Anti-spam Policy

This policy explains the rules for sending email through SorviAI. It applies to every customer, every user in a workspace, and every message sent using our sending infrastructure or a mailbox connected to our platform.

It forms part of our Terms of Service. Breaking it is a breach of your agreement with SORVI AI LTD and can lead to the enforcement set out below. Conduct that is not about email, such as what you publish on a storefront, is covered by our Abuse Policy.

The platform sends email in three ways, and all three are relationship-based rather than promotional.

SorviAI is not a bulk email or marketing platform. It has no campaign builder, no list management and no mass-send feature, and that is deliberate. It does not, however, cap the number of recipients on a single document email or throttle how much a workspace sends, so staying within this policy is up to you. Using document sending or a connected mailbox to push out marketing to a large list is a misuse of the product and breaches this policy. If you need to run marketing campaigns, use a dedicated email marketing service built for it.

Business document emails are sent with open and click tracking switched on by default. Our email provider, SendGrid, adds a tracking pixel and rewrites the links, and records opens and clicks on its own side; SorviAI does not currently receive or store those results. Customer Portal emails (invitations, password resets and sign-in reminders) and workspace invitations are sent without tracking. Our Cookie Policy explains what this means under UK law.

• Have a reason to be emailing them. Either they asked, or you have a real business relationship, as defined under Permission. For marketing to individuals in the UK, including sole traders and many partnerships, the law usually needs their consent even then: see Your legal duties.
• Be honest about who you are. Real sender name, real address, real reply-to, from a domain you control.
• Make the subject line match the message. No bait, no fake replies, no fake urgency.
• Stop when asked. Immediately, permanently, and without making the person ask twice.
• Keep your own house in order. Keep addresses current, remove bounces, and do not email people whose details you obtained from someone else.

You may only send to an address where at least one of these is true.

• They are your customer or supplier. You are sending a document arising from an actual transaction: an invoice for work done, a quote they requested, a purchase order you are placing.
• They asked to hear from you. They signed up, enquired, or otherwise gave you their address for this purpose.
• They wrote to you first. You are replying to a conversation they started.
• You have an existing business relationship and the message relates to it.

These conditions are the minimum for any email. They are not enough on their own for marketing. Where a message promotes your products or services, the law of the recipient’s country decides whether you need their prior consent. In the UK you need it for individuals, and an individual includes a sole trader and, in England, Wales and Northern Ireland, a partnership that is not a limited liability partnership (a Scottish partnership is a legal person in its own right), unless the soft opt-in described under Your legal duties applies. A document email that also carries a promotion, a discount offer or a request for a review is treated as marketing for this purpose.

Records

You must be able to show where an address came from and why you were entitled to use it. If we receive a complaint we may ask, and “it was in our system” is not an answer. Keep enough of a record to demonstrate consent or the relationship it rests on.

Where you rely on consent, the record has to prove it: who consented, when, how, and what they were told. The dependable way is double opt-in: the person enters their address, you send a confirmation message to it, and you log when they confirmed, from which form, and the wording they agreed to. SorviAI’s own newsletter sign-up form on our website uses double opt-in and records when, from which form and from which IP address the person confirmed; it does not yet store the wording shown. The confirmation message must only ask the person to confirm; it must not itself market anything. UK GDPR requires consent to be specific, informed and unambiguous, and a pre-ticked box is not consent.

There is no “sometimes” column on this table, which is the point of it.

Every message must clearly identify who sent it. The platform enforces part of that for you: how a message is addressed depends on whether the sending address has been confirmed and whether its domain has been authenticated.

Authenticated domains

We support authenticating your whole sending domain by adding DNS records we generate for you. This publishes SPF and DKIM so that receiving mail servers can confirm the message genuinely came from you, and we check those records before the domain is treated as authenticated. If a domain’s authentication lapses after it was checked, a message that the provider refuses is resent from SorviAI’s sending address instead, addressed as the table shows for a confirmed or unconfirmed sender.

We strongly recommend authenticating your domain. Authenticated mail is far more likely to reach the inbox, and it protects your domain from being spoofed by someone else. We also recommend publishing a DMARC record.

Required in every message

• A sender name and address that accurately identify your organisation.
• A working reply-to address that a human monitors.
• Your business identity, and a valid postal address where the message is promotional in nature.
• Accurate headers throughout. Do not alter them to disguise the message’s origin or path.

Business identity in UK emails

A marketing email must not disguise or conceal the identity of the sender, and must give a valid address to which the recipient can send an opt-out request (PECR reg. 23). If you are a UK company or limited liability partnership, your business emails must also show your registered name, registered number, the part of the UK in which you are registered and your registered office address (the Company, Limited Liability Partnership and Business (Names and Trading Disclosures) Regulations 2015). A commercial communication must be clearly identifiable as such and identify the person on whose behalf it is sent (Electronic Commerce (EC Directive) Regulations 2002, reg. 7). Put these details in the signature of each sender address you use. Your registered number can also be printed on your documents through the company ID field in your organisation settings.

Transactional documents such as an invoice or a purchase order do not need an unsubscribe link, because the recipient needs them and cannot reasonably opt out of being invoiced. That is true only while the message stays transactional: add a promotion to it and it becomes marketing.

Anything promotional is different. If a message markets your products or services, it must include a clear and working way to opt out, and you must honour it.

• The opt-out must be obvious and easy to use, needing no login, no account and no explanation from the recipient.
• You must act on it immediately and permanently. Once someone has said stop, the next marketing message to them breaches this policy, and in the UK it breaches PECR.
• An opt-out request is valid however it arrives, including a plain reply saying “stop” or a phone call.
• You must not charge a fee, require a reason, or make someone opt out more than once. Beyond the ordinary cost of sending the request, opting out must cost the recipient nothing.
• You must keep a suppression record so the address is not re-added later by an import. SorviAI has no suppression list for the contacts in your workspace, so keep this record yourself.

Whatever the legal position, you must not use SorviAI to send:

• Anything unlawful, defamatory, harassing, discriminatory or obscene.
• Malware, ransomware, or attachments and links intended to compromise a recipient’s device.
• Phishing, or anything designed to trick a recipient into revealing credentials, card details or bank details, including messages impersonating another business, a bank, a government body or a tax authority, HMRC included.
• Chain letters, pyramid schemes, “get rich quick” offers or fraudulent investment promotions.
• Content that infringes someone else’s copyright or trade mark.
• Anything requiring a licence or approval you do not hold, such as a financial promotion that has not been made or approved by a person authorised by the Financial Conduct Authority (Financial Services and Markets Act 2000, s. 21).

When your organisation connects a Microsoft 365 mailbox to TeamEmail, messages are sent through your own mail provider rather than our sending infrastructure. This policy still applies to them.

• Your mail provider’s own acceptable use terms apply in addition to ours, and they may act independently of us.
• Abuse from a connected mailbox risks your own domain’s reputation, which we cannot repair for you.
• If we receive credible abuse reports about mail sent through a connected mailbox, we may ask you to disconnect it, and we may suspend the workspace under Enforcement if the mail does not stop.
• A shared mailbox does not dilute responsibility. Your organisation is accountable for every message any of your users sends from it.

We do not read your business correspondence. We do keep a record of what was sent, and we act on the abuse signals that reach us, because deliverability is shared across all customers.

• Send logs. We keep a record of messages sent from your workspace: the sender name and address, the recipients including any cc and bcc, the subject, the full message body, the time, the delivery outcome and any error returned. The record is used for delivery troubleshooting, audit and abuse investigation. It is kept for the life of the workspace, as our Privacy Policy sets out; no automatic deletion runs.
• Delivery outcomes. Each message carries the outcome our sending provider returned when we handed it over, including any error. Bounces and spam complaints that mailbox providers report later do not reach us automatically yet; we act on them when they are reported to us.
• Abuse reports. We act on complaints from recipients, mailbox providers and blocklist operators.
• Rate limiting. We apply limits to domain verification, and to messages sent from a portal to a business’s support address, to contain abuse and protect the platform. Nothing caps the number of recipients or throttles the volume of document email or connected-mailbox sending.

Our aim is to fix problems, not to catch people out. Most breaches are a customer misunderstanding what the product is for, and a conversation resolves them.

• We get in touch. We tell you what we are seeing and what needs to change, and give you a reasonable chance to fix it.
• We may suspend the workspace if the problem is not resolved, as set out in our Abuse Policy, including what happens to your data during a suspension.
• We may terminate for serious or repeated breaches, in line with the Terms of Service.

For severe abuse, specifically phishing, malware or a large unsolicited send in progress, we may suspend the whole workspace immediately and contact you afterwards. We cannot pause sending on its own: suspension stops the whole workspace, sign-in included. Refunds in these circumstances are covered by our Refund Policy, which excludes refunds where an account is suspended for breach of terms.

This policy sets our rules. The law sets its own, and you are responsible for meeting it in every country you send to.

United Kingdom

The Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025, and UK GDPR. The Information Commission (the ICO) enforces them.

• Individuals need prior consent (PECR reg. 22). Marketing email and texts to individual subscribers need their prior consent, and individual subscribers include sole traders and, in England, Wales and Northern Ireland, partnerships other than limited liability partnerships. Many small UK businesses are sole traders: treat them as individuals.
• The soft opt-in (reg. 22(3)) is the one exception. It applies only where you obtained the address from the person in the course of a sale or negotiations for a sale of a product or service to them; you market only your own similar products or services; and you gave them a simple way to refuse, free of charge except for the cost of sending the refusal, both when you collected the address and in every message. It does not cover an address you bought or were given by someone else.
• Corporate subscribers (companies, limited liability partnerships, Scottish partnerships, public bodies and other corporate bodies) may be sent marketing email without prior consent, but you must identify yourself, give a valid address for opting out, and honour objections. UK GDPR still applies to a named employee’s address, such as [email protected]: you need a lawful basis, must tell them how you use it, and must stop when they object to direct marketing.
• Sender identity (reg. 23). Do not disguise or conceal who is sending, and always give a valid address for opt-out requests.
• Penalties. Since the Data (Use and Access) Act 2025, the ICO can fine for PECR breaches up to the UK GDPR maximum: £17.5 million or 4% of worldwide annual turnover, whichever is higher.

Elsewhere

Our own marketing

We hold our own marketing to the same rule. Sign-ups through the newsletter form on our website are confirmed by double opt-in. Not every address we hold rests on recorded consent or the soft opt-in: our earlier launch “notify me” list was single opt-in, and addresses imported into the newsletter from our customer records can be marked as confirmed without a confirmation email. Until each of those people re-confirms by email, we send them no marketing. Marketing to UK companies always identifies us, offers an opt-out and honours it.

Where you use SorviAI to send to your own contacts, you are the data controller for those contacts and we are your processor. Our respective roles are set out in our Privacy Policy and our Data Processing Agreement.

If you received unwanted email sent through SorviAI, tell us at [email protected]. Include the full message with headers if you can, since headers are what let us identify the sending account.

We investigate every report. We acknowledge it within 2 working days and act sooner where the report involves phishing or malware.

Because we are usually the processor rather than the sender, we may pass your request to the customer who sent the message so they can act on it, and we will tell you when we have. If you asked them to stop and they did not, tell us: that is a breach of this policy and we will treat it as one.

For recipients in the United Kingdom

You can also report unwanted marketing email or texts to the ICO, which enforces PECR, through its website at ico.org.uk. Suspicious or phishing emails can be forwarded to the National Cyber Security Centre at [email protected], and suspicious texts to 7726.

We may update this policy as sending standards and the law change. The version and effective date at the top tell you which one you are reading. This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

We will announce changes on this page and notify workspace owners by email at least 30 days in advance of material changes, except where an immediate change is needed to address abuse or meet a legal requirement. How a change takes effect in your contract is governed by the Terms of Service.

For abuse reports, or questions about whether a planned send is acceptable, use the details below. If you are not sure whether something is allowed, ask first. It is a great deal easier than unwinding a suspension.

Our full company details are on our company information page.