Most small businesses treat email as a newsletter they send when they remember. The emails that tend to do the most work are different: automated flows that go out because a person did something, like signing up, leaving a cart or going quiet for months.
A flow is written once, then sent to each person at the right moment. It still needs good triggers, honest copy, a clean list and regular checks. This guide covers the four flows worth building first, how to keep them out of the spam folder, and the laws you have to follow in the US, EU and UK.
The four flows worth building first
Start with flows that react to clear behavior. Each has a trigger, a goal and an exit condition.
| Flow | Trigger | Goal | Typical length |
|---|---|---|---|
| Welcome | New subscriber or first account | First purchase or booking | 3–5 emails over 1–2 weeks |
| Nurture | Signed up but hasn't bought | Build trust, answer objections | 4–6 emails over a few weeks |
| Abandoned cart / browse | Left items or viewed a product | Finish the purchase | 2–3 emails over 2–4 days |
| Win-back | No purchase or open in a set period | Re-engage or clean the list | 2–3 emails, then suppress |
These lengths are starting points, not rules. Your sales cycle decides the timing.
Welcome series
This is the flow people are most likely to read, because they just asked to hear from you. Use it to deliver what you promised at signup (a discount, a guide, a booking link), introduce who you are, and show one or two real customer reviews you have permission to use.
Nurture
Nurture emails answer the questions that stop people buying: price, timing, quality, "is this right for me?" One useful idea per email beats a wall of features.
Abandoned cart and browse
These recover sales that were nearly made. Send the first reminder within a few hours, keep it short, and show the exact item. Discounts are optional. If you offer one every time, some customers learn to wait for it.
Win-back
Win-back flows ask lapsed customers if they still want to hear from you. If they don't respond, stop emailing them: people who never open hurt the deliverability of everything else you send.
Building a flow, step by step
- Pick one trigger and one goal. "Signed up via the footer form → first order" is clear. "Engage the audience" is not.
- Map the exits. Remove people from the flow as soon as they convert, unsubscribe or enter a more relevant flow, so nobody gets a "still thinking about it?" email after buying.
- Write for one reader. Plain language, one call to action per email, a subject line that matches the content.
- Segment lightly. New vs. returning customers and product interest are usually enough to start. Over-segmenting a small list leaves each group too small to learn from.
- Test one thing at a time. Subject line, send time or offer, not all three at once. With a small list, run a test longer before deciding.
- Review monthly. Check clicks, orders, unsubscribes and spam complaints per email. Rewrite or cut the weakest message.
If you also text customers, coordinate the two channels so people don't get the same reminder twice. Our guide to SMS marketing rules and flows covers that side.
Deliverability: getting into the inbox
A great flow is worthless in the spam folder. Mailbox providers now set firm technical rules. Google's sender guidelines for anyone sending more than 5,000 messages a day to Gmail accounts require:
- SPF and DKIM authentication for your sending domain, plus a DMARC record
- A From address whose domain aligns with SPF or DKIM
- One-click unsubscribe headers and a visible unsubscribe link in marketing emails
- A spam complaint rate below 0.30% in Google Postmaster Tools (Google recommends staying under 0.10%)
Even if you send far less, meeting these standards is wise. Beyond that, never buy lists, validate addresses at signup, and suppress hard bounces right away.
The legal rules, by region
Email law differs by where your recipients are, not just where you are. If you sell internationally, you need to meet each set of rules.
United States: CAN-SPAM Act
The CAN-SPAM Act covers all commercial email, and the FTC states it makes no exception for business-to-business email. According to the FTC's compliance guide, you must:
- Use accurate header information (From, To, Reply-To) and honest subject lines
- Identify the message as an ad when it is one
- Include a valid physical postal address (a street address, registered PO box or registered private mailbox)
- Offer a clear way to opt out, and honor opt-out requests within 10 business days
- Keep the opt-out mechanism working for at least 30 days after sending, without charging a fee or asking for more than an email address
You remain responsible even if another company sends the email for you. The FTC currently lists penalties of up to $53,088 for each separate email in violation.
European Union: GDPR and ePrivacy
In the EU, the default for marketing emails to individuals is prior consent. The ePrivacy Directive 2002/58/EC (Article 13) requires it, with a narrow "soft opt-in" exception: you may email existing customers whose address you got in the context of a sale, about your own similar products, if you offered an easy, free opt-out when you collected the address and in every message.
The GDPR (Regulation (EU) 2016/679) sets the standard for that consent and for the personal data involved:
- Article 6 requires a lawful basis for processing; for marketing email this is usually consent.
- Article 7 says you must be able to prove consent, and withdrawing it must be as easy as giving it. Pre-ticked boxes don't count.
- Article 21 gives people an absolute right to object to direct marketing. Once they object, you stop.
- Article 83 allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of these core rules.
United Kingdom: PECR
The UK's Privacy and Electronic Communications Regulations (regulation 22) work in a similar way. According to the UK Information Commissioner's Office, you need specific consent to email individuals, unless the soft opt-in applies: the person bought or negotiated to buy a similar product from you, and you offered an opt-out at collection and in every message. Sole traders and some partnerships count as individuals. Emails to companies are allowed, but you should honor objections.
A compliance checklist for every flow
- Signup form states what people will receive and how often
- Consent is recorded with date, source and wording
- Every email shows your business name and postal address
- Unsubscribe works in one click and is processed promptly
- Subject lines match the content
- Suppression list is synced across every tool that sends email
What AI can and can't do here
AI is well suited to the repetitive parts of email: drafting variations of subject lines and copy, building triggers, timing sends, running A/B tests and flagging emails that underperform. On our Pro and Business plans, AI agents build and run these flows, alongside SMS, and connect to your store or CRM through our integrations.
What it can't do is supply your real offers, product knowledge or customer reviews, and it shouldn't set strategy alone. You approve the flows, provide genuine photos and promotions, and answer the customers who reply. To see how the work is divided, look at how our process works.
FAQ
How many emails should a welcome series have?
Three to five emails over one to two weeks is a reasonable start. Fewer if you sell simple, low-cost products; more if buyers need time to decide. Let your click and purchase data guide changes.
Do I need consent to send marketing emails in the US?
CAN-SPAM doesn't require prior opt-in consent, but it does require honest headers, a postal address and a working opt-out honored within 10 business days. Mailbox providers and good practice push you toward permission-based lists anyway.
Is the soft opt-in allowed under GDPR?
The soft opt-in comes from the ePrivacy Directive and national laws, not the GDPR itself. It covers existing customers, your own similar products, and requires an opt-out at collection and in every email. Newsletter signups from non-customers need consent.
What's a good spam complaint rate?
Google asks bulk senders to stay below 0.30% and recommends under 0.10%. If you're near those numbers, clean your list and check that people know why they're getting your emails.
Good email flows are built on permission, relevance and steady maintenance. If you'd like AI agents to handle the build and testing while you keep control of the offers and approvals, see our plans.
