1. Acceptance of Terms

By accessing or using the NexoraMail platform, APIs, SMTP relay services, or any related service operated by NexoraMail Inc. ("NexoraMail," "we," "us," or "our"), you ("Customer," "you," or "your") agree to be bound by these Terms of Service ("Terms"). If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind such entity to these Terms. If you do not have such authority, or if you do not agree with these Terms, do not use the Service.

NexoraMail reserves the right to modify these Terms at any time. We will provide notice of material changes via email or through the dashboard. Continued use of the Service after the effective date of any changes constitutes acceptance of the revised Terms.

2. Service Description

NexoraMail provides enterprise-grade transactional email infrastructure services, including SMTP relay, a RESTful API for programmatic email delivery, domain authentication (SPF, DKIM, DMARC), real-time delivery monitoring, bounce and complaint tracking, suppression list management, and webhook event delivery.

NexoraMail is exclusively a transactional email platform. The Service is designed and intended solely for emails that are triggered by user actions or system events and are expected by the recipient. The Service is not designed for, and may not be used for, bulk marketing, promotional campaigns, cold outreach, or any form of unsolicited commercial email.

3. Acceptable Use

You agree to use the Service only for lawful transactional email purposes. You are solely responsible for all content transmitted through your account. You may not use the Service to:

• Send unsolicited commercial email (spam) or any communication to recipients who have not explicitly opted in
• Send to purchased, rented, scraped, harvested, or third-party email lists
• Conduct cold email campaigns, marketing campaigns, or promotional broadcasts
• Violate the CAN-SPAM Act, GDPR, CASL, or any other applicable anti-spam law
• Distribute malware, phishing content, or fraudulent messages
• Impersonate any person or entity or misrepresent your affiliation with any person or entity
• Engage in any activity that degrades the deliverability of other NexoraMail customers
• Circumvent rate limits, abuse detection systems, or other technical controls

Violation of this Section will result in immediate account suspension without refund and may be referred to law enforcement.

4. Account Registration

To use the Service, you must register for an account and provide accurate, complete, and current information. You are responsible for maintaining the confidentiality of your credentials and for all activity occurring under your account. Notify NexoraMail immediately at support@nexoramail.us of any unauthorized access.

NexoraMail reserves the right to verify your identity and use case at any time. Accounts may not be shared, sublicensed, or transferred to third parties without prior written consent from NexoraMail.

5. Compliance Requirements

All customers must maintain: a complaint rate below 0.1%, a hard bounce rate below 3%, verified sending domains (SPF + DKIM minimum), and documented opt-in consent for all recipient addresses. Accounts that fail to meet these thresholds will have sending automatically restricted pending compliance review.

High-volume accounts (Growth plan and above) must complete a compliance review prior to activation. NexoraMail may request evidence of opt-in practices, list acquisition methods, and example email content at any time.

6. Fees & Payment

Service fees are as published on the NexoraMail pricing page and are billed monthly in advance. You authorize NexoraMail to charge your payment method on file for all applicable fees. All fees are non-refundable except as required by law or as expressly provided in these Terms. Accounts suspended for policy violations are not eligible for refunds.

NexoraMail reserves the right to modify pricing with 30 days' notice. Continued use after a price change takes effect constitutes acceptance of the new pricing.

7. Intellectual Property

NexoraMail retains all intellectual property rights in the Service, including software, APIs, documentation, and trademarks. You retain all rights in content you transmit through the Service. You grant NexoraMail a limited license to process your content solely to provide the Service.

8. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEXORAMAIL'S TOTAL LIABILITY FOR ANY CLAIMS UNDER THESE TERMS SHALL NOT EXCEED THE FEES PAID BY YOU IN THE THREE MONTHS PRECEDING THE CLAIM. NEXORAMAIL SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, DATA, OR GOODWILL.

9. Termination

Either party may terminate these Terms on 30 days' written notice. NexoraMail may suspend or terminate your account immediately, without notice, if you violate the Acceptable Use Policy, Anti-Spam Policy, or any other material provision of these Terms. Upon termination, your access to the Service will be revoked and your data will be deleted within 90 days.

10. Governing Law

These Terms are governed by the laws of the State of Delaware, United States, without regard to conflict of law principles. Any disputes shall be resolved in the courts of New Castle County, Delaware. You consent to personal jurisdiction in such courts.

For any legal notices, contact: NexoraMail Inc., 1209 Orange Street, Wilmington, DE 19801. Email: support@nexoramail.us

1. Information We Collect

NexoraMail collects the following categories of information in connection with operating the Service:

Account Information

When you register for an account, we collect your name, company name, email address, billing information, and information about your intended use case. This information is used to operate your account, process payments, and communicate with you about the Service.

Email Delivery Data

As part of providing the Service, we process email messages, including recipient addresses, message headers, subject lines, and delivery metadata. We do not read, index, or analyze message body content for commercial purposes. Email content is stored transiently during delivery and deleted within 72 hours of final delivery status.

Usage & Technical Data

We collect logs of API calls, SMTP connections, delivery events, bounce notifications, and complaint reports. This data is used to operate and monitor the Service, enforce compliance policies, and provide analytics to customers.

2. How We Use Information

We use information we collect to: provide and operate the NexoraMail Service; authenticate your identity and secure your account; process payments and manage billing; monitor compliance with our Acceptable Use and Anti-Spam policies; detect and prevent fraudulent or abusive sending; provide customer support; send administrative communications about the Service (not marketing); and improve the Service through aggregated, de-identified analytics.

We do not sell your personal information or recipient data to third parties. We do not use recipient email addresses for any purpose other than delivery of your authorized messages.

3. Data Sharing

We share data with third parties only as necessary to operate the Service: AWS (infrastructure and email delivery), Stripe (payment processing), and internal monitoring tools. All sub-processors are bound by data processing agreements. A full sub-processor list is available upon request at support@nexoramail.us.

We may disclose information to law enforcement or regulatory authorities when required by law, subpoena, or court order, or when we believe disclosure is necessary to prevent imminent harm or investigate policy violations.

4. Data Retention

Account information is retained for the duration of your account and for 12 months following account termination. Delivery logs and event records are retained for the period specified by your plan (7, 30, or 90 days for Starter, Growth, and Enterprise respectively). Email message content is deleted within 72 hours. Suppression list entries are retained indefinitely to prevent future delivery to opted-out or bounced addresses.

5. Security

NexoraMail implements industry-standard security measures including TLS 1.3 encryption for all data in transit, AES-256 encryption for data at rest, multi-factor authentication for administrative access, role-based access control, continuous vulnerability scanning, and immutable audit logging. No security measure is perfect; if you suspect unauthorized access to your account, contact support@nexoramail.us immediately.

6. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or port personal data we hold about you. To exercise these rights, contact support@nexoramail.us. EU residents may have additional rights under GDPR; see our Data Processing Agreement for details. California residents may have rights under the CCPA, including the right to know, delete, and opt out of sale (we do not sell personal data).

7. Cookies

Our website and dashboard use essential cookies for session management and authentication. We do not use third-party tracking cookies or behavioral advertising cookies. You may disable non-essential cookies in your browser settings without affecting core Service functionality.

8. Contact Us

For privacy-related inquiries, contact NexoraMail Inc. at support@nexoramail.us or by mail at 1209 Orange Street, Wilmington, DE 19801, United States.

Overview

This Acceptable Use Policy ("AUP") establishes the rules governing the use of NexoraMail's email infrastructure platform. This AUP applies to all customers, users, and any third party acting on behalf of a NexoraMail customer. By using the Service, you agree to comply with this AUP at all times.

NexoraMail is a transactional email infrastructure provider. The Service is designed to deliver expected, legitimate communications — not to facilitate unsolicited messaging of any kind. This distinction is fundamental to how the platform is designed, monitored, and enforced.

Permitted Uses

NexoraMail may be used for the following purposes, provided all recipients have explicitly opted in:

• Password reset and account recovery emails
• Email address verification and account activation
• Two-factor authentication codes and security alerts
• Order confirmations, shipping updates, and delivery notifications (e-commerce)
• Payment receipts, invoices, and billing notifications
• Account activity alerts (login from new device, unusual activity)
• Application-generated reports explicitly requested by the user
• Service status notifications and incident alerts
• Welcome emails to new users who have completed verified signup
• Scheduled digest emails to users who have explicitly subscribed

Prohibited Uses

The following uses are strictly prohibited and will result in immediate account suspension:

• Cold email outreach — any unsolicited email to a recipient with whom you have no prior relationship
• Purchased or rented list sending — sending to addresses acquired from any third party
• Scraped list sending — sending to addresses collected by automated means from websites, social networks, or public databases
• Bulk marketing campaigns — promotional emails, sales campaigns, or advertising to any list
• Newsletter sending — mass distribution of newsletters unless every recipient has individually subscribed via confirmed opt-in
• Affiliate marketing — sending on behalf of third parties or promoting affiliate products
• Deceptive sending — misleading subject lines, forged headers, or impersonation of other organizations
• Malicious content — phishing, malware distribution, fraud facilitation
• Harassment — sending to individuals who have requested no further contact

Content Standards

All email content transmitted through NexoraMail must: accurately identify the sending organization; include a valid physical mailing address for the sender; comply with applicable laws in the sender's and recipient's jurisdictions; not contain deceptive subject lines or misleading headers; include a functional unsubscribe mechanism for any recurring message type; not contain content that violates intellectual property rights; and not contain illegal content of any kind.

Enforcement

NexoraMail actively monitors sending behavior using automated systems and manual review. The following enforcement actions may be taken based on policy violations:

• Warning: Issued for first-time minor violations or threshold approaches.
• Temporary restriction: Sending suspended pending investigation and remediation.
• Permanent suspension: Account closed for serious or repeat violations. No refund.
• Legal referral: Significant violations (large-scale spam, phishing, fraud) may be referred to the FTC, state attorneys general, or other authorities.

Reporting Abuse

To report suspected abuse of the NexoraMail platform, including spam originating from NexoraMail infrastructure, contact support@nexoramail.us with full email headers and a description of the issue. We investigate all reports within 24 hours and take enforcement action as appropriate.

Policy Statement

NexoraMail maintains a zero-tolerance policy toward spam and unsolicited email of any kind. As an infrastructure provider, we have both a legal obligation and a fundamental business interest in ensuring our platform is never used to send spam. Every email sent through NexoraMail must comply with this policy, and we enforce it aggressively through automated systems, manual review, and immediate account suspension when necessary.

CAN-SPAM Act Compliance

All email sent through NexoraMail must comply with the U.S. CAN-SPAM Act of 2003 (15 U.S.C. § 7701 et seq.). Required compliance elements include:

• The "From," "To," "Reply-To," and routing information must accurately identify the sending organization
• Subject lines must not contain deceptive or misleading information
• All commercial messages must be identified as advertising (where applicable)
• All commercial messages must include a valid physical postal address of the sender
• All commercial messages must include a clear and conspicuous unsubscribe mechanism
• Opt-out requests must be honored within 10 business days
• Third-party email senders are monitored; customers are responsible for compliance of agents sending on their behalf

GDPR & International Anti-Spam Requirements

For customers sending to recipients in the European Union or European Economic Area, GDPR applies to the processing of recipient personal data. Additionally, Directive 2002/58/EC (ePrivacy Directive) requires prior consent for electronic direct marketing communications. NexoraMail's opt-in requirements meet or exceed these standards.

For recipients in Canada, the Canadian Anti-Spam Law (CASL) requires express consent for commercial electronic messages. For recipients in Australia, the Spam Act 2003 applies. Customers are responsible for ensuring compliance with all applicable jurisdictional laws for their specific recipient populations.

Technical Enforcement

NexoraMail implements the following technical measures to prevent spam originating from our infrastructure:

• Domain verification requirement: No email can be sent from unverified domains. All sending domains must complete SPF and DKIM verification.
• Complaint feedback loop (FBL) processing: We receive complaint notifications from major ISPs (Gmail, Yahoo, Outlook) and process them in real time, automatically suppressing complaining recipients.
• Automated complaint rate monitoring: We calculate complaint rates continuously and apply automatic restrictions at defined thresholds.
• Anomaly detection: Machine learning models flag unusual sending patterns including sudden volume increases, high invalid-address rates, and atypical recipient domain distributions.
• Content scanning: Outbound messages are scanned for known spam indicators, phishing patterns, and malicious URLs. Messages flagged by content filters are queued for manual review.
• IP reputation monitoring: We monitor the reputation of our sending IPs and domains against major blocklists (Spamhaus, SORBS, Barracuda). Accounts contributing to blocklisting are suspended immediately.

Complaint Rate Thresholds

Violations & Consequences

Violations of this Anti-Spam Policy will be handled as follows, depending on severity and whether the violation is intentional:

• First-time minor violations (e.g., complaint rate approaching threshold): Written warning with compliance guidance. Sending continues with enhanced monitoring.
• Policy violations under investigation: Sending suspended pending review. Customer must provide documentation of opt-in practices and remediation plan.
• Confirmed spam sending: Immediate and permanent account suspension. No refund. Negative account history retained.
• Large-scale spam operations, phishing, or fraud: Immediate suspension plus referral to the FTC, relevant state authorities, and notification to major ISPs and blocklist operators.

Customers whose accounts are suspended for spam violations may not re-register under a different account, company name, or payment method. Circumventing a suspension is a material breach of the Terms of Service.

Scope & Definitions

This Data Processing Agreement ("DPA") forms part of the NexoraMail Terms of Service and governs the processing of personal data by NexoraMail Inc. ("Processor") on behalf of the Customer ("Controller") in connection with the NexoraMail email infrastructure services. This DPA applies where the Customer transmits personal data of EU/EEA individuals to NexoraMail for processing in the performance of the Service.

"Personal Data" means any information relating to an identified or identifiable natural person as defined in Article 4(1) GDPR. In the context of this DPA, Personal Data primarily consists of recipient email addresses, names embedded in message metadata, and delivery event data linked to identifiable individuals.

Roles & Responsibilities

The Customer acts as the Data Controller and is responsible for: ensuring a lawful basis for the processing of recipient personal data; collecting and maintaining valid consent or other lawful grounds for sending communications; providing data subjects with required privacy notices; and instructing NexoraMail only to process personal data in accordance with applicable law.

NexoraMail acts as the Data Processor and processes personal data only on documented instructions from the Controller, for the purpose of email delivery and related infrastructure services.

Processing Instructions

NexoraMail shall process personal data only as instructed by the Controller and only for the purposes described in the Terms of Service and this DPA. NexoraMail shall not process personal data for its own commercial purposes, share personal data with third parties for advertising, or process personal data in any way inconsistent with the Controller's documented instructions.

If NexoraMail is required by EU or member state law to process personal data in a manner not authorized by the Controller's instructions, NexoraMail shall notify the Controller of this requirement before processing, unless such law prohibits notification.

Security Measures

NexoraMail implements the following technical and organizational measures to protect personal data in accordance with Article 32 GDPR: AES-256 encryption for data at rest; TLS 1.3 for data in transit; access controls restricting personal data access to personnel with a need-to-know; pseudonymization of log data where technically feasible; regular security assessments and penetration testing; employee training on data protection obligations; and documented incident response procedures.

Sub-Processors

NexoraMail uses the following approved sub-processors for the delivery of its services:

• Amazon Web Services, Inc. (USA) — Cloud infrastructure, compute, storage, and email delivery via AWS SES
• Stripe, Inc. (USA) — Payment processing (billing data only; no email content)
• Datadog, Inc. (USA) — Infrastructure monitoring and log analytics

NexoraMail will notify the Controller at least 30 days before adding or replacing sub-processors. The Controller may object to changes within 10 business days by notifying support@nexoramail.us.

Data Subject Rights

NexoraMail shall assist the Controller in fulfilling its obligations under GDPR Chapter III (Data Subject Rights), including access, rectification, erasure, restriction, portability, and objection, to the extent technically feasible and within the scope of the data processed by NexoraMail. Requests should be submitted to support@nexoramail.us. NexoraMail will respond within 72 hours.

Breach Notification

In the event of a personal data breach affecting Controller data, NexoraMail will notify the Controller without undue delay and within 72 hours of becoming aware of the breach. Notification will include: a description of the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate number of records affected; likely consequences of the breach; and measures taken or proposed to address the breach.

International Transfers

NexoraMail processes EU/EEA personal data on AWS infrastructure located in us-east-1 (Northern Virginia, USA). Such transfers are covered by Standard Contractual Clauses (SCCs) as adopted by the European Commission in Decision 2021/914 (Controller-to-Processor). A copy of the executed SCCs is available upon request at support@nexoramail.us.

Termination & Deletion

Upon termination of the Terms of Service, NexoraMail shall, at the Controller's election, either delete or return all personal data processed under this DPA within 90 days of account closure, and shall delete existing copies unless EU or member state law requires continued storage. NexoraMail will provide written confirmation of deletion upon request.

To execute a signed copy of this DPA for your GDPR compliance documentation, contact support@nexoramail.us.