Legal · Compliance
Email compliance
UK GDPR is in the DPA. CAN-SPAM rules below are the general US commercial-email requirements. They are not a certification.
The data processing agreement covers UK GDPR: roles, sub-processors, transfers, and security. The privacy policy points at the same frame. Neither document says that cold email is or is not legal in every country.
CAN-SPAM, in general
The US CAN-SPAM Act sets rules for commercial email. This page describes those rules in plain language. It is not legal advice, and Prospect AI does not claim a certification.
- Headers and the From line must identify who sent the message. They must not be deceptive.
- Subject lines must reflect the content of the message. They must not be misleading.
- The message must include a valid physical postal address of the sender.
- The message must include a clear way to opt out of future commercial email.
- Opt-out requests must be honored within 10 business days.
- The address of someone who opted out must not be sold or transferred, except as needed to stop further mail.
Cold email on the product goes out from dedicated domains and inboxes, not the customer's primary domain. See infrastructure. The same question is answered on the DPA page.