Calling and messaging consent policy

1. Purpose and scope

This policy sets out the obligations of every customer that uses TuniCall to make or receive calls, run Campaigns or exchange WhatsApp messages, whether those conversations are handled by AI agents or by people. It forms part of the TuniCall terms of service, and words with capital letters have the meanings given there.

This policy is not legal advice. The rules on calls and messages differ between countries, regions and sectors, and they change often. You must obtain your own legal advice on the rules that apply to your activities.

2. Consent is your responsibility

Your organisation, not TuniCall, is responsible for consent. You instruct and authorise TuniCall to place calls and send messages on your behalf to the contacts you provide. Before any of them is contacted, you must already hold every consent and permission the law requires, keep proof of it and be able to show it. TuniCall does not obtain, verify or guarantee any consent.

You represent and warrant that every person you call or message through TuniCall has already opted in and given every consent required by applicable law and by your Providers’ policies, as applicable to the way you contact them, including consent to:

• receive calls from your business on the number used;
• receive automated calls, calls placed or answered by an AI agent, and calls using an artificial or AI-generated voice;
• have the conversation transcribed and analysed by AI and speech providers, and recorded where any recording is made by you or your Providers;
• receive marketing calls or messages, where the purpose is marketing;
• receive WhatsApp messages from your business (WhatsApp opt-in), including marketing messages where applicable;
• the processing of their personal data for these purposes, including its transmission to the Providers you have chosen.

You also undertake to keep proof of every consent, to honour opt-outs and do-not-call lists, to respect calling hours, to disclose the use of AI and recording where required, and to comply with all applicable laws and Provider policies, as described in this policy. These commitments are part of the terms of service, under which you indemnify TuniCall for claims arising from your calls, messages, contact lists, content and instructions.

For the personal data of your contacts, you are the controller and TuniCall is your processor, under our data processing agreement.

3. How you instruct TuniCall

Every call and message made through TuniCall results from a decision taken by you or your users. For example:

• starting or resuming a Campaign instructs TuniCall to call or message each eligible recipient within the schedule and limits you set;
• placing a call to a contact from an AI agent, or sending a WhatsApp message, instructs TuniCall to make that call or send that message;
• routing a phone number or a WhatsApp sender to an AI agent instructs TuniCall to let that agent answer callers and reply to messages automatically;
• allowing actions for an AI agent instructs TuniCall to let it save notes, update contact statuses, create callback tasks or hand the conversation to a person.

TuniCall does not choose your recipients, does not add contacts to your Campaigns and does not decide what your AI agents say. When someone calls or writes to one of your numbers, their number is recorded and a contact may be created so that you can follow up. That is not consent to marketing or to outbound calls.

4. Consent by channel and purpose

The consent you need depends on the channel, the purpose, the method used and the place where the person is located. The table below lists the points you typically need to check. It is a starting point, not a complete statement of the law.

TuniCall records three consents for each contact, for voice, WhatsApp and marketing, plus a do-not-contact flag. If the law or your own policy requires more detailed consents, for example specifically for AI calls, for recording, or for a given brand or product, keep them in your own records and set the TuniCall flag only when every consent needed for the way you will use that channel is in place. For example, tick “voice” only if the person agreed to the calls you will actually make through TuniCall, including calls by AI agents with artificial voices.

5. What valid consent usually requires

The exact standard depends on the applicable law. In general, a valid consent is:

• freely given: not a condition for receiving a product or service unless it is necessary for it, and not obtained under pressure;
• specific: given for your business, for the channel and for the purpose concerned, and separately for each where the law requires it;
• informed: the person knew who would contact them, how (including by automated calls, AI agents or artificial voices), why, and how to withdraw consent;
• unambiguous: given by a clear positive action, such as ticking an empty box or saying yes to a clear question. Silence, pre-ticked boxes, inactivity or acceptance of general terms are not consent;
• provable: you can show when, how and on what wording it was given;
• easy to withdraw: withdrawing consent must be as easy as giving it.

Some laws set stricter requirements. In the United States, for example, telemarketing calls using an artificial or prerecorded voice require a signed, written agreement that clearly authorises such calls to a specific number and states that consent is not a condition of purchase.

Consent given to another company, such as a partner, a lead generator, a comparison site or a list provider, generally does not cover your calls or messages unless your business was clearly named when the person gave it, and some laws do not allow it at all. Consent can also become outdated: refresh it when it is old or when you change the way you contact people.

6. Keeping proof of consent

You must be able to prove every consent you rely on. For each person, keep a record of:

• the phone number and the identity of the person who consented;
• the date and time of the consent;
• how it was collected, for example a web form, a paper form, a recorded verbal statement or a WhatsApp opt-in flow;
• the exact wording and information shown or read to the person;
• the channels, purposes and business names it covers;
• technical evidence for online forms, such as the page address and the IP address;
• any later change, withdrawal or objection.

Keep this proof for as long as the law requires and for the period during which claims can be made. Some laws set a specific period. Germany, for example, requires proof of consent to advertising calls to be kept for five years.

In TuniCall, record the consent source for every contact: where and when permission was obtained, for example “Quote form on our website, 12 March, box ticked for calls by our automated assistant”. TuniCall stores this text, the date of the record and the user who saved it, and the change is recorded in the audit log. This is a summary that helps you apply your decisions. It does not replace the original evidence, which you must keep in your own systems. You must give us proof of consent promptly when we ask for it, for example after a complaint or a request from a Provider or an authority.

7. Opt-outs and withdrawal of consent

People can withdraw their consent or object at any time. You must:

• accept opt-outs made by any reasonable means, such as a spoken request during a call, a WhatsApp reply, an email, a letter or a message through your website;
• honour them immediately, or at the latest within the time the law allows, which can be very short;
• apply them to every channel, Campaign, AI agent and brand that the request covers;
• not contact the person again about the opt-out, except for a single confirmation where the law expressly allows it;
• tell people in your calls and messages how they can opt out, where the law requires it.

Record every opt-out in TuniCall by setting do not contact in the contact’s consent record, with the source of the request. Contacts marked do not contact are excluded from Campaigns, from AI calls and from calls placed from the browser phone. Any user can set this flag, but only an administrator can remove it. Remove it only if the person has given a new, valid and documented consent.

TuniCall helps you capture some opt-outs automatically:

• WhatsApp. An incoming message consisting only of an opt-out keyword, such as STOP, UNSUBSCRIBE, CANCEL, STOPP, ABMELDEN, ARRET, ARRETER, DESABONNER or “NE ME CONTACTEZ PLUS”, marks the contact as do not contact, withdraws the recorded voice, WhatsApp and marketing consents, switches the conversation to a person and blocks pending Campaign calls and messages to that contact. Messages that express the same wish in other words are not detected automatically.
• Calls with AI agents. When agent actions are enabled, AI agents are instructed to mark the contact as do not contact when the person asks not to be contacted again. This depends on the AI understanding the request and is not guaranteed.
• Calls by your team. After a call, your users can record the outcome “do not contact”, which marks the contact accordingly.

Review transcripts, messages and outcomes regularly to catch opt-outs that were not recorded automatically. You remain responsible for honouring every opt-out, however it is expressed.

8. Do-not-call and opposition lists

Before calling, screen your contact lists against every register that applies to you and to the people you call, for example:

• national registers such as the National Do Not Call Registry and state lists in the United States, the Telephone Preference Service (TPS) and Corporate TPS in the United Kingdom, Bloctel in France, and the National Do Not Call List in Canada;
• your own internal do-not-contact list and, where required, the lists of the partners on whose behalf you call.

Repeat the screening as often as the law requires. In the United States, for example, the registry must be checked at least every 31 days. Exemptions, for example for existing customers, are narrow: document why an exemption applies before relying on it.

TuniCall does not connect to or check any national do-not-call or opposition register. Screen your lists before importing them, and keep the do-not-contact flags in TuniCall up to date.

9. Calling hours and frequency

Many laws restrict when and how often people may be called. In the United States, for example, telemarketing calls are allowed only between 8 a.m. and 9 p.m. in the called person’s local time, and some states set stricter limits. France, for example, limits unsolicited marketing calls to certain weekday hours and limits how often the same person may be called. Some countries also prohibit marketing calls at weekends or on public holidays.

TuniCall helps you apply your own calling windows:

• each Campaign has business hours, active weekdays and a time zone, and new calls and messages start only within that window;
• AI calls placed to a single contact are checked against the business hours and time zone of your workspace;
• Campaign retries after a busy, unanswered or failed call are limited to the number you set, up to three, with the delay you choose between attempts.

Know the limits of these settings. The window is applied in the time zone of the Campaign or workspace, not in each contact’s location, so split audiences in different time zones into separate Campaigns. Public holidays are not taken into account. A call started just before the end of the window can continue after it. Retries count towards frequency limits. Calls placed by your team from the browser phone are not restricted by these settings.

10. Identification, caller ID and AI disclosure

• Say who you are. At the start of every call and in every message, identify your business and the purpose of the contact.
• Disclose AI. Tell people that they are speaking with an AI agent or an artificial voice wherever the law or your Providers require it, which is increasingly the case, for example under the transparency rules of the EU Artificial Intelligence Act. The default greeting in TuniCall introduces the agent as an automated assistant, but you can change it and you are responsible for making sure your greeting gives every disclosure required. Never instruct an AI agent to deny being an AI.
• Offer a person. Configure transfers to your team or to a transfer number, so that people can reach a person when they ask. If nobody is available, TuniCall records a callback request for your team.
• Use a genuine caller ID. Calls are placed from the number configured for your workspace in your Provider account. Use only numbers you own or are authorised to use, that can be called back where the law requires it, and that comply with caller authentication rules.
• Give the required information. Some laws require specific information during automated calls, such as a telephone number to call back or an automated way to opt out. Build these into your greetings and instructions.

11. Recording, transcription and AI processing

TuniCall does not record the audio of calls. During calls handled by an AI agent, the audio is streamed in real time to the speech and AI providers selected for that agent, which turn speech into text, generate answers and produce the agent’s voice. The text of what both sides say is saved as a transcript in your workspace, with call events and outcomes. Calls between your team and your contacts through the browser phone are not transcribed by TuniCall.

Your Providers may record or keep call and message data if you enable such features in your accounts with them. You are responsible for those settings.

You must:

• tell people at the start of the call that the conversation is handled by an AI system and transcribed, and recorded where any recording is made, and why;
• obtain consent where the law requires it. Several US states, for example, require the consent of every party to record a call, and some laws treat the real-time transcription or analysis of a call by a third-party service like a recording or an interception;
• decide how long transcripts are kept, inform people accordingly, and ask us to delete transcripts you no longer need.

12. WhatsApp opt-in and template rules

Meta’s WhatsApp Business policies apply to every message you send, whether through Twilio or Meta’s Cloud API. Among other things, they require you to:

• obtain an opt-in before messaging a person on WhatsApp, which clearly states that the person agrees to receive messages from your business, named, on WhatsApp;
• start conversations, and send messages outside the 24-hour customer service window, only with approved message templates, using the template category that matches the content;
• honour every request to stop receiving messages, and respect the quality ratings and messaging limits of your number;
• comply with Meta’s Commerce Policy and the restrictions Meta applies to certain messages or countries.

TuniCall enforces some of these rules: free-form messages are only allowed within 24 hours of the contact’s last message; outside that window, an approved template and a recorded WhatsApp consent are required; WhatsApp Campaigns always require a recorded WhatsApp consent, and marketing Campaigns also require an approved template and a recorded marketing consent; and opt-out keywords are handled as described above. Templates are created and approved in your Twilio or Meta account, not in TuniCall.

TuniCall does not check the wording of your opt-ins, whether a template’s category matches its content, or country-specific restrictions. Meta may limit or block your number if people report or block your messages.

13. How TuniCall’s consent features work

• Consent record. Each contact has a consent record for voice, WhatsApp and marketing, a do-not-contact flag and a consent source of 3 to 1,000 characters. TuniCall stores the date of each change and the user who made it, and records the change in the audit log.
• Importing never grants consent. Contacts imported from a CSV file or added to a Campaign have no recorded consent until you record it.
• Campaign purpose. Each Campaign is marked as service or marketing. Marketing Campaigns require a recorded marketing consent in addition to consent for the channel.
• Eligibility checks. A preview shows which recipients are eligible and why others are blocked. Eligibility is checked again immediately before each call or message. A recipient is blocked if the contact is marked do not contact, if the consent for the channel is missing, if marketing consent is missing for a marketing Campaign, or, for calls, if the destination country is not enabled.
• Single AI calls. Placing an AI call to a contact requires the contact to exist with a recorded voice consent, and the call to be within your business hours.
• Calls by your team. Calls from the browser phone are blocked for contacts marked do not contact and for destinations outside the enabled countries.
• Destinations. Outbound calls are limited to ordinary landline and mobile numbers in the countries an administrator has enabled, plus approved test numbers.
• Limits. Campaigns have business hours, weekdays, a time zone, a maximum number of retries, a daily budget and a workspace-wide daily cap. An emergency stop blocks all new automated calls, messages and AI replies at once.
• No double sends. If a Provider does not confirm whether a call or message went out, the recipient is marked as unknown instead of being contacted again automatically.

14. Limits of these features

TuniCall’s consent features are aids. They are not a guarantee of legal compliance and do not replace your own compliance programme. In particular:

• they apply only the information you and your users enter. TuniCall cannot know whether a consent was really given, whether its wording was adequate, whether it covers AI calls, artificial voices or recording, or whether it is still valid;
• one voice, one WhatsApp and one marketing consent per contact cannot express every distinction the law may require, for example by brand, product or type of call;
• TuniCall does not check national do-not-call or opposition registers, reassigned numbers, or the identity of the person who answers;
• business hours apply in the time zone of the Campaign or workspace, not in each contact’s location, and public holidays are not taken into account;
• automatic opt-out detection covers only the WhatsApp keywords listed above. Spoken opt-outs depend on the AI agent understanding them and on agent actions being enabled;
• calls placed by your team from the browser phone are not checked against consent records;
• the emergency stop and budgets block new automated calls and messages, but do not end calls already in progress or recall messages already sent. Administrators can end live automated calls from the live calls view;
• TuniCall does not know which laws apply to you and does not give legal advice.

Your responsibility for consent does not depend on these features working perfectly. If anything does not work as described, tell us so that we can fix it.

15. Leads and lists from third parties

If you obtain contacts from lead generators, partners, list providers, comparison sites or events, you must, before contacting them:

• check that each consent names your business and covers the channel, the purpose and, where relevant, automated calls, AI agents and artificial voices;
• obtain the proof of each consent, or a contractual commitment to provide it promptly on request;
• check the lists against do-not-call and opposition registers and your own suppression list.

Never use purchased, rented or scraped lists for automated calls, AI calls or marketing messages unless every person gave consent that specifically covers your business.

16. Examples of laws you must check

The rules depend on where you are, where the people you contact are, the channel, the purpose and your sector. The list below gives examples only. It is not exhaustive, may not reflect the latest changes, and is not legal advice.

European Union and EEA

• The General Data Protection Regulation (Regulation (EU) 2016/679): legal basis, transparency, rights of the people concerned, including the right to object to direct marketing at any time, and records of processing.
• The ePrivacy Directive (Directive 2002/58/EC) and the national laws implementing it: prior consent for direct marketing through automated calling systems without human intervention, and national choices between opt-in and opt-out for other marketing calls.
• National telemarketing rules, such as opposition lists (for example Bloctel in France), limits on the days, hours and frequency of marketing calls, and in some countries a prior consent requirement for all marketing calls to consumers. Germany, for example, requires prior express consent for advertising calls to consumers under its Act against Unfair Competition, and requires that consent to be documented.
• The Artificial Intelligence Act (Regulation (EU) 2024/1689), including its transparency obligations to inform people that they are interacting with an AI system and to disclose artificially generated or manipulated audio.
• Consumer protection and unfair commercial practices rules.

United Kingdom

• The UK GDPR and the Data Protection Act 2018.
• The Privacy and Electronic Communications Regulations 2003 (PECR), which require specific consent for automated marketing calls and restrict live marketing calls to numbers registered with the Telephone Preference Service (TPS) or Corporate TPS.

United States

• The Telephone Consumer Protection Act (TCPA) and the rules of the Federal Communications Commission, which require prior express consent, and for telemarketing prior express written consent, for many calls made with an automatic telephone dialing system or an artificial or prerecorded voice. The FCC has confirmed that AI-generated voices are artificial voices under the TCPA. These rules also cover calling hours, the National Do Not Call Registry, company-specific do-not-call lists and opt-out mechanisms.
• The Telemarketing Sales Rule (TSR) of the Federal Trade Commission, which covers do-not-call compliance, caller ID transmission, required disclosures, abandoned calls and prerecorded messages.
• The Truth in Caller ID Act and the caller authentication requirements applied by carriers (STIR/SHAKEN).
• State laws, including state telemarketing and do-not-call laws, laws that require the consent of every party to record a call, and state privacy and AI laws.

Canada

• The Unsolicited Telecommunications Rules of the CRTC and the National Do Not Call List, Canada’s Anti-Spam Legislation (CASL) for commercial electronic messages, and federal and provincial privacy laws.

Tunisia

• Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, which generally requires the consent of the person concerned, subject to the exceptions set by the law, prior formalities with the national authority for the protection of personal data (Instance Nationale de Protection des Données Personnelles, INPDP), and an authorisation for transfers of personal data abroad.
• The rules that apply to telecommunications, electronic commerce and consumer protection.

Other countries, sectors and Providers

• Every country where you call or message people may have its own data protection, telemarketing, consumer, telecommunications and AI rules.
• Sector rules, for example for financial services, insurance, debt collection, healthcare, energy, charities and political communications.
• The policies of your Providers, including Meta’s WhatsApp Business Messaging Policy and Commerce Policy, the acceptable use and registration requirements of your telephony provider, and the usage policies of your AI providers.

17. Checklist before you start a campaign

1. Confirm the purpose of the Campaign, service or marketing, and select the matching setting.
2. Confirm that each recipient has given the consent required for the channel and purpose, including for AI agents and artificial voices, and that its source is recorded in TuniCall.
3. Screen the list against the do-not-call and opposition registers that apply, and against your own suppression list.
4. Remove numbers that may no longer belong to the person who consented.
5. Set business hours, weekdays and a time zone that match where the recipients are, and avoid public holidays.
6. Check that the greeting identifies your business, discloses the AI agent and the transcription, and explains how to opt out and reach a person.
7. For WhatsApp, select an approved template of the right category.
8. Set a daily budget and a retry limit, and name a person who will monitor the Campaign and handle opt-outs and complaints.
9. Test the AI agent with the text test and a call to a number you control before going live.

18. What TuniCall may do

• We may ask you for proof of consent and for information on how you comply with this policy, and you must provide it promptly.
• If we receive a complaint, an opt-out request or a request from a Provider, a carrier or an authority about calls or messages made through your workspace, we may forward it to you, and you must handle it promptly and lawfully.
• We may pause Campaigns, disable automated calls or messages, or suspend your workspace, as described in the terms of service and the acceptable use policy, if we reasonably believe that people are being contacted without the required consent or in breach of the law.
• We cooperate with Providers, carriers and authorities as the law requires, including requests to trace the origin of calls.

Nothing we do, such as pausing a Campaign, sending a reminder or suggesting a wording, transfers your responsibility for consent and compliance to TuniCall.

19. Changes to this policy

We may update this policy as the law, Provider requirements and the service evolve. Updates required by law or by Providers apply as soon as they are published. Other material updates follow the change process in the terms of service. The “last updated” date at the top of this page shows the current version.