Anti-Spam Policy

1. Our commitment

Tomosu AI does not send spam, does not permit spam to be sent on its behalf, and does not do business with anyone who does. Specifically, and without limitation:

• We prohibit the use of unsolicited bulk or commercial email to advertise, promote, or drive traffic to Tomosu AI or to any domain listed in Section 3, by any party, under any circumstances.
• We prohibit the advertising of any Tomosu AI domain in email sent through third-party networks, whether or not those networks are under our control, and whether or not that email originates from an address at one of our domains.
• We do not purchase, rent, trade, harvest, or scrape email address lists, and we do not permit any party acting on our behalf to do so.
• We do not send email to any recipient who has asked us to stop, and we honour those requests across every domain we operate.

These commitments are binding on us. A violation by a partner, vendor, or agency is grounds for immediate termination of that relationship.

2. What we mean by spam

For the purposes of this Policy, spam means any email message that is both unsolicited — sent without the recipient’s consent or without a genuine, documented relationship that would lead the recipient to expect it — and bulk or commercial in nature.

A message does not cease to be spam because it is short, because it is personalised, because it contains no hyperlink, or because it was sent from a domain other than tomosu.ai. Any message that advertises Tomosu AI and that a recipient did not consent to receive falls within this Policy.

3. Domains covered by this Policy

This Policy applies to tomosu.ai and to every domain Tomosu AI owns, operates, or uses for correspondence, including but not limited to the domains below. Each of the domains below is owned and operated by Tomosu AI, Inc., is used solely for business correspondence and redirection to tomosu.ai, and is subject to every commitment in this Policy.

Domains listed here do not host independent content. They resolve to tomosu.ai, and any email sent from them is governed by this Policy and by the same suppression lists, consent records, and opt-out handling that govern tomosu.ai.

4. Prohibited practices

The following are prohibited absolutely, whether carried out by Tomosu AI personnel or by any third party acting on our behalf:

• Sending unsolicited bulk or commercial email that advertises, promotes, or mentions Tomosu AI or any domain in Section 3.
• Purchasing, renting, leasing, trading, or otherwise acquiring email addresses from a third party without verifiable, recipient-level consent to receive email from us.
• Harvesting, scraping, or generating email addresses from websites, directories, social platforms, or by dictionary attack.
• Falsifying, forging, obscuring, or misrepresenting the sender name, sender address, reply-to address, routing information, or originating domain of a message.
• Using a deceptive, misleading, or irrelevant subject line.
• Sending email through an open relay, open proxy, compromised host, or any third-party mail system without authorisation.
• Continuing to email any recipient after an opt-out, unsubscribe request, or complaint.
• Registering domains, mailboxes, or accounts for the purpose of evading a block, filter, suppression list, or blocklisting.

5. Consent and permission

We contact a recipient only where we hold a lawful basis to do so — typically because the recipient requested information from us, signed up for our mailing list, downloaded a resource, met us at an event, or holds a business role for which our communication is directly relevant and permitted under applicable law.

Where we rely on a business-to-business legitimate interest basis, we keep that outreach relevant, low volume, and immediately stoppable, and we maintain records of the source of each address. We do not treat the mere public availability of an address as consent.

6. Message standards

Every message we send, from any domain listed in Section 3, will:

• identify Tomosu AI clearly and accurately as the sender, with truthful header and routing information;
• carry a subject line that accurately reflects the content of the message;
• include our valid physical postal address, as set out in Section 13;
• provide a clear and functioning means of opting out of further messages; and
• be sent from authenticated infrastructure, with SPF, DKIM, and DMARC configured for the sending domain.

7. Opt-out and suppression

Any recipient may opt out of our email at any time, by using the opt-out mechanism in the message or by writing to abuse@tomosu.ai or contact@tomosu.ai. No reason is required and no information beyond the address is needed.

We action opt-out requests promptly and in all cases within ten business days, as required by the CAN-SPAM Act, and we do so across every domain listed in Section 3 rather than only the domain that sent the message. Suppressed addresses are retained solely to ensure they are not contacted again, are never sold or transferred, and are never re-added to a sending list.

8. Third parties acting on our behalf

Any agency, contractor, reseller, affiliate, lead-generation vendor, or other party that sends email referencing Tomosu AI is contractually bound by this Policy. We require each such party to warrant that it will not advertise Tomosu AI or any Tomosu AI domain through unsolicited bulk or commercial email, and to make its consent records and suppression handling available to us on request.

We audit these arrangements, and we terminate any relationship in which a violation is established. No party has authority to send email on our behalf in breach of this Policy, and no instruction to do so — from anyone at Tomosu AI — is valid.

9. Legal compliance

Our email practices are designed to comply with the United States CAN-SPAM Act of 2003, the Canadian Anti-Spam Legislation (CASL), the EU General Data Protection Regulation and ePrivacy Directive, the UK Privacy and Electronic Communications Regulations, and other applicable law in the jurisdictions where our recipients are located. Where those regimes differ, we apply the stricter standard.

How we handle the personal data behind these communications is described in our Privacy Policy.

10. Enforcement

We investigate every report we receive. Where a violation of this Policy is established, we will, as appropriate to the circumstances: stop the sending immediately; suppress the affected addresses across all our domains; terminate the responsible employee, contractor, or vendor relationship; retire or disable the sending domain or mailbox concerned; and notify the affected recipients and any relevant blocklist or mailbox operator.

We treat inclusion of any of our domains on a reputation or blocklist service as a matter to be investigated and resolved on the merits, not merely appealed.

11. Reporting abuse

If you have received email that you believe violates this Policy, or that advertises Tomosu AI or any domain listed in Section 3 without your consent, please report it to abuse@tomosu.ai.

Where possible, include the full message headers and the body of the message, which allow us to trace the sending path. We acknowledge reports within two business days and confirm the outcome of the investigation to the reporter. This mailbox is monitored by a person, not by an autoresponder, and reports from mailbox providers, blocklist operators, and security researchers are welcome and are prioritised.

12. Changes to this Policy

We may update this Policy from time to time. The effective date at the top of this page reflects the current version. Material changes will be posted here, and the commitments in Section 1 will not be narrowed.

13. Contact and postal address

Abuse reports: abuse@tomosu.ai
General enquiries: contact@tomosu.ai

Tomosu AI, Inc.
8 The Green Suite A
Dover, Delaware 19901, USA