SMS and Communications Consent Terms

Exact consent language for forms, text-back opt-in, keyword handling, quiet hours, A2P 10DLC campaign registration, and email consent · Effective date: [EFFECTIVE DATE]

1. Purpose and how to use this document

This document contains the exact words Torvara uses to obtain and honor consent for text messages and emails sent through the Platform on behalf of a client business. Sections 2 through 8 are customer-facing and may be published at https://claude.ai/code/artifact/c5a58f88-8293-4695-8053-292152cca1ac#sms. Section 9 is the text submitted to Twilio for A2P 10DLC campaign registration. Appendix A is internal and describes how the software enforces each rule.

Throughout, "[BUSINESS NAME]" is replaced with the exact legal or trade name of the single client business the customer is agreeing to hear from (for example, "Elevyn"). Consent is always given to one named business; Torvara never collects consent on behalf of an unnamed list of "partners."

2. Principles

1. One business per consent. Each opt-in names the one specific business that will text the customer. Consent for one business is never reused for another business, even if both are Torvara clients.
2. Prior express written consent for marketing. Marketing texts sent with automated technology are sent only after the customer has taken a clear affirmative action (typing a keyword, ticking an unchecked box, or replying YES) after seeing the disclosure in Section 3.
3. Logically and topically related. Messages stay within the subject the customer signed up for (the business's services, appointments, offers). We do not text about unrelated products.
4. Not a condition of purchase. Consent is never required to buy, book, or receive service.
5. Easy to stop. STOP works on every message, in every program, immediately.
6. Records. Every consent and every opt-out is stored with the time, the method, the form or keyword used, the phone number, the business, and the exact disclosure text shown.

Note to counsel: the FCC's "one-to-one consent" rule (adopted December 2023, originally scheduled to take effect January 2025) was challenged in the Eleventh Circuit and its enforcement status has changed since adoption. We have drafted to the one-to-one standard regardless, because it is also what Twilio, Meta lead forms, and most carriers expect. Please confirm the current status and whether any wording below should change.

3. Web and lead-form consent language

Place the following next to an unchecked checkbox on any form that collects a mobile number. The checkbox must be separate from any "I agree to the terms" checkbox and must not be pre-ticked.

Form requirements. The form must (a) display the business name and the disclosure before the submit button; (b) not submit the phone number to the messaging system unless the checkbox is ticked; (c) store the timestamp, IP address (when the back end is live), form URL, and the exact disclosure text with the record; and (d) send a single confirmation text (Section 5.1) that restates the program and the STOP instruction.

Meta and Google lead forms. When a lead form on Meta or Google collects a phone number, the form must include a custom disclosure with the marketing checkbox text above and the business name. Leads from forms without that disclosure are treated as informational only: they receive at most one human-initiated reply and no automated marketing until they opt in.

4. Missed-call text-back

When a customer calls [BUSINESS NAME] and the call is not answered, the Platform may send one automated text to the number that called. This is a direct response to the customer's own call to the business. The text-back:

• is sent once per missed call, and no more than [TEXT-BACK CAP PER DAY, e.g. 2] times per number per day;
• identifies the business, says why the customer is receiving it, and includes STOP;
• contains no promotional offer;
• is not sent to a number that has previously replied STOP to that business, or that is on the business's internal do-not-text list;
• is sent only between 9:00 a.m. and 9:00 p.m. in the customer's local time (based on the area code, or the business's time zone if the area code is ambiguous); a missed call outside that window is answered by text at 9:00 a.m.;
• does not by itself create consent for marketing texts. Marketing consent requires a separate opt-in under Section 3 or Section 5.

5. Keyword opt-in and the confirmation message

5.1 Confirmation (double opt-in). After any opt-in (form, keyword, or verbal), the first message sent is:

5.2 Keyword opt-in. Where the business advertises a keyword (for example, "Text JOIN to [BUSINESS TEXTING NUMBER]"), the advertisement must show the full disclosure: "By texting JOIN to [BUSINESS TEXTING NUMBER] you agree to receive recurring automated marketing texts from [BUSINESS NAME]. Consent is not a condition of purchase. Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel, HELP for help. Privacy: [PRIVACY POLICY URL]." The keyword is treated as consent only when the customer initiates the text.

5.3 Verbal or in-person consent. Staff may enter a customer's number with the "marketing" flag only after reading the disclosure in Section 3 aloud and receiving a yes; the Platform then sends the confirmation in 5.1 and requires the customer to reply YES before any marketing text is sent. Until YES is received, the number is informational-only.

6. STOP, HELP, and other keywords

Opt-out requests received by any other channel (email, phone, in person, social media) are honored within the same business day by marking the number opted out.

7. Frequency, hours, and content rules

• Frequency. Marketing texts are capped at [MARKETING TEXT CAP, e.g. 4] per month per number per business unless the program disclosure states a different frequency. Informational texts (reminders, quotes, receipts) are sent as needed, but never more than [TOTAL DAILY CAP, e.g. 3] messages per day per number.
• Quiet hours. No marketing text is sent before 9:00 a.m. or after 9:00 p.m. in the recipient's local time. For recipients whose number or address indicates Florida, the cut-off is 8:00 p.m. and no more than three marketing texts on the same subject are sent in any 24-hour period, following the Florida Telephone Solicitation Act. Where another state sets a stricter window, the stricter window applies. Informational replies to a customer's own message may be sent at any time.
• Identification. Every message begins with or clearly includes the business name.
• Content. No content prohibited by carriers or Twilio (no cannabis, firearms, gambling, adult content, high-risk financial offers, or third-party lead sales). Links are to the business's own pages or the Portal; no public URL shorteners. For a mortgage lender, no rates, payments, or loan terms appear in any text unless the lender's compliance officer approved the exact text and it contains the required disclosures.
• Do-not-call. Before any human-initiated outbound marketing call is made from the Platform, the number is checked against the National Do Not Call Registry and the business's internal do-not-call list. [Confirm with counsel whether SAN registration is needed for any client.]

8. Email consent (CAN-SPAM) and deliverability

8.1 Consent. Marketing email is sent only to people who opted in through the checkbox in Section 3, an existing customer relationship with the business, or an equivalent written consent recorded in the CRM. Purchased or scraped lists are never loaded.

8.2 Every marketing email contains: a truthful "From" name identifying the business; a subject line that is not misleading; a clear identification that the message is an advertisement where that is not obvious from context; the business's valid physical postal address; and a working one-click unsubscribe link plus a List-Unsubscribe header. Unsubscribes take effect within ten business days at most and in practice immediately, and we do not charge, require login, or ask for more than an email address to process them.

8.3 Transactional email (booking confirmations, receipts, password or access-code messages, security notices) may be sent without marketing consent and need not carry an unsubscribe link, but must not contain promotional content beyond a brief signature line.

8.4 Deliverability. Every sending domain has SPF, DKIM, and a DMARC policy published; bulk sending stays under a 0.3% spam-complaint rate; and hard bounces are suppressed automatically.

9. A2P 10DLC campaign registration text (for Twilio)

Submit one campaign per client business (or per use case where a business needs both a marketing and a customer-care campaign). The brand registered is the client business, with Torvara as the ISV/agency where Twilio's forms allow. Replace bracketed fields before submission.

The privacy policy linked in the campaign must state that mobile opt-in data is not shared with third parties for marketing; Section 6 of the Privacy Policy contains that sentence.

Appendix A (internal): How the software enforces these rules