Unsubscribes, opt-outs, and the blacklist

For anyone sending email, SMS, WhatsApp, push, or website messages through The AI CMO.

The short version

• Every marketing email you send carries a working unsubscribe link. You don't add it, you can't remove it, and it can't break.
• Opt-outs are enforced automatically on every send, on every channel. There is nothing to configure and no way to accidentally reach someone who said no. WhatsApp shares the SMS opt-out list, so a STOP on either one stops both.
• An unsubscribe is not a blacklist entry. Unsubscribing stops marketing messages – it is the customer's choice, recorded and honored forever. The blacklist is a stronger tool that you control, for people who must not be contacted at all.
• Marketing and service messages are two separate things. Unsubscribing stops the marketing. Service messages – receipts, password resets, security and account notices – keep arriving, because a customer who doesn't want your newsletter still needs to be told their payment went through.

Email unsubscribes

Every journey email includes an unsubscribe link in the footer, plus the one-click unsubscribe support that Gmail and Yahoo require of bulk senders – recipients can opt out directly from their inbox without opening the email. Both are added automatically.

The links are signed. A link only works for the address it was sent to, so nobody can unsubscribe someone else by guessing a URL.

When someone unsubscribes:

• They stop receiving marketing email from your account immediately – every marketing journey checks before it sends, including runs that were already in flight.
• They stop entering new marketing journeys.
• They keep receiving service messages, if you send any. See "Marketing and service messages" below.
• The opt-out is recorded permanently and applies across your whole account, including all brand profiles in it.

Bounced addresses and spam complaints are handled the same way, automatically – the address is suppressed and future sends skip it. This protects your sender reputation as much as it protects the recipient.

SMS opt-outs

When you connect SMS sending, the setup includes an inbound webhook URL for your SMS provider. Once that is in place, replies are handled automatically:

• STOP, UNSUBSCRIBE, CANCEL, END, or QUIT opts the number out immediately, as US law (TCPA) requires.
• START, UNSTOP, or YES opts it back in.

ProfiSMS is wired slightly differently. It has no webhook field; inbound texts are forwarded through a URL template instead. In the ProfiSMS Extranet, under SMS → "URL adresa pro předávání SMS", paste the URL from your SMS sending card with &msisdn=$msisdn&smstext=$smstext added to the end – the card shows the exact address. Without those two placeholders ProfiSMS calls the URL with no sender or text, and STOP replies never reach us.

ProfiSMS also keeps its own blacklist for your login – the numbers that opted out at the gateway, and any your team added in the Extranet. Once a day The AI CMO pulls that list and keeps it as a blacklist of its own, "Marketing opt-out feed (ProfiSMS · your login)", under Customer Intelligence → Blacklist. Numbers on it stop receiving your marketing texts; service texts and e-mail are untouched. A number your team removes at ProfiSMS is lifted on the next pull. In the other direction, a STOP that reaches The AI CMO is added to the ProfiSMS list at once, so texts you send through the same login from other tools respect it too, and a START removes it again – unless the person is on a block-all list, which no text of theirs can lift. Once a day the numbers on your own blacklists here – block-all and marketing opt-out alike, however they arrived – are added to the ProfiSMS list as well, so nothing sent through that login from anywhere can reach them by mistake. Service texts are not affected: ProfiSMS keeps the blacklist on the marketing product only. The SMS sending card on Connections shows the last pull and has a "Pull now" button; if a pull ever looks wrong (an empty or much shorter file), nothing is lifted and the card says so.

What you remove here is removed at ProfiSMS too. Take a number off "Marketing opt-out feed (ProfiSMS · your login)" with Remove – on the Blacklist tab or on the person's Compliance tab – or tick Marketing SMS for the person in the customer editor, and The AI CMO takes it off the ProfiSMS list on the spot – for every brand that texts through the same login – and tells you it did. It stays at ProfiSMS, and you are told why, in two cases: ProfiSMS added the number again after you removed it (a new call to the 800 line, say), or something else here still stops marketing texts to it – a block-all list, another opt-out list, a STOP. Remove that first and ProfiSMS follows. Unticking Marketing SMS works the other way round: marketing texts stop, and the number goes onto the ProfiSMS list at once. Teammates who run the brand (owners, admins, managers) see every entry on these lists and can remove them.

Failed numbers and carrier complaints are suppressed automatically, like email bounces.

A number that arrives with a new customer starts "Not granted". A phone that comes in with someone new – a customer you type in, a landing-page lead, a row of a file you import, a number you add to a customer who had none, a changed number of a customer who was "Not granted" – has given no consent to marketing texts yet, the same rule as e-mail. Your marketing texts and marketing WhatsApp messages skip it, and the run says so ("without marketing SMS consent"), never "opted out", because nobody did. Service texts reach it. It becomes reachable for marketing when consent is given: Marketing SMS ticked for the person in the customer editor (in the same save when you create them), the person texting START, or a consent column in the file you import (sms_consent, sms_opt_in) saying yes. Someone already in your contacts with that number keeps what they had, and SMS consent you recorded before is never undone. This is not a blacklist entry and is never sent to ProfiSMS's list; if the person later texts STOP, that is an opt-out and is handled like any other.

Where to see one person's standing

Open the person from Customers. The header says at once whether they are blacklisted – which tier, which list, since when, and by which identity (a phone number, an e-mail address or a customer ID). The Compliance tab shows the present per channel, marketing and service side by side: e-mail, SMS, WhatsApp, push, web tracking and ad audiences, each read from the tables your sends obey, with the reason and the date when a channel is withdrawn (a STOP text, a bounce, a list). A channel reads Not granted when nothing was ever given – a new person's e-mail or phone – which is not the same as withdrawn. Below it, every consent change ever recorded and every blacklist entry, active or lifted, with the identity it was keyed on. The Activity tab lists the same consent changes among everything else the person did – filter it to "Consent" to see only those. On the Customers list, a blacklisted person carries a badge beside their name.

A list entry keyed on a phone number stops texts and WhatsApp and says nothing about e-mail, and the page reads that way: e-mail stays granted. A customer ID is seen by every channel. A block-all entry blocks everything, whichever identity it was keyed on.

What "opted out" changes – and what it doesn't

Marketing stops. History stays. An opted-out customer still appears in your analytics – revenue, RFM segments, cohorts, lifetime value. Your numbers stay honest. What changes is targeting: they disappear from lists that feed sends, such as the Churn Risk "save these first" list and its CSV export, and journeys skip them.

Service messages are unaffected. Order confirmations, receipts, password resets and account notices are a separate stream. Whether they come from your own app or you send them through The AI CMO, a marketing opt-out never touches them – see the next section.

Opting back in is the customer's move, not yours. For SMS, they text START. Email opt-outs are permanent. There is deliberately no button in the app to re-add someone who opted out – that line is what keeps your sending compliant and your deliverability strong.

An opt-out on one channel stays on that channel. Someone who texts STOP has stopped your marketing texts. They have said nothing about email, so their email marketing is untouched, and vice versa.

Marketing and service messages

Everything you send through The AI CMO is one of two kinds, and the difference decides who receives it.

Marketing is promotions, newsletters, win-backs, lifecycle campaigns – anything you send because you want to. It carries an unsubscribe link, it respects the frequency cap and your send hours, and an unsubscribe stops it.

Service is receipts, order confirmations, password resets, security alerts, payout and account notices – anything the customer needs to know about something that already happened. It carries no unsubscribe link, because offering to switch off a password reset would be misleading. It ignores the frequency cap and send hours, and it reaches people who unsubscribed from your marketing.

Service messages are still stopped by the things that should stop them:

• A hard bounce or a spam complaint. A dead mailbox is dead for receipts too.
• A blacklist entry set to Blocks everything.
• On WhatsApp, Meta's own rules – only Utility and Authentication templates can be sent as service messages, and we check the category with Meta rather than taking your word for it.

Choosing the kind. In a journey, open Settings and pick Marketing or Service. Service journeys are deliberately restricted: they can only start from an event or be run by hand, never from an audience or a repeating schedule, and each step reaches the one person the event is about. That is what keeps the stream honest – a service journey cannot be turned into a way to blast a list past everyone's opt-outs. The app refuses to publish one that tries.

For a single message from your own system, use the send API – see "Sending service messages from your own system" below.

We watch for marketing slipping into service messages. Every service send is checked – first against known marketing patterns (promo codes, discounts, free bets, an unsubscribe link that signals the wrong email template), then by an AI reviewer that reads the actual copy in any language and flags promotional intent the patterns can't see. The message still goes out – but the journey's run log and the API response carry a clear warning, so you see it before a customer or a regulator does. Service templates in Brand Settings are kept apart too: marketing emails never use your Transactional / Service template, and service messages never use your Newsletter, Promotional or Welcome layouts.

Your service email needs its own address. In Connections you will find two email cards: Marketing email and Service email. They are separate on purpose. If a promotion lands people in spam, you do not want that reputation deciding whether your password resets arrive, so service email sends from its own verified domain – a subdomain like txn.yourbrand.com is the usual choice. There is no fallback: if the service identity isn't set up, service email doesn't send, and the app says so rather than quietly using your marketing domain.

SMS works the same way, with one extra wrinkle worth knowing. Mobile carriers record STOP against the number it was texted to. So if you want service texts to keep arriving after someone opts out of marketing, give them a separate Service SMS number – otherwise the carrier may refuse the message before it reaches anyone.

Sending service messages from your own system

If your app already knows when an order shipped or a password was reset, it can hand that message to The AI CMO to deliver – on email, SMS, WhatsApp, push, or the on-site inbox.

1. Go to Settings → API keys and create a key with Send service messages ticked. Existing keys do not have this and will not gain it; it has to be granted on purpose.
2. Have your backend POST /api/send with the key in an Authorization: Bearer header.

POST /api/send
Authorization: Bearer <your api key>
Content-Type: application/json

{
  "channel": "email",
  "to": "customer@example.com",
  "category": "delivery",
  "subject": "Your order is on its way",
  "html": "<p>Order #1032 shipped this morning.</p>",
  "idempotency_key": "order-1032-shipped"
}

Say what kind of message it is. category is one of receipt, order, delivery, payout, security, account, support, legal or other, and it is recorded against the send. Service messages reach people who opted out of marketing, so being able to show what you sent them – and that it was a payout notice rather than an offer – is what makes that defensible. If you are a regulated operator, your compliance team will ask for exactly this breakdown.

The message goes out immediately – it does not wait for a journey or a scheduled run.

Always send an idempotency_key. If your request times out and you retry, the key means the customer gets one message, not two.

• Retry with the same key and the same message and you get the original result back, marked "replayed": true.
• Retry while the first attempt is still running and you get 409 send_in_progress with a Retry-After header. That is not a failure – it means the first attempt is still in flight. Wait the suggested seconds and retry to read its result.
• Retry with the same key but a different message and you get 409 idempotency_conflict. That is a bug in the calling code rather than something to paper over.

Errors worth handling. 403 missing_scope – the key doesn't have "Send service messages". 403 suppressed – the recipient is on a blacklist that blocks everything, or their address has hard-bounced. 403 unknown_recipient – the address is not a contact of this brand (pass allow_unknown: true for a first receipt or a one-time code). 403 recipient_mismatch – the external_id you sent belongs to a different contact than the address. 410 identity_erased – the person was erased on request. 422 no_sending_identity – you haven't set up a service sending identity for that channel yet. 400 marketing_not_supported – the request set stream to something other than transactional; this endpoint sends service messages only, and marketing goes through a journey. 429 rate_limited, 503 idempotency_unavailable and 503 erasure_check_unavailable (erasure requests could not be checked, so nothing was sent) are all temporary: back off and retry.

If your account has more than one brand profile, include client_id. Suppression and blacklist rules are kept per profile, and the API will not guess which one you meant.

Every service message you send this way is logged alongside everything else, and if an email, SMS or WhatsApp message went to someone who had opted out of marketing, that is recorded too – so you can always show why a message was sent.

The blacklist

Where: Customer Intelligence → Retention → Audiences.

The blacklist holds identities – email addresses, phone numbers, or your own customer IDs – that you decide must not be contacted. Use it for legal do-not-contact requests, self-excluded customers, or anyone you never want a campaign to reach. Entries can be added one at a time or imported as a list, and lists can be copied across brand profiles.

Each list enforces one of three levels. When someone appears on several lists, the strictest level wins:

Every send the blacklist stops is logged, so you can show exactly when and where an entry did its job.

Blacklist or unsubscribe – which is which? An unsubscribe is the customer's choice and happens on its own. The blacklist is your policy: you add entries, you pick the level, and "Blocks everything" reaches further than any unsubscribe can – it silences every channel at once, including website messages.

Blocked and opted-out people are excluded from targeting surfaces automatically. The Churn Risk list, for example, says so in plain text: "Blacklisted and opted-out customers are already excluded." An audience you push to Meta or Google Ads leaves them behind too. Someone blacklisted after a push is handled differently on Meta and Google: see Pushing an audience to Meta or Google Ads.

Frequency cap

Separate from opt-outs: in your email and SMS sending settings you can cap how many marketing messages one person receives per 7 days, counted across all journeys. It is optional, and it is the polite ceiling that keeps an enthusiastic month of campaigns from burning a list.

Questions

Do unsubscribed customers still count in my dashboards? Yes. Analytics count everyone; only targeting filters them out.

Do service messages show up in my campaign numbers? No. Open and click rates, the calendar and the weekly digest all count marketing only – otherwise a month of receipts (which nearly everyone opens) would flatter every campaign you ran. Service messages are still logged and auditable, just kept out of the marketing metrics.

Can someone unsubscribe from service messages? No, and they carry no unsubscribe link. If a customer must not be contacted at all, that is a blacklist entry set to "Blocks everything" – which does stop service messages too.

Do service messages cost the same? Yes – email is email. They count against your plan's monthly email allowance exactly like marketing does. The one difference: if you run out mid-month, marketing stops and service messages keep going, billed as overage at the end of the period. Dropping someone's password reset because the newsletter budget ran out is not a trade we will make for you.

Someone unsubscribed by accident – can I fix it? Not from the app. SMS recipients can opt back in themselves by texting START. Email opt-outs are permanent today – if a customer genuinely wants back in, contact support and we'll handle it with their consent on record.

Does the blacklist remove people from my analytics? No. Their history remains in your numbers. They are removed from every list that could feed a send.

We run several brands in one account – does an unsubscribe apply to all of them? Yes. An email opt-out applies account-wide. Blacklist lists are per brand profile, and you can copy a list across brands when policy should follow the person.