Acceptable use policy

1. Permitted use

Bloomod is for sending calendar invitations to people who have agreed to receive them from your business — client meetings, webinars, recurring sessions, deadlines, events — and for maintaining the event-attendee records those invitations draw from.

2. Content

Invitations, Event descriptions and attendee attributes must not contain or promote:

• Unlawful goods, services or activity
• Deceptive offers, fake urgency or misrepresented identity
• Phishing, credential harvesting, malware or links to either
• Harassment, threats, or content targeting an individual
• Sexual content involving minors, or any content exploiting minors
• Content unlawfully infringing someone else's rights

The organiser name, event title and description must accurately reflect who is inviting and what the event is. A calendar invitation carries an implicit claim that a real event exists at that time.

3. Conduct

You must not:

• Impersonate another business, person or platform in an invitation
• Use Bloomod to invite people on behalf of a third party without disclosing it
• Resell access to your account, or share credentials outside your business
• Create multiple accounts to evade limits, review or suspension
• Use the platform to test how much unsolicited sending is tolerated

4. Technical limits

Plan, Event, provider and fair-use limits may apply to invitation operations. You must not attempt to circumvent them — including by splitting an attendee list across accounts, rotating sending identities, or scripting around a rate limit.

5. Security

You must not:

• Probe, scan or test the vulnerability of the platform without written permission
• Attempt to access another business's account, records or API keys
• Interfere with the queue, delivery pacing or approval mechanism
• Introduce malicious code, or overload the service deliberately

If you believe you have found a vulnerability, report it to hello@bloomod.com rather than exploring it further. We will not pursue a good-faith reporter who stops at discovery.

6. API and automation

If API or webhook early access is provided, automation must not be used to bypass a control:

• The approval gate cannot be skipped, and must not be automated away with a script that approves everything unread
• Keys must not be shared between businesses
• Retry loops must respect the documented rate limits and back off on errors
• Webhook endpoints must not be used to re-inject suppressed recipients

7. Enforcement

Breaches are handled proportionately — a held invitation batch, reduced limits, required verification, suspension, or termination for serious or repeated breach. Where practical we will tell you what we found first. Illegal activity may be reported to the relevant authority.