Compliance is not a document.It is the tool that sends.

Get started for free Get a demo

Five checks
on every send.

Consent per channel. Each contact decides channel by channel, and the platform respects it on every send.

Opt-out that works. Unsubscribe links, keywords and suppression, applied before you send.

Registered senders. Filed with the regulator and carriers in each country.

Legal sending hours. Each market has its window. The send waits for it, by itself.

Checked before every send. Consent, opt-outs, hours and sender, verified on the way out. Not by the prompt: by the platform.

It is not
only the GDPR.

Privacy and data

GDPR: The base framework for personal data: roles, lawful basis and the rights of the person behind the record.
ePrivacy: The one that actually governs direct marketing and electronic communications. That is not the GDPR's job.
LSSI-CE: Commercial communications in Spain. It applies to us by registered office and by customer base.
UK GDPR and PECR: The United Kingdom went its own way. It applies the moment a recipient is there.

Channel regulation

Legal sending hours: Marketing is not legal at every hour, and the hours change with the border. The platform skips them where the rule exists.
Sender registration: The CNMC in Spain and its equivalent elsewhere. Regulatory, and nothing to do with privacy.

Platform rules

WhatsApp Business Policy: Meta's rules are contractual rather than law, and just as binding. Opt-in is not optional there.
RCS and the GSMA: A verified agent answers to the standard, not only to the operator carrying it.

Emerging

EU AI Act: Transparency about the use of AI. The per-project data policy existed before it was asked for.

This is the map of what governs sending messages in Europe, not a claim of certification — none of these issues a badge, and the ones that do are regulators. Where a framework asks something of you as the controller, the page covering it says so.

What is ours,
what stays yours.

Instasent is a processor. You are the controller: you decide what you collect, why, and on what lawful basis. What the platform does is make it hard for itself to be the reason you breach — the consent model, the opt-out flow and the audit trail are ours. The relationship with the person on the other end is yours.

Nothing on this page exempts you from your obligations. It is here to make them cheaper to meet.

Go deeper,
one topic at a time.

Consent and opt-outs

The two attributes, the three policies, keywords, cross-channel propagation and the record that proves it.

What Iris sees

Data policy per project, redaction of identity fields, and why it is a setting instead of a sentence in a contract.

Describe the send.
The platform checks the rules.

Start