This Acceptable Use Policy ("AUP") governs all use of the KapoMail platform, operated by HRMFIRM LTD, a company registered in England and Wales (16785320).
It applies to you, to everyone in your organisation, and to anyone you send on behalf of — including, if you are an agency, each of your clients. You are responsible for their compliance as if it were your own.
By using KapoMail you agree to this policy. If you cannot comply with it, do not use the service.
We may update this policy. Material changes will be notified by email at least 14 days before taking effect, except where a change is required urgently to address abuse or a legal obligation.
KapoMail is a transactional email service. It is intended for messages sent to a specific recipient in response to an action that recipient took, or as part of an ongoing service relationship they entered into.
Permitted examples: password resets, account verification, one-time passcodes, order confirmations, shipping notifications, receipts and invoices, appointment reminders, security alerts, service status notifications, and support ticket correspondence.
Not permitted at this time: bulk marketing campaigns, newsletters, promotional broadcasts, cold outreach of any kind, and re-engagement or win-back campaigns. If your use case is marketing email, KapoMail is not the right service and your account will be declined or closed.
We may introduce a separate marketing product in future. Until we do, sending marketing mail through a transactional account is a breach of this policy.
You may only send to a recipient where at least one of the following is true:
You must be able to show us, on request and within 5 business days, how and when a given recipient came to be on your list.
You may never send to addresses that were:
You must not use KapoMail to send, facilitate or support:
Fraud and deception - Phishing, credential harvesting, or any message designed to impersonate another person, business or authority. - Forged, disguised or misleading headers, sender names, domains, subject lines or reply addresses. - Advance-fee fraud, fake invoices, fake delivery or payment notices, or fabricated security alerts. - False or unsubstantiated claims about products, services, earnings or health outcomes.
Malicious payloads - Malware, ransomware, spyware, keyloggers, or any executable or macro-enabled attachment intended to compromise a recipient. - Links to sites hosting any of the above, or to sites that mislead recipients about their identity or purpose.
Illegal and harmful material - Anything unlawful under the laws of the United Kingdom or of the recipient's country. - Child sexual abuse material — reported immediately to law enforcement, with no notice to the account holder. - Content that harasses, threatens, defames, or incites violence or hatred against any person or group. - Unlicensed pharmaceuticals, controlled substances, weapons, counterfeit goods, or stolen data or credentials.
High-risk commercial categories - Cryptocurrency, token, NFT or investment promotions of any kind. - Gambling, betting, lotteries or prize draws, except where you hold a UK Gambling Commission licence and have our prior written approval. - Multi-level marketing, pyramid schemes, matrix schemes, "get rich quick" or work-from-home earning claims. - Payday lending, debt relief, credit repair, and unsolicited financial advice. - Adult content or services.
Platform abuse - Using KapoMail to send mail on behalf of an undisclosed third party, or to resell KapoMail's sending capacity as your own email service, without our prior written agreement. - Circumventing quotas, rate limits, suppression lists or account suspensions, including by creating additional accounts. - Probing, scanning, load-testing or attempting to breach the security of the platform or of any other customer's data. - Using the service to relay mail for open relays, mailing lists you do not control, or any system that forwards mail from unverified sources.
Domain and identity
- You may only send from domains you own or are authorised to use, and which you have verified through the platform.
- Your From address must accurately identify the sender. Display names must not imply a relationship that does not exist.
- You must keep the DNS records we provide published and correct for as long as you send.
List hygiene and suppression - You must not send to any address on your suppression list. Removing a hard-bounced or complained address from suppression, and sending to it again, is a serious breach. - You must promptly stop sending to anyone who asks you to stop, by any means they use to ask. - Where you send anything with a promotional element permitted under this policy, you must include a functioning unsubscribe mechanism that works without requiring a login.
Credential security - API keys and SMTP credentials are secrets. You must not commit them to source control, embed them in client-side code or mobile apps, or share them outside your organisation. - You must use a separate credential per application, site or client, so that one compromise does not expose the rest. - You must notify us within 24 hours of discovering that a credential has been exposed or that a system sending through KapoMail has been compromised. - We may revoke any credential immediately, without notice, if we believe it has been compromised.
Content quality - Message content must be relevant to the recipient and to the relationship you have with them. - You must not use image-only messages, obfuscated text, hidden text, or other techniques intended to evade spam filtering.
New accounts begin with deliberately low sending limits. Limits increase as you establish a consistent, clean sending history. We may:
Sudden volume increases without notice may be automatically throttled. If you expect a legitimate spike, tell us in advance.
You are responsible for the quality of your sending. We act on the following:
| Metric | Expected | Action may be taken above |
|---|---|---|
| Hard bounce rate | Below 2% | 3% |
| Spam complaint rate | Below 0.05% | 0.08% |
| Spamtrap hits | Zero | Any confirmed hit |
| Authentication failures | Zero | Sustained failures |
These are stricter than the thresholds our upstream providers enforce. That is deliberate: it lets us work with you before your sending affects other customers.
We monitor aggregate sending metrics, abuse reports and automated risk signals. We inspect message content only where necessary to investigate a suspected breach, respond to an abuse report, or comply with a legal obligation.
Where we identify a breach, we may — proportionate to the severity and at our discretion:
We act first and explain second where there is an immediate risk of harm to recipients, to other customers' deliverability, or to our infrastructure. In those cases we will tell you what we did and why within one business day.
Suspension for abuse does not entitle you to a refund of fees already paid for the period in which the abuse occurred.
If your account is suspended and you believe it was in error, reply to the suspension notice or write to [email protected]. We aim to respond within one business day.
To lift a suspension we generally need: what happened, what you have fixed, and what prevents recurrence. Where a compromise occurred, we need evidence it has been remediated before sending resumes.
Anyone may report abuse of the KapoMail platform:
Include full message headers where possible. We acknowledge reports within one business day and act on confirmed abuse promptly. We do not disclose the identity of a reporter to the account they reported.
We welcome reports from mailbox providers, blocklist operators and security researchers, and will work with them directly.
This policy sits alongside our Terms of Service, Privacy Notice and Data Processing Agreement. Where this policy is stricter than another document, this policy applies to questions of acceptable use.
Nothing in this policy limits our obligations under applicable law, including the UK GDPR and the Privacy and Electronic Communications Regulations.
Contact: HRMFIRM LTD, Flat 3 Carradale House, 88 St. Leonards Road, London, England, E14 0SN · [email protected]