Xevolution · Free file 03

The Permission and Compliance Sheet

Every rule below exists because one of two things happens to small senders: a burnt domain, or a complaint you cannot answer. Neither is a copywriting problem. This is the sheet I check a list against before a single email goes out. It is file 03 of seven in The Outreach Operating System, given here in full. It is not legal advice and it does not replace a lawyer.

All three questions must be yes before an address joins a list. One no is the whole answer.

Plain English. This is not legal advice and it does not replace a lawyer. It is the working standard that keeps you out of the two failures that actually end small outreach operations: a burnt domain and a complaint you cannot answer.

The three questions that decide everything

Before any address goes on a list, all three must be yes:

Did the business publish this address itself? If yes, you have a source URL. Log it.
Would I be comfortable if this exact email arrived in my own inbox? If no, stop.
Can I tell the recipient, in one line, where I got their address? If no, stop.

Rules you cannot buy your way around, in the US (CAN-SPAM), the EU/UK (GDPR + PECR), and Canada (CASL) all point the same direction for a small sender:

What must be true of every commercial email

Requirement	What it looks like in your mail
Accurate sender identity	Your real name, your real business, a real reply address that a human reads
Truthful subject line	No "Re:" on a first touch, no fake forwarding, no invented urgency
A physical address	A real postal address in the footer, or a registered PO box
A working opt-out	One clear way to say stop, honoured within 10 business days — do it same day
No deceptive routing	The from-domain must match the business you claim to be

For a first cold touch, keep it short, identify yourself and the business, say why you are writing to that specific person, and give the opt-out line. That is the whole standard in one paragraph.

The unsubscribe, exactly

Any clear request counts: "stop", "remove me", "take me off", "not interested, don't contact again". You do not get to require a magic word.
Suppression is permanent. Keep a file of every address that said stop and check every new batch against it, forever. Removing someone from one list and re-adding them from another is the single most common compliance failure among small senders.
Honour it the same day. Waiting is not a permitted interpretation.

What a "purchased list" really costs

You are not buying addresses. You are buying the right to be accused. Purchased lists carry spam traps — addresses that exist only to catch bulk senders. One trap hit can put you on a blocklist, and a blocklist entry takes weeks to remove and cuts off real mail, including invoices and password resets. The economic argument alone settles it: a $50 list can cost you a domain worth more than the campaign.

GDPR, in one paragraph

If you are mailing into the EU or UK, a business address is still personal data. You need a lawful basis; for B2B cold outreach the usual one claimed is legitimate interest, and it holds only if the message is relevant to that person's job, minimal, and offers an easy opt-out. If your message would read as irrelevant to them, the basis is not there. Do not mail consumer addresses on legitimate interest.

Record keeping

For each batch, keep for two years:

The list as sent (addresses + source URLs + date gathered)
The exact message sent and the date
The suppression file as of that date
Any complaints received and what you did

Four files. If a complaint ever escalates, this is the difference between a misunderstanding and a problem.

The one-line standard

Send to people who could reasonably expect to hear from a business like yours, tell them the truth about who you are, and make stopping effortless. Everything above is that sentence with paperwork attached.

File 03 of seven. Quoted in full from The Outreach Operating System by Xevolution. No tracking, no email capture, no expiry — save it, print it, hand it to whoever owns the list.

The other five free files: /free (90-Day Sending Calendar), /free/target-list-standard (Target List Standard), /free/inbox-triage-decision-tree (Inbox Triage Decision Tree), /free/objection-library (Objection Library) and /free/failure-runbook (Failure Runbook).

Questions about your own setup: support@xevolution.biz