Unsolicited Email & Anti-Spam Policy

1. Purpose:

Lumana AI is committed to responsible business communications, protecting the reputation of its corporate domain, and preventing unsolicited, unauthorized, deceptive, or abusive email activity.

This policy establishes mandatory standards for outbound email communications and ensures compliance with applicable anti-spam legislation, email service provider policies, and industry best practices.

2. Scope:

This policy applies to all email originating from:

- Lumana AI's primary corporate domain.

- Any company-owned secondary domain or subdomain.

- Company email accounts and connected applications.

- Sales engagement, marketing automation, CRM, and third-party outreach platforms.

- Any employee, contractor, or agency acting on behalf of Lumana AI.

3. Prohibited Activities

Lumana AI strictly prohibits:

1. Sending unsolicited bulk or mass email without approved authorization and an applicable lawful basis.

2. Using the primary corporate domain for automated cold-email campaigns or high-volume prospecting.

3. Sending commercial communications to recipients who have unsubscribed, objected, or requested no further contact.

4. Using purchased, scraped, harvested, or otherwise unverified contact lists without documented compliance review and authorization.

5. Sending emails using misleading subject lines, deceptive identities, or falsified sender information.

6. Circumventing company sending limits, suppression lists, or email security controls.

7. Using unauthorized third-party outreach platforms connected to corporate email accounts.

8. Continuing outreach after receiving abuse complaints, elevated bounce rates, or provider warnings.

9. Rotating domains, inboxes, or sending infrastructure to evade blocks, suppression requirements, or provider enforcement.

4. Authorized Business Communications

Lumana AI permits legitimate business communications, including:

- Customer support and service communications.

- Existing customer and partner correspondence.

-Transactional and operational notifications.

- Individual, relevant business development communications that comply with applicable laws and company approval requirements.

- Approved marketing campaigns sent through authorized systems to appropriately sourced audiences.

All communications must use accurate sender identification, truthful content, and applicable unsubscribe or objection mechanisms.

Unsolicited sales outreach requires documented approval from Revenue Operations and compliance with applicable jurisdiction-specific rules.

5. Corporate Domain Protection

The primary Lumana AI domain is designated for trusted corporate, customer, partner, and operational communications.

Automated prospecting and bulk promotional campaigns are prohibited from the primary corporate domain.

Where permitted, marketing communications must use approved, authenticated sending infrastructure with appropriate monitoring, recipient eligibility checks, and suppression controls.

No alternate domain or sending platform may be used to bypass an existing block or abuse restriction.

6. Consent, Recipient Eligibility, and Opt-OutBefore sending commercial outreach, employees and approved systems must:

- Verify the source and business relevance of recipient information.

- Establish and document the applicable consent or other lawful basis where required.

- Respect applicable regional marketing and privacy regulations.- Provide required sender identification and unsubscribe mechanisms.

- Maintain centralized suppression and do-not-contact records.

- Process unsubscribe and objection requests promptly, with a company target of 48 hours and always within applicable legal deadlines.

- Prevent re-importing suppressed contacts into future campaigns.Consent requirements and other outreach restrictions must be assessed based on recipient jurisdiction.

7. Sending Limits and Monitoring

Lumana AI establishes centralized oversight of outbound promotional email.

Mandatory controls include:

- Approved sending accounts and connected applications.

- Defined daily and hourly sending limits appropriate to account purpose and reputation.

- Monitoring of delivery failures, bounce rates, complaints, and unsubscribe requests.

- Immediate suspension of sending activity when material abuse indicators are detected.

- Periodic reviews of sender reputation, authentication, and outbound email practices.

- Escalation of suspected violations to IT/Security and Revenue Operations.

Google Workspace, Microsoft 365, or other email platform controls must be configured and enforced as applicable.

8. Technical Authentication and Security

All authorized email-sending infrastructure must implement applicable authentication and security standards, including:

- SPF.

- DKIM.

- DMARC.

- TLS for email transmission.

- Appropriate DNS and sender configuration.

- Controlled authorization for third-party applications.

- Periodic access and account activity reviews.

Email delivery configurations must conform to the requirements of the relevant mailbox providers.

9. Incident Response and Remediation

Any suspected spam incident, blocklisting event, unauthorized bulk campaign, or abnormal sending pattern must be reported promptly.

Lumana AI's response process includes:

1. Identifying the sending account, application, and source of the incident.

2. Immediately suspending the offending activity.

3. Reviewing message logs, recipient sources, and sending permissions.

4. Revoking unauthorized application access where applicable.

5. Removing noncompliant recipient lists and updating suppression records.

6. Investigating the root cause and documenting corrective actions.

7. Validating technical configuration and ongoing compliance.

8. Requesting delisting or account reinstatement only after appropriate remediation.

9. Monitoring subsequent sending activity for recurrence.

10. Employee Training and Enforcement

Employees involved in sales, marketing, customer communications, or email administration must receive training on this policy.

Violations may result in:

- Immediate suspension of outbound email privileges.

- Mandatory retraining.

- Removal of access to outreach tools.

- Disciplinary measures, up to and including termination, consistent with applicable law and company procedures.

11. Ownership and ReviewRevenue Operations and IT/Security are jointly responsible for enforcing this policy.

This policy will be reviewed at least annually and following material email security, compliance, or sender reputation incidents.

Any exceptions require written approval from the designated policy owners.