Marketing & Communications Policy
Email, SMS, push and telephone marketing (where applicable) for waitlist launch updates and — once released — product news. Transactional/security messages are not marketing.
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Separate consent per channel (never bundled)
Email, SMS, push (and telephone where applicable) each require their own affirmative choice. Terms acceptance, privacy acknowledgement, analytics and advertising consent are never bundled with marketing. Pre-checked marketing boxes are prohibited. Consent text version + timestamp + source + jurisdiction stored in consent_records/marketing_preferences; withdrawal recorded in suppression_records.
Do not assume email consent covers SMS. The waitlist marketing_consent flag is email-only until SMS/push choices are separately collected.
2. Identification, content and unsubscribe (per message)
Every marketing message: accurate sender (From/Caller ID), honest subject/purpose, identification as advertisement where required, valid physical postal address where required (CAN-SPAM), and a working unsubscribe (List-Unsubscribe header + one-click link for email; STOP for SMS; in-app toggle + OS-level opt-out for push) honoured immediately (CAN-SPAM 10 business days max; CASL 10 business days; others sooner). Suppression list (hashed) enforced before every send; no send after unsubscribe.
3. Jurisdiction overlays
EU ePrivacy Art.13: prior consent or narrow existing-customer soft opt-in + opt-out. UK PECR reg.22: consent or soft opt-in + unsubscribe. US CAN-SPAM: header/subject/address/opt-out. Canada CASL: express/implied consent + identification + unsubscribe. Australia Spam Act: consent + ID + unsubscribe. Singapore: DNC + Spam Control Act consent/unsubscribe. Japan: opt-in/opt-out per channel. Israel s.30A: opt-in. Mexico: secondary-purpose opt-out + ARCO opposition. Others: purpose-specific consent (defensive). [LEGAL REVIEW REQUIRED per send until matrix confirmed.]
4. SMS/telemarketing as its own compliance area
Track per number: consent, source, timestamp, message category (marketing vs transactional), opt-out, suppression, jurisdiction. No global SMS compliance claim without jurisdiction review. Telephone where applicable follows the same separation + DNC + calling-time rules.
5. Reviews, testimonials and claims (no fakes)
Testimonials require customer identity + permission + actual-customer/actual-experience proof + incentive disclosure + publication date (registry TEST-001 currently FAIL — permission/evidence missing). Fake/invented/AI-as-genuine/employee-as-independent/conditioned-positive reviews prohibited. Statistics and superlatives ('10x', '#1', 'most secure', 'trusted by 50,000', 'guaranteed', 'zero risk', '100% accurate') require evidence (metric/sample/period/limitations) in claims-registry.json or must be rewritten. Currently 14 claims FAIL.
6. Version
Version 0.9.0-draft, last updated 2026-10-02, LEGAL REVIEW REQUIRED. No marketing email is sent until unsubscribe + suppression are operational (CONFIG.md assumption 6).
Sources
This document is derived from the following entries in our legal source registry: US-CAN-SPAM, CA-CASL, AU-SPAM, EU-EPRIVACY, UK-PECR, SG-PDPA, JP-APPI, IL-PPL. See for the full citations and the date each source was last verified.