Acceptable Use Policy

What you may and may not do with RatifAi. This policy forms part of the Terms of Service. Last updated 7 October 2026.

RatifAi is a data-quality tool. It does not send email. But the data you put through it is personal data about real people, and the shared intelligence it builds is relied on by every other customer. Both facts shape this policy.

1. You must have a lawful basis for the data you submit

Do not submit contact data you have no right to process. In practice that means you must not use RatifAi to validate, enrich or deduplicate:

Lists purchased, rented or scraped where you have no lawful basis to process the individuals in them.
Data obtained through a breach, a credential dump, or any unauthorised access.
Data you are contractually or legally barred from disclosing to a processor.

We do not police the provenance of your data, and we cannot. The obligation is yours, and you confirm it each time you submit.

2. Do not use RatifAi to enable unsolicited or abusive mail

Verification cleans a list; it does not make sending to that list lawful. You must not use RatifAi to:

Prepare lists for sending that would breach anti-spam law in the recipient’s jurisdiction — including CAN-SPAM, CASL, the UK PECR or the EU ePrivacy rules.
Validate addresses in order to send phishing, malware, fraud or any deceptive commercial message.
Identify which addresses in a breached or harvested set are live.

3. Do not circumvent the suppression list

The suppression list records hard bounces, complaints, spamtraps and abuse reports as one-way hashes. It exists so that nobody re-contacts a person who has already objected, or hits a trap.

You must not attempt to defeat it — by probing for suppressed addresses, by re-submitting under altered forms to obtain a different verdict, or by using the service to determine whether a given address is suppressed in order to route around it. Suppression entries are deliberately retained even through an erasure, because removing them would cause the harm they prevent.

4. Do not harvest

The email finder exists to confirm or locate a business contact you have a legitimate reason to reach. You must not use it to generate contact lists at scale from domains with which you have no relationship, nor to enumerate the staff of an organisation for resale.

5. Do not extract or resell the shared corpus

The pseudonymised corpus is ours and is built from everyone’s checks. You must not attempt to extract, reconstruct, mirror or resell it, nor use the API primarily as a means of bulk-reading it rather than validating your own data. You must not attempt to reverse the address pseudonyms.

6. Respect rate limits and capacity

Each plan carries a documented per-minute rate limit. Do not attempt to exceed it by rotating API keys, creating multiple accounts, or distributing requests across accounts to obtain capacity you have not paid for. Do not use the service in a way that degrades it for others.

7. Do not attack or probe the service

No penetration testing, vulnerability scanning, load testing, reverse engineering or attempts to access another tenant’s data without our prior written permission. If you believe you have found a security vulnerability, report it to security@ratifai.app and give us a reasonable opportunity to fix it before disclosing it. We will not pursue a researcher who reports in good faith and does not access, modify or retain other customers’ data.

8. One account per organisation

Do not create multiple accounts to obtain repeated Free-plan allowances, to evade a suspension, or to exceed a seat limit. Seats are per plan and named users are not to be shared.

9. High-risk uses

RatifAi verdicts are probabilistic. Do not use them as the sole basis for a decision that produces a legal or similarly significant effect on a person — denying someone credit, employment, housing, insurance or access to a service. If a verdict informs such a decision, a human must review it and other evidence must support it.

10. What happens if you breach this policy

Depending on severity we may contact you, rate-limit you, suspend specific capabilities, suspend the account, or terminate it. Where circumstances allow we will tell you what we have seen and give you a chance to fix it. Where we believe there is an imminent risk of harm — to a data subject, to the corpus, or to our infrastructure — we may act first and explain promptly afterwards.

We may also be required to report certain activity to law enforcement.

11. Reporting abuse

To report a suspected breach of this policy by another user, or to raise a concern about how your own data has been handled, write to abuse@ratifai.app. Data-protection questions go to privacy@ratifai.app.

12. Changes

We may update this policy. Material changes are notified in the same way as changes to the Terms of Service. The date at the top reflects the current version.