Unsubscribes, opt-outs, and the blacklist

For anyone sending email, SMS, or website messages through The AI CMO.

The short version

Every marketing email you send carries a working unsubscribe link. You don't add it, you can't remove it, and it can't break.
Opt-outs are enforced automatically on every send, on every channel. There is nothing to configure and no way to accidentally email someone who said no.
An unsubscribe is not a blacklist entry. Unsubscribing stops marketing messages – it is the customer's choice, recorded and honored forever. The blacklist is a stronger tool that you control, for people who must not be contacted at all.
Marketing and service messages are two separate things. Unsubscribing stops the marketing. Service messages – receipts, password resets, security and account notices – keep arriving, because a customer who doesn't want your newsletter still needs to be told their payment went through.

Email unsubscribes

Every journey email includes an unsubscribe link in the footer, plus the one-click unsubscribe support that Gmail and Yahoo require of bulk senders – recipients can opt out directly from their inbox without opening the email. Both are added automatically.

The links are signed. A link only works for the address it was sent to, so nobody can unsubscribe someone else by guessing a URL.

When someone unsubscribes:

They stop receiving marketing email from your account immediately – every marketing journey checks before it sends, including runs that were already in flight.
They stop entering new marketing journeys.
They keep receiving service messages, if you send any. See "Marketing and service messages" below.
The opt-out is recorded permanently and applies across your whole account, including all brand profiles in it.

Bounced addresses and spam complaints are handled the same way, automatically – the address is suppressed and future sends skip it. This protects your sender reputation as much as it protects the recipient.

SMS opt-outs

When you connect SMS sending, the setup includes an inbound webhook URL for your SMS provider. Once that is in place, replies are handled automatically:

STOP, UNSUBSCRIBE, CANCEL, END, or QUIT opts the number out immediately, as US law (TCPA) requires.
START, UNSTOP, or YES opts it back in.

Failed numbers and carrier complaints are suppressed automatically, like email bounces.

What "opted out" changes – and what it doesn't

Marketing stops. History stays. An opted-out customer still appears in your analytics – revenue, RFM segments, cohorts, lifetime value. Your numbers stay honest. What changes is targeting: they disappear from lists that feed sends, such as the Churn Risk "save these first" list and its CSV export, and journeys skip them.

Service messages are unaffected. Order confirmations, receipts, password resets and account notices are a separate stream. Whether they come from your own app or you send them through The AI CMO, a marketing opt-out never touches them – see the next section.

Opting back in is the customer's move, not yours. For SMS, they text START. Email opt-outs are permanent. There is deliberately no button in the app to re-add someone who opted out – that line is what keeps your sending compliant and your deliverability strong.

An opt-out on one channel stays on that channel. Someone who texts STOP has stopped your marketing texts. They have said nothing about email, so their email marketing is untouched, and vice versa.

Marketing and service messages

Everything you send through The AI CMO is one of two kinds, and the difference decides who receives it.

Marketing is promotions, newsletters, win-backs, lifecycle campaigns – anything you send because you want to. It carries an unsubscribe link, it respects the frequency cap and your send hours, and an unsubscribe stops it.

Service is receipts, order confirmations, password resets, security alerts, payout and account notices – anything the customer needs to know about something that already happened. It carries no unsubscribe link, because offering to switch off a password reset would be misleading. It ignores the frequency cap and send hours, and it reaches people who unsubscribed from your marketing.

Service messages are still stopped by the things that should stop them:

A hard bounce or a spam complaint. A dead mailbox is dead for receipts too.
A blacklist entry set to Blocks everything.
On WhatsApp, Meta's own rules – only Utility and Authentication templates can be sent as service messages, and we check the category with Meta rather than taking your word for it.

Choosing the kind. In a journey, open Settings and pick Marketing or Service. Service journeys are deliberately restricted: they can only start from an event or be run by hand, never from an audience or a repeating schedule, and each step reaches the one person the event is about. That is what keeps the stream honest – a service journey cannot be turned into a way to blast a list past everyone's opt-outs. The app refuses to publish one that tries.

For a single message from your own system, use the send API – see "Sending service messages from your own system" below.

We watch for marketing slipping into service messages. Every service send is checked – first against known marketing patterns (promo codes, discounts, free bets, an unsubscribe link that signals the wrong email template), then by an AI reviewer that reads the actual copy in any language and flags promotional intent the patterns can't see. The message still goes out – but the journey's run log and the API response carry a clear warning, so you see it before a customer or a regulator does. Service templates in Brand Settings are kept apart too: marketing emails never use your Transactional / Service template, and service messages never use your Newsletter, Promotional or Welcome layouts.

Your service email needs its own address. In Connections you will find two email cards: Marketing email and Service email. They are separate on purpose. If a promotion lands people in spam, you do not want that reputation deciding whether your password resets arrive, so service email sends from its own verified domain – a subdomain like txn.yourbrand.com is the usual choice. There is no fallback: if the service identity isn't set up, service email doesn't send, and the app says so rather than quietly using your marketing domain.

SMS works the same way, with one extra wrinkle worth knowing. Mobile carriers record STOP against the number it was texted to. So if you want service texts to keep arriving after someone opts out of marketing, give them a separate Service SMS number – otherwise the carrier may refuse the message before it reaches anyone.

Sending service messages from your own system

If your app already knows when an order shipped or a password was reset, it can hand that message to The AI CMO to deliver – on email, SMS, WhatsApp, push, or the on-site inbox.

Go to Settings → API keys and create a key with Send service messages ticked. Existing keys do not have this and will not gain it; it has to be granted on purpose.
Have your backend POST /api/send with the key in an Authorization: Bearer header.

http

POST /api/send
Authorization: Bearer <your api key>
Content-Type: application/json

{
  "channel": "email",
  "to": "customer@example.com",
  "category": "delivery",
  "subject": "Your order is on its way",
  "html": "<p>Order #1032 shipped this morning.</p>",
  "idempotency_key": "order-1032-shipped"
}

Say what kind of message it is. category is one of receipt, order, delivery, payout, security, account, support, legal or other, and it is recorded against the send. Service messages reach people who opted out of marketing, so being able to show what you sent them – and that it was a payout notice rather than an offer – is what makes that defensible. If you are a regulated operator, your compliance team will ask for exactly this breakdown.

The message goes out immediately – it does not wait for a journey or a scheduled run.

Always send an idempotency_key. If your request times out and you retry, the key means the customer gets one message, not two.

Retry with the same key and the same message and you get the original result back, marked "replayed": true.
Retry while the first attempt is still running and you get 409 send_in_progress with a Retry-After header. That is not a failure – it means the first attempt is still in flight. Wait the suggested seconds and retry to read its result.
Retry with the same key but a different message and you get 409 idempotency_conflict. That is a bug in the calling code rather than something to paper over.

Errors worth handling. 403 missing_scope – the key doesn't have "Send service messages". 403 suppressed – the recipient is on a blacklist that blocks everything, or their address has hard-bounced. 422 no_sending_identity – you haven't set up a service sending identity for that channel yet. 400 marketing_not_supported – this endpoint sends service messages only; marketing goes through a journey. 429 rate_limited and 503 idempotency_unavailable are both temporary: back off and retry.

If your account has more than one brand profile, include client_id. Suppression and blacklist rules are kept per profile, and the API will not guess which one you meant.

Every service message you send this way is logged alongside everything else, and if it went to someone who had opted out of marketing, that is recorded too – so you can always show why a message was sent.

The blacklist

Where: Customer Intelligence → Retention → Audiences.

The blacklist holds identities – email addresses, phone numbers, or your own customer IDs – that you decide must not be contacted. Use it for legal do-not-contact requests, self-excluded customers, or anyone you never want a campaign to reach. Entries can be added one at a time or imported as a list, and lists can be copied across brand profiles.

Each list enforces one of three levels. When someone appears on several lists, the strictest level wins:

Level	What it does
Blocks everything	No email, no SMS, no website messages, no service messages – nothing, from any journey, campaign or API call.
Suppresses marketing	Marketing messages stop on the channels you choose – all channels, or email and SMS only. Service messages still reach them, which is the point of this level: a self-excluded gambling customer must stop getting offers and must still get their payout notice.
Flag only	Nothing is blocked. The person is flagged so campaigns and content can treat them with care.

Every send the blacklist stops is logged, so you can show exactly when and where an entry did its job.

Blacklist or unsubscribe – which is which? An unsubscribe is the customer's choice and happens on its own. The blacklist is your policy: you add entries, you pick the level, and "Blocks everything" reaches further than any unsubscribe can – it silences every channel at once, including website messages.

Blocked and opted-out people are excluded from targeting surfaces automatically. The Churn Risk list, for example, says so in plain text: "Blacklisted and opted-out customers are already excluded."

Frequency cap

Separate from opt-outs: in your email and SMS sending settings you can cap how many marketing messages one person receives per 7 days, counted across all journeys. It is optional, and it is the polite ceiling that keeps an enthusiastic month of campaigns from burning a list.

Questions

Do unsubscribed customers still count in my dashboards? Yes. Analytics count everyone; only targeting filters them out.

Do service messages show up in my campaign numbers? No. Open and click rates, the calendar and the weekly digest all count marketing only – otherwise a month of receipts (which nearly everyone opens) would flatter every campaign you ran. Service messages are still logged and auditable, just kept out of the marketing metrics.

Can someone unsubscribe from service messages? No, and they carry no unsubscribe link. If a customer must not be contacted at all, that is a blacklist entry set to "Blocks everything" – which does stop service messages too.

Do service messages cost the same? Yes – email is email. They count against your plan's monthly email allowance exactly like marketing does. The one difference: if you run out mid-month, marketing stops and service messages keep going, billed as overage at the end of the period. Dropping someone's password reset because the newsletter budget ran out is not a trade we will make for you.

Someone unsubscribed by accident – can I fix it? Not from the app. SMS recipients can opt back in themselves by texting START. Email opt-outs are permanent today – if a customer genuinely wants back in, contact support and we'll handle it with their consent on record.

Does the blacklist remove people from my analytics? No. Their history remains in your numbers. They are removed from every list that could feed a send.

We run several brands in one account – does an unsubscribe apply to all of them? Yes. An email opt-out applies account-wide. Blacklist lists are per brand profile, and you can copy a list across brands when policy should follow the person.