Acceptable Use Policy

Version 1.0. Effective 14 August 2026. Every published version of this document is retained and can be produced on request.

1. STATUS OF THIS POLICY.

1.1. This Acceptable Use Policy ("AUP") is incorporated by reference into the PostLever Terms of Service (the "TOS") and forms part of the Agreement. Capitalised terms used and not defined in this AUP have the meaning given to them in the TOS. Where the documents forming the Agreement conflict, the order of precedence is: (1) the Order Form; (2) the TOS, including Section 4 and Addendum A of the TOS; (3) the Pricing Page, for the fee figures, band boundaries, and rates only; (4) this AUP; and (5) the SLA.

1.2. This AUP applies to Customer and to every Authorised User, and to every Campaign, creative, landing page, domain, and dataset Customer uses with the Services. Customer is responsible for its Authorised Users' compliance with this AUP.

1.3. Breach of this AUP is a material breach of the Agreement. PostLever's rights on breach are in Section 13 of this AUP, Section 9.3 of the TOS (suspension), and Section 9.2.2 of the TOS (termination for cause).

1.4. Nothing in this AUP excludes, restricts, or modifies any guarantee, right, or remedy conferred on Customer by the Australian Consumer Law or any other law that cannot lawfully be excluded.

1.5. This AUP expressly prevails over the TOS, to the extent of any inconsistency, on the consent standard, consent evidence, data sources, message requirements, deliverability, and enforcement. It says so here because the TOS permits a lower ranked document to prevail where that document expressly so provides. That statement does not reach clause 7.5 of the TOS, Section 12 of the TOS, or Section 4 and Addendum A of the TOS, none of which this AUP varies. This AUP and the TOS impose cumulative obligations, and a requirement stated in one and not the other is not an inconsistency.

2. THE PRINCIPLE.

2.1. PostLever is built for affiliate senders. Sending on behalf of third-party advertisers, promoting third-party offers, and running many brands from one account are the ordinary use of the Services and are permitted.

2.2. What this AUP controls is how Customer sends: whether recipients consented, whether Customer can prove it, whether messages identify their sender honestly, whether recipients can get off the list, and whether Customer's sending harms recipients, mailbox providers, other customers, or PostLever. A Campaign that satisfies this AUP is not made unacceptable by the vertical it promotes, and a Campaign that breaches it is not saved by the vertical being lawful.

3. CONSENT AND PERMISSION.

3.1. Customer must not send a Campaign to any recipient who has not consented to receive it. Consent means consent within the meaning of Schedule 2 to the Spam Act, whether express or reasonably inferred, and where the recipient is in a jurisdiction imposing a higher standard, that higher standard applies. Customer must also hold all rights, permissions, notices, and lawful bases necessary to collect, use, disclose, and instruct PostLever to Process Customer Data and to send each Campaign.

3.2. Inferred consent is not assumed from the mere existence of an address. Customer may rely on inferred consent only where there is a genuine and current business relationship with the recipient and the message relates to that relationship, or where the recipient's electronic address was conspicuously published in connection with that person's business, trade, profession, or official functions, the publication carried no statement to the effect that the person does not want to receive unsolicited commercial electronic messages at that address, and the message is directly relevant to those functions. Those are the limbs of Schedule 2 to the Spam Act and this Section is no wider than they are.

3.3. Customer must keep consent records, and must produce them on request. For every recipient, Customer must be able to show when consent was given, how it was given, what the recipient was told they were consenting to, and from which source the address came. Customer must retain those records for the life of the address on the platform and for two years afterwards.

3.4. On PostLever's request, Customer must produce consent records for any address or Campaign within five (5) business days of the request, or within any shorter period the request reasonably specifies where the matter is urgent, which will be no shorter than twenty-four (24) hours. Where the records sit with a third-party list owner or advertiser of the kind Section 4.3 contemplates, PostLever will allow a reasonable extension of that period if Customer tells PostLever within it that the records have been requested and are being pursued diligently. Failure to produce them is itself a breach of this AUP, whether or not the underlying sending was consented, and PostLever may suspend under Section 13 until they are produced. PostLever will not terminate the Agreement for a failure to produce unless the failure is repeated or Customer refuses to produce. Customer acknowledges that this obligation exists because PostLever cannot verify consent independently and is exposed to regulators and mailbox providers for sending it did not originate.

4. DATA SOURCES.

4.1. Customer must be able to identify the source of every address it uploads or sends to, and must disclose that source to PostLever on request. Customer must identify any third-party campaign to PostLever in advance of sending it, and must ensure that any use of third-party offers, publisher inventory, affiliate traffic, rented lists, appended data, or co-registration data complies with all applicable laws and with the self-regulatory requirements applicable to the offer.

4.2. The following sources are prohibited outright:

• Addresses harvested from websites, social media, directories, or any other public source, whether by Customer or by a third party.
• Addresses generated by dictionary attack or any other automated combination of names and domains.
• Addresses obtained from a data breach, a leaked dataset, or any source Customer knows or ought reasonably to suspect was unlawfully obtained.
• Addresses of recipients who have opted out of receiving messages from Customer or from the relevant brand or advertiser.
• Addresses acquired from a source that cannot or will not evidence consent.

4.3. Co-registration data, appended data, rented lists, and third-party data supplied by an advertiser, network, or list owner are permitted only where Customer holds consent records satisfying Section 3.3 for each address, has disclosed the source under Section 4.1, has satisfied itself that the source's collection was lawful and its consent disclosure covered messages of the kind Customer will send, and the opt-in form through which the address was collected named Customer, the brand, or the advertiser on whose behalf the Campaign is sent among no more than ten (10) named partners.

4.4. Customer must not use the Services on behalf of, or provide access to, any person or entity listed on the Register of Known Spam Operations ("ROKSO"), which is a private list compiled and maintained by The Spamhaus Project rather than an official register, or any person Customer knows to be subject to an enforcement action by the Australian Communications and Media Authority, the United States Federal Trade Commission, or an equivalent authority in respect of electronic messaging. Before treating a ROKSO listing as a breach of this Section, PostLever will tell Customer of the listing and give Customer a reasonable opportunity to respond, including to show that the listing does not concern Customer or the person for whom it sends or that the listing is being contested with Spamhaus. That opportunity does not delay a suspension PostLever is entitled to make immediately under Section 13.2 on another ground.

5. MESSAGE REQUIREMENTS.

5.1. Every Campaign must:

• accurately identify Customer as the sender, or, where the Campaign is sent on behalf of a brand or advertiser, accurately identify that party as the sender, and include a valid physical postal address of the sender;
• identify clearly and conspicuously that the message is an advertisement or a solicitation, except where the recipient gave prior affirmative consent to receive it;
• where the Campaign promotes the goods, services, or website of more than one advertiser, designate a single one of them as the sole sender for the purposes of 16 CFR 316.2(m), identify that advertiser in the from line, and tell PostLever which advertiser has been designated;
• carry a subject line and preheader that accurately describe the message and do not mislead as to its content, origin, or purpose;
• carry a functional unsubscribe facility that meets the requirements of section 18 of the Spam Act, that is clear and conspicuous, that costs the recipient no more than nominal cost, that requires no login or information beyond an electronic address, and that remains functional for at least thirty (30) days after the message is sent;
• include one-click unsubscribe headers conforming to RFC 8058 where the Campaign is a marketing or promotional message; and
• be authenticated with SPF, DKIM, and a DMARC policy on the sending domain, with alignment passing.

An unsubscribe request made at any point within the thirty (30) day period in which the facility must remain functional, including on the last day of it, must still be given effect within the period in Section 5.2.

5.2. Customer must give effect to an unsubscribe request within five (5) business days, which is the Spam Act standard and is shorter than the ten business days permitted under CAN-SPAM. Where a recipient is in a jurisdiction imposing a shorter period, the shorter period applies.

5.3. Customer must honour every suppression source it is obliged to honour, and must connect it to the account before sending. PostLever applies suppression at send from the sources Customer has connected, and does not verify their completeness, accuracy, or currency.

5.4. The requirements in Sections 5.1 and 5.2 are Customer's obligations, not PostLever's, and PostLever's provision of tooling that assists with them does not transfer them.

6. CONTENT STANDARDS.

6.1. Before a Campaign is disseminated, Customer must hold the substantiation for every claim the Campaign makes, whether the claim is express or implied, and must make every disclosure the law applicable to the offer requires. Customer must produce that substantiation and evidence of those disclosures to PostLever on request under Section 12. Customer must not use the Services in connection with content that:

• is unlawful in a jurisdiction the Campaign is directed to, or promotes unlawful goods, services, or conduct;
• sexually exploits or endangers a child, or is otherwise harmful to minors. PostLever suspends any account connected with such material immediately and without notice, and reports it to law enforcement and to the Australian Centre to Counter Child Exploitation or the National Center for Missing and Exploited Children as appropriate, including where section 474.25 of the Criminal Code Act 1995 (Cth) obliges it to report the material or where a removal notice under the Online Safety Act 2021 (Cth) obliges it to remove or cease hosting the material. Immediate suspension, removal, and deletion under this AUP do not displace the preservation obligation in Section 13.5, and PostLever preserves the material that obligation covers for as long as it requires;
• is pornographic or sexually explicit, or promotes escort services, mail-order spouse services, or sexual encounter services;
• promotes, supports, or incites terrorism, violent extremism, or serious violence;
• constitutes hate speech, meaning content attacking or demeaning a person or group by reference to race, ethnic or national origin, religion, disability, sex, gender identity, sexual orientation, or age;
• promotes or encourages self-harm, suicide, disordered eating, or illicit drug use;
• infringes another person's intellectual property, or promotes counterfeit goods or services facilitating infringement;
• is defamatory, or discloses another person's sensitive personal information without consent;
• makes health, medical, therapeutic, or financial claims that are false, unsubstantiated, or not permitted in the jurisdiction addressed, including promotion of prescription medicines where their promotion is restricted;
• promotes a pyramid scheme, chain letter, matrix scheme, or a business or investment opportunity whose returns are misrepresented;
• is misleading or deceptive, or is likely to mislead or deceive, including as to price, availability, endorsement, affiliation, or the identity of the advertiser; or
• is malware, or links to a resource distributing malware, or is a phishing message or otherwise seeks to obtain credentials, payment details, or identity documents by deception.

6.2. Advertising claims and disclosures. Customer must comply with the advertising law applicable to each offer it promotes, and in particular must:

• disclose material connections between an endorser and the advertiser clearly and conspicuously as the United States Federal Trade Commission's Endorsement Guides (16 CFR Part 255) require, and must not use fake reviews, fabricated or unrepresentative testimonials, or creative formatted to read as a news article, an editorial, or independent content when it is advertising, which the Endorsement Guides and the Commission's Enforcement Policy Statement on Deceptively Formatted Advertisements each reach;
• comply with the Business Opportunity Rule (16 CFR Part 437), including its required disclosure document, for any Campaign promoting a money making opportunity. Customer acknowledges that Part 437, and the Notices of Penalty Offenses the Commission issued in October 2021 concerning money making opportunities and endorsements, are brought to its attention by this Section;
• disclose a recurring charge, its amount, and its frequency before billing information is collected, obtain express informed consent to it, provide a simple mechanism to cancel it, and otherwise comply with the Restore Online Shoppers' Confidence Act, for any Campaign promoting a free trial, a negative option, or a recurring charge; and
• comply with the Telemarketing Sales Rule (16 CFR Part 310) where a Campaign drives an outbound telephone call or a lead it generates is sold into a call centre.

7. PROHIBITED SENDING PRACTICES.

Customer must not:

• forge, falsify, or obscure a header, sender name, return path, or transmission path, or otherwise misrepresent the origin of a message;
• use a domain, brand, trade mark, or sender identity Customer is not authorised to use;
• use deceptive links, including links whose visible text misdescribes their destination, links concealed in images presented as other content, or redirect chains designed to obscure a destination;
• distribute sending across domains, subdomains, or IP addresses for the purpose of evading a spam filter, a reputation system, or a volume threshold, including the practices known as snowshoeing and waterfalling;
• re-mail addresses that have hard bounced, or continue mailing an address after it has generated a complaint;
• mail a list acquired to replace one that was suppressed, blocked, or terminated for a compliance reason;
• send test or seed traffic designed to misrepresent a Campaign's characteristics to a mailbox provider or filtering service; or
• use the Services to send messages Customer would be unable to send on its own infrastructure because of a suspension, a blocklisting, or an enforcement action.

8. PROHIBITED TECHNICAL CONDUCT.

Customer must not:

• gain or attempt to gain unauthorised access to any system, network, or account, whether PostLever's, another customer's, or a third party's, including by probing, scanning, or testing for vulnerabilities without permission;
• interfere with the normal operation of the Services, including by denial of service attack, or intercept or monitor data without permission;
• distribute malware, rootkits, spyware, adware, password crackers, keystroke capture software, or comparable tooling;
• consume platform resources at a level that materially degrades the Services for other customers, or run scripts or processes that do so. Where PostLever raises resource consumption with Customer it will identify the specific behaviour and give Customer a reasonable opportunity to change it before taking further action;
• reverse engineer, decompile, or disassemble the PostLever Platform, or use it to build a competing product;
• use any image uploaded or stored on the Platform other than solely for the purpose of creating, managing, and delivering email communications through the Services, use the PostLever Platform as a general-purpose content hosting service, or serve, link, or embed assets stored on the Platform for any purpose unrelated to the delivery of Campaigns through the Services; or
• use any contact data uploaded or stored on the Platform other than solely for the purpose of managing and delivering email communications through the Services, use the PostLever Platform as a general-purpose contact database or data warehouse, or store contact data on the Platform for any purpose unrelated to the delivery of Campaigns through the Services.

9. DELIVERABILITY STANDARDS.

9.1. Customer must manage its sending so that it does not harm recipients, mailbox providers, other customers, or PostLever's platform edge. Customer breaches this Section where its sending attracts complaints from mailbox providers or from law enforcement, generates an unreasonable number of complaints from recipients, or results in excessive blocklistings or in a blocklisting that is not resolved. That standard is the contractual trigger for action under Section 13.

9.2. As at the date of this AUP, Google, Yahoo, and Microsoft require bulk senders to keep the spam complaint rate below 0.3%, to authenticate with SPF, DKIM, and DMARC, and to offer one-click unsubscribe, and they reject or filter mail that fails. Those are the requirements those mailbox providers had published as at that date, not PostLever's, and each of them may change what it requires without notice to PostLever or to Customer.

9.3. PostLever measures complaint rate and bounce rate per sending domain and per account, and applies the following trigger points:

9.4. The review stage and the action stage are keyed to the standard in Section 9.1. Where PostLever reasonably considers that Customer's sending has reached that standard, it will raise the matter with Customer and may require a remediation plan. Where the matter is not remedied, where it recurs, or where the sending is causing harm of the kind Section 9.1 describes, PostLever may throttle, restrict, or suspend sending under Section 13. The measures in Section 9.3 describe what PostLever monitors and the points at which it ordinarily reviews and acts; they are not themselves the contractual trigger, and they neither limit nor extend Section 9.1. PostLever will tell Customer which measure was reached and on what data.

9.5. Where Customer's sending causes a domain or IP address served by the PostLever platform edge to be blocklisted, Customer must cooperate in delisting, and PostLever may restrict Customer to its own infrastructure for the affected traffic while the listing stands.

10. SUSPENSION AND OFFER OBLIGATIONS.

10.1. Where Customer sends on behalf of an advertiser, Customer is responsible for honouring that advertiser's suppression obligations and any restriction the advertiser imposes on creative, claims, or audience. PostLever is not a party to the arrangement between Customer and its advertisers.

10.2. Customer must not represent to any third party that PostLever has reviewed, approved, or verified a Campaign, an offer, a data source, or a consent record.

11. REPORTING ABUSE.

Anyone may report a suspected breach of this AUP to abuse@postlever.com. PostLever reviews reports it receives, and is not required to establish the validity of a complaint received from a recipient, a mailbox provider, a blocklist operator, or an anti-abuse organisation before acting under Section 13, provided it acts reasonably on the information available. PostLever is not obliged to identify a complainant to Customer.

12. INFORMATION REQUESTS AND COOPERATION.

12.1. Customer must respond to a request from PostLever's compliance team within five (5) business days of the request, or within any shorter period the request reasonably specifies where the matter is urgent.

12.2. Customer must provide the information PostLever reasonably requests to assess compliance, including consent records under Section 3.3, data source information under Section 4.1, creative, landing pages, advertiser identity, and sending configuration.

12.3. Where a regulator, mailbox provider, blocklist operator, or law enforcement agency makes a request or brings an action relating to Customer's sending, Customer must cooperate with PostLever in responding, and PostLever may disclose information about Customer's account to that body where it is required to do so or where disclosure is reasonably necessary to respond.

13. ENFORCEMENT.

13.1. PostLever enforces this AUP proportionately to the breach, acting reasonably. Depending on severity, persistence, and the risk to recipients, other customers, and PostLever, PostLever may:

• raise the matter with Customer and require a remediation plan;
• throttle or restrict sending, on a domain, a brand, or the account;
• require Customer to move affected traffic to its own infrastructure;
• suspend the Services in whole or in part under Section 9.3 of the TOS; or
• terminate the Agreement for cause under Section 9.2.2 of the TOS.

Enforcement on the deliverability ground ordinarily runs in two stages. At the review stage, sending continues, PostLever raises the matter with Customer, tells Customer what it has observed and on what data, and may require a remediation plan and a reasonable time to carry it out. At the action stage, reached where the matter is not remedied within that time, where it recurs, or where the sending is causing harm of the kind Section 9.1 describes, PostLever may throttle, restrict, or suspend sending. Both stages are keyed to the standard in Section 9.1 rather than to the measures in Section 9.3, and both are subject to Sections 13.2 and 13.3.

13.2. PostLever will ordinarily raise a breach with Customer and give it a reasonable opportunity to remedy before suspending. PostLever may suspend immediately, without prior notice, where the breach involves material within the second bullet of Section 6.1, where there is a credible risk of serious harm to a person, where Customer's sending is actively damaging the deliverability of other customers or PostLever's platform edge, where immediate action is required by law or by a regulator, where PostLever reasonably suspects fraud, where payment fails or a charge is reversed by way of chargeback, where screening returns a hit under Section 16, where Customer fails to produce consent records under Section 3.4, where a domain served by the PostLever platform edge is blocklisted, where a regulator or a mailbox provider raises a matter that is urgent, or where the Services are being used by or on behalf of a person barred under Section 4.4. PostLever will notify Customer as soon as reasonably practicable after suspending and will state the ground.

13.3. A suspension will be no broader in scope and no longer in duration than is reasonably necessary to address the matter, and PostLever will restore the Services promptly once it is resolved.

13.4. Appeal. Customer may contest a decision under this Section by writing to compliance@postlever.com setting out why it says the decision was wrong. PostLever will review the decision, will consider any evidence Customer provides, and will complete the review and notify Customer of the outcome within five (5) business days of receiving a complete appeal. PostLever will reverse the decision and restore the Services if the review shows it was not justified. An appeal does not suspend a decision taken under Section 13.2.

13.5. PostLever reports breaches to law enforcement or to a regulator where it is required to, or where the breach involves material within the second bullet of Section 6.1. Where PostLever is required by law to preserve reported material, it preserves that material for as long as the obligation requires and notwithstanding any commitment in the Agreement to delete or return Customer Data. That includes preserving a report of material within the second bullet of Section 6.1, and the contents of that report, for at least ninety (90) days after it is made, as 18 USC 2258A(h) requires, and preserving material held under a removal notice under the Online Safety Act 2021 (Cth) or under an obligation arising from section 474.25 of the Criminal Code Act 1995 (Cth).

13.6. PostLever's decision not to enforce a provision of this AUP on one occasion is not a waiver of its right to enforce it on another.

14. CHANGES TO THIS POLICY.

14.1. PostLever may amend this AUP on the notice terms and with the termination right set out in the change-of-terms provision of the TOS.

14.2. An amendment that is required by law or by a regulator, or that is reasonably necessary to address an active security or abuse threat, takes effect on publication, and PostLever will notify Customer of it as soon as reasonably practicable afterwards. Every other amendment takes effect on the notice terms and with the termination right in Section 14.1, including an amendment that tightens a measure in Section 9.3 or any other point on which throttling, restriction, or suspension turns, which is a materially adverse change for those purposes.

15. COPYRIGHT COMPLAINTS AND REPEAT INFRINGERS.

15.1. PostLever stores and serves material at the direction of its customers, and it operates the notification and counter notification procedure in this Section for claimed copyright infringement in that material. Nothing in this Section obliges PostLever to monitor the Services or to seek facts indicating infringing activity.

15.2. A notification of claimed infringement must be in writing to PostLever's designated agent and must include: a physical or electronic signature of a person authorised to act on behalf of the owner of an exclusive right that is allegedly infringed; identification of the copyrighted work claimed to have been infringed, or, where multiple works at a single site are covered by a single notification, a representative list of them; identification of the material claimed to be infringing or to be the subject of infringing activity, and information reasonably sufficient to permit PostLever to locate it; information reasonably sufficient to permit PostLever to contact the complaining party, including an address, a telephone number, and, if available, an electronic mail address; a statement that the complaining party has a good faith belief that the use complained of is not authorised by the copyright owner, its agent, or the law; and a statement that the information in the notification is accurate, and, under penalty of perjury, that the complaining party is authorised to act on behalf of the owner of an exclusive right that is allegedly infringed. Those are the elements 17 USC 512(c)(3) requires, and a notification that does not substantially contain them does not put PostLever on notice.

15.3. PostLever removes or disables access to material that is the subject of a compliant notification, and takes reasonable steps to tell the customer that it has done so. A customer whose material has been removed or disabled may send a counter notification to the designated agent containing: the customer's physical or electronic signature; identification of the material removed or disabled and the location at which it appeared before it was removed or disabled; a statement under penalty of perjury that the customer has a good faith belief that the material was removed or disabled as a result of mistake or misidentification; and the customer's name, address, and telephone number, together with a consent to the jurisdiction of the Federal District Court for the judicial district in which that address is located, or, where the address is outside the United States, of any judicial district in which PostLever may be found, and a statement that the customer will accept service of process from the complaining party or its agent. PostLever forwards a counter notification to the complaining party, and, unless the complaining party first notifies PostLever that it has filed an action seeking a court order to restrain the infringing activity, restores the material in not less than ten (10) and not more than fourteen (14) business days after receiving the counter notification.

15.4. Designated agent. Notifications and counter notifications must be sent to PostLever's designated agent. The agent's title, postal address and electronic mail address are:

Compliance Officer
PostLever Pty Ltd ACN 701 249 881
7 High Street, Victoria Point, Queensland 4165, Australia
Electronic mail: compliance@postlever.com

The copyright section of the PostLever website terms of use carries the same agent details. 17 USC 512(c)(2) requires those details both to be available to the public on the service provider's website and to be provided to the United States Copyright Office in a designation filed with it, and nothing in this Section is a representation that PostLever has filed one.

15.5. Repeat infringer termination policy. This Section is PostLever's policy for the termination, in appropriate circumstances, of the accounts of repeat infringers, adopted and implemented for the purposes of 17 USC 512(i)(1)(A). PostLever records each notification of claimed infringement it receives against an account, each counter notification, and the action it took, and retains that record for the life of the account and for two years afterwards. Where an account is the subject of repeated notifications of claimed infringement, PostLever terminates it, having regard to the number of notifications, whether any was withdrawn or answered by a counter notification, and the seriousness of the conduct.

16. SANCTIONS AND RESTRICTED PARTIES.

16.1. Customer must not use the Services, and must not permit an Authorised User to use them, for or on behalf of a person or entity that is designated, listed, or otherwise subject to a sanction under the Autonomous Sanctions Act 2011 (Cth) or the Charter of the United Nations Act 1945 (Cth), or under a sanctions regime of the United States, the United Kingdom, the European Union, or the United Nations. That includes a person named on the Consolidated List maintained by the Australian Department of Foreign Affairs and Trade and a person named on the Specially Designated Nationals and Blocked Persons List maintained by the United States Office of Foreign Assets Control.

16.2. Customer represents and warrants that neither it, nor a person that owns or controls it, nor an Authorised User, nor an advertiser on whose behalf it sends, is such a person, and must tell PostLever promptly if that ceases to be true. Customer must cooperate with the screening PostLever conducts, including by providing the identity, ownership, and control information PostLever reasonably requests.

16.3. Where screening returns a hit against Customer, an Authorised User, a person that owns or controls Customer, or an advertiser on whose behalf Customer sends, PostLever may suspend the Services immediately and without prior notice under Section 13.2, and may keep them suspended until the matter is resolved. PostLever's own obligations under those regimes are in the trade controls provision of the TOS.