1. Why this policy exists

BUL sends email on behalf of its customers. Every message affects the shared reputation of the infrastructure, and therefore the ability of all other customers to reach the inbox. This policy sets out what is and is not allowed, and what BUL may do to protect recipients, other customers and mailbox providers. It forms part of the Terms of Service.

2. What the customer must do

1. A legal basis for every send. Send only to recipients the customer is allowed to contact under the law that applies to the customer and the recipient. In Israel, this includes section 30A of the Communications (Telecommunications and Broadcasting) Law. Send advertising only with consent where the law requires it.
2. Proof. Keep a record of where each address came from and of the consent, and provide it to BUL on request in connection with a complaint, an abuse investigation or a mailbox provider's demand.
3. Sender identification and ad marking. Every message clearly identifies the sending customer. For advertising sent to recipients in Israel, the law requires:
   • the word "פרסומת" ("advertisement") in the email subject;
   • the advertiser's name, address and contact details;
   • notice of the right to refuse.
4. A way to unsubscribe. Every marketing message includes a simple, free way to opt out. Honour opt-out requests immediately.
5. Respect the suppression list. An address that hard-bounces, files a spam complaint or unsubscribes is suppressed for the account automatically. Do not work around suppression — whether through another account, another domain or a small change to the address.
6. Verified domains. Send only from domains the customer controls and has verified with BUL.
7. Mailbox provider requirements. Meet the requirements that major mailbox providers commonly set for senders, such as domain authentication (SPF, DKIM, DMARC), one-click unsubscribe for bulk mail and low complaint rates. Also meet BUL's own policy, which varies with risk.
8. Account security. Keep API keys and login details safe; the customer is responsible for all sending done with them. If a key leaks, revoke it immediately and tell BUL.

3. What is not allowed

1. Spam. Any advertising or bulk sending without a legal basis, and any sending that causes an abnormal rate of complaints or bounces.
2. Lists without a legal basis. Lists that are purchased, rented, transferred from another party, scraped or built by guessing addresses, and any list for which there is no legal basis to send.
3. Fraud and phishing. Impersonation, credential theft, financial fraud, malware, and links to any of these.
4. Forged identity. Hiding the real sender, misleading headers or subject lines, and impersonating another organisation.
5. Illegal content. Content that is unlawful under the applicable law, including content that exploits minors, incites violence or harasses.
6. Infringing third-party rights. Infringing copyright, trademarks or privacy, or defamation.
7. Risk to reputation and deliverability. Any use that endangers the reputation or deliverability of BUL or of other customers, for example:
   • spreading sends across many domains or accounts to avoid filtering;
   • opening multiple accounts to get around limits;
   • sending to non-existent addresses over a sustained period;
   • using BUL as a fallback for a provider that blocked the customer for spam.
8. Circumventing protections. Getting around rate limits, quotas, the suppression list, domain verification or the service's protection mechanisms.
9. Harming the service. Trying to access other customers' data, testing for vulnerabilities without written permission, or overloading the infrastructure.

4. High-risk sectors

In sectors with a high risk of complaints, fraud or legal breaches — such as gambling, pharmaceuticals, adult content, investment or cryptocurrency trading, loans and debt collection — BUL may refuse the service or set conditions, such as manual review, a valid licence or age verification. Transactional email from a lawful business is allowed in every sector.

5. What BUL may do

To protect recipients, other customers, mailbox providers and the infrastructure, BUL may, depending on the risk:

• slow down sending;
• limit quotas or types of sending;
• stop a campaign;
• suspend an account;
• end the customer's use of the service.

When there is real or immediate risk — such as phishing, malware, a compromised account, or a sharp rise in complaints or bounces — BUL acts at once and without prior notice. In other cases, where practical, BUL gives notice and a chance to fix the problem.

Automatic protections work on internal signals that BUL does not publish. Stopping or suspending sending because of a breach of this policy does not give rise to a refund, to the extent the law allows.

6. Investigation and cooperation

When there is suspected abuse, a recipient complaint or a mailbox provider's inquiry, BUL may review sends and content. It may also ask the customer for information, such as the source of a list and proof of consent. BUL may disclose information to a competent authority where the law requires it.

7. Reporting abuse

To report email sent through BUL, write to support@friman.app. Please include the full message, with headers.

8. Changes

BUL may update this policy to respond to risks, to mailbox provider requirements or to changes in the law. A change made to protect the service against abuse may take effect immediately. Other material changes will be announced at least 30 days in advance.