Anti-spam policy

This page summarizes the anti-spam rules in Tomba's Acceptable Use Policy, which governs how you use Tomba and the data you get from it. If this page and the Acceptable Use Policy differ, the Acceptable Use Policy applies.

Prohibited uses

Don't use Tomba, or data you get from Tomba, to:

• Send unsolicited bulk email, spam, or any commercial message that doesn't meet applicable anti-spam law.
• Send phishing, pretexting, social engineering, fraud, or any other deceptive or misleading message.
• Harass, threaten, stalk, dox, defame, or intimidate anyone.
• Keep contacting someone who has opted out, unsubscribed, or asked not to be contacted.

The Acceptable Use Policy lists the other prohibited uses, such as reselling Tomba data or targeting people in their personal capacity.

Sending rules

You're responsible for every message you send to a contact you found through Tomba. For each message, you must:

• Have a lawful basis for processing the contact's personal data under the GDPR, the UK GDPR, and any other data protection law that applies.
• Comply with the anti-spam and marketing laws that apply, including the CAN-SPAM Act (US), CASL (Canada), the ePrivacy Directive and its national implementations (EU), and PECR (UK).
• Identify yourself as the sender accurately, include a valid postal address, and use a truthful subject line.
• Include a working, clearly visible unsubscribe mechanism in every commercial message.
• Honor opt-out and unsubscribe requests promptly, and keep those contacts out of future outreach.
• Provide any privacy notice you owe as a data controller, including notice at first contact where Article 14 of the GDPR requires it.
• Not suggest that Tomba endorses, sponsors, sent, or is responsible for your messages.

Report abuse

To report someone using Tomba in breach of these rules, email support@tomba.io. Include the account, domain, or message involved, with the message headers or any other evidence. Tomba investigates reports and doesn't share the outcome with third parties.

Report security issues to security@tomba.io, and data removal requests to privacy@tomba.io.

Enforcement

When Tomba reasonably believes you've broken these rules, it can take any of these steps, in proportion to the breach:

• Throttle or rate-limit your usage.
• Block IP addresses or request patterns.
• Remove or disable access to the offending content.
• Suspend seats, API keys, or the whole account.
• Terminate your agreement under the Terms of Service.
• Report the activity to law enforcement or another competent authority where the law requires or allows it.

Where practicable, Tomba gives you notice and a chance to fix a breach that can be fixed. It can act immediately and without notice when there's a security risk, a risk of harm to a person, a threat to the stability of the service, or a legal requirement.