Marketing Automation Acceptable Use Policy

Last Updated: September 2026

This Marketing Automation Acceptable Use Policy (“Policy”) applies to all use of Duda’s Marketing Automation service, including email and SMS campaigns, automated communications, test and preview messages, templates, links, attachments, integrations, APIs, and other methods of creating or initiating communications.

This Policy forms part of the Agreement governing Company’s use of Marketing Automation. Capitalized terms not defined in this Policy have the meanings given in the Duda Business Plan Terms or the Company Contract.

Company is responsible for compliance with this Policy by its Clients, authorized users, and any other person using Marketing Automation through Company’s account.

1. Relationship to the Agreement

The Business Plan Terms establish Company’s obligations concerning recipients, consent, contact sources, sender identification, campaign disclosures, opt-outs, suppression, provider and carrier requirements, monitoring, enforcement, charges, reimbursement, and indemnification.

This Policy supplements those requirements by identifying content, conduct, industries, and use cases that are prohibited or restricted when using Marketing Automation.

If this Policy conflicts with another part of the Agreement, the order-of-precedence provisions in the Business Plan Terms or Company Contract apply. A use permitted under this Policy remains subject to all other requirements of the Agreement.

2. Prohibited Content and Conduct

Company and its Clients must not use Marketing Automation to create, test, transmit, promote, or facilitate:

1. Phishing, credential harvesting, impersonation, identity deception, fraud, or materially misleading conduct;
2. Malware, viruses, malicious code, executable content, or material designed to compromise a person, account, device, network, or system;
3. Counterfeit goods, scams, pyramid schemes, chain letters, or materially deceptive offers;
4. Unlawful goods, services, transactions, or activities;
5. Pornography, sexually explicit content, escort services, mail-order spouse services, or similar adult services;
6. Unauthorized or unlawful claims that a product or service prevents, treats, or cures a health condition;
7. Advertising for prescription medication that cannot lawfully be sold over the counter;
8. Content that is threatening, harassing, exploitative, hateful, defamatory, or unlawfully discriminatory;
9. Content that infringes or misappropriates intellectual property, privacy, publicity, confidentiality, or other legal rights;
10. Simulated phishing, social-engineering exercises, penetration testing, or other security testing;
11. False, deceptive, disguised, or manipulated sender information, domains, subject lines, headers, routing information, or transmission paths;
12. Attempts to bypass spam filters, abuse controls, content controls, sending limits, rate limits, verification requirements, suppression lists, or other safeguards;
13. Snowshoeing or distributing substantially similar traffic across accounts, domains, email addresses, telephone numbers, brands, or sender identities to evade detection or dilute reputation metrics;
14. Waterfalling or moving contact lists across providers to remove or conceal bounces, complaints, opt-outs, or other negative reputation indicators;
15. Attempts to probe, disable, circumvent, or interfere with Duda’s or its providers’ security, compliance, deliverability, monitoring, or abuse-prevention controls; or
16. Any content, activity, or use case prohibited by an applicable communications provider, telecommunications carrier, or country-specific requirement.

These restrictions apply regardless of whether the communication is sent as a test, preview, individual message, bulk campaign, scheduled campaign, or automation.

3. Restricted and High-Risk Activities

The following activities are restricted and may be unavailable or prohibited for particular channels, countries, number types, providers, or use cases:

1. Alcohol;
2. Tobacco, cannabis, CBD, vaping products, and other controlled or age-restricted substances;
3. Firearms, weapons, and related products;
4. Gambling, betting, lotteries, sweepstakes, and prize promotions;
5. Healthcare, pharmaceutical, telehealth, medical, and wellness products or services;
6. Lending, debt relief, credit repair, investments, securities, financial services, and cryptocurrency;
7. Political campaigning, fundraising, and advocacy;
8. Affiliate marketing, lead generation, list brokerage, and third-party promotions;
9. Using or importing contact lists that are purchased, rented, scraped, harvested, or otherwise not directly opted-in;
10. Dating and other adult-oriented services;
11. Multi-level marketing, work-from-home, get-rich-quick, and similar opportunities; and
12. Other activities designated as high risk by Duda or its communications providers.

Duda may require business verification, licensing information, age gating, geographic restrictions, content review, reduced sending limits, enhanced monitoring, or prior written approval before permitting a restricted activity.

A restricted activity may be prohibited entirely where required by applicable law, a communications provider, a carrier, a particular messaging route, or Duda’s risk controls. Availability of a Marketing Automation feature does not constitute approval of a restricted activity.

Duda may modify or withdraw permission for a restricted activity where the activity creates legal, security, abuse, deliverability, provider, carrier, or reputational risk.

4. Prohibited Data

Company and its Clients must not use Marketing Automation to collect, import, store, include, or transmit Prohibited Data, as defined in the Agreement.

This restriction applies to contact records, custom fields, message content, subject lines, attachments, URLs, query parameters, tracking identifiers, templates, integrations, and API requests.

Company and its Clients must not use free-text fields, encodings, links, attachments, or integrations to circumvent this restriction.

5. Links and Redirects

Links included in communications must accurately represent their destinations.

Company and its Clients must not:

1. Link to phishing, credential-harvesting, malware, deceptive, unlawful, or otherwise prohibited destinations;
2. Use displayed URLs, redirects, or tracking mechanisms that conceal a materially different destination;
3. Use URL shorteners, redirect chains, newly registered domains, look-alike domains, or internationalized domains to conceal a destination or evade review; or
4. Prevent Duda or its communications providers from identifying a link’s final destination.

Duda may inspect, reject, disable, or block a link. Duda may stop a scheduled or active campaign if a linked destination becomes known or reasonably suspected to be malicious, deceptive, unlawful, or otherwise prohibited.

6. Attachments and Technical Content

Attachments must use file types and sizes supported by Duda.

Company and its Clients must not include:

1. Executable files or active content;
2. Malware, viruses, scripts, or malicious code;
3. Prohibited Data;
4. Content prohibited under this Policy; or
5. Files intended to evade content, security, or abuse controls.

Duda may scan, reject, remove, quarantine, or block an attachment. Acceptance of an attachment by the Platform does not constitute Duda’s approval of its content or use.

7. Classification of New or Unclear Use Cases

Duda may classify a use case as:

1. Prohibited, meaning it may not be conducted through Marketing Automation;
2. Restricted, meaning it may be conducted only if specified conditions or approvals are satisfied; or
3. Permitted, meaning it may be conducted subject to the Agreement and Duda’s ordinary controls.

A use case that is not addressed by this Policy is not automatically permitted. Duda may hold or restrict an unclear use case while determining its classification.

8. Enforcement

Violations or suspected violations of this Policy are subject to the monitoring, investigation, restriction, suspension, termination, reimbursement, and other enforcement provisions of the Agreement.

Duda’s decision not to enforce this Policy in one instance does not waive its right to enforce the Policy in another instance.

9. Reporting Abuse

Known or suspected violations of this Policy may be reported to abuse@duda.co.

Reports should include sufficient information to identify the sender, campaign, message, account, domain, email address, telephone number, link, or attachment involved.

10. Changes

Duda may update this Policy from time to time. Updates are effective when posted, except where the Duda Business Plan Terms or applicable law requires advance notice. Duda may make immediate changes necessary to comply with law, provider or carrier requirements, or to address fraud, abuse, spam, security, or deliverability risks.