Acceptable Use Policy

1.Purpose, scope and incorporation into the Terms

1.1 This Acceptable Use Policy (the "Policy") sets the rules for using SDRclose (the "Service"), a product of BiopharmaWatch LLC ("we", "us" or "our"). It applies to every Customer and Authorized User and to every Workspace, Connected Mailbox, list, sequence and message on the Service, including messages sent automatically on Customer's behalf. Capitalized terms have the meaning given in the Terms of Service.

1.2 The Policy is incorporated into the Terms of Service by its section 7 and is a material term of the Agreement. A breach of the Policy is a material breach that entitles us to act under section 9 of the Terms of Service, falls outside the liability cap in the Terms of Service, section 17.2, and is covered by Customer's indemnity under the Terms of Service, section 16.1.

1.3 If the Policy conflicts with the Terms of Service or the Data Processing Addendum, those documents prevail, in the order set out in the Terms of Service, section 1.6.

2.You are the sender

2.1 The Service sends email only through mailboxes that Customer connects, under Customer's own name and domain. There is no shared sending pool. Every message sent through the Service, whether generated, hand-written or sent automatically, is Customer's message, and Customer is the sender for the purposes of anti-spam, marketing and data protection law.

2.2 Customer decides who is contacted and what is said, holds the lawful basis for that contact, honors every opt-out and stands behind every commitment made in a message, including by the automated features described in section 9. The safeguards in the Service help Customer meet those obligations but do not transfer them to us.

2.3 Customer must respond in good faith to recipient complaints, regulator inquiries and mailbox provider notices about its outreach, and must cooperate with any investigation under section 12.

3.Lawful basis, consent and the rules of each market

3.1 Customer must hold a valid lawful basis for contacting each recipient, assessed under the law that applies to that recipient rather than only Customer's own, and must be able to demonstrate it on request.

3.2 Some markets require prior consent before a business receives marketing email, even at a work address about a matter relevant to the recipient's role. Others allow unsolicited business email subject to identification, opt-out and content rules. Customer must confirm the rules of each market before sending into it, and must not send where it lacks the basis that market requires.

3.3 The laws that may apply include the General Data Protection Regulation and national ePrivacy rules in the European Economic Area, the United Kingdom GDPR and PECR, the CAN-SPAM Act in the United States, Canada's Anti-Spam Legislation and equivalent rules elsewhere, together with sector rules and marketing codes. The Policy does not analyze the law of any market and is not legal advice.

3.4 Customer must give recipients the information the applicable law requires about the source of their details and the basis for contact, including under Article 14 of the General Data Protection Regulation, and must maintain an accessible privacy notice that names Customer as controller, discloses any open or click tracking it enables, and gives a working route for rights requests.

4.Business-to-business outreach only

4.1 The Service is built for business-to-business outreach: messages to people in their professional capacity, at a business address, about matters relevant to their role or organization. Every user represents that they are using the Service for business purposes.

4.2 Customer must not use the Service to email consumers, to send to personal addresses, including consumer webmail addresses used privately, or to conduct consumer marketing of any kind. The Service is not for political, election or issue advocacy messaging, charitable solicitation of individuals, or any other outreach that is not business-to-business.

5.Sender identification and message requirements

5.1 Every message must accurately identify Customer as the sender. Headers, From and reply-to addresses and subject lines must not be forged, disguised or misleading. Where Customer sends on behalf of another organization, which the Terms of Service permit only under a written agreement with us, the message must say on whose behalf it is sent.

5.2 Messages must carry a valid physical postal address, a functioning opt-out mechanism and any other identifier the law of the recipient's market requires.

5.3 Statements must be truthful and substantiated. Research notes and prospect records come from third-party and public sources and may be wrong, so Customer must review factual claims about a recipient before they are sent.

5.4 Customer must own or be authorized to use every sending domain, must configure SPF, DKIM and DMARC for it, and must not use a domain that imitates another organization. Links must lead where they appear to lead, and messages must not contain hidden content or malicious code.

6.Opt-out handling and the suppression list

6.1 Every message sent through a sequence carries a one-click List-Unsubscribe header and an opt-out link. Using either, or replying to ask not to be contacted, adds the address to a permanent suppression list that applies across every sequence, Connected Mailbox and Workspace on the account.

6.2 Customer must honor every opt-out promptly and permanently, whatever channel it arrives through, and must add an opt-out received outside the Service to the suppression list before the next send.

6.3 Customer must not circumvent opt-out handling, including by removing or disabling an unsubscribe mechanism, re-importing, re-mining or re-enriching a suppressed address, editing or deleting suppression records, or using a different mailbox, domain, Workspace or account to reach a person who has opted out.

6.4 Suppression records are retained permanently and survive deletion of the account, as a compliance safeguard described in the Terms of Service, section 11.8. Where a recipient contacts us directly, we suppress the address on the sending account and pass the request to Customer. Customer must not reverse a suppression we apply.

7.Prospect list sourcing

7.1 Customer may bring into the Service, and send to, only records it is entitled to hold and use for outreach: prospects found through the Service's lead discovery; Customer's own business records collected lawfully; lawful imports; and people who have engaged with Customer's business and have not opted out. Records from our prospect data provider may be used only within the Service and for Customer's own outreach, as the Terms of Service, section 11.3, sets out.

7.2 Customer must not upload, import, mine or send to lists purchased or rented from a source that cannot demonstrate a lawful basis for the transfer; lists scraped from websites, social networks or directories in breach of their terms; lists obtained from a data breach, leak or unauthorized access; or addresses harvested, guessed or generated from name patterns.

7.3 By adding a record, Customer represents that it may hold and use it and will provide evidence of its source on request. Customer must not re-import an address the Service has marked as bounced or suppressed.

8.Prohibited content and prohibited uses

8.1 Prohibited content. Customer must not use the Service to send, link to, promote or facilitate any of the following:

• Spam. Bulk or unsolicited messaging that breaches sections 3 to 7, or that a reasonable recipient would regard as spam.
• Phishing and fraud. Credential harvesting, business email compromise, payment redirection and any other deceptive scheme.
• Malware. Harmful code of any kind, or links to it.
• Harassment and hate. Threats, abuse, defamation, hate speech, or incitement to violence or discrimination.
• Impersonation. Presenting as another person, company, brand, public body or SDRclose, or falsely claiming affiliation or endorsement.
• Restricted goods and services. Adult content, gambling, weapons, controlled substances, counterfeit goods, and anything unlawful to offer in Customer's or the recipient's market.
• Deceptive financial claims. Unlawful financial products, misleading investment or income claims, and offers that require a license Customer does not hold.
• Sanctions. Messages to individuals or entities subject to applicable sanctions or export controls.
• Unlawful content. Anything unlawful where it is sent from or into, or that infringes the rights of any person.

9.Automated replies, meeting booking and AI-generated content

9.1 Nothing sends without Customer's approval until Customer switches on autopilot for a sequence. Autopilot has three separate switches, auto-send, auto-reply and auto-book, and Customer is responsible for the result of each.

9.2 With auto-reply or auto-book on, the Service answers replies in Customer's voice, offers times from Customer's connected calendar, books when the prospect agrees and hands off to a person otherwise. Customer must configure the writing controls, custom instructions and calendar so that replies are accurate, must monitor the inbox and needs-attention list, and must keep or properly cancel booked meetings.

9.3 Generated drafts, replies and research notes come from third-party language-model and research providers and can be inaccurate or unsuitable. Customer must review output before it is sent where autopilot is off and accepts responsibility for it where autopilot is on. Locked templates and replies typed by a person are sent verbatim. Customer must not use custom instructions or templates to produce content prohibited by section 8, to evade this Policy or to deceive recipients about who is responsible for a message, and must make any disclosure of automated content that a recipient's market requires.

10.Sending volume, deliverability and account health

10.1 The Service protects every Connected Mailbox with daily and hourly sending caps, a progressive warmup ramp with a guard that keeps a warming mailbox out of cold sends, mailbox health monitoring, and SPF, DKIM and DMARC checks. These protect Customer's own sender reputation and do not replace the limits of Customer's mailbox provider. Customer must not circumvent them or multiply its allowances by using more than one account.

10.2 Sending that produces complaint, bounce, unsubscribe or blocklist patterns materially above the norms that major mailbox providers publish or apply is a serious breach of this Policy, whatever its cause. Customer must keep its lists clean, act on bounces and complaints, and slow or stop sending when the signals in the Service show a mailbox or domain in difficulty.

10.3 We may pause a sequence or mailbox, automatically or by hand, where its health signals deteriorate or an abuse report is received. Section 12 describes enforcement. Our Deliverability guide covers list hygiene, warmup, authentication and volume; it is assistance, not a warranty of inbox placement.

11.Connected mailbox provider terms

11.1 The Service sends and reads email only through mailboxes Customer connects, whether hosted by Gmail and Google Workspace, Outlook and Microsoft 365, Zoho or another standard mail provider. Customer must own or be authorized to use every Connected Mailbox and sending domain.

11.2 Each Connected Mailbox remains governed by the terms of service, acceptable use rules and sending limits of its provider. Using the Service does not exempt Customer from those rules, and where a provider's rules are stricter than this Policy, the provider's rules apply.

11.3 To detect replies, the Service reads messages in Connected Mailboxes. Customer must be entitled to give us that access, including where the mailbox belongs to a colleague, and must protect the credentials it supplies.

11.4 Decisions by a mailbox provider, registrar, DNS provider or receiving mail system, including throttling, blocklisting or suspension, are matters between Customer and that provider, as the Terms of Service, section 8, sets out.

12.Monitoring, enforcement and appeals

12.1 Monitoring. We do not routinely read Customer's messages. We monitor aggregate health signals such as bounce, complaint and unsubscribe patterns, blocklist status and abuse reports, and may inspect an account where we receive a complaint, a legal demand or a signal of abuse.

12.2 Graduated enforcement. We take the least intrusive measure that addresses a breach or a risk to recipients, mailbox providers, other customers or the Service, and escalate only if it persists. The measures, in ascending order, are: pausing a sequence or mailbox; a written warning describing what must change; a temporary rate limit; suspension of a sequence, mailbox, Workspace or account; and termination of the Agreement under the Terms of Service, section 18.3. A serious breach may justify starting at a higher step.

12.3 Notice. Where practicable, we give notice by email to the address on the account and a reasonable opportunity to fix the problem before we suspend. We act immediately and without prior notice for phishing, malware or fraud, an ongoing security incident, a severe complaint or bounce pattern, or a legal demand requiring immediate action, and give notice afterwards as soon as reasonably possible.

12.4 Effect. Suspension pauses sending and the other affected functions. Customer can still sign in and export Customer Data unless that is unsafe for security reasons. No refund is due for a suspension arising from Customer's breach, as the Terms of Service, section 9.4, sets out.

12.5 Appeals. Customer may appeal any enforcement action, or respond to a warning, through the contact form, stating what happened and what has been changed. We review every appeal, reply in writing and restore access once the cause is resolved to our reasonable satisfaction. Repeated or serious breaches may result in termination without reinstatement.

13.Reporting abuse

13.1 Anyone may report abuse of the Service. Reports go through the contact form and should include the full message headers, a copy of the complete message including its body and links, the address that received it and the date received. The headers let us identify the sending account reliably; a report without them may take longer or prove inconclusive.

13.2 We acknowledge each report, investigate it, act under section 12 where the Policy has been breached and, where the law and circumstances allow, tell the reporter in general terms what was done.

13.3 A recipient who wants a sender to stop should use the unsubscribe option in their mail client or the opt-out link in the message. Where the sender does not respond or cannot be identified, the Privacy Center describes how we identify the sending account and suppress the address. Security vulnerabilities should be reported through the contact form, as the Terms of Service, section 9.7, describes.

14.Changes to this policy

14.1 We may update this Policy. Where a change is material and restricts what Customer may do, we give at least 30 days' notice by email to the address on the account before it takes effect, and the updated Policy shows a new effective date. Clarifications, corrections and changes needed to address a legal requirement, a security threat or a mailbox provider requirement take effect when published.

14.2 Continued use after a change takes effect constitutes acceptance. A Customer that does not accept a material change may cancel its subscription, as the Terms of Service describe, before it takes effect.

15.How to contact us

15.1 SDRclose is operated by BiopharmaWatch LLC, a United States limited liability company. Questions about this Policy, appeals, abuse reports and legal notices go through the contact form on our website. Support is provided by the SDRclose team by written message during business hours, in English. We do not currently offer a contractual SLA.

15.2 Requests concerning personal data, including from recipients of email sent through the Service, are described in the Privacy Policy and the Privacy Center. The Legal page lists every document in the Agreement with its effective date.