Acceptable Use Policy

1. Scope

This Acceptable Use Policy ("AUP") sets out what you may and may not do with LexLab products and services. It applies to everything we sell, including:

• LexlabMTA and LexLab Relay — dedicated-IP SMTP for application email and campaigns
• VPS and Windows RDP hosting — resold from Contabo
• Domain registration and DNS — resold from Namecheap
• Tools, website templates and marketplace listings
• SMM panel orders
• Engineering and custom development work

It applies to you as the account holder and to anyone acting through your account — staff, contractors, agencies, resellers, and your own end users. If someone sends, hosts, or publishes through your account, you are responsible for what they do. If you resell LexLab services, you are responsible for your downstream customers and for holding them to terms at least as strict as these.

This policy sits alongside our Terms of Service. Where a service is resold from an upstream provider, that provider's terms apply in addition to this one — see Section 7.

2. Intended Use of Products and Services

LexLab products and services are intended for:

• Businesses building and running web applications and platforms
• Web developers and agencies delivering client projects
• Companies that need hosting, domains and digital infrastructure
• Application email — signups, receipts, alerts, password resets — sent to your own users
• Campaigns sent to recipients who opted in to hear from you
• Educational use, portfolio demonstrations and personal projects

3. Strictly Prohibited Activities

You are strictly prohibited from using LexLab products or services for any of the following:

Financial Crimes & Fraud

• Phishing websites or pages designed to steal credentials or financial information
• Operating Ponzi schemes, pyramid schemes, or investment fraud
• Money laundering or facilitating illegal financial transactions
• Payment fraud, identity theft, or unauthorised data collection
• Operating unlicensed financial services where licensing is required
• Fake cryptocurrency exchanges or trading platforms designed to defraud users

Deceptive Practices

• Impersonating another business, institution or person
• Creating fake or counterfeit websites to deceive users
• Misleading consumers about product authenticity or business legitimacy
• Operating scam websites of any kind
• Social engineering attacks or pretexting
• Fake online stores that do not deliver products
• Romance scams, lottery scams, or advance-fee fraud

Illegal Content & Activities

• Distribution of malware, viruses, ransomware, or spyware
• Hacking, unauthorised access, or cyberattacks
• Drug trafficking or sale of controlled substances
• Human trafficking or exploitation
• Terrorism financing or support
• Child exploitation material (CSAM) — reported to authorities immediately
• Sale of weapons, explosives, or dangerous materials
• Harassment, stalking, or threats

Spam & Abuse

• Mass unsolicited email (spam)
• Harvesting personal data without consent
• Creating fake accounts or automated bot networks
• DDoS attacks or network disruption
• Scraping or data mining without authorisation

4. Sending Infrastructure — Prohibited Use

This section covers LexlabMTA and LexLab Relay. It applies to every message that leaves our infrastructure under your account, whatever generated it — a campaign tool, your application, a cron job. Campaign mail and application mail are both fine. What matters is who you send to and how.

You may not use LexLab sending infrastructure for:

• Unsolicited bulk email. Any message sent at volume to recipients who did not ask to hear from you. It does not matter how the campaign is described internally — cold outreach, prospecting, re-engagement, or a "warm list" from a previous business. If the recipient did not opt in, it is spam.
• Purchased, rented, scraped, or appended recipient lists. This includes lists bought from data brokers, lists harvested from websites, LinkedIn, or public directories, lists obtained through email-appending services, and lists acquired with a company or domain you did not run at the time consent was given.
• Phishing and credential harvesting. Messages that direct recipients to fake login pages, payment forms, MFA prompts, or anything else designed to capture credentials, session tokens, or financial details.
• Brand impersonation. Sending as, or on behalf of, a company, institution, or individual you have no authorisation to represent. This includes lookalike domains, homoglyph domains, and display names chosen to imply a relationship that does not exist.
• Spoofed or forged headers and sender identities. Forging From, Return-Path, Reply-To, Message-ID, or Received headers; falsifying originating IP or hostname information; injecting headers to disguise the true source of a message.
• Malware and malicious links. Attaching or linking to malware, ransomware, droppers, credential stealers, exploit kits, or any URL that redirects to them — including through shorteners, open redirects, or compromised third-party sites.
• Evading unsubscribe requests. Continuing to mail a recipient who opted out; moving an opted-out address to a different list, sending domain, subaccount, or provider to keep mailing them; making unsubscribe deliberately hard to find, slow to take effect, or dependent on logging in.

Sending infrastructure is also covered by everything in Section 3. The list above is the part specific to email.

5. Sender Requirements

If you send through LexLab, these are not suggestions. They are conditions of keeping the service.

• Consent. Every recipient must have given you permission to email them, and you must be able to show where and when. Keep the record: signup timestamp, source IP or form URL, and what the recipient agreed to. We may ask for it during an abuse investigation.
• Working unsubscribe. Every commercial message needs a clear, one-click way out that works without a login. Honour opt-outs across all of your lists and sending domains, not just the one the recipient happened to receive. Process them within 48 hours. Bulk mail must carry List-Unsubscribe and List-Unsubscribe-Post headers.
• Accurate sender identity. The From name and address must identify who is actually sending. Reply-To must reach an address a human reads. Subject lines must describe the message honestly. No misleading pretexts.
• Authentication alignment. Your sending domains need valid SPF, DKIM, and DMARC records, and they need to align with the domain in the visible From header. We give you the records to publish at provisioning. If alignment breaks — a DNS change, an expired key, a third-party sender added to your SPF record — fix it. Sending on a domain that fails alignment gets throttled.
• Postal address and identification. Include a valid postal address and a clear statement of who you are in commercial mail wherever the law in your recipients' country requires it — CAN-SPAM, CASL, GDPR and their equivalents.
• List hygiene. Remove hard bounces immediately. Suppress addresses that have stopped engaging rather than mailing them forever; a list that never shrinks is how bounce rates climb past the thresholds in Section 8. Do not re-import addresses you previously removed.

6. Rate Limits, Warm-up and Sending Volume

Every account gets a daily sending cap set at provisioning, based on the plan purchased and the warm-up state of your dedicated IP and domains. Your cap is stated in your service details. It is a technical limit and a contractual one.

• New accounts warm up. We set the initial daily cap and raise it as your delivery history justifies it. Ramp schedules may not be skipped.
• Increases are available on request through your dashboard or support. Small steps are quick. Large increases need 7 days' lead time so the IP can be warmed to the new volume. Increases are granted on delivery history, not on how much you need to send.
• You may not circumvent your cap. That includes splitting a campaign across multiple accounts, API keys, IPs, or sending domains to stay under per-object limits while exceeding your total.
• You may not open additional accounts to obtain additional capacity, or have a third party open them on your behalf.
• Traffic above your cap is queued or rejected at the relay. Repeated attempts to push past it are treated as a policy violation under Section 9, not as a capacity problem.
• Idle IPs. An account with no sending for 60 days may have its dedicated IP reclaimed after notice. If you are pausing deliberately, tell us before, not after.

7. Hosting and Domains — Prohibited Use

This section covers VPS and RDP hosting resold from Contabo, and domains registered through Namecheap.

You may not use LexLab hosting or domains to:

• Host, stage, or distribute malware, ransomware, exploit kits, credential stealers, or command-and-control infrastructure
• Host phishing pages, phishing kits, fake login portals, or reverse-proxy credential capture
• Run open relays, open proxies, or open resolvers
• Launch port scans, brute-force attempts, DDoS traffic, or any unauthorised access attempt against systems you do not own
• Register or use domains that impersonate another organisation, including typosquats and homoglyph variants of established brands
• Host content that violates the terms of the upstream provider carrying it

Upstream terms apply on top of this policy. Contabo's terms of service and acceptable use policy govern all VPS and RDP hosting. Namecheap's registration agreement and acceptable use policy, and ICANN's requirements, govern all domains. Read them — they bind you directly.

Contabo and Namecheap can suspend a service or a domain on their own initiative, without consulting us and without prior notice to you. When that happens we pass on whatever information we receive, but we cannot reverse an upstream suspension and we cannot compel reinstatement.

8. Monitoring

We monitor sending infrastructure per account. Each account has its own dedicated IP, but all of our IPs sit in the same ranges and carry our reputation with the large receivers. One sender's behaviour lands on the neighbours.

What we track:

• Blocklist status of sending IPs and domains across the major public and commercial blocklists, plus reputation signals from the large receiving providers
• Bounce rates, hard and soft, broken out per campaign and per sending domain
• Deferral rates and rejection reasons returned by receiving servers
• Send volume against your provisioned cap, including short spikes
• Complaint rates from feedback loops where the receiving provider offers one
• Abuse reports received at support@lexlabtools.com or forwarded to us by an upstream provider

What triggers a review:

• A sending IP or domain appearing on a major blocklist
• A bounce rate above 5% over any 24-hour window
• A complaint rate above 0.1% over any 24-hour window
• Sustained deferrals or rejections from a major receiving provider
• Volume exceeding your provisioned cap, or a sudden spike inconsistent with your normal pattern
• Any credible abuse report naming your account

Above 10% bounces or 0.3% complaints we pause sending until the cause is fixed. That is not a judgement call; it is where the receivers start blocking the whole range.

Monitoring is based on delivery telemetry and headers rather than routine inspection of message bodies. When we are investigating a specific abuse report, a blocklisting, or an upstream complaint, we may examine full message content, including bodies and attachments, to establish what was sent.

9. Enforcement

Most problems are mistakes — a bad import, a misconfigured DNS record, a client who was less careful than you were. The response is graduated to match.

1. Warning. We contact you with what we found and what needs to change. You have 48 hours to fix it and tell us what you did.
2. Throttle. If the problem continues, or the metrics are damaging shared reputation, we reduce your sending rate below your provisioned cap while you work through it. Throttles lift when the underlying numbers recover.
3. Suspension. Sending, hosting, or both are stopped. Your data stays in place while the suspension is open. Reinstatement requires a written explanation of the cause and the fix.
4. Termination. The account is closed and access to all services is revoked. The deletion schedule in the Data Processing Agreement then applies.

Phishing and malware skip the ladder. Confirmed phishing, credential harvesting, malware distribution, CSAM, or anything else illegal results in immediate suspension without prior notice, followed by investigation. CSAM is reported to NCMEC and law enforcement the same day. There is no warning step for these.

We may also act immediately, without working through the stages, where a violation is causing active harm to recipients, to shared reputation, or to our standing with an upstream provider.

Other consequences of enforcement action:

• No refunds. Accounts terminated for policy violations are not eligible for refunds of any kind, including unused prepaid balance or the remainder of a billing period.
• Product revocation. Access to purchased products, licences, and services is revoked on termination.
• Data retention. We may retain account records, delivery logs, and evidence for legal purposes and law enforcement cooperation after termination.

If you think an enforcement decision is wrong, reply to the notice you received. We will look at it again. Appeals do not lift a suspension while they are pending.

10. Your Responsibilities

As a LexLab client, you are solely responsible for:

• Ensuring your use complies with all applicable local, national, and international laws
• Obtaining necessary licences, permits, and regulatory approvals for your business
• Implementing proper legal disclaimers and terms on your deployed applications
• Verifying the legality of your business model in your jurisdiction
• Protecting end-user data in accordance with privacy regulations (GDPR, CCPA, and equivalents)
• Keeping your account credentials, API keys, and SMTP credentials secure — compromised credentials used to send spam are still your account's traffic
• All content created, sent, hosted, or distributed using our products

11. Law Enforcement Cooperation

LexLab takes violations of this policy seriously:

• We cooperate with law enforcement agencies investigating illegal activities
• We may report suspected criminal activity to appropriate authorities
• We comply with valid legal requests, subpoenas, and court orders
• We keep logs and records that may be provided to investigators
• Child exploitation material is reported immediately to NCMEC and law enforcement

12. Disclaimer of Liability

LexLab provides software tools, sending infrastructure, hosting, domains and engineering services for legitimate purposes. We are not responsible for:

• How clients choose to deploy or use our products and services
• Illegal activities conducted by clients using our products and services
• Third-party actions or content created, sent, or hosted using our tools
• Compliance failures by clients in their respective jurisdictions
• Suspensions or terminations applied directly by an upstream provider

Clients bear full legal responsibility for their actions and any consequences arising from misuse of our products and services.

13. Reporting Abuse

If you have received spam, a phishing message, or malware from LexLab infrastructure, or you have found abusive content hosted on it, report it to support@lexlabtools.com.

Include as much of the following as you have — it decides how fast we can act:

• Full message source with complete headers, not a forwarded copy or a screenshot
• The date and time you received it, with timezone
• The sending IP address, envelope sender, and any URLs in the message
• For hosted content: the URL, the IP, and what is wrong with it

We acknowledge abuse reports within 24 hours and aim to resolve or escalate within 72 hours. Reports involving active phishing or malware are handled ahead of everything else.

You can also use the contact form or message @lexlabtools on Telegram, though emailing the address above with full headers is fastest.

14. Changes to This Policy

We update this policy as services change and as upstream requirements change. The current version always lives at this URL, with the revision date at the top of the page.

• Material changes — new restrictions, tighter thresholds, or anything that affects how you can use a service you already pay for — are announced on this page, and by email or on Telegram, at least 14 days before they take effect.
• Clarifications, corrections, and new examples that do not change what is permitted take effect when posted.
• Changes required by law, by an upstream provider, or to stop active abuse take effect immediately. We will tell you as soon as we can afterwards.

Continuing to use LexLab services after a change takes effect means you accept the updated policy. If you do not accept a material change, tell us before the effective date and we will discuss options for winding down your service.