Acceptable use policy

This policy applies to organizations using Mühür Mail, their team members and the users of the mailboxes organizations create. It covers every channel of the service, including webmail, the mobile app, IMAP and SMTP connections and Mühür Assistant.

This policy is an integral part of the terms of service, and the two documents are read together. The organization that creates mailboxes is responsible for making sure their users follow this policy.

Mühür Mail is designed for organizations' everyday business correspondence on their own domain:

• Person-to-person correspondence: with customers, suppliers, colleagues and institutions.
• Transactional messages: quotes, orders, invoices, appointments, support replies and other messages the recipient expects and that relate to a transaction.
• Announcements with a reasonable number of recipients, sent to the organization's own team and to people it has a business relationship with.

Newsletters, campaigns and other bulk marketing sends are not within the scope of the service. For these, use a service dedicated to bulk email that manages consent and unsubscribes. You can connect your domain to that service as well; your Mühür Mail mailboxes are not affected.

Mühür Mail may not be used to:

• Send unsolicited bulk messages (spam), or send messages to large numbers of people without their consent or an existing relationship.
• Send messages to address lists that were bought, rented, scraped from the internet or otherwise obtained without permission.
• Phish: send messages designed to obtain passwords, card details or personal data, or link to pages that do so.
• Send malware or ransomware, or links to them.
• Falsify sender information; impersonate another person, organization or public authority; mislead the recipient about the source of a message.
• Try to connect, or send on behalf of, a domain you don't own or aren't authorized to use.
• Send or store unlawful content: content that infringes others' intellectual property rights, contains threats, harassment or hate, relates to child abuse or constitutes a criminal offence.
• Process, transfer or disclose other people's personal data without a legal basis.
• Circumvent these prohibitions indirectly, for example by creating many mailboxes, aliases or domains.

Commercial electronic messages that promote your goods and services or your organization must comply with Turkish Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. In particular:

• The recipient's prior consent must be obtained, subject to the exceptions provided by law.
• The sending organization must be clearly identified, and the recipient must be able to opt out easily and free of charge.
• Once an opt-out is received, no further commercial messages may be sent to that recipient.
• Record-keeping and notification obligations under the legislation, including those relating to the Message Management System (İleti Yönetim Sistemi, İYS), belong to the organization.

Compliance with commercial message legislation is the organization's responsibility. As a reminder, the service is not suited to bulk marketing sends (see "What the service is designed for").

Whether a message reaches the inbox depends on the reputation of the sending domain and servers. One organization's careless sending can affect other organizations that share the same infrastructure. Therefore:

• Keep the rate of bounced (undeliverable) messages and of messages recipients mark as spam low. If these rates rise far above normal business correspondence, sending may be put under review.
• Recipient addresses that fail permanently are added to the suppression list and are not sent to again. Don't try to get around this list with different spellings of the address or from other mailboxes.
• Sending is subject to rate limits, daily quotas and outbound scanning; don't split or automate sending to get around these limits.
• If you send to a group or a regular list of recipients, give recipients a way to leave the list. For copies of group messages delivered to a group's external members, Mühür Mail adds an unsubscribe link (List-Unsubscribe) itself.
• Keep your domain's SPF, DKIM and DMARC records published as recommended in the dashboard.

• You may not use Mühür Mail servers as an open relay or proxy, or try to send on behalf of any address other than your own address, your aliases and the shared mailboxes you have been granted access to.
• You may not probe, scan or test the service or other organizations for vulnerabilities, or try to bypass authentication and access controls. If you believe you have found a security vulnerability, report it to info@muhurmail.com without exploiting it.
• Automated use that places an unusual load on the service (opening excessive connections, constant sync loops, load testing) is not allowed.
• You may not use the service to harvest addresses, send test messages to verify addresses or try to guess other organizations' addresses.

Compromised accounts are the most common source of spam and phishing. Organizations and users take the following measures:

• Set a strong password for every mailbox and account that you don't use anywhere else, and don't share it with anyone.
• Turn on two-step verification for your account. Organization admins can require two-step verification for the team.
• In desktop and phone mail apps, use the app passwords you create in the dashboard, and revoke the ones you no longer use.
• Suspend the mailboxes of people who leave, or reset their passwords.
• If you notice unauthorized use of your account, change your password immediately, sign out of all sessions and let us know at info@muhurmail.com.

To keep the service secure, sending is monitored automatically: rate limits, daily quotas, spam and malware scanning of outbound messages, bounce and complaint rates, and reports from receiving servers and complaint feedback channels. Sending that shows signs of a compromised account may be stopped automatically; the user and the organization's admins are informed.

The platform team does not routinely read message content, and admin screens do not show it. An abuse review is limited to the evidence sent to us as complaints and reports, metadata such as sending logs and delivery results, and the results of automated scans. Lawful requests from competent authorities are reserved.

How personal data is processed in this context is explained in the KVKK privacy notice.

Depending on the severity and repetition of a breach, the following steps may be taken in stages:

• Warning: the organization's admins are told about the breach and what needs to be done.
• Sending suspension: sending from the mailbox concerned is stopped; reading and receiving continue.
• Mailbox or organization suspension: access and mail flow are temporarily stopped.
• Termination: the service agreement is terminated for serious or repeated breaches.

If a breach puts other users, recipients or the reputation and security of the service at immediate risk (for example, an ongoing spam or phishing send), sending or access may be stopped without prior notice; notice is given afterwards. A suspension is lifted once the breach is found to be resolved. To appeal a decision, write to info@muhurmail.com.

Suspension and termination are subject to the terms of service. Legal obligations and the right to claim compensation for damages are reserved.

If you notice spam, phishing or other abuse sent through Mühür Mail, report it to abuse@muhurmail.com. If possible, include the full headers of the message (the message source); a screenshot alone is often not enough to identify the sender.

Reports are reviewed; where necessary, we contact the organization concerned and take the steps above.

This policy may be updated in response to new forms of abuse, changes in legislation and the development of the service. Significant changes are announced to organization owners by email or in-app notification before they take effect. The current version is published on this page; the "Last updated" date at the top of the page applies.