Home / Anti-spam and permission policy

Anti-Spam and Permission Policy

Effective date: 15 September 2026. Applies to Liliakona OÜ and to every client program we operate.

Arcada Info sends messages on behalf of client brands. This policy sets the conditions under which we agree to do that. It is contractual: it forms part of every client agreement, and a client who will not meet it does not get a send. It is also a promise to recipients, who can hold us to it at abuse@arcada-info.com.

1. Permission is the entry condition

We contact a person only where the client holds a record of that person agreeing to be contacted. The consent record must show:

• Who the consent was given to, meaning the brand by name;
• When it was given, as a timestamp;
• Where it was captured, meaning the signup form, the account registration flow or the preference centre it came from;
• What it covers, meaning service messages, marketing messages or both, and on which channels.

Consent is specific. Agreement to receive service notifications is not agreement to receive marketing. Agreement given to one brand is never reused for another brand, another product or another company in the same group. Consent given for email is not extended to SMS or push.

2. Data sources we refuse

We do not send to, and we will not load, contact data that was:

• purchased, rented, leased or swapped;
• scraped or harvested from websites, forums, directories or social networks;
• obtained from a public data vendor, a data broker or an email appending service;
• collected through co-registration or a third party lead form that did not name the brand;
• guessed, generated, or derived from a pattern such as first initial plus surname at a domain;
• transferred by a client that cannot document its origin and its consent record.

Where a client program relies on a customer base that already exists, the client must confirm in writing that the base is its own first-party data, that consent was obtained by the client at the time of collection, and that the base was not assembled by any of the means listed above. We reserve the right to sample the consent evidence at any time.

3. What every message contains

• A truthful from-name that identifies the brand the recipient knows, and a from-address on a domain controlled by us or by that brand.
• A subject line and preheader that accurately describe the content. No false urgency, no fake replies, no misleading claims, no deceptive header information.
• A valid physical postal address of the sender.
• A short line explaining why the recipient is receiving the message and where they signed up.
• A working unsubscribe link, prominent and clickable, which works without logging in, without a password and without answering questions.
• A List-Unsubscribe header, including the one-click variant, on every commercial message.
• For SMS, a documented stop keyword and the sender identity in the body.

4. Opt-outs

• Opt-outs are processed within 24 hours of receipt and in practice within minutes.
• An opt-out is applied to every future campaign for that brand, not only to the list it came from.
• Opt-outs are permanent. Suppressed identifiers survive every subsequent import, and no file upload can resurrect them. Only the person themselves can opt back in, through the brand.
• We accept an opt-out through any route: the link in the message, a stop keyword, a reply, a message to unsubscribe@arcada-info.com, or a request made to the brand directly.
• We never charge for an opt-out, never require an account, and never ask for a reason as a condition.

5. Complaints and abuse reports

• The mailboxes abuse@ and postmaster@ on our sending domains are monitored every business day.
• Feedback loop complaints from mailbox providers are ingested automatically and suppressed on receipt.
• An abuse report is acknowledged on the next business day, investigated, and answered with what we found and what we changed.
• If a report shows that a list or a segment was not permission-based, the program is paused immediately, the segment is suppressed, and it is not resumed until the client evidences consent for the remaining records.

6. Volume, quality and circuit breakers

• New programs start on a warm-up schedule with limited daily volume that grows only while engagement holds and complaint rates stay low.
• We monitor the spam complaint rate against the thresholds published by the major mailbox providers and treat 0.10 percent as the working ceiling and 0.30 percent as a hard stop.
• Hard bounces are removed after the first occurrence, soft bounces after repeated failures.
• Contacts who have not engaged for twelve months are sunset and stop receiving marketing messages, regardless of the consent on file.
• If complaint, bounce or spam-trap signals cross the agreed threshold, sending stops automatically and resumes only after the cause is identified and fixed.

7. Authentication and infrastructure

• SPF, DKIM and an aligned DMARC policy are configured on every sending domain before the first send.
• Each brand and each stream uses a dedicated subdomain, so that reputation stays separate.
• Transactional and marketing streams are separated.
• We publish and monitor postmaster@ and abuse@ on the sending domains, and we do not send from free mailbox addresses.
• We use only sending platforms whose acceptable use policy permits the traffic in question, and we comply with that policy in addition to this one.

8. Audience restrictions

• No messaging to anyone below the legal age for the client's product, and never below 16.
• Suppression by jurisdiction where local law restricts or prohibits the content, applied before the send rather than after a complaint.
• Immediate and permanent suppression of any person who states they are not the account holder or did not sign up.
• Self-exclusion and do-not-contact lists provided by the client are loaded as suppression before any campaign and take precedence over any consent record.

9. Content we will not send

We do not prepare or deliver messages that are deceptive, that impersonate another company or person, that promote malware, phishing, pyramid or matrix schemes, illegal products, or content that is prohibited in the recipient's jurisdiction. We do not obscure the identity of the sender, and we do not use purchased domains or forwarding chains to hide who is sending.

10. Applicable law

Programs are operated to meet, at minimum, the General Data Protection Regulation and the ePrivacy rules in the European Union and the United Kingdom, the CAN-SPAM Act in the United States, Canada's Anti-Spam Legislation, the Spam Act in Australia, and equivalent rules in any other market a campaign targets. Where two rules conflict, we apply the stricter one.

11. Client obligations

By instructing us to send, a client warrants that it is the controller of the data, that consent was obtained lawfully and is recorded, that the data was not obtained by any prohibited means, that the content is lawful in every targeted market, and that it will forward every opt-out and complaint it receives directly to us without delay. Clients must keep the evidence of consent for as long as they instruct us to message the person, and produce it on request.

12. Enforcement

Breach of this policy entitles us to pause a campaign, suppress a segment, or terminate the client agreement immediately and without refund. We report unlawful sending to the relevant platform and, where required, to the competent authority. We would rather lose a client than a mailbox provider's trust.

13. Contact