Acceptable Use Policy

One-to-one outbound email from your own business mailboxes, to people whose work makes your message relevant to them. A short, honest email to a head of operations about an operations problem is what Ballast is built for. Blasting thousands of strangers who never had a reason to hear from you is not.

This policy is part of the Terms of Service. It applies to everything sent or stored through Ballast, from the dashboard, the API or an AI assistant connected over MCP.

You must not:

• email purchased, rented or scraped lists of consumers, or private email addresses of people with no business role your message relates to;
• use lists whose people never had any link to a business reason for your email, or lists collected in breach of the law or of the source's terms;
• email anyone who has opted out, unsubscribed or asked not to be contacted, from any of your workspaces or tools;
• email addresses that look like spam traps, role accounts that ask not to be emailed, or addresses you know are not real.

Verify lists before you send. Ballast flags invalid and risky addresses and can check them with your own verifier account.

You must not send emails that:

• phish for passwords, payment details or other credentials, or link to malware;
• impersonate another person, company, brand or authority, or hide who is really writing;
• use false or misleading sender names, subject lines or headers, or pretend to be a reply to a conversation that never happened;
• sell illegal goods or services, or promote scams, get-rich-quick schemes, unlicensed financial or gambling offers, or adult content;
• harass, threaten or discriminate against anyone.

Every campaign must let people opt out, and Ballast makes sure it does:

• each email carries a one-click unsubscribe header that mailbox providers show as an "Unsubscribe" button;
• your workspace picks an unsubscribe link in the email, or a line asking people to reply "stop";
• anyone who unsubscribes, replies asking to stop, or hard bounces is suppressed in the workspace for good, and every queued email to them is cancelled.

You must not remove these, hide them, or move people to another workspace or tool to keep emailing them.

• Connect only mailboxes and domains you own or are allowed to use, and follow your mailbox provider's terms and limits.
• Do not use hacked, borrowed or resold accounts, or send from a domain that copies someone else's brand.
• Ballast is not for newsletters, marketing blasts or transactional email. Use an email service built for that.

These guardrails are built in. Trying to get around them, for example by opening extra workspaces, breaks this policy:

• New workspaces: at most 5 mailboxes and 1,000 emails a day for the first 7 days.
• Each mailbox has a daily limit, ramps up slowly when new, and waits a random gap between emails.
• A mailbox stops sending above a 5% bounce rate. A campaign stops at its own limit. A workspace stops above 8%, whatever its setting.
• Rate limits apply to the API, the MCP server, AI features and the free domain checker.

• Do not probe, scan or test Ballast's security without our written permission. Found a problem? Write to contact@ballast.to.
• Do not overload the service, scrape it, or use the domain checker to scan domains in bulk.
• Do not resell access to Ballast or share an account outside your team.

We look at bounce rates, complaints and reports. When something breaks this policy, we may pause campaigns, limit sending, or suspend the workspace or account. Usually we tell you first and give you a chance to fix it. For phishing, impersonation, malware or a purchased consumer list, we suspend at once.

Serious or repeated breaches end the account without a refund for the current period, and we may refuse a new one.

Got an email sent through Ballast that breaks these rules? Forward it with its full headers to contact@ballast.to. We look at every report. To stop the emails, use the unsubscribe option in the email or reply "stop": it suppresses you in that sender's workspace.