Outbound compliance

Compliance is not a constraint we work around. A campaign that would embarrass a client in front of their own general counsel is a campaign we should not have run, whatever it produced.

Our name and our client’s name are both on every message. So the standard below is the standard, not a target — and if an instruction conflicts with it, we say no and explain why.

Email

CAN-SPAM permits cold commercial email without prior consent, subject to conditions we meet in full:

• Header information — from, reply-to, and routing — is accurate and identifies the real sender.
• Subject lines describe the message honestly and are never designed to mislead about its content or purpose.
• Every message identifies itself as a commercial approach and includes a valid physical postal address.
• Every message carries a working opt-out that stays live for at least 30 days after sending.
• Opt-outs are honored promptly, and never later than 10 business days.
• We never charge, require a login, or ask for information beyond an email address to process an opt-out.

Phone

Calls are made to business numbers in a business context. We screen against the National Do Not Call Registry and applicable state registries where they apply, observe permitted calling hours in the recipient’s time zone, and do not use automated dialing or prerecorded messages to mobile numbers without the consent the TCPA requires.

Legal basis

For business-to-business outreach in the EU and UK we rely on legitimate interests under Article 6(1)(f). We hold a documented legitimate interests assessment for each campaign, covering the purpose, the necessity, and the balance against the recipient’s rights. It is available to the client and, on request, to a regulator.

Telling people how we got their details

Because the data is obtained indirectly, Article 14 obliges us to tell the recipient what we hold, where it came from, why, and how to object — at the first communication. Every message links to the source disclosure in our privacy policy.

PECR and corporate subscribers

In the UK, PECR treats corporate subscribers differently from individuals. We send business-to-business messages to corporate subscribers at corporate addresses, we do not send unsolicited marketing to sole traders or partnerships without consent where the rules require it, and we honor objections immediately in every case.

Objections

An objection to direct marketing is absolute. We do not ask for a reason, we do not attempt to persuade, and we do not resume later.

CASL is a consent regime, not a notice regime. We send commercial electronic messages into Canada only where we have express consent or a valid basis for implied consent — an existing business relationship or a conspicuously published business address with no stated refusal, used only for messages relevant to that role. We record the basis and its expiry for each recipient, identify the sender in full, and include a working unsubscribe honored within 10 days. Where the basis is unclear, we do not send.

One suppression list covers every campaign we run, for every client. A person who opts out of one is out of all of them.

• Opt-outs are applied to the address, and to the whole domain on request.
• Suppression records are retained indefinitely, because deleting them is how firms accidentally re-contact people.
• Client-supplied exclusion lists — competitors, existing customers, live opportunities — are loaded before the first send.
• Every list is checked against suppression immediately before sending, not at the point it was built.

Contact data comes from public sources, licensed providers who warrant lawful collection, and our own researchers. The detail is in the privacy policy.

Records are verified before use. Where a role or an address cannot be confirmed, the record is dropped rather than guessed at.

• Separate sending domains, warmed before use, so a campaign never risks the client's primary domain.
• SPF, DKIM, and DMARC configured on every sending domain.
• Volume held below the thresholds that trigger filtering, and paced per mailbox rather than per campaign.
• Plain text, no tracking pixels, and no link wrapping that records clicks.
• Bounces and complaints monitored continuously; sending pauses on any abnormal rate rather than pushing through it.

No engagement fee changes any of these. If a campaign requires one of them, we decline the campaign.

• Buy general-purpose mailing lists, or send to a list whose provenance cannot be established.
• Scrape data from behind a login, a paywall, or in breach of a platform's terms.
• Guess at email addresses in volume and send to whatever does not bounce.
• Send from a domain or identity that misrepresents who is writing.
• Contact people on personal addresses or personal phone numbers.
• Continue contacting anyone who has asked us to stop, under any address, for any client.
• Impersonate a mutual connection, a referral, or a prior conversation that did not happen.
• Use fabricated scarcity, fabricated social proof, or invented case results.

Where an engagement involves approaching investors, our role is limited to arranging introductions and scheduling conversations. Mogul is not a registered broker-dealer, investment adviser, funding portal, or placement agent. We do not give investment advice, discuss or negotiate terms, participate in structuring or pricing, handle funds or securities, or accept transaction-based compensation. The full statement is in section 14 of our terms of service.

If you have received a message from us that you believe breaches any of the above, tell us and we will investigate it properly and tell you what we found.

Compliance concerns: compliance@mogul.com. To stop being contacted, which needs no explanation and no investigation: optout@mogul.com.