Luzzu - Consent-First Email and SMS Marketing Automation Platform
Marketing Automation for a Maltese Skincare Brand
Designed and built a clickable marketing automation platform for a Malta-based skincare brand selling across the EU: one contact record with provable consent per channel and purpose, welcome, abandoned cart, post-purchase and win-back journeys that respect caps and quiet hours, and a deliverability dashboard that checks the Gmail and Yahoo bulk sender rules.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Impact
Dashboard, contacts, contact detail with 5 tabs, journeys with expandable step flows, and the deliverability dashboard. Every one of the 26 demo contacts opens its own record.
Email marketing, SMS marketing, product review requests and personalised recommendations, each with its lawful basis, source, wording version and evidence such as IP address and confirmation click time.
SPF, DKIM, DMARC alignment, one-click unsubscribe, unsubscribes processed within 2 days, and Gmail spam rate below 0.3% and below 0.1%, each shown as pass, watch or fail with its last checked time.
Contacts across 9 EU countries in 4 languages, 13 journeys, 8 segments, 8 mailbox providers, 3 deliverability alerts and 7 staff users.
The Problem
Xemxa Skin grew from a market stall in Valletta to about 180,000 contacts in four languages. Sign-ups came from three pop-ups, a checkout tick box and trade-show tablets, and nobody could say who had agreed to what. Unsubscribes from the email tool never reached the SMS tool, a customer erased from one list was emailed from another a week later, promotional mail landed in spam after Gmail and Yahoo tightened their sender rules, and the abandoned cart email went to people who had already bought.
Our Solution
Luzzu gives the team one contact record with consent recorded per channel and purpose, journeys that check consent, frequency caps and quiet hours on every send step, holdout groups that show whether a journey earns its sends, and a deliverability view that tracks complaints, bounces and the bulk sender requirements before revenue dips.
The Challenge: Marketing Across the EU on Provable Consent
Email and SMS marketing to EU consumers runs on consent the brand must be able to prove, rules that differ by member state, and mailbox providers that filter senders who do not meet their requirements.
Consent Nobody Could Prove
Under GDPR Article 7 the brand must show who consented, when, how and to what wording, and withdrawing must be as easy as giving consent. Contacts arrived from pop-ups, checkout, imports and trade-show tablets with no record of the wording they saw.
Soft Opt-In Differs by Country
The ePrivacy Directive allows a soft opt-in for existing customers, but member states implement it differently. In Malta it runs through Subsidiary Legislation 586.01 with the IDPC as lead authority, while the recipient's own country may also apply, so it has to be a per-country setting.
Opt-Outs and Erasures That Did Not Stick
Unsubscribes, SMS STOP replies, complaints and erasure requests lived in separate tools. Data subject requests must be answered within one month, and an erased address has to stay blocked if it is re-imported or typed in again.
Inbox Placement at Risk
Since 2024 Gmail and Yahoo require bulk senders to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe under RFC 8058, honour unsubscribes within two days and keep the spam complaint rate below 0.3%. The team had no view of bounces or complaints.
Our Approach: From Consent Rules to a Clickable Platform
Spec and Rules Research
Mapped 7 staff roles plus the contact, 36 screens (31 for staff and 5 mobile-first public pages for sign-up, confirmation, preferences, unsubscribe and privacy requests), and the data model for contacts, versioned consent wording, append-only consent events, suppressions, segments, journeys, messages, frequency policy and data subject requests. Wrote down the rules the design follows: GDPR, the ePrivacy Directive and Malta's SL 586.01, double opt-in, data subject rights, the Gmail and Yahoo bulk sender requirements and RFC 8058 one-click unsubscribe.
Clickable Demo on a Production UI Kit
Built 5 key screens on a production dashboard kit: the dashboard with attributed revenue, marketable contacts, click rate and Gmail spam rate, contacts with status filters and a quick view, the contact detail with consent card, timeline, messages, journeys, segments and consent history, journeys with step flows, holdouts and approval, and the deliverability dashboard with alerts, provider reputation and the bulk sender checklist. All actions run on local state.
What a Production Build Adds
Integration with Shopify for orders and carts, Amazon SES or SparkPost for email, Twilio or Vonage for SMS, Google Postmaster Tools, Yahoo's complaint feedback loop and Microsoft SNDS, DMARC report processing, rendering previews, the cookie consent tool, warehouse export and the customer care desk. Plus the journey builder canvas, segment builder, campaigns, templates, the compliance screens and public contact pages, staff auth by role with masking for customer care, and an audit log of every consent change, suppression, export and data subject request.
Why It Works: Consent and Caps on Every Send
Only the Contact Can Opt In
There is no bulk subscribe action, adding a contact cannot set consent, and staff changing preferences on a customer's request can only withdraw. Every consent row shows its lawful basis, source and wording version, and the consent history keeps the evidence behind each event.
Every Send Step Shows Its Rules
Each email and SMS step in a journey carries a consent badge and a counts-to-cap badge. Messages held by quiet hours show as skipped with the reason, and a journey's own author cannot approve it to go live.
Deliverability Before It Costs Revenue
The dashboard sets the Gmail spam rate against Xemxa's own alert level, the provider table shows Postmaster and SNDS reputation, and the CRM lead can pause all marketing sends with a required reason, which puts a banner on every page until sends resume.
Numbers That Do Not Flatter
Click rate leads and open rate is marked as inflated by privacy proxies. Journeys run with holdout groups so revenue shows next to the uplift over contacts who received nothing, and every marketing email carries List-Unsubscribe and List-Unsubscribe-Post headers, visible in the message preview.
Related case studies
View all: Marketing & email
Fanous - Brand-Locked Trilingual Landing Page Builder with Approvals
Designed and built a clickable no-code landing page builder for a private university in Beirut: faculty teams build course, open day and scholarship pages from brand-locked blocks in English, French and right-to-left Arabic, with fees synced from programme data, live quality checks and an approval workflow with versioning and rollback.
Vidikovac - Consent-Aware Marketing Attribution and Measurement Platform
Designed and built a clickable attribution platform for a Podgorica online travel agency selling Adriatic holidays to EU and UK travellers: last click, position-based and data-driven models side by side and reconciled to the booking engine, return on ad spend counted net of cancellations, and every booking traced back to the consented touchpoints that led to it.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab