last updated: 04 October 2026

1. Scope

This Anti-Spam Policy governs all email and messaging sent through the Nomity platform. It forms part of the Acceptable Use Policy and, through it, of the Terms of Use. Breaching this policy is breaching your agreement with us.

It applies to you, to every user in your account, and to anyone who sends through your account. The operational requirements for each individual message (sender identity, footer contents, unsubscribe handling) are set out in the Email Sending Requirements.

Two channels, two rulebooks, one standard of permission. The principles here apply to every channel we make available. What they require of an individual message differs by channel, because the rules and the enforcement differ: email is governed by the Email Sending Requirements, and WhatsApp by the WhatsApp Messaging Requirements, whose rules are set by Meta and enforced automatically against your number.

2. What spam means here

Spam is any message sent to a recipient who did not give you permission to send it. Permission is specific: it is permission from that person, to you as the sending business, for the kind of message you are sending.

Three consequences follow, and they are the ones customers most often get wrong:

  • Permission given to another business does not transfer to you, including through an acquisition, a partnership, an affiliate, or a shared parent company, unless the recipient was told at the time that their details would be shared with you.

  • Permission to receive one kind of message is not permission to receive another. Someone who asked for property alerts has not consented to your newsletter.

  • Permission is per channel. Consent to email someone is not consent to message them on WhatsApp or by SMS, and holding a person's mobile number is not permission to use it. WhatsApp requires an opt-in that names WhatsApp and names your business, and the requirements are set out in WhatsApp Messaging Requirements §3.

  • A business relationship is not automatically permission. Whether it is depends on the law applying to that recipient, and the burden of showing it is yours.

Whether a message is spam is judged by the recipient's experience and by the law applying to them, not by your intent.

3. How an address may enter your list

An address may only be sent to if it was obtained in one of these ways:

  • The person subscribed themselves: through a signup form, a checkout opt-in, or a preference centre, where the consent was a deliberate act. Pre-ticked boxes, consent bundled into terms acceptance, and consent as a condition of an unrelated transaction are not valid.

  • The person gave permission offline, in a documented way (a signed form, a written enquiry, a recorded request) where they were told what they would receive and from whom.

  • The person is your customer or active enquirer, where the law applying to them permits marketing on that basis, the messages relate to what they engaged you for, and they were given the opportunity to decline at the point of collection.

Double opt-in (where the person confirms by clicking a link in a confirmation email) is the standard we recommend for every source, and we may require it for a list we have concerns about.

On WhatsApp these routes are necessary and not sufficient. A person may have entered your list by one of the routes above and still have given you no permission to message them on WhatsApp. See WhatsApp Messaging Requirements §3, which also lists what we will not accept as WhatsApp opt-in.

4. Prohibited sources

You may not send to addresses that were:

  • Purchased, rented, leased, or licensed from any source, however it is described, and whatever assurances came with it;

  • Scraped, harvested, or generated: collected from websites, directories, social media, WHOIS records, or public registries, or produced by guessing or by combining names with a domain;

  • Appended or enriched: obtained by matching a name, phone number, or company against a third-party database to derive an email address;

  • Traded, shared, or transferred from another business, including a partner or an affiliate;

  • Collected by someone else on your behalf without permission that names you.

You also may not waterfall, which means sending a list through another provider first, or across several providers, to strip out bounces, complaints, and unengaged recipients before bringing the survivors to Nomity. Sending a list elsewhere to clean it does not make it a permissioned list, and doing so to evade our controls is a serious breach.

5. Proof of permission

You must be able to produce, for any address on request, evidence of how and when permission was obtained: the source, the date, and where the consent was given electronically, the record captured at the time.

Where you import a list, you must attest to how it was collected. We may ask for evidence before activating a sending domain, before a large import, or at any time we have a concern. If you cannot produce evidence for an address, we treat it as having no permission, and we may require you to remove it, re-confirm it, or stop sending to the list it came from.

5.1 Migrating an existing list

If you are moving to Nomity from another platform, you may import your existing subscriber list once, during onboarding, and we will treat those contacts as opted in on your written attestation rather than requiring each of them to opt in again. We do this because forcing a re-confirmation on a legitimate, long-standing list destroys most of it, and that is not a fair price for changing supplier.

This is trust, not evidence. To import, an authorised person at your business must attest that every address was collected with consent, that the list has been maintained and is current, and that it contains no purchased, rented, scraped, appended or third-party addresses. We record who attested, when, and what they said.

The first send from an imported list is probationary, and the consequences are severe. If that send produces a hard bounce or complaint rate above the thresholds in section 8 (or any pattern indicating the list was not what you attested it was) we may terminate your account permanently, immediately, and without refund of any amount paid. There is no warning step for a false attestation. It is the one breach in this policy for which we will not normally accept an explanation, because the attestation was the explanation.

Validate your list before you import it. Run it through an email verification service (ZeroBounce, Kickbox, NeverBounce, Emailable or equivalent) and remove everything they flag as invalid, disposable, or a role address. These services check addresses without sending mail, and using one is the difference between discovering a problem before you migrate and discovering it in a way that ends your account. This is a recommendation, not a requirement, but if a first send fails on addresses a routine validation would have caught, we will take that into account.

Permission must be current. We do not set a fixed expiry, because legitimate contact cycles differ by sector, but an address whose permission is old, that has not been mailed in a long time, or that has never engaged is a list-quality risk you carry, and section 8 applies to it in full.

6. Prohibited and restricted content

6.1 Prohibited outright

You may not send messages promoting or relating to:

  • Pornography, sexually explicit material, escort or adult services;

  • Illegal goods or services, controlled substances, or drug paraphernalia;

  • Weapons, ammunition, explosives, or their components;

  • Malware, hacking tools, credential harvesting, or phishing of any kind;

  • Pyramid schemes, multi-level marketing, matrix schemes, chain letters, "get rich quick" and work-from-home offers;

  • Counterfeit goods, or goods and services that infringe another party's rights;

  • Payday, title, and other predatory lending; debt relief, credit repair, and advance-fee offers;

  • Deceptive or fraudulent offers of any kind, including fake prizes, fake invoices, and fake delivery notices;

  • Content that is unlawful, defamatory, or that promotes violence, terrorism, or hatred against a person or group;

  • Content that sexually exploits or endangers a child.

6.2 Allowed only with prior review

Some sectors are lawful but attract disproportionate complaint rates, and a complaint against one customer damages delivery for every customer on the platform. You must have our written approval before sending on any of the following, and we may impose conditions, volume limits, or a separate sending domain:

  • Cryptocurrency, digital assets, token offerings, and trading platforms;

  • Gambling, betting, lotteries, and competitions with a stake;

  • Nutritional supplements, weight loss, and health claims;

  • Investment, trading, and financial advice;

  • Cannabis and CBD products, where lawful;

  • Political campaigning and advocacy;

  • Lead generation and list brokerage;

  • Alcohol, tobacco, vaping, and age-restricted goods.

Approval is a judgement about deliverability risk, not about the legitimacy of your business, and we may withdraw it if the risk materialises.

7. What every message must carry

In summary. The full requirements are in the Email Sending Requirements:

  • A truthful From name and address, on a sending domain you have verified with us;

  • A subject line that accurately reflects the message, with no deception in any header;

  • A visible, working unsubscribe link, and the one-click unsubscribe header we add on your behalf;

  • The sending business's name and physical postal address;

  • Clear identification that the message is a marketing message, where the law applying to the recipient requires it.

You may not remove, obscure, disable, or work around the unsubscribe mechanism, and you may not require a recipient to log in, reply, or give any information beyond their email address in order to unsubscribe.

7.1 WhatsApp messages

WhatsApp carries none of the above. A business-initiated message must use a template Meta has approved on your account, in the category Meta assigns to it; a marketing template must carry an opt-out instruction; and your WhatsApp profile must identify your business accurately and give a support contact. The full requirements, including the 24 hour service window and the rules on automation, are in the WhatsApp Messaging Requirements.

8. Sending practices we monitor

Bounces and complaints are the two measurements that tell us most about permission. A high hard-bounce rate usually means a list was not collected the way it was described to us: bought, scraped, or generated lists are full of addresses that never existed. A high complaint rate means recipients do not recognise you.

We monitor, per account:

Measure

Threshold

What it means

Hard bounce rate

5%

Addresses that permanently do not exist. Above this, we review the list's source.

Spam complaint rate

0.1%

Recipients marking your message as spam. Above this, we review immediately.

Unsubscribe rate

No fixed figure

An abnormal rate, judged against your own history and your sector, puts an account under review.

Engagement

No fixed figure

Sustained near-zero opens and clicks indicates a list that is stale or was never permissioned.

These measures are email measures. WhatsApp has no bounce and no complaint rate: Meta scores a number on how often recipients block and report it, and answers with a lower quality rating, a reduced messaging limit, paused templates and eventually a restricted number. What we monitor on that channel, and what we do about it, is in WhatsApp Messaging Requirements §7.

These are ceilings, not targets, and they sit at or below the limits our sending provider publishes for the infrastructure we send on: Postmark requires a bounce rate below 10% and a spam complaint rate below 0.1% (Postmark Terms of Service §5). Ours are stricter. Exceeding them puts your account at risk regardless of the cause. We may act below these figures where a pattern is clear. A single send with a 40% bounce rate does not need to move an account average to tell us what happened.

Rates are measured over a rolling window, against a minimum number of recipients, so that a small send cannot trip a threshold on one or two events. The current window and minimum are available on request.

You must not attempt to manage a rate by splitting sending across accounts, tenants, sending domains, or providers.

9. Suppression is platform-wide

When an address hard bounces or issues a spam complaint anywhere on the Nomity platform, it is suppressed across the entire platform, permanently, for every customer, not only for you. Unsubscribes are honoured immediately and apply across your account.

You may not re-add, re-import, re-confirm, or otherwise attempt to send to a suppressed address, and you may not use another account, tenant, or provider to reach one. Attempting to circumvent suppression is among the most serious breaches of this policy and is grounds for immediate termination.

WhatsApp opt-outs work differently, and the obligation on you is the same. A person who opts out of your WhatsApp messages has opted out of your messages: the platform-wide email suppression list does not extend to phone numbers, because a number that asked one business to stop has said nothing about any other. You must stop messaging that person, in that category, on that channel, and you may not use another number, another account or another provider to reach them. Blocking and reporting inside WhatsApp is a recipient's own control and is enforced by Meta, not by us.

10. Enforcement

Where we find a breach we may warn you, restrict or throttle your sending, remove a list or campaign, suspend your account, or terminate it permanently and ban you from the platform, at our sole discretion, as set out in Acceptable Use Policy §6.

We will normally warn first. We will suspend immediately and without notice where the breach is serious, including sending to a purchased or scraped list, a false import attestation under section 5.1, circumventing suppression, waterfalling, phishing, or sending prohibited content, or where continued sending puts other customers' delivery at risk.

We may inspect message content, list metadata, and consent records where it is necessary to investigate a suspected breach.

10.1 Our service providers

Nomity does not send email in isolation. We build and send on infrastructure operated by Cloudflare, Google Cloud Platform, Postmark (AC PM, LLC, part of ActiveCampaign) and Resend, and we are bound by their acceptable use and anti-spam terms in everything we and our customers send.

We act on abuse flags, complaints, investigations and requests from those providers. Where a provider flags a message, a campaign, a domain, or an account (or asks us to investigate, restrict, or stop sending) we will act on it, and we will act promptly, including by suspending sending before we have completed our own investigation. We may be required to do so on short notice and without the opportunity to consult you first.

We will tell you what has happened and why as soon as we reasonably can, and you may respond under the review route in Acceptable Use Policy §6. But a provider's decision about its own network is not ours to overrule, and we will not put our ability to deliver mail for every other customer at risk in order to keep one account sending.

We also cooperate with mailbox providers, blocklist operators, feedback-loop programmes and abuse-reporting bodies on the same basis, and we will share the information necessary to investigate and resolve a report.

11. Reporting spam

If you have received an unwanted message sent through Nomity, report it to privacy@nomity.com with the message and its full headers. We acknowledge every report within 24 hours. See the Abuse Reporting Policy.

Recipients should also use the unsubscribe link in the message, which we honour immediately and independently of the sending business.

12. Changes and contact

We may update this policy. Material changes are notified to account owners by email and posted here with a revised date.