Kirora is for sending messages people want and expect. This policy sets out what you may and may not do with the Service, and how we enforce it. It is part of our Terms of Service, and the terms defined there have the same meaning here.
1. Purpose and scope
This policy applies to every Workspace, User, API key, agent key, partner account and tenant Workspace, and to every channel we offer, now or later. If you are a partner, you must make sure your customers follow it too.
Following the law is the minimum. Some rules here go further, because the reputation of our sending infrastructure is shared by every Customer.
2. Prohibited content
You must not use the Service to create, store or send content that:
- is illegal, or promotes or facilitates illegal activity;
- is phishing, or tries to collect passwords, payment details or other sensitive information under false pretences;
- contains or links to malware, spyware or other harmful code;
- impersonates any person, company or brand, including through the From name, sender address, reply-to address, logos or design, or suggests a connection with an organisation that does not exist;
- promotes hatred, violence or discrimination against people based on protected characteristics, or harasses or threatens anyone;
- sexualises minors in any way, or includes any sexual content involving minors. We report such content to the authorities;
- is false or misleading, including fake invoices, deceptive offers, or misleading health or financial claims;
- infringes anyone’s intellectual property, privacy or other rights.
3. Prohibited sending practices
You must only send to people who have agreed to hear from you, in a way they would expect. You must not:
- Use lists you did not build. No purchased, rented, shared, appended or scraped lists, and no addresses harvested from websites or directories.
- Send without consent or another lawful basis. Every marketing message needs the consent or other permission required by the law where the Contact is. The consent basis and evidence you record on import or through the API must be true.
- Remove or hide the unsubscribe link. We add one to every marketing email. Do not obscure it, break it, or ignore the opt-outs it records.
- Leave out your postal address. Marketing email must carry your valid physical postal address. We add it from your Workspace settings and refuse marketing sends without one. Do not enter a false address.
- Mislead in subject lines or headers. Subject lines, From names, reply-to addresses and other headers must be accurate and not deceptive.
- Evade our limits. Do not spread sending across many domains, sending addresses or Workspaces (“snowshoeing”), or rotate domains, to avoid filtering, suppressions, pauses or plan limits. Suppressions for bounces and complaints apply across Workspaces with the same owner or partner.
- Disguise marketing as transactional email. Transactional sends are for messages a person needs because of a relationship or action, such as receipts, password resets and account alerts. Do not use them to send marketing, especially to Contacts who have unsubscribed. We monitor transactional sending that reaches unsubscribed Contacts, and our team reviews what we find.
- Send from domains you do not control. Email may only be sent from domains you have verified with us, and is signed with DKIM. Marketing email also needs a DMARC record on the sending domain or its parent domain. Do not try to send from someone else’s domain or from free mailbox domains.
- Keep mailing addresses that bounce or complain. Do not try to re-add, re-import or otherwise work around suppressed addresses.
4. Sensitive data
Store only the data you need to send relevant messages.
Do not put special-category data in contact attributes, events or Content. That includes health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, sex life or sexual orientation, and criminal records. The same goes for data about children. The only exception is where you have a lawful basis and the data is truly necessary for the messages you send.
The Service shows a warning when you create a custom field or map an import column, to remind you of this rule. The warning does not check what you store. That is your responsibility.
Never store payment card numbers, bank account credentials, government ID numbers or passwords in contact attributes or events.
5. Push notifications
Push notifications reach people on their own devices, so the bar is high. You must:
- send push only to people who have allowed notifications from your app or site, and follow Apple’s and Google’s push rules;
- not use push for prohibited content, or for marketing where the law or platform rules require separate consent you do not have;
- keep notifications accurate and relevant, and not use them to mislead or manipulate;
- respect reasonable hours. Set quiet hours for your Contacts’ time zones where your audience expects them;
- keep your push credentials (such as APNs and FCM keys) secure, and use only credentials for apps you control.
6. API and platform abuse
You must not:
- deliberately exceed or work around rate limits, for example by spreading requests across many keys or Workspaces;
- scrape, crawl or bulk-download the Service other than through the documented API;
- reverse engineer, decompile or try to extract the source code of the Service, except where the law allows despite this restriction;
- probe, scan or test the security of the Service, or attempt to get around authentication, scopes or tenant boundaries, without our written permission. If you find a vulnerability, report it to us;
- share API, partner or agent keys with other organisations, sell access to the Service, or let others use your account, except partners serving their own tenant Workspaces as the Terms allow;
- interfere with the Service or other Customers’ use of it, for example through denial-of-service attacks or by sending excessive load;
- use the Service to build a competing product, or to benchmark it for publication without our consent.
7. AI features
When using Kiro AI or connecting your own agents with agent keys, you must not:
- use AI features to produce content this policy prohibits, including phishing, impersonation or misleading claims;
- try to make Kiro AI ignore its rules, reveal its instructions, or reach data your role cannot see, for example by planting instructions in contact attributes or event data;
- get around the human-approval rule in section 8 of the Terms, for example by giving an agent key the power to send or building tooling that confirms sends automatically;
- use AI features to generate content at a volume, or in a way, meant to exhaust or get around usage limits.
8. Thresholds and enforcement
We watch bounce rates, spam complaints, unsubscribes, engagement and other signals. We do not publish fixed thresholds, because mailbox-provider rules change and context matters. Our guidance on keeping your sending healthy is at /resources/deliverability.
When we see a problem, we may:
- Suppress addresses automatically. Hard bounces and spam complaints suppress the address, including for transactional email, in every Workspace with the same owner or partner.
- Pause marketing email automatically when bounce or complaint rates are too high. An admin can resume after a first pause, once the cause is fixed.
- Require operator review when a pause happens again within 30 days. Our team must approve before marketing sending resumes, and may ask you for evidence of how you collected consent.
- Limit or suspend sending, features, API keys or a Workspace, while we investigate or until you fix the problem.
- Remove content that breaks this policy.
- Terminate a Workspace or account for serious or repeated breaches.
- Report illegal activity to the authorities, and cooperate with mailbox providers and regulators where the law allows.
We will usually tell you first and give you a chance to put things right. For serious harm, such as phishing, malware, child sexual abuse material or a compromised account, we act at once. Any fees owed remain payable.
9. Reporting abuse
If you receive unwanted messages sent through Kirora, or see the Service being misused, tell us at abuse@kirora.io. Please include the full message with its headers, or the details of what you saw. We review every report. We may share it with the Customer concerned, but we will not share your identity without your permission unless the law requires it.
If you are a recipient, you can also stop messages at once with the unsubscribe link in any marketing email.
10. Changes to this policy
We may update this policy as laws, platform rules and abuse patterns change. We will post the new version here with its date. Material changes are announced as described in the Terms of Service. Continuing to use the Service after a change takes effect means the updated policy applies.
Questions about this policy: legal@kirora.io.