Acceptable use policy

Letterpier is a service for transactional email: messages that your own products send because of something the recipient did or asked for, and the replies they receive.

This policy applies to every organisation, project and API key on Letterpier, and to all mail sent or received through it. It is part of the terms of service. “You” means the business that uses Letterpier and everyone who acts for it.

Use Letterpier only for transactional and service messages that the recipient expects, such as:

• sign-in and verification codes;
• receipts, invoices and order confirmations;
• notifications about the recipient’s account or activity;
• replies to messages the recipient sent you.

You may receive mail for domains that you control and have added to Letterpier.

Newsletters, campaigns, cold outreach and bulk marketing are not permitted, even with the recipients’ consent. The product has no mailing lists, campaigns or broadcasts for them either.

You must not use Letterpier to send, receive or distribute:

1. advertising by email without the recipient’s prior express consent (§ 7(2) Nr. 2 UWG, Article 13 of the ePrivacy Directive), unless every condition of the exception for existing customers in § 7(3) UWG is met. Advertising added to a transactional message counts as advertising;
2. mail to purchased, rented, scraped or appended address lists;
3. mail for which you have no lawful basis under the GDPR;
4. mail that disguises or conceals the sender or the commercial nature of the message (§ 7(2) Nr. 3 UWG, § 6(2) DDG);
5. mail from domains you don’t control, or mail that impersonates another person or organisation;
6. phishing, malware, or attempts to obtain passwords, codes or other credentials;
7. illegal content, including child sexual abuse material, terrorist content, content that is a criminal offence under the German Criminal Code (Strafgesetzbuch, StGB), content that infringes the rights of others, and harassment.

You must not:

1. evade suppressions, rate limits or domain checks, for example by spreading sending across projects, keys or domains;
2. use catch-all receiving on domains you don’t control;
3. relay mail for third parties, or let them send through your account, without our written approval;
4. test the security of Letterpier outside our responsible disclosure policy.

Keep SPF, DKIM and DMARC for your sending domains set up and aligned. Letterpier shows the records each domain needs; the domains guide explains them.

Honour opt-outs and objections, and keep your recipient lists clean.

Watch your bounces and complaints. As an operational benchmark, not a legal rule: Google asks senders to keep the spam rate reported by its users below 0.1 % and never to reach 0.3 %.

Don’t add a suppressed address again unless you have fixed and documented the cause of the failure.

Permanent failures are suppressed automatically per project. Messages to suppressed addresses are not sent and report a failure event. Remove an entry only after fixing the underlying cause.

Automatic complaint feedback loops are not yet configured. Complaints that recipients make to their mailbox provider therefore don’t reach your suppression list automatically.

Report spam, phishing, other abuse or illegal content sent through Letterpier to mail@michael-ketzer.com.

Please include:

1. the full message headers, or the original message as an .eml file;
2. the time you received it and the address that received it;
3. for illegal content: why you consider it illegal.

A report of illegal content helps most if it also gives your name and email address and states that you believe, in good faith, that it is accurate and complete. You don’t have to give your name when you report child sexual abuse material.

We confirm receipt and tell you what we decided.

Operators of mail servers can also reach postmaster@letterpier.com. Law enforcement and other authorities: mail@michael-ketzer.com.

[For legal review: whether Letterpier is a mere conduit or also a hosting service under the DSA decides which of Articles 16 to 18 apply. This clause and the enforcement clause follow the duties of a hosting service.]

If we have concrete indications that this policy has been breached, we may, depending on how serious the breach is:

1. hold messages;
2. revoke API keys;
3. suspend a domain, a project or the account;
4. terminate the contract, as the terms of service set out.

We act proportionately: we choose the mildest measure that stops the harm, and we give notice and reasons before we act where we can. Where harm is urgent, for example phishing or malware, we act first and send you our reasons when we act, at the latest on the day of the restriction.

When we restrict your use, we tell you what we restricted and for how long, which facts we relied on, whether we acted on a report from someone else, which rule of this policy or which law we relied on and why, and how to appeal.

Some measures are automatic: addresses that fail permanently are suppressed, messages from a sender domain that is not verified or not recently checked are held, and rate limits can hold or refuse messages. Every other decision under this policy, including every decision on a report and every suspension, is made by a person. We don’t use automated tools to assess the content of messages, and attachment scanning is not yet available.

If we become aware of information that gives rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we inform the competent law enforcement or judicial authorities.

If you disagree with a decision on your report or on a restriction of your use, reply to our notice or write to mail@michael-ketzer.com. Tell us which decision you mean and why you disagree.

We review the decision and tell you the outcome and our reasons.

Your right to go to court is not affected.