Attunr

Attunr acceptable use policy

Draft. Written 2026-10-17 and revised the same day after the legal review in lawyer-review.md. Not in force and not published.

BUILD: marks something that depends on a planned build step. Words in [square brackets] are placeholders.

The legal summaries below are plain-language reminders, checked against the law on 2026-10-17 (sources in lawyer-review.md, point 16k). They aren't legal advice for your business.

This policy is part of the Attunr terms of service. It applies to everyone using an Attunr account. The customer is responsible for its team following it.

Attunr has guards built in: the email footer, calling hours, the do-not-call list, send limits, and the recording notice. They help you follow the law. They don't do it for you. You decide whom to email and call, and you are responsible for having the right to.

1. Email (Canada's anti-spam law, CASL)

Any email that encourages someone to buy something is a commercial message under CASL. That includes business-to-business email. Before you send one, you need one of these:

  • Express consent. The person said yes to getting your email. It doesn't expire until they withdraw it. When you ask, say who you are, why you're asking and that they can withdraw at any time.
  • Implied consent:
    • they bought from you in the last 2 years, or asked you something in the last 6 months;
    • or they published their work email, or had it published (on their website, for example), without saying they don't want sales email, and your message is about their job or business;
    • or they gave you their email themselves, without saying they don't want sales email, and your message is about their job or business.
  • An exemption:
    • a message to someone at another organization that your organization already has a relationship with, about that organization's activities. A first cold email to a business you've never dealt with doesn't qualify;
    • one message after a referral. The person who referred you must have a relationship with both you and the recipient, and your message must give their full name and say they referred you.

Guessed addresses and lists

  • A guessed address is not consent. Attunr's email finder guesses addresses from name patterns. A guessed address was never published or given by the person, so the implied consent routes don't apply. Canada's privacy law also limits collecting and using addresses made by software built to generate them.
  • In Canada, Attunr won't send sales email to a lead whose address came from the finder until you record another reason you may email them (express consent, a relationship, or a referral). BUILD: the "why can we email" field on each lead, required in that case.
  • Imported lists. Import only lists you have the right to use, and know the consent basis for each address. Consent given to someone else usually doesn't carry over to you.
  • Keep your records. If a regulator asks, you must show why you could email each person. Record it in the "why can we email" field. Attunr already records consent for newsletter subscribers.
  • Attunr adds a footer to every sales email (sequences, autopilot, pitch-page emails, new emails to leads): "Sent by [your name] for [your business]. This is a sales email.", your mailing address and an unsubscribe link, plus one-click unsubscribe headers. BUILD: the "Sent by" line.
  • Attunr won't send sales email until you add a mailing address. A PO box is fine. The address must be real and current.
  • The email goes out from your own mailbox with your name, so the person can also reach you by replying. Keep that mailbox working for at least 60 days after each email.
  • Don't remove, hide or change the footer. Don't send sales email outside Attunr to people who unsubscribed in it.
  • CASL wants an unsubscribe honoured within 10 business days, and the link working for at least 60 days. Attunr blocks further sales email to that lead at once, and the link keeps working with no end date.
  • Don't mark a sales email as a reply to get around the footer.

Outside Canada

  • United States (CAN-SPAM). You don't need consent before a sales email, including to a business. But every one must:
    • have true sender and header details;
    • have a subject that doesn't mislead;
    • say it's a sales email, unless the person agreed to get your email;
    • give a valid postal address;
    • offer a way to opt out that works for at least 30 days, and honour it within 10 business days.

Attunr's footer covers the last three. Pick one address for each person. Don't send the same email to several guessed addresses.

  • EU and UK. Many countries there need consent before any sales email, even to a business address. Don't send sales email to people in the EU or UK unless you know the local law allows it.

Volume

  • Each mailbox has a daily send limit (80 by default). Raise it only as far as your mail provider and your domain's reputation allow.
  • Don't spread one campaign across extra accounts or mailboxes to get around limits.

2. Calls (CRTC rules and the do-not-call lists)

Rules for every sales call in Canada

The CRTC's Telemarketing Rules apply to every sales call, including calls to businesses:

  • Register. Every business that makes sales calls must register with the National Do Not Call List operator, even if it only calls businesses. Registering is free. You only buy the list if you call consumers (see below).
  • Say who you are at the start. Your name, and the business you're calling for. If asked, give a phone number, fax number or address where they can reach someone responsible.
  • Calling hours. 9:00 to 21:30 on weekdays and 10:00 to 18:00 on weekends, in the time zone of the person you call, or stricter hours if their province sets them. Attunr blocks calls outside these hours by default. Don't turn the hours off for sales calls.
  • Your own do-not-call list. When someone asks not to be called, mark them "Asked not to be called" in Attunr right away. The rules give you 14 days, and you must keep the request for 3 years and 14 days. Attunr's flag follows the phone number, so every lead with that number is blocked too.
  • Keep the list. Your do-not-call list must outlive your Attunr account. Export it before you close the account.
  • Caller ID. Show a number people can call back.
  • No recorded sales messages. Don't use Attunr to play recorded or automated sales messages (robocalls).
  • No sequential dialing. Don't dial number after number in a block.
  • Never call emergency lines or health care facilities for sales.

The National Do Not Call List

  • The National DNCL rules don't apply to sales calls made to businesses.
  • They do apply to consumers. The CRTC treats any number that isn't linked to a business line as a consumer's number. A sole trader's personal cell phone counts as a consumer number.
  • Before you call a consumer number for sales, you must:
    • buy a subscription to the list from the National DNCL operator;
    • check the number against a copy of the list no more than 31 days old;
    • unless an exemption applies, such as an existing business relationship (a purchase or contract in the last 18 months, or an enquiry in the last 6 months) or the person's express consent.
  • Attunr doesn't check numbers against the National DNCL. If you call consumers, or sole traders on a personal cell, check those numbers yourself before calling.

United States

US calling is off until your owner turns it on. Before you call US numbers:

  • Calling hours. 8:00 to 21:00 in the time zone of the person you call. Attunr's US default is 9:00 to 20:00.
  • Your own do-not-call list. Have a written do-not-call policy and train your reps on it. Record a request at once (mark the lead "Asked not to be called"), honour it within 10 business days and keep it for 5 years.
  • Say who you are. Your name, the business you're calling for, and a phone number or address where they can reach it.
  • Caller ID. Send a number people can call back. Never block it.
  • The National Do Not Call Registry doesn't cover business numbers. But a cell phone on the Registry is presumed to be a home number, so check a sole trader's personal cell against the Registry before a sales call, unless an exemption applies. Attunr doesn't check the Registry.
  • A person dials every call. Don't use autodialers, recorded messages or AI voices on sales calls. The US rules for those (the TCPA) are much stricter, especially for cell phones.
  • Tell the truth. The FTC's rules forbid misleading statements on sales calls, including calls to businesses.
  • State registration. Florida and Washington make businesses that sell by phone register before calling people there, and their exemptions for calls to businesses are narrow. Texas, Nevada, Oklahoma, Utah and other states have registration laws of their own. Check each state before you start calling it.

3. Recording calls

  • Recording is off until your owner turns it on.
  • When recording is on, tell the other person at the start of each call: "This call is recorded so I have good notes. Is that OK?" (or "recorded and transcribed" when the live transcript is on). Recording starts only when you press They agreed. Your owner can instead turn on a spoken notice that Attunr plays as the other person answers, or as you pick up their call: "This call is recorded for our notes". Nothing is recorded before it ends; on any call that isn't between two Canadian numbers it asks "Is that OK?" and recording still waits for They agreed.
  • If they object, press Stop recording. It stops the recording and deletes what was recorded on that call. Then carry on without recording, or end the call.
  • Canada. Privacy law expects you to tell people at the start that a call is recorded and why, and to let them carry on without being recorded if they object.
  • United States. Federal law lets you record when one side agrees, but some states need everyone on the call to agree: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington. Delaware and Michigan are unclear, so treat them the same. On a US number, recording starts only when you press They agreed, whether you said the notice or Attunr did. Press it only after a clear yes. If they say no, don't press it: the call goes on unrecorded. In those states, recording someone without telling them can be a crime and lets them sue.
  • Tell people too when you use the live transcript and AI wrap-ups, since those are made from the call. The spoken notice covers this when it says "recorded and transcribed".
  • Set your recording retention no longer than you need. It's 90 days by default.
  • Use call practice only with the AI prospect. Don't play a real person's recording to it without their consent.

4. Reading websites, the extension and searches

Attunr's prospecting tools are made for looking at businesses one at a time. Don't use them, or anything else, to collect data in bulk.

The extension

  • The extension reads the one page you are on, and only when you press its button. On LinkedIn, it reads the one profile you have open when you press it.
  • Don't automate it. No scripts, bots or auto-clickers that press the button, open pages in bulk or scroll through lists to capture them.
  • Don't use it on pages you could only reach by signing in to someone else's account.
  • Google's and LinkedIn's own terms limit add-ons and automated use, and LinkedIn's limit add-ons that copy profile data. Your use of LinkedIn, Google, Facebook and every other site stays under that site's terms, and the risk to your own account there is yours.
  • To check a lead on Google, press Check Google on the lead's page. It opens the search in a normal tab. Press the extension's button there to send the results to Attunr. BUILD: the Check Google button.

Site checks, pitch pages and scans

  • Run site checks, pitch pages and market scans only on businesses you are really thinking of contacting.
  • Don't point Attunr at sites you aren't allowed to check, at pages behind a login, or at your own systems to load-test or attack them.
  • Don't try to get around a site's blocks, CAPTCHAs or rate limits, or Attunr's daily limits.

Search results

Don't use Attunr's searches to copy search results in bulk or to resell them. The search services Attunr pays for forbid it too.

5. Pitch pages

  • Keep pitch pages true and fair. Don't add claims you can't back up, and don't add figures for lost sales or customers unless you measured them.
  • Keep Attunr's lines on every pitch page: the screenshot credit, when and how each finding was measured, and the line saying you can see when the page is opened. BUILD: those lines.
  • A pitch page must be clearly from you. Don't make it look like it comes from the business it describes, or from anyone else.
  • Don't use a business's name, logo or screenshots to mislead anyone.
  • If a business asks you to take its pitch page down, do it within 5 business days. BUILD: the take-down control and the "Ask to take this page down" link.
  • Pitch pages record opens and reading. If you send one to a person, your own privacy notice should say so. For leads in Quebec, the page records nothing until the visitor agrees.

6. Data you put in

  • Put in only information you have a lawful reason to hold, and give people the notices the law requires.
  • Don't put in health information, bank or card numbers, government ID numbers, or information about children.
  • Honour people's requests to see, correct or delete their information. Use the erase tool when someone asks you to delete them and you have no legal reason to keep it. See the data processing agreement, section 8.

7. Never use Attunr to

  • send spam, phishing or messages with false or misleading sender details, subjects or content;
  • harass, threaten or discriminate against anyone;
  • pretend to be someone else, or another business;
  • send or store malware, or anything illegal;
  • use AI features to make deceptive or harmful content;
  • try to reach another account's data, test Attunr's security without our written OK, or get around plan limits;
  • share a seat between people, resell access, or copy or reverse engineer Attunr.

8. If someone breaks this policy

  • We may pause sending or calling for an account, or suspend it, as the terms say (section 16). For serious abuse we may do it without notice.
  • We pass complaints about your email or calls to you, and you must answer them.
  • Report abuse to hello@attunr.com.