Marketing vs transactional emails (gränsdragning)

All outbound mail flows through one EmailDistributor abstraction with two methods: send_transactional and send_bulk. Both call the same backend (Mailjet, Azure Communication Services, or the Null backend in dev), but the distributor stamps each message with its category, which drives downstream policy.

Transactional sends respond to a user action — booking confirmations, reset links, license renewal reminders — and their legal basis is GDPR 6.1b/6.1f (contract performance and legitimate interest). They need no separate consent, carry no marketing tracking pixels, dispatch immediately, ignore quiet hours, and use Jinja templates versioned with the codebase. Marketing sends require GDPR 6.1a consent verified through double-opt-in (DOI), batch through a campaign-dispatcher with throttle_per_hour (default 5000/h), pause between 22:00 and 07:00 recipient-local unless overridden with fresh-auth, and use MJML-source templates editable in the system console with live preview.

The two streams share one critical resource: the suppression list. A hard bounce or spam complaint from a transactional message blocks future marketing to the same address, and vice versa — protecting deliverability across the whole platform. Conversely they have completely separate audit trails: notification.* actions in sys_audit_entries for transactional, newsletter.* actions for marketing. That separation makes it trivial for a compliance officer to audit one category without bleed from the other.

Unsubscribe semantics differ. Marketing emails always include RFC 8058 one-click unsubscribe plus a preference-center link and per-list opt-out. Transactional emails generally do not — you cannot unsubscribe from your booking confirmation — except for explicitly optional transactional categories like ranking-change pings, where users can opt out granularly. Tracking is off by default for transactional (privacy first); marketing carries opens via pixel and clicks via redirect, plus heatmap data feeding the newsletter analytics. Logging is separate too: transactional writes to notification_logs, marketing writes to a dedicated newsletter_events pipe with cohort and engagement analytics.