Marketing Communications Compliance Policy

1) Purpose

This Policy governs the conduct of direct marketing communications sent by Tanqory itself to merchants, prospective merchants, partners, developers, and end users. It sets out the consent standards, suppression-list management, content and identification requirements, unsubscribe handling, and statutory exposure that apply across the principal jurisdictions in which Tanqory operates.

2) Scope

This Policy applies to electronic marketing communications initiated by Tanqory in any of the following categories:

• Email marketing (newsletters, product announcements, promotional emails, lifecycle marketing).
• SMS and other electronic short-message marketing.
• Push notifications to Tanqory-operated apps where used for marketing rather than transactional purposes.
• In-product messages used for marketing rather than service-operational purposes.
• Marketing voice calls, including any call that contains an advertisement or constitutes telemarketing under 47 C.F.R. §64.1200(f)(12).

This Policy does not govern:

• Transactional and relationship messages necessary to operate the Tanqory service (account creation, billing, password reset, multi-factor authentication, security alerts, service-incident notifications), which are governed by the Privacy Policy and the Terms of Service.
• Marketing communications initiated by merchants to their own end customers using Tanqory's platform tools. Merchant-initiated marketing is the merchant's sole responsibility under the Acceptable Use Policy and the Merchant Agreement. Tanqory does not act as the sender of merchant-initiated marketing for purposes of the statutes cited in Section 1.

3) Consent standards by jurisdiction

3.1 United States — TCPA

Tanqory does not place autodialed or prerecorded marketing voice calls to consumers. Tanqory does not initiate marketing SMS to United States consumers without prior express written consent obtained in accordance with 47 C.F.R. §64.1200(a)(2) and §64.1200(f)(9). Prior express written consent must be:

• In writing or in an equivalent electronic form;
• Signed by the consumer, including by E-SIGN-compliant electronic signature;
• Clear and conspicuous;
• Disclosing that the consumer is consenting to receive prerecorded or autodialed telemarketing calls or text messages from the specifically identified sender;
• Disclosing that consent is not a condition of any purchase.

Tanqory honors the Do Not Call Registry where applicable to any non-exempt marketing voice calls.

3.2 United States — CAN-SPAM

Email marketing initiated by Tanqory complies with 15 U.S.C. §§7701-7713 and 16 C.F.R. Part 316. Each such email:

• Identifies the message as an advertisement (header content and "from" line do not deceive).
• Contains a valid physical postal address of the sender.
• Contains a clear and conspicuous unsubscribe mechanism that operates without requiring the recipient to log in, pay a fee, or provide information other than the email address and unsubscribe preferences.
• Does not use false or misleading header information or deceptive subject lines.

CAN-SPAM operates on an opt-out basis. The other statutes in this Policy may require opt-in consent, and where multiple regimes apply, Tanqory follows the strictest applicable regime.

3.3 Canada — CASL

CASL requires express consent (with limited statutory exceptions for existing business and non-business relationships) prior to sending a commercial electronic message ("CEM") to an electronic address. Each Tanqory CEM:

• Is sent only to recipients for whom Tanqory holds valid express consent or a documented statutory exception.
• Clearly identifies Tanqory as the sender and provides a Tanqory mailing address and a contact email or web URL.
• Includes a functioning unsubscribe mechanism that is at no cost to the recipient.
• Is recorded in the consent register described in Section 4.

3.4 European Union — ePrivacy

Marketing communications to recipients in the European Union and European Economic Area follow Article 13 of Directive 2002/58/EC as transposed into Member State law and as supplemented by the GDPR (Regulation (EU) 2016/679):

• Opt-in consent is required for marketing communications to non-customer prospects.
• The "soft opt-in" available to existing customers permits marketing of similar products and services where (i) the contact details were obtained in the context of the sale of a product or service, (ii) the recipient was given a clear and simple opportunity to object at the point of collection and in each subsequent message, and (iii) the recipient has not objected.

Tanqory OÜ acts as the entity responsible for EU ePrivacy compliance for marketing communications targeted at EU/EEA recipients.

3.5 Singapore — Spam Control Act and PDPA

The Singapore Spam Control Act 2007 governs unsolicited commercial electronic messages sent in bulk and requires a functioning unsubscribe facility, accurate header information, and identification of the message as an advertisement (e.g., "" prefix where required). The Personal Data Protection Act 2012 (Do Not Call provisions) governs telemarketing voice, SMS, and fax to Singapore telephone numbers and requires checking the relevant Do Not Call register prior to sending, unless an exemption applies (including the ongoing-business-relationship exemption under the Personal Data Protection (Exemption from Section 43) Order, subject to its conditions).

3.6 United Kingdom — PECR and UK GDPR

The Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), read with the UK GDPR, apply to marketing communications to UK recipients. Tanqory applies the same opt-in standard as for the European Union, subject to the soft-opt-in for existing customers.

4) Suppression list management

Tanqory maintains a master suppression list across all marketing channels. The suppression list:

• Records every unsubscribe request from any channel, every bounce that meets the hard-bounce criteria of the sending provider, every complaint reported by an inbox provider, every Do Not Call entry, and every withdrawal of consent submitted under the GDPR or the Singapore PDPA.
• Is checked before each send. A recipient on the suppression list for a given channel is not sent further marketing in that channel.
• Is retained indefinitely as a suppression record (i.e., to prevent further sending), separate from any personal-data retention used for marketing-list membership. Retention as a suppression record is permitted under the GDPR Article 17(3)(b) and equivalent provisions.

5) Identification and physical-address requirements

Every Tanqory-initiated marketing email and CEM includes:

• The sender identity (Tanqory, with the operating entity per the contracting matrix in 00-entities.yaml).
• A valid physical postal address: c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA (Tanqory Inc.), the sender for all regions, including EU-directed mail.
• A clear unsubscribe mechanism.
• Where the recipient is in a jurisdiction requiring advertising-identification language, that identification.

6) Unsubscribe handling

Tanqory processes unsubscribe requests as follows:

• CAN-SPAM: the unsubscribe mechanism operates for at least 30 days following transmission. Unsubscribe requests are honored within 10 business days of receipt, as required by 15 U.S.C. §7704(a)(4).
• CASL: unsubscribe requests are honored without delay and in any event within 10 business days from the day on which the request is sent, as required by section 11(3) of CASL.
• GDPR / ePrivacy / UK GDPR / PECR: unsubscribe and withdrawal of consent are honored without undue delay, and in practice on the next send cycle following processing.
• Singapore Spam Control Act: unsubscribe requests are honored within 10 business days of receipt.

Unsubscribe from marketing does not unsubscribe the recipient from transactional and service-operational messages necessary to operate the Tanqory service.

7) Penalties (statutory exposure)

Tanqory acknowledges the following statutory exposure ranges, included here for awareness; specific monetary amounts are subject to inflation adjustments and statutory amendments:

• TCPA: $500 per violation, trebled to $1,500 for knowing or willful violations (47 U.S.C. §227(b)(3) and §227(c)(5)).
• CAN-SPAM: civil penalties per violating message under 15 U.S.C. §7706; the per-violation cap is the FTC's inflation-adjusted civil penalty (currently US$53,088 per violation, subject to annual inflation adjustment) under 16 C.F.R. §1.98.
• CASL: administrative monetary penalties up to CAD 1,000,000 for individuals and CAD 10,000,000 for organizations per violation under section 20 of CASL.
• GDPR (where ePrivacy violations are also processed as data-protection breaches): up to EUR 20,000,000 or 4 percent of total worldwide annual turnover, whichever is higher.
• Singapore Spam Control Act: civil liability to recipients; PDPA Do Not Call breaches subject to financial penalties imposed by the Personal Data Protection Commission.

This Section is informational; it does not modify any liability that Tanqory may have under any applicable statute.

8) Third-party service providers

Tanqory uses third-party providers in two distinct categories — transactional and marketing — and enforces a logical separation between the two routes. The full provider list, including legal entities, regions, and transfer mechanisms, is published in the Subprocessor List (data-protection/subprocessor-list.md).

8.1) Transactional providers

Used for transactional and service-operational messages necessary to operate the Tanqory service (account creation, billing, password reset, multi-factor authentication, security alerts, service-incident notifications). These messages fall outside the scope of this Policy per Section 2.

• SendGrid (Twilio SendGrid, Twilio Inc., United States): primary transactional email transport.
• Resend (Resend, Inc., United States): secondary transactional email transport.
• Vonage (Vonage Holdings Corp., United States): SMS for multi-factor authentication and transactional SMS.
• Firebase Cloud Messaging (Google LLC, United States): transactional push notifications to the Android merchant app.
• Apple Push Notification service (Apple Inc., United States): transactional push notifications to the iOS merchant app.

The transactional providers above are not used to send Tanqory-initiated direct marketing communications.

8.2) Marketing providers

Used for the direct marketing communications governed by Sections 1–7 of this Policy (lifecycle marketing email, marketing SMS where consent permits, marketing push, in-product marketing messages).

• Customer.io (Peaberry Software, Inc. d/b/a Customer.io, United States; European Union — Frankfurt region planned): marketing communications orchestration; serves as the consent-state and suppression-list source of truth for marketing channels. Tanqory selects per-recipient region of processing where supported by the provider. The United States region is currently used for every recipient including recipients in the European Union, the European Economic Area, and the United Kingdom. The European Union region (Frankfurt) is planned and, once provisioned, EU/EEA/UK recipients will route through the EU region automatically without further customer notice — the change reduces the scope of cross-border transfer rather than extending it.

The marketing provider above is operated under a Data Processing Agreement that includes Standard Contractual Clauses for cross-border transfers, the UK International Data Transfer Addendum where applicable, and PDPA-compliant terms for Singapore data subjects. Tanqory does not use Customer.io to send transactional or service-operational messages.

8.3) Route separation and routing rule

Tanqory enforces a one-way logical separation between transactional and marketing routes at the platform level:

• A communication that is unambiguously transactional, service-operational, or required by law or contract is routed through the transactional providers identified in Section 8.1 and is not subject to the marketing consent requirements of Section 3.
• A communication that is promotional in purpose or content, or that cannot be unambiguously classified as transactional, is treated as marketing for the purposes of this Policy and is routed through the marketing provider identified in Section 8.2 with the consent verification, suppression-list check, sender-identification, and unsubscribe-handling required by Sections 3, 4, 5, and 6.
• Where a single message has both transactional and promotional elements, Tanqory follows the stricter standard and routes the message through the marketing provider with marketing-grade consent and suppression checks.

8.4) Sender entity

Tanqory Inc. is the sender entity that appears in the "from" line and in the physical-address disclosure required by Section 5, for every marketing send regardless of the recipient's jurisdiction (including EU-directed mail). This is a single, global sender identity — there is no per-recipient sender-entity selection. Tanqory OÜ's role is limited to its function as the GDPR Article 27 EU representative (see the Privacy Policy); it is not a marketing-email sender.

8.5) Marketing-route sending domain, From address, and link tracking

Marketing-route messages are sent with the verified mailbox support@tanqory.com as From and Reply-To. The same mailbox is used by the transactional providers identified in Section 8.1, so customers see a single brand sender and a single inbox for replies regardless of whether a message is transactional or marketing.

Link tracking on marketing-route messages is routed through the dedicated subdomain email.tanqory.com operated by Customer.io. Click telemetry, open-pixel hosting, and any tracked-link redirects originate from email.tanqory.com rather than from the root domain. This subdomain is reserved for marketing-route telemetry; it is not used as a From address and it is not used by the transactional providers in Section 8.1.

The entity identification required by CAN-SPAM §7704(a)(5)(A), CASL s.6(2)(c), the Singapore Spam Control Act, ePrivacy, and GDPR Art. 13 is carried in two visible elements of every marketing send:

• the From display name identifies the sender entity, Tanqory Inc., per Section 8.4;
• the physical-address line in the message footer is the Tanqory Inc. address, per Section 5.

The mailbox local-parts and reply paths are uniform for every send:

• From address: support@tanqory.com for every marketing send.
• Reply-To address: support@tanqory.com. Replies to marketing messages are answered by the same support inbox that handles general account inquiries.
• Unsubscribe-reply address: unsubscribe@tanqory.com for every marketing send. The List-Unsubscribe and List-Unsubscribe-Post headers required by RFC 8058 and the major inbox providers are emitted by Customer.io against this address.
• Link tracking domain: email.tanqory.com (Customer.io). Visible to recipients only when they hover or click a tracked link.

The unsubscribe link, the physical-address disclosure, and the advertising identification (where required) remain mandatory in every send.

Reputation-sharing trade-off — because marketing and transactional mail both use the same From mailbox on tanqory.com, complaint and bounce signals from marketing campaigns can affect transactional deliverability and vice versa. This trade-off is intentional in exchange for a single brand mailbox surface. Mitigation is monitored through the deliverability action items in the DPIA for Marketing Communications and Lifecycle Automation (_compliance/audits/2026-06-12-dpia-marketing-communications.md A6) and the Tanqory engineering team retains the option to migrate marketing-route From to a dedicated subdomain if the spam-complaint rate exceeds 0.1% in any rolling 7-day window or if transactional delivery latency increases as a result.

This Section is operational in design only and does not relieve Tanqory of any statutory obligation in Sections 1 through 7. Merchant-initiated marketing run by merchants to their own end customers using Tanqory platform tools remains out of scope of this Policy per Section 2.

9) No Tanqory-initiated robocalls

Tanqory does not initiate prerecorded or artificial-voice marketing calls and does not use an automatic telephone dialing system as defined in 47 U.S.C. §227(a)(1) for marketing purposes. Customer-support callbacks and account-security calls placed by a Tanqory representative do not fall within the marketing scope of this Policy.

10) B2B and B2C distinction

Several statutes treat business-to-business ("B2B") and business-to-consumer ("B2C") communications differently. Tanqory recognizes the following distinctions but follows the stricter standard when in doubt:

• TCPA applies to both B2B and B2C wireless telephone numbers; the FCC has clarified that calls to business cell phones are not exempt.
• CAN-SPAM applies regardless of B2B or B2C status, with the same opt-out, identification, and content requirements.
• CASL applies regardless of B2B or B2C status, with limited B2B exemptions under section 3 of the Electronic Commerce Protection Regulations.
• EU ePrivacy permits Member States to apply lower-burden treatment to messages sent to legal persons (corporate subscribers), and Member State implementation varies; Tanqory follows the applicable national rule for the recipient's country.

11) Training

Tanqory provides periodic, risk-based training on the requirements of this Policy to marketing, sales, and customer-success personnel. In addition, marketing personnel are referred to this Policy and to the relevant statutes for self-study, with legal review of new campaigns prior to launch.

12) Recordkeeping

Tanqory retains, for at least three (3) years from the date of the relevant communication or longer where required by a specific statute or by a litigation hold:

• Records of express consent and prior express written consent, including source, timestamp, and consent text shown to the data subject.
• Suppression list entries.
• Templates of marketing communications actually sent, with the sender entity and date range.
• Records of unsubscribe requests received and the processing date.

13) Cross-references

• Privacy Policy: platform/privacy-policy.md
• Cookie Policy: platform/cookie-policy.md
• Acceptable Use Policy: platform/acceptable-use-policy.md
• Subprocessor List: data-protection/subprocessor-list.md
• Records of Processing Activities: data-protection/records-of-processing-activities.md
• Merchant Agreement: platform/merchant-agreement.md

14) Adoption note

This Policy was adopted effective 28 May 2026 (v1.0). Version 1.1, effective 9 June 2026, restructures Section 8 to disclose the separation of transactional and marketing service-provider routes and identifies Customer.io (Peaberry Software, Inc.) as the marketing communications orchestration provider; the change corresponds to Subprocessor List v3.2. This Policy will be reviewed at least annually and upon any material change to the statutes cited in Section 1 or to the marketing channels Tanqory operates. Material revisions will be published on this page with a revised effective date and version number.

Change history